kernel-module-8814au-6.6-desktop-6.6.148-1> )lp d9ad02bc6de8c8d6c830dacd3080bc29d9b9099bab43a5df8316cc8fd001f522233f9bedbd4e66d3ba969757cdfeda01df1989b9!9k>:?N?}r`>Bi?Yd#+ - Y     9 <@EJpt~(89:G@HDIHXLY\\]^bcdefltuvwXx\y`p|Ckernel-module-8814au-6.6-desktop6.6.1481Binary module 8814au for kernel-6.6-desktopBinary module 8814au for kernel-6.6-desktopjlocalhostr'ROSAROSAGPLv2System/Kernel and hardwarehttps://www.kernel.orglinuxx86_64r'j#588c4b1aa5d8ffca37da06364365adb02d917f38930425da72688c952de416b0drootrootkernel-6.6-desktop-6.6.148-1.src.rpminstallonlypkg(kernel-module)kernel-module-8814au-6.6-desktopkernel-module-8814au-6.6-desktop(x86-64)kmod(8814au)    kernel-6.6-desktop(x86-64)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)6.6.148-13.0.4-14.6.0-14.0-15.2-14.17.0jtw@jgH@jL@jL@jj9j Pj Pj Pj Pi@iD@iii@h/Mikhail Novosyolov BiteDasher BiteDasher 6.6.144-1BiteDasher BiteDasher 6.6.126-8BiteDasher 6.6.126-7Mikhail Novosyolov 6.6.126-6Mikhail Novosyolov 6.6.126-5Mikhail Novosyolov Mikhail Novosyolov Mikhail Novosyolov 6.6.126-3Mikhail Novosyolov 6.6.126-2Mikhail Novosyolov 6.6.126-1Mikhail Novosyolov Mikhail Novosyolov 6.6.106-3Mikhail Novosyolov - [bot] upd: 6.6.145 -> 6.6.148 - Changelog: - accel/ivpu: Reject firmware log with size smaller than header - afs: Annotate struct afs_addr_list with __counted_by - afs: Turn the afs_addr_list address array into an array of structs - ALSA: hda: conexant: Remove mic bias threshold override - ALSA: hda: Fix cached processing coefficient verbs - ALSA: seq: close a re-opened queue timer in the destructor - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: cs35l56: Don't use devres to unregister component - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: tas2781: bound firmware description string parsing - ata: libata-core: Reject an invalid concurrent positioning ranges count - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: use platform_get_irq() - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - binfmt_elf_fdpic: only honour the first PT_INTERP - binfmt_misc: set have_execfd only once the interpreter is opened - Bluetooth: btusb: validate Realtek vendor event length - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: hci_sync: Protect UUID list traversal - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: qca: fix NVM tag length underflow in TLV parser - Bluetooth: RFCOMM: Fix session UAF in set_termios - bonding: fix devconf_all NULL dereference when IPv6 is disabled - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bpf: drop bpf_lsm_getselfattr from hook list - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: free mapping node on duplicate reloc root insert - btrfs: reject free space cache with more entries than pages - can: bcm: add locking when updating filter and timer values - can: bcm: add missing device refcount for CAN filter removal - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: isotp: serialize TX state transitions under so->rx_lock - can: j1939: fix lockless local-destination check - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - comedi: comedi_parport: deal with premature interrupt - coredump: fix pidfs file refcount leak in umh_coredump_setup - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - dm-verity: avoid double increment of &use_bh_wq_enabled - dm-verity: make error counter atomic - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amd/display: set new_stream to NULL after release - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amd/pm: make pp_features read-only when scpm is enabled - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gt: use correct selftest config symbol - drm/i915: Return NULL on error in active_instance - drm/i915/selftests: Fix GT PM sort comparators - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/nouveau: fix reversed error cleanup order in ucopy functions - drm/radeon: fix r100_copy_blit for large BOs - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - drm/vc4: Prevent shader BO mappings from becoming writable - drm/virtio: bound EDID block reads to the response buffer - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - drm/vmwgfx: Validate vmw_surface_metadata::array_size - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - exfat: validate cluster allocation bits of the allocation bitmap - fbcon: Rename struct fbcon_ops to struct fbcon_par - fbcon: Use correct type for vc_resize() return value - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - firewire: net: Fix fragmented datagram reassembly - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - firmware_loader: introduce __free() cleanup hanler - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list - ftrace: Add global mutex to serialize trace_parser access - geneve: require CAP_NET_ADMIN in the device netns for changelink - gpio: mt7621: avoid corruption of shared interrupt trigger state - gpio: tegra: do not call pinctrl for GPIO direction - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - hinic: remove unused ethtool RSS user configuration buffers - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: occ: validate poll response sensor blocks - i2c: davinci: Unregister cpufreq notifier on probe failure - i2c: i801: fix hardware state machine corruption in error path - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - i40e: remove read access to debugfs files - IB/mad: Drop unmatched RMPP responses before reassembly - ice: fix LAG recipe to profile association - ice: use READ_ONCE() to access cached PHC time - ila: reload IPv6 header after pskb_may_pull in checksum adjust - Input: ims-pcu - fix firmware leak in async update - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - Input: ims-pcu - fix logic error in packet reset - intel_th: fix MSC output device reference leak - iomap: correct the range of a partial dirty clear - iommu/amd: Bound the early ACPI HID map - iommu/amd: Don't split flush for amd_iommu_domain_flush_all() - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/vt-d: Disallow SVA if page walk is not coherent - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - ipmi: fix refcount leak in i_ipmi_request() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - ipv6: ndisc: fix NULL deref in accept_untracked_na() - ksmbd: bound DACL dedup walk to copied ACEs - ksmbd: defer destroy_previous_session() until after NTLM authentication - ksmbd: pin conn during async oplock break notification - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate ACE size against SID sub-authorities - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - KVM: Introduce vcpu->wants_to_run - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - KVM: x86/mmu: Fix use-after-free on vendor module reload - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN - libceph: bound get_version reply decode to front len - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: guard missing CRUSH type name lookup - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: Reject monmaps advertising zero monitors - libceph: reject zero bucket types in crush_decode - libceph: remove debugfs files before client teardown - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - LoongArch: Fix oops during single-step debugging - lsm: infrastructure management of the sock security - mac802154: hold an interface reference across the scan worker - mac802154: llsec: reject frames shorter than the authentication tag - mctp: serial: handle zero-length frames to prevent rx buffer overflow - media: airspy: Return queued buffers on start_streaming() failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: cedrus: clean up media device on probe failure - media: cedrus: Fix missing cleanup in error path - media: cedrus: skip invalid H.264 reference list entries - media: cx231xx: fix devres lifetime - media: cx23885: add ioremap return check and cleanup - media: marvell-cam: fix missing pci_disable_device() on remove - media: meson: vdec: Fix memory leak in error path of vdec_open - media: msi2500: Return queued buffers on start_streaming() failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: pci: dm1105: Free allocated workqueue - media: pwc: Drain fill_buf on start_streaming() failure - media: pwc: Return queued buffers on start_streaming() failure - media: radio-si476x: Unregister v4l2_device on probe failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: stm32: dcmi: unregister notifier on probe failure - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: ti: vpe: unwind v4l2 device registration on probe error - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: v4l2-ctrls: validate HEVC active reference counts - media: vb2: use ssize_t for vb2_read/vb2_write - media: vidtv: fix reference leak on failed device registration - media: vimc: fix reference leak on failed device registration - media: vivid: add vivid_update_reduced_fps() - media: vivid: check for vb2_is_busy() when toggling caps - media: vpif_capture: fix OF node reference imbalance - mei: bus: access mei_device under device_lock on cleanup - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - mm: refactor mm_access() to not return NULL - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - mptcp: decrement subflows counter on failed passive join - mptcp: only set DATA_FIN when a mapping is present - mtd: fix double free and WARN_ON in add_mtd_device() error paths - mtd: mtdswap: remove debugfs stats file on teardown - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: rawnand: Add a helper for calculating a page index - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Pause continuous reads at block boundaries - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - net: bridge: vlan: fix vlan range dumps starting with pvid - net: dpaa: fix mode setting - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - net: hip04: fix RX buffer leak on build_skb failure - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: ipa: fix SMEM state handle leaks in SMP2P init - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/iucv: fix use-after-free of a severed iucv_path - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - net: macb: drop in-flight Tx SKBs on close - net: mana: Validate the packet length reported by the NIC - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net/packet: avoid fanout hook re-registration after unregister - net: pcs: xpcs: fix SGMII state reading - net: qrtr: ns: Raise node count limit to 512 - net: qrtr: restrict socket creation to the initial network namespace - net/sched: act_tunnel_key: Defer dst_release to RCU callback - net: slip: serialize receive against buffer reallocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - net: stmmac: reset residual action in L3L4 filters on delete - net/x25: fix use-after-free in x25_kill_by_neigh() - nexthop: initialize extack in nh_res_bucket_migrate() - nfp: Check resource mutex allocation - NFS: Charge unstable writes by request size, not folio size - NFSD: pass nfsd_file to nfsd_iter_read() - nfs: remove dead code for the old swap over NFS implementation - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: fix SQB pointer leak on init failure - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-vf: set TC flower flag on MCAM entry allocation - openvswitch: fix GSO userspace truncation underflow - ovl: use linked upper dentry in copy-up tmpfile - pds_core: check for workqueue allocation failure - pds_core: fix auxiliary device add/del races - pds_core: order completion reads after the ownership check - pds_core: reject component parameter in legacy firmware update - pds_core: yield the CPU while waiting for the adminq to drain - phonet: pep: fix use-after-free in pep_get_sb() - pinctrl: remove pinctrl_gpio_direction_output() - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - platform/x86/amd/pmc: Avoid logging "(null)" for DMI values - platform/x86/amd/pmc: Don't log during intermediate wakeups - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - powerpc/time: Prepare to stop elapsing in dynticks-idle - powerpc/vtime: Initialize starttime at boot for native accounting - ppp: annotate data races in ppp_generic - ppp: convert to percpu netstats - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - ppp: enable TX scatter-gather - pppoe: reload header pointer after dev_hard_header() - ppp: use IFF_NO_QUEUE in virtual interfaces - proc: Fix broken error paths for namespace links - rbd: Reset positive result codes to zero in object map update path - RDMA/cma: Fix hardware address comparison length in netevent callback - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/irdma: Prevent overflows in memory contiguity checks - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/siw: publish QP after initialization - RDMA/umem: Add helpers for umem dmabuf revoke lock - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add pinned revocable dmabuf import interface - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/umem: Introduce an option to revoke DMABUF umem - RDMA/umem: Move umem dmabuf revoke logic into helper function - rds: drop incoming messages that cross network namespace boundaries - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - RISC-V: KVM: Serialize virtual interrupt pending state updates - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Fix socket notification race - rxrpc: Pull out certain app callback funcs into an ops table - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Use irq-disabling spinlocks between app and I/O thread - sched/vtime: Get rid of generic vtime_task_switch() implementation - sctp: auth: verify auth requirement when auth_chunk is NULL - sctp: don't free the ASCONF's own transport in DEL-IP processing - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - sctp: fix auth_hmacs array size in struct sctp_cookie - sctp: validate stream count in sctp_process_strreset_inreq() - selftest: af_unix: Add Kconfig file. - selftests: af_unix: add USER_NS config - selftests/alsa: Fix memory leak in find_controls error path - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - selftests: openvswitch: add config file - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - seqlock: Allow KASAN to fail optimizing - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: sc16is7xx: implement gpio get_direction() callback - smb/client: handle overlapping allocated ranges in fallocate - smb: client: validate DFS referral PathConsumed - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - tipc: fix infinite loop in __tipc_nl_compat_dumpit - tipc: fix u16 MTU truncation in media and bearer MTU validation - tipc: restrict socket queue dumps in enqueue tracepoints - tls: device: push pending open record on splice EOF - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - udmabuf: Do not create malformed scatterlists - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - USB: serial: ftdi_sio: add support for E+H FXA291 - USB: serial: io_edgeport: cap received transmit credits - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: option: add TDTECH MT5710-CN - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - VDUSE: avoid leaking information to userspace - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - VFS/audit: introduce kern_path_parent() for audit - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - vxlan: mdb: Fix source list corruption on a failed replace - vxlan: require CAP_NET_ADMIN in the device netns for changelink - wan: wanxl: Only reset hardware after BAR mapping - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath6kl: fix OOB access from firmware ADDBA window size - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: cfg80211: cancel sched scan results work on unregister - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: mac80211: recalculate TIM when a station enters power save - wifi: mac80211: tear down new links on vif update error path - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7915: guard HE capability lookups - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mwifiex: bound uAP association event IEs to the event buffer - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: nl80211: validate nested MBSSID IE blobs - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: wilc1000: validate assoc response length before subtracting header - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - x86/boot/compressed: Disable jump tables - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xprtrdma: Clear receive-side ownership pointers on release - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- [bot] upd: 6.6.144 -> 6.6.145 - Changelog: - 6lowpan: fix NHC entry use-after-free on error path - 9p: skip nlink update in cacheless mode to fix WARN_ON - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: IPMI: Fix message kref handling on dead device - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: resource: Amend kernel-doc style - afs: Fix callback service message parsers to pass through -EAGAIN - afs: Fix error code in afs_extract_vl_addrs() - afs: Fix further netns teardown to cancel the preallocation charger - afs: Fix netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix unchecked-length string display in debug statement - afs: Fix vllist leak - afs: use kvfree() to free memory allocated by kvcalloc() - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - ALSA: aoa: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - ALSA: es1938: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: gus: check snd_ctl_new1() return value - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: seq: Clear variable event pointer on read - ALSA: seq: Fix partial userptr event expansion - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: seq: midi: Serialize output teardown with event_input - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: virtio: Add missing 384 kHz PCM rate mapping - ALSA: ymfpci: check snd_ctl_new1() return value - amt: fix size calculation in amt_get_size() - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: advertise the tcp fast open fix is applied - apparmor: check label build before no_new_privs test - apparmor: fix label can not be immediately before a declaration - apparmor: fix potential UAF in aa_replace_profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: put secmark label after secid lookup - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - arm64: dts: qcom: sm8450: Fix ICE reg size - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - arm64: Fix early handling of FEAT_E2H0 not being implemented - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - arm64/mm: convert ptep_clear() to ptep_get_and_clear() - arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) - arm64/mm: convert set_pte_at() to set_ptes(..., 1) - arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() - arm64: Revamp HCR_EL2.E2H RES1 detection - arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 - arm64: sysreg: Correct sign definitions for EIESB and DoubleLock - arm64: tegra: Fix Tegra234 MGBE PTP clock - arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - ARM: imx31: Fix IIM mapping leak in revision check - ARM: imx3: Fix CCM node reference leak - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - ASoC: codecs: aw88261: fix incorrect masks for boost regs - ASoC: codecs: hdac_hdmi: Validate written enum value - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - ata: libata: Fix ata_exec_internal() - ata: pata_pxa: Fix DMA channel leak on probe error - ata: sata_gemini: unwind clocks on IDE pinctrl errors - audit: add audit_log_nf_skb helper function - audit: Fix data races of skb_queue_len() readers on audit_queue - audit: fix potential integer overflow in audit_log_n_hex() - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: dat: fix tie-break for candidate selection - batman-adv: ensure minimal ethernet header on TX - batman-adv: fix VLAN priority offset - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: gw: acquire ethernet header only after skb realloc - batman-adv: retrieve ethhdr after potential skb realloc on RX - batman-adv: tt: avoid request storms during pending request - batman-adv: tt: prevent TVLV OOB check overflow - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - bitops: make BYTES_TO_BITS() treewide-available - bitops: use common function parameter names - block: Avoid mounting the bdev pseudo-filesystem in userspace - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - Bluetooth: btmtk: Fix btmtk.c undefined reference build error - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices. - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown - Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c - Bluetooth: btmtk: remove #ifdef around declarations - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: btrtl: validate firmware patch bounds - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - Bluetooth: hci_sync: annotate data-races around hdev->req_status - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci: validate codec capability element length - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: separate CIS_LINK and BIS_LINK link types - Bluetooth: vhci: validate devcoredump state before side effects - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - bonding: 3ad: fix mux port state on oper down - bonding: add ESP offload features when slaves support - bonding: Correctly support GSO ESP offload - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - bonding: fix type confusion in bond_setup_by_slave() - bonding: fix xfrm offload feature setup on active-backup mode - bonding: prevent potential infinite loop in bond_header_parse() - bonding: use common function to compute the features - bpf: Add missing access_ok call to copy_user_syms - bpf: Allow LPM map access from sleepable BPF programs - bpf, arm64: Reject out-of-range B.cond targets - bpf: Check tail zero of bpf_prog_info - bpf: Consistently use bpf_rcu_lock_held() everywhere - bpf: Disable xfrm_decode_session hook attachment - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - bpf: Fix effective prog array index with BPF_F_PREORDER - bpf: Fix stack slot index in nospec checks - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - bpf,fork: wipe ->bpf_storage before bailouts that access it - bpf, lsm: Add disabled BPF LSM hook list - bpf: Prefer dirty packs for eBPF allocations - bpf: Prefer packs that won't trigger an IBPB flush on allocation - bpf: Reject fragmented frames in devmap - bpf: Restore sysctl new-value from 1 to 0 - bpf: Restrict JIT predictor flush to cBPF - bpf: Run generic devmap egress prog on private skb - bpf: Skip redundant IBPB in pack allocator - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Support for hardening against JIT spraying - bpf: Tighten cgroup storage cookie checks for prog arrays - bpftool: Use libbpf error code for flow dissector query - bpf: Update transport_header when encapsulating UDP tunnel in lwt - bpf: zero-initialize the fib lookup flow struct - bridge: cfm: reject invalid CCM interval at configuration time - bridge: stp: Fix a potential use-after-free when deleting a bridge - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - btrfs: do not trim a device which is not writeable - btrfs: fix false IO failure after falling back to buffered write - btrfs: fix incorrect buffered IO fallback for append direct writes - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - btrfs: zoned: don't account data relocation space-info in statfs free space - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - bus: sunxi-rsb: Always check register address validity - can: bcm: add missing rcu list annotations and operations - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: esd_usb: kill anchored URBs before freeing netdevs - can: isotp: use unconditional synchronize_rcu() in isotp_release() - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - char: tlclk: fix use-after-free in tlclk_cleanup() - cifs: invalidate cfid on unlink/rename/rmdir - cifs: remove all cifs files before kill super - cifs: validate DFS referral string offsets - clk: at91: keep securam node alive while mapping it - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - clk: scmi: Fix clock rate rounding - clk: scpi: Unregister child clock providers on remove - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - configfs: fix lockless traversals of ->s_children - configfs_lookup(): don't leave ->s_dentry dangling on failure - coresight: cti: Fix DT filter signals silently ignored - coresight: etb10: restore atomic_t for shared reading state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Documentation: fix conservative governor freq_step description - cpufreq: Documentation: fix sampling_down_factor range - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - crypto: af_alg - Remove zero-copy support from skcipher and aead - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: ccp - Treat zero-length cert chain as query for blob lengths - crypto: crypto4xx - Remove ahash-related code - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: drbg - Fix the fips_enabled priority boost - crypto: ecc - Fix carry overflow in vli multiplication - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: hisilicon/qm - disable error report before flr - crypto: hisi-trng - Remove crypto_rng interface - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - crypto: pcrypt - restore callback for non-parallel fallback - crypto: qat - fix restarting state leak on allocation failure - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - crypto: qat - validate RSA CRT component lengths - crypto: rng - Free default RNG on module exit - crypto: sun4i-ss - Remove insecure and unused rng_alg - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - stop using crypto_ahash::init - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - cxgb4: Fix decode strings dump for T6 adapters - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - cxl/test: Fix integer overflow in mock LSA bounds checks - cxl/test: Zero out LSA backing memory to avoid leaking to user - dax/kmem: account for partial discontiguous resource upon removal - debugobjects: Plug race against a concurrent OOM disable - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - devlink: Fix parent ref leak in devl_rate_node_create() - dlm: fix add msg handle in send_queue ordered - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: Fix possible use after free - dmaengine: imx-sdma: Refine spba bus searching in probe - dmaengine: qcom: gpi: set DMA_PRIVATE capability - dmaengine: tegra: Fix burst size calculation - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm_early_create: fix freeing used table on dm_resume failure - dm era: fix NULL pointer dereference in metadata_open() - dm era: fix out-of-bounds memory access for non-zero start sector - dm-integrity: don't increment hash_offset twice - dm-ioctl: fix a possible overflow in list_version_get_info - dm-ioctl: report an error if a device has no table - dm-log: fix a bitset_size overflow on 32bit machines - dm-stats: fix dm_jiffies_to_msec64 - dm-stats: fix merge accounting - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - dm-verity: fix a possible NULL pointer dereference - dm-verity: increase sprintf buffer size - Documentation: proc: fix section numbering in table of contents - dpaa2-switch: fix VLAN upper check not rejecting bridge join - drbd: reject data replies with an out-of-range payload size - driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() - driver core: Guard deferred probe timeout extension with delayed_work_pending() - driver core: Use mod_delayed_work to prevent lost deferred probe work - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amd/display: Add missing kdoc for ALLM parameters - drm/amd: Fix set but not used warnings - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/amdgpu: initialize irq.lock spinlock earlier - drm/amdgpu: set sub_block_index for mca ras sub-blocks - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - drm/edid: fix OOB read in drm_parse_tiled_block() - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/msm/dp: fix HPD state status bit shift value - drm/msm/dp: Fix the ISR_* enum values - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - drm/tegra: Fix iommu_map_sgtable() return value check - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - drm/tidss: Drop extra drm_mode_config_reset() call - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - dt-bindings: power: imx93: Add MIPI PHY power domain - EDAC/i10nm: Don't fail probing if ADXL is missing - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - espintcp: use sk_msg_free_partial to fix partial send - evm: terminate and bound the evm_xattrs read buffer - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: bound uniname advance in exfat_find_dir_entry() - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: move free cluster out of exfat_init_ext_entry() - exfat: preserve benign secondary entries during rename and move - exfat: remove unnecessary read entry in __exfat_rename() - exfat: rename argument name for exfat_move_file and exfat_rename_file - ext2: fix ignored return value of generic_write_sync() - ext4: fix kernel BUG in ext4_write_inline_data_end - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - ext4: get rid of ppath in get_ext_path() - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: validate orphan inode entry count - fbcon: fix NULL pointer dereference for a console without vc_data - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: sm501fb: Fix buffer errors in OF binding code - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - firmware: arm_scmi: Read sensor config as 32-bit value - firmware_loader: fix device reference leak in firmware_upload_register() - firmware_loader: Fix recursive lock in device_cache_fw_images() - flow_dissector: check device type before reading ETH_ADDRS - fpga: dfl: add bounds check in dfh_get_param_size() - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - fs: efs: remove unneeded debug prints - fsl/fman: Free init resources on KeyGen failure in fman_init() - fs/ntfs3: add bounds check to run_get_highest_vcn() - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - fs/ntfs3: fsync files by syncing parent inodes - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - fuse: fix device node leak in cuse_process_init_reply() - fuse: re-lock request before returning from fuse_ref_folio() - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - gpio-f7188x: Add support for NCT6126D version B - gpio: htc-egpio: use managed gpiochip registration - gpio: mlxbf3: fail probe if gpiochip registration fails - gpio: mvebu: fail probe if gpiochip registration fails - gpio: sch: use raw_spinlock_t in the irq startup path - gpios: palmas: add .get_direction() op - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - gpu: host1x: Allow entries in BO caches to be freed - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - gpu: host1x: Fix iommu_map_sgtable() return value check - gue: validate REMCSUM private option length - handshake: Require admin permission for DONE command - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: add haptics page defines - HID: appleir: fix UAF on pending key_up_timer in remove() - HID: core: Fix OOB read in hid_get_report for numbered reports - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - HID: playstation: validate num_touch_reports in DualShock 4 reports - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: wacom: stop hardware after post-start probe failures - HID: wiimote: Fix table layout and whitespace errors - hwmon: adm1275: Prevent reading uninitialized stack - hwmon: (asus_atk0110) Check package count before accessing element - hwmon: (it87) Clamp negative values to zero in set_fan() - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - hwmon: (occ) unregister sysfs devices outside occ lock - hwmon: (pmbus) Fix passing events to regulator core - hwmon: (w83627hf) remove VID sysfs files on error and remove - hwmon: (w83793) remove vrm sysfs file on probe failure - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - hwrng: virtio: clamp device-reported used.len at copy_data() - hwspinlock: qcom: avoid uninitialized struct members - i2c: core: fix adapter debugfs creation - i2c: core: fix adapter deregistration race - i2c: core: fix adapter registration race - i2c: core: fix hang on adapter registration failure - i2c: core: fix irq domain leak on adapter registration failure - i2c: core: fix NULL-deref on adapter registration failure - i2c: mediatek: fix WRRD for SoCs without auto_restart option - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mpc: Fix timeout calculations - i2c: stm32f7: truncate clock period instead of rounding it - i3c: master: Prevent reuse of dynamic address on device add failure - i40e: Fix i40e_debug() to use struct i40e_hw argument - ia64: Make acpi_cpufreq_cpu_exit return void - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - IB/mlx4: Fix refcount leak in add_port() error path - IB/mlx5: Don't take the rereg_mr fallback without a new translation - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - IB/mlx5: Properly support implicit ODP rereg_mr - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - ice: fix ice_init_link() error return preventing probe - ieee802154: admin-gate legacy LLSEC dump operations - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - iio: accel: bmc150: clamp the device-reported FIFO frame count - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: event: Fix event FIFO reset race - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: light: al3010: fix incorrect scale for the highest gain range - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: opt3001: fix missing state reset on timeout - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: veml6030: fix channel type when pushing events - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: pressure: mpl115: fix runtime PM leak on read error - iio: tcs3472: power down chip on probe failure - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: goodix - clamp the device-reported contact count - Input: iforce - bound the device-reported force-feedback effect index - Input: ims-pcu - add response length checks - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix use-after-free and double-free in disconnect - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - validate control endpoint type - Input: maplecontrol - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: maplemouse - fix NULL pointer dereference in open() - Input: maplemouse - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: mms114 - reject an oversized device packet size - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - Input: touchwin - reset the packet index on every complete packet - iommu/amd: Fix a stale comment about which legacy mode is user visible - ionic: Fix check in ionic_get_link_ext_stats - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - ipv4: fib: Don't ignore error route in local/main tables. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - ipv4: igmp: remove multicast group from hash table on device destruction - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - ipv6: fix error handling in disable_ipv6 sysctl - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix more places with wrong ipv6 transport offsets - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: pass parsed transport offset to state handlers - ipvs: reload ip header after head reallocation - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - ipvs: use parsed transport offset in TCP state lookup - irqchip/crossbar: Fix parent domain resource leak - irqchip/crossbar: Use correct index in crossbar_domain_free() - irqchip/gic-v3-its: Fix OF node reference leak - irqchip/ts4800: Fix missing chained handler cleanup on remove - isofs: bound Rock Ridge symlink components to the SL record - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - kcm: use WRITE_ONCE() when changing lower socket callbacks - kconfig: fix potential NULL pointer dereference in conf_askvalue - KEYS: Use acquire when reading state in keyring search - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - ksmbd: fix integer overflow in set_file_allocation_info() - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: fix use-after-free in same_client_has_lease() - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - ksmbd: reject undersized DACLs before parsing ACEs - ksmbd: require source read access for duplicate extents - ksmbd: run set info with opener credentials - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: track the connection owning a byte-range lock - ksmbd: use opener credentials for delete-on-close - ksmbd: use opener credentials for FSCTL mutations - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - KVM: arm64: Initialize HCR_EL2.E2H early - KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - leds: uleds: Fix potential buffer overread - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - libbpf: Report error when a negative kprobe offset is specified - lib/test_meminit: use && for bools - llc: fix SAP refcount leak in llc_ui_autobind() - llc: fix SAP refcount leak when creating incoming sockets - lockd: Plug nlm_file leak when nlm_do_fopen() fails - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - LoongArch: Add PIO for early access before ACPI PCI root register - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - mac802154: remove interfaces with RCU list deletion - macsec: don't read an unset MAC header in macsec_encrypt() - macsec: fix promiscuity refcount leak in macsec_dev_open() - mailbox: mtk-adsp: fix UAF during device teardown - md/raid10: reset read_slot when reusing r10bio for discard - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - media: cedrus: Fix failure to clean up hardware on probe failure - media: mtk-jpeg: cancel workqueue on release for supported platforms only - media: nxp: imx8-isi: Convert to platform remove callback returning void - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: qcom: venus: drop extra padding in NV12 raw size calculation - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: relax encoder frame/blur step size on v6 - media: rockchip: rga: fix too small buffer size - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - media: uvcvideo: Avoid partial metadata buffers - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Fix sequence number when no EOF - media: v4l2-common: Add YUV24 format info - memstick: ms_block: reject a card that reports too many blocks - mfd: cros_ec: Delay dev_set_drvdata() until probe success - mfd: cs42l43: Sanity check firmware size - mfd: sm501: Fix reference leak on failed device registration - mfd: tps6586x: Fix OF node refcount - minix: avoid overflow in bitmap block count calculation - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: DEC: Ensure RTC platform device deregistration upon failure - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix gio device memory leak - MIPS: ip22-gio: fix kfree() of static object - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mmc: vub300: defer reset until cmd_mutex is unlocked - mm/damon/core: make charge_addr_from aware of end-address exclusivity - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm: do file ownership checks with the proper mount idmap - mm/fake-numa: fix under-allocation detection in uniform split - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - mm: shrinker: fix NULL pointer dereference in debugfs - mm: shrinker: remove redundant shrinker_rwsem in debugfs operations - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - mm/vmscan: flush deferred TLB before freeing large folios - module: decompress: check return value of module_extend_max_pages() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - mtd: rawnand: fix condition in 'nand_select_target()' - mtd: rawnand: fsl_ifc: return errors for failed page reads - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: pl353: fix probe resource allocation - mtd: slram: remove failed entries from the device list - mtd: spi-nor: Drop duplicate Kconfig dependency - mtd: spi-nor: swp: Improve locking user experience - net/9p: fix infinite loop in p9_client_rpc on fatal signal - net/9p: fix race condition on rdma->state in trans_rdma.c - net: add a common function to compute features for upper devices - net: af_key: initialize alg_key_len for IPComp states - net: atm: reject out-of-range traffic classes in QoS validation - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net, bpf: check master for NULL in xdp_master_redirect() - net: Drop the lock in skb_may_tx_timestamp() - net: dsa: sja1105: round up PTP perout pin duration - net: ena: clean up XDP TX queues when regular TX setup fails - net: enetc: check the number of BDs needed for xdp_frame - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: conntrack: revert ct extension genid infrastructure - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump - netfilter: ebtables: module names must be null-terminated - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: Use vmalloc_array() to improve code - netfilter: ebtables: zero chainstack array - netfilter: ecache: fix inverted time_after() check - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: Fix data race between add and dump in all hash types - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: fix race between dump and ip_set_list resize - netfilter: nf_conncount: callers must hold rcu read lock - netfilter: nf_conncount: fix zone comparison in tuple dedup - netfilter: nf_conncount: prevent connlimit drops for early confirmed ct - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: xt_connmark: reject invalid shift parameters - netfilter: xt_nat: reject unsupported target families - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - net: gianfar: dispose irq mappings on probe failure and device removal - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: lan743x: Initialize eth_syslock spinlock before use - net: liquidio: fix BAR resource leak on PF number failure - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net: marvell: prestera: initialize err in prestera_port_sfp_bind - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5: Check max_macs devlink param value against max capability - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - net/mlx5: Fix L3 tunnel entropy refcount leak - net: mvneta: re-enable percpu interrupt on resume - net: openvswitch: reject oversized nested action attrs - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - net: psample: fix info leak in PSAMPLE_ATTR_DATA - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net/sched: cake: reject overhead values that underflow length - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - net/sched: cls_flow: Dont expose folded kernel pointers - net/sched: hhf: clear heavy-hitter state on reset - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_drr: annotate data-races around cl->deficit - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - net/sched: sch_hfsc: Don't make class passive twice - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - net: sit: require CAP_NET_ADMIN in the device netns for changelink - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net: sparx5: unregister blocking notifier on init failure - net: sungem: fix probe error cleanup - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - net: thunderbolt: Fix frags[] overflow by bounding frame_count - net/tls: Consume empty data records in tls_sw_read_sock() - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - net: wwan: iosm: bound device offsets in the MUX downlink decoder - net: wwan: t7xx: check skb_clone in control TX - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: Don't reset the write verifier on a commit EAGAIN - nfsd: move name lookup out of nfsd4_list_rec_dir() - nfsd: release layout stid on setlease failure - nfsd: reset write verifier on deferred writeback errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - NFSv4/flexfiles: reject zero filehandle version count - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - NFSv4/pnfs: defer return_range callbacks until after inode unlock - nilfs2: fix backing_dev_info reference leak - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - NTB: epf: Make db_valid_mask cover only real doorbell bits - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - nvdimm/btt: Free arenas on btt_init() error paths - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Handle preemption in BTT lane acquisition - nvme-multipath: fix flex array size in struct nvme_ns_head - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - nvmet-auth: validate reply message payload bounds against transfer length - nvmet-rdma: handle inline data with a nonzero offset - nvmet: remove superfluous initialization - nvmet: return DHCHAP status codes from nvmet_setup_auth() - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - nvmet-tcp: Fix potential UAF when ddgst mismatch - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: avoid moving extents to occupied clusters - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: don't BUG_ON an invalid journal dinode - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2: kill osb->system_file_mutex lock - ocfs2: rebase copied fsdlm LVB pointers in locking_state - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: use kzalloc for quota recovery bitmap allocation - octeontx2-af: fix VF bringup affecting PF promiscuous state - octeontx2-af: mcs: Fix unsupported secy stats read - octeontx2-pf: check DMAC extraction support before filtering - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - of: cpu: add check in __of_find_n_match_cpu_property() - OPP: of: Fix potential memory leak in opp_parse_supplies() - orangefs: keep the readdir entry size 64-bit in fill_from_part() - partitions: aix: bound the pp_count scan to the ppe array - PCI: Add kerneldoc for pci_resize_resource() - PCI: altera: Do not dispose parent IRQ mapping - PCI: altera: Fix resource leaks on probe failure - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining - PCI/ASPM: Don't reconfigure ASPM entering low-power state - PCI: Check ROM header and data structure addr before accessing - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - PCI: Fix restoring BARs on BAR resize rollback path - PCI: Free saved list without holding pci_bus_sem - PCI: host-common: Request bus reassignment when not probe-only - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - PCI: Introduce named defines for PCI ROM - PCI: iproc: Restore .map_irq() for the platform bus driver - PCI: loongson: Do not ignore downstream devices on external bridges - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: Move Resizable BAR code to rebar.c - PCI: Prevent resource tree corruption when BAR resize fails - PCI: rcar-host: Remove unused LIST_HEAD(res) - PCI: Skip Resizable BAR restore on read error - perf/core: Detach event groups during remove_on_exec - perf: Fix dangling cgroup pointer in cpuctx backport - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - perf trace beauty fcntl: Fix build with older kernel headers - perf/x86/amd/brs: Fix kernel address leakage - perf/x86/amd/core: Always use the NMI latency mitigation - perf/x86/amd/lbr: Fix kernel address leakage - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - phy: phy-can-transceiver: Check driver match and driver data against NULL - pinctrl: cs42l43: Fix polarity on debounce - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: meson: restore non-sleeping GPIO access - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - platform/x86/amd/pmc: Add delay_suspend module parameter - platform/x86/amd/pmc: Check for intermediate wakeup in function - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - pmdomain: imx: Fix i.MX8MP power notifier - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - PM: sleep: Use complete() in device_pm_sleep_init() - pNFS/filelayout: fix cheking if a layout is striped - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - powerpc/pseries: fix memory leak on krealloc failure in papr_init - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - power: supply: charger-manager: fix refcount leak in is_full_charged() - power: supply: core: fix supplied_from allocations - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - proc: only bump parent nlink when registering directories - proc: protect ptrace_may_access() with exec_update_lock (FD links) - proc: protect ptrace_may_access() with exec_update_lock (part 1) - proc: rename proc_setattr to proc_nochmod_setattr - pwm: imx27: Fix variable truncation in .apply() - qede: fix off-by-one in BD ring consumption on build_skb failure - qede: fix out-of-bounds check for cqe->len_list[] - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - RDMA/hns: Fix warning in poll cq direct mode - RDMA/irdma: Fix OOB read during CQ MR registration - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Remove raw RSS QP restrack tracking - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/srpt: fix integer overflow in immediate data length check - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - remoteproc: qcom: Fix leak when custom dump_segments addition fails - reset: sunxi: fix memory region leak on ioremap failure - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - Revert "PCI/MSI: Unmap MSI-X region on error" - Revert "treewide: Fix probing of devices in DT overlays" - ring-buffer: Fix event length with forced 8-byte alignment - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - riscv: probes: save original sp in rethook trampoline - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - rpmsg: use generic driver_override infrastructure - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: mpfs: fix counter upload completion condition - rtc: msc313: fix NULL deref in shared IRQ handler at probe - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - s390/monwriter: Reject buffer reuse with different data length - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - s390/process: Fix kernel thread function pointer type - s390/zcrypt: Remove the empty file - sched/fair: Fix cpu_util runnable_avg arithmetic - sched/fair: Only update stats for allowed CPUs when looking for dst group - sched: restore timer_slack_ns when resetting RT policy on fork - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: sg: Report request-table problems when any status is set - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Fix hexadecimal CHAP_I handling - scsi: target: Remove tcm_loop target reset handling - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - sctp: fix SCTP_RESET_STREAMS stream list length limit - sctp: hold socket lock when dumping endpoints in sctp_diag - sctp: validate embedded address parameter length - sctp: validate STALE_COOKIE cause length before reading staleness - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - seg6: validate SRH length before reading fixed fields - selftests/bpf: Add simple strscpy() implementation - selftests/bpf: Fix bpf_iter/task_vma test - selftests/bpf: Initialize operation name before use - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: do not manually call headers_install - selftests/hid: ensure CKI can compile our new tests on old kernels - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - selftests/hid: force using our compiled libbpf headers - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - selftests/mm: fix exclusive_cow test fork() handling - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - selinux: check connect-related permissions on TCP Fast Open - selinux: fix incorrect execmem checks on overlayfs - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: fix scoped_seqlock_read kernel-doc - seqlock: Introduce scoped_seqlock_read() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - smb/client: always return a value for FS_IOC_GETFLAGS - smb: client: fix change notify replay double-free - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix double-free in SMB2_open() replay - smb/client: Fix error code in smb2_aead_req_alloc() - smb: client: Fix next buffer leak in receive_encrypted_standard() - smb: client: fix overflow in passthrough ioctl bounds check - smb: client: fix query directory replay double-free - smb: client: fix query_info() replay double-free - smb: client: harden POSIX SID length parsing - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - smb: client: mask server-provided mode to 07777 in modefromsid - smb/client: preserve errors from smb2_set_sparse() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: resolve SWN tcon from live registrations - smb: client: restrict implied bcc[0] exemption to responses without data area - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - smb: client: use unaligned reads in parse_posix_ctxt() - smb: move some duplicate definitions to common/cifsglob.h - smb/server: do not require delete access for non-replacing links - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - sparc: led: avoid trimming a newline from empty writes - spi: dw: fix wrong BAUDR setting after resume - spi: ep93xx: fix double-free of zeropage on DMA setup failure - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: hisi-kunpeng: Use dev_err_probe() for host registration failure - spi: meson-spifc: fix runtime PM leak on remove - spi: rpc-if: Use correct device for hardware reinitialization on resume - spi: sh-msiof: abort transfers when reset times out - spi: uniphier: Fix completion initialization order before devm_request_irq() - spi: xilinx: use FIFO occupancy register to determine buffer size - staging: media: atomisp: reduce load_primary_binaries() stack usage - staging: most: video: avoid double free on video register failure - staging: nvec: fix use-after-free in nvec_rx_completed() - staging: rtl8723bs: core: move constants to right side in comparison - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: vme_user: bound slave read/write to the kern_buf size - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: fix location monitor leak in tsi148 bridge - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sysfs: clamp show() return value in sysfs_kf_read() - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - team: fix header_ops type confusion with non-Ethernet ports - thermal: hwmon: Fix critical temperature attribute removal - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - time: Fix off-by-one in compat settimeofday() usec validation - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - tipc: fix UAF in tipc_l2_send_msg() - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: reject inverted service ranges from peer bindings - tipc: require net admin for TIPCv2 netlink mutators - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - tools/power/x86/intel-speed-select: Harden daemon pidfile open - tools/testing: add linux/args.h header and fix radix, VMA tests - tools/virtio: check mmap return value in vringh_test - tpm: fix event_size output in tpm1_binary_bios_measurements_show - tpm: Make the TPM character devices non-seekable - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - tracing: Bound synthetic-field strings with seq_buf - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - tracing/osnoise: Call synchronize_rcu() when unregistering - tracing: Prevent out-of-bounds read in glob matching - tracing/probes: Fix double addition of offset for @+FOFFSET - tracing: probes: fix typo in a log message - treewide: Switch/rename to timer_delete[_sync]() - udf: validate free block extents against the partition length - udf: validate sparing table length as an entry count, not a byte count - udf: validate VAT header length against the VAT inode size - udmabuf: fix DMA direction mismatch in release_udmabuf() - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - usb: dwc3: run gadget disconnect from sleepable suspend context - usb: free iso schedules on failed submit - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: gadget: f_fs: initialize reset_work at allocation time - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - usb: gadget: f_printer: take kref only for successful open - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - usb: host: max3421: Reject hub port requests for non-existent ports - USB: idmouse: fix use-after-free on disconnect race - USB: iowarrior: fix use-after-free on disconnect - usb: iowarrior: remove inherent race with minor number - usbip: tools: support SuperSpeedPlus devices - usbip: vudc: fix NULL deref in vep_dequeue() - USB: ldusb: fix use-after-free on disconnect race - USB: legousbtower: fix use-after-free on disconnect race - USB: misc: uss720: unregister parport on probe failure - usb: mtu3: unmap request DMA on queue failure - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: keyspan_pda: fix information leak - USB: serial: option: add Telit Cinterion FE990D50 compositions - usb: sl811-hcd: disable controller wakeup on remove - USB: storage: include US_FL_NO_SAME in quirks mask - usb: typec: anx7411: use devm_pm_runtime_enable() - usb: typec: class: drop PD lookup reference - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - USB: ulpi: fix memory leak on registration failure - USB: usb-storage: ene_ub6250: restore media-ready check - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - userfaultfd: gate must_wait writability check on pte_present() - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - vduse: hold vduse_lock across IDR lookup in open path - vduse: Requeue failed read to send_list head - veth: fix NAPI leak in XDP enable error path - vfio/mlx5: Fix racy bitfields and tighten struct layout - vfio/pci: Fix racy bitfields and tighten struct layout - vfio/pci: Latch disable_idle_d3 per device - vfio/pci: Release the VGA arbiter client on register_device() failure - vfio/pci: Use a private flag to prevent power state change with VFs - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - vhost/net: complete zerocopy ubufs only once - vhost/vdpa: validate virtqueue index in mmap and fault paths - virtio-mmio: fix device release warning on module unload - virtio_net: disable cb when NAPI is busy-polled - virtio-net: fix len check in receive_big() - virtio_net: Support dynamic rss indirection table size - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - watchdog: apple: Add "apple,t8103-wdt" compatible - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: unregister PM notifier on watchdog unregister - wifi: ath9k: fix OOB access from firmware tx status queue ID - wifi: cfg80211: fix grammar in MLO group key error message - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: mac80211: free ack status frame on TX header build failure - wifi: mt76: fix argument to ieee80211_is_first_frag() - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: rt2x00: avoid full teardown before work setup in probe - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - workqueue: drop spurious '*' from print_worker_info() fn declaration - writeback: Avoid contention on wb->list_lock when switching inodes - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - X.509: Fix validation of ASN.1 certificate header - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - x86/bugs: Enable IBPB flush on BPF JIT allocation - x86/mm: Fix check/use ordering in switch_mm_irqs_off() - x86/platform/olpc: xo15: Drop wakeup source on driver removal - xen/gntdev: fix error handling in ioctl - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: use compat translator only for u64 alignment mismatch - xfrm: Use the XFRM_GRO to indicate a GRO call on input - xfrm: validate selector family and prefixlen during match - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfs: dump the recovered xattri log item if corruption happens - xfs: fail recovery on a committed log item with no regions - xfs: fix stupid compiler warning - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: move ->iop_recover to xfs_defer_op_type - xfs: recreate work items when recovering intent items - xfs: resample the data fork mapping after cycling ILOCK - xfs: use null daddr for unset first bad log block - xfs: use xfs_defer_finish_one to finish recovered work items - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Check frwr_wp_create() during connect - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Remove temp allocation of rpcrdma_rep objects - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Use sendctx DMA state for Send signaling - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Remove rudiment CVE patches- [bot] upd: 6.6.126 -> 6.6.144 - Changelog: - 6lowpan: fix off-by-one in multicast context address compression - 6pack: propagage new tty types - 9p: avoid putting oldfid in p9_client_walk() error path - accel/qaic: Add overflow check to remap_pfn_range during mmap - accel/qaic: Handle DBC deactivation if the owner went away - ACPI: AGDI: fix missing newline in error message - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - ACPI: PM: Save NVS memory on Lenovo G70-35 - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix - ACPI: scan: Use acpi_dev_put() in object add error paths - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: x86: cmos_rtc: Clean up address space handler driver - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - af_key: validate families in pfkey_send_migrate() - af_unix: Cache state->msg in unix_stream_read_generic(). - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Give up GC if MSG_PEEK intervened. - af_unix: read UNIX_DIAG_VFS data under unix_state_lock - af_unix: Reject SIOCATMARK on non-stream sockets - af_unix: Set gc_in_progress to true in unix_gc(). - agp/amd64: Fix broken error propagation in agp_amd64_probe() - alarmtimer: Fix argument order in alarm_timer_forward() - ALSA: 6fire: Fix input volume change detection - ALSA: 6fire: fix use-after-free on disconnect - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: i2sbus: fix OF node lifetime handling - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - ALSA: aoa: Use guard() for mutex locks - ALSA: asihpi: avoid write overflow check warning - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: fix stack out-of-bounds read in init_card - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - ALSA: core: Fix potential data race at fasync handling - ALSA: core: Serialize deferred fasync state checks - ALSA: core: Validate compress device numbers without dynamic minors - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: ctxfi: Limit PTP to a single page - ALSA: firewire-lib: fix uninitialized local variable - ALSA: firewire-motu: Protect register DSP event queue positions - ALSA: firewire-tascam: Do not drop unread control events - ALSA: fireworks: bound device-supplied status before string array lookup - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: fix some typos - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: hda: cs35l56: Propagate ASP TX source control errors - ALSA: hda: cs35l56: Put ACPI device after setting companion - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: add quirk for Framework F111:000F - ALSA: hda/realtek: Add quirk for Inspur S14-G1 - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: misc: Use guard() for spin locks - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - ALSA: scarlett2: Add missing sentinel initializer field - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - ALSA: timer: Fix UAF at snd_timer_user_params() - ALSA: ua101: Reject too-short USB descriptors - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - ALSA: usb-audio: Add sanity check for OOB writes at silencing - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Cap the packet size pre-calculations - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Evaluate packsize caps at the right place - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Improve Focusrite sample rate filtering - ALSA: usb-audio: midi2: Restart output URBs on resume - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - ALSA: usb-audio: Update the number of packets properly at receiving - ALSA: usb-audio: Use correct version for UAC3 header validation - ALSA: usb-audio: Use inclusive terms - amd-xgbe: fix link status handling in xgbe_rx_adaptation - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - amd-xgbe: fix sleep while atomic on suspend/resume - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - APEI/GHES: ensure that won't go past CPER allocated record - apparmor: fix aa_label to return state from compount and component match - apparmor: fix differential encoding verification - apparmor: Fix double free of ns_name in aa_replace_profiles() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: fix: limit the number of levels of policy namespaces - apparmor: fix memory leak in verify_header - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix NULL sock in aa_sock_file_perm - apparmor: fix race between freeing data and fs accessing it - apparmor: fix race on rawdata dereference - apparmor: fix rlimit for posix cpu timers - apparmor: fix side-effect bug in match_char() macro usage - apparmor: fix unprivileged local user can do privileged policy management - apparmor: fix use-after-free in rawdata dedup loop - apparmor: make label_match return a consistent value - apparmor: mediate the implicit connect of TCP fast open sendmsg - apparmor: provide separate audit messages for file and policy checks - apparmor: refcount the pdb - apparmor: remove apply_modes_to_perms from label_match - apparmor: replace recursive profile removal with iterative approach - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: validate DFA start states are in bounds in unpack_pdb - arm64: Add support for TSV110 Spectre-BHB mitigation - arm64: cpufeature: Make PMUVer and PerfMon unsigned - arm64: cputype: Add C1-Premium definitions - arm64: cputype: Add C1-Ultra definitions - arm64: cputype: Add NVIDIA Olympus definitions - arm64: Disable branch profiling for all arm64 code - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8-apalis: Fix LEDs name collision - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - arm64: dts: rockchip: Fix rk356x PCIe range mappings - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU - arm64: errata: Mitigate TLBI errata on various Arm CPUs - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - arm64: Fix sampling the "stable" virtual counter in preemptible section - arm64: Force the use of CNTVCT_EL0 in __delay() - arm64: io: Extract user memory type in ioremap_prot() - arm64: io: Rename ioremap_prot() to __ioremap_prot() - arm64: kexec: Remove duplicate allocation for trans_pgd - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - arm64: mm: Batch dsb and isb when populating pgtables - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - arm64/mm: Enable batched TLB flush in unmap_hotplug_range() - arm64: probes: Handle probes on hinted conditional branch instructions - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - arm64/scs: Fix handling of advance_loc4 - arm64/scs: Fix potential sign extension issue of advance_loc4 - arm64: tegra: smaug: Add usb-role-switch support - arm64: tlb: Allow XZR argument to TLBI ops - arm64: tlb: Flush walk cache when unsharing PMD tables - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI - arm64/xor: fix conflicting attributes for xor_block_template - ARM: 9467/1: mm: Don't use %pK through printk - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: clean up the memset64() C wrapper - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: group is_permission_fault() with is_translation_fault() - ARM: integrator: Fix early initialization - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - ARM: omap2: Fix reference count leaks in omap_control_init() - ARM: socfpga: Fix OF node refcount leak in SMP setup - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - ASoC: amd: yc: Add quirk for HP 200 G2a 16 - ASoC: codecs: ab8500: Fix casting of private data - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - ASoC: codecs: simple-mux: Fix enum control bounds check - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - ASoC: cs42l43: Correct handling of 3-pole jack load detection - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: detect empty DMI strings - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - ASoC: es8328: Add error unwind in resume - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: fix comment typo - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_micfil: Add access property for "VAD Detected" - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: Intel: catpt: Fix the device initialization - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm: move component registration to unmanaged version - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6asm-dai: close stream only when running - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays - ASoC: simple-card-utils: use __free(device_node) for device node - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - ASoC: soc-core: drop delayed_work_pending() check before flush - ASoC: soc-core: flush delayed work before removing DAIs and widgets - ASoC: SOF: compress: return the configured codec from get_params - ASoC: SOF: Don't allow pointer operations on unconfigured streams - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda: Place check before dereference - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: sti: Return errors from regmap_field_alloc() - ASoC: sti: use managed regmap_field allocations - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - atm: fore200e: fix use-after-free in tasklets during device removal - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - atm: lec: fix use-after-free in sock_def_readable() - audit: add fchmodat2() to change attributes class - audit: add missing syscalls to read class - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - audit: fix incorrect inheritable capability in CAPSET records - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - auxdisplay: arm-charlcd: fix release_mem_region() size - auxdisplay: line-display: fix OOB read on zero-length message_store() - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - batman-adv: Avoid double-rtnl_lock ELP metric worker - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: clear current gateway during teardown - batman-adv: dat: handle forward allocation error - batman-adv: dat: prevent false sharing between VLANs - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: fix fragment reassembly length accounting - batman-adv: fix integer overflow on buff_pos - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: hold claim backbone gateways by reference - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: mcast: fix use-after-free in orig_node RCU release - batman-adv: prevent ELP transmission interval underflow - batman-adv: reject new tp_meter sessions during teardown - batman-adv: reject oversized global TT response buffers - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: stop tp_meter sessions during mesh teardown - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: tp_meter: keep unacked list in ascending ordered - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tt: fix negative last_changeset_len - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tt: prevent TVLV entry number overflow - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tt: track roam count per VID - batman-adv: tvlv: abort OGM send on tvlv append failure - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: v: stop OGMv2 on disabled interface - bcache: fix cached_dev.sb_bio use-after-free and crash - bcache: fix uninitialized closure object - binder: don't use %pK through printk - binfmt_misc: restore write access before closing files opened by open_exec() - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - blk-cgroup: fix UAF in __blkcg_rstat_flush() - blk-cgroup: wait for blkcg cleanup before initializing new disk - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - blktrace: fix __this_cpu_read/write in preemptible context - block: add pgmap check to biovec_phys_mergeable - block: relax pgmap check in bio_add_page for compatible zone device pages - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: bnep: reject short frames before parsing - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events - Bluetooth: btmtk: add the function to get the fw name - Bluetooth: btmtk: fix urb->setup_packet leak in error paths - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btmtk: validate WMT event SKB length before struct access - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: btusb: Allow firmware re-download when version matches - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - Bluetooth: hci_conn: fix potential UAF in create_big_sync - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - Bluetooth: hci_ll: Fix firmware leak on error path - Bluetooth: hci_qca: Cleanup on all setup failures - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - Bluetooth: hci_sync: Fix hci_le_create_conn_sync - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - Bluetooth: HIDP: Fix possible UAF - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - Bluetooth: ISO: Fix defer tests being unstable - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU - Bluetooth: MGMT: Fix backward compatibility with userspace - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: MGMT: validate LTK enc_size on load - Bluetooth: MGMT: validate mesh send advertising payload length - Bluetooth: qca: fix ROM version reading on WCN3998 chips - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - Bluetooth: serialize accept_q access - Bluetooth: SMP: derive legacy responder STK authentication from MITM state - Bluetooth: SMP: force responder MITM requirements before building the pairing response - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy - Bluetooth: virtio_bt: clamp rx length before skb_put - Bluetooth: virtio_bt: validate rx pkt_type header length - bnxt_en: Fix NULL pointer dereference - bonding: 3ad: implement proper RCU rules for port->aggregator - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - bonding: add support for per-port LACP actor priority - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - bonding: fix NULL pointer dereference in actor_port_prio setting - bonding: fix use-after-free due to enslave fail after slave array update - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - bonding: only set speed/duplex to unknown, if getting speed failed - bonding: print churn state via netlink - bonding: refuse to enslave CAN devices - bpf: Add CHECKSUM_COMPLETE to bpf test progs - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf, arm64: Fix off-by-one in check_imm signed range check - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - bpf, devmap: Remove unnecessary if check in for loop - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks - bpf: export bpf_link_inc_not_zero. - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf: fix end-of-list detection in cgroup_storage_get_next_key() - bpf: Fix NULL deref in map_kptr_match_type for scalar regs - bpf: Fix OOB in pcpu_init_value - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf: Fix RCU stall in bpf_fd_array_map_clear() - bpf: Fix regsafe() for pointers to packet - bpf: Fix stack-out-of-bounds write in devmap - bpf: Fix stale offload->prog pointer after constant blinding - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN - bpf: Forget ranges when refining tnum after JSET - bpf: Free reuseport cBPF prog after RCU grace period. - bpf: handle fake register spill to stack with BPF_ST_MEM instruction - bpf: preserve constant zero when doing partial register restore - bpf: preserve STACK_ZERO slots on partial reg spills - bpf: reject direct access to nullable PTR_TO_BUF pointers - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - bpf: Reject sleepable kprobe_multi programs at attach time - bpf: Release module BTF IDR before module unload - bpf: Remove mark_precise_scalar_ids() - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - bpf, sockmap: Fix af_unix iter deadlock - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix FIONREAD for sockmap - bpf, sockmap: Fix incorrect copied_seq calculation - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - bpf, sockmap: Take state lock for af_unix iter - bpf: support non-r10 register spill/fill to/from stack in precision tracking - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpftool: Fix truncated netlink dumps - bpf: track aligned STACK_ZERO cases as imprecise spilled registers - bpf: Track equal scalars history on per-instruction level - bpf: use kvfree() for replaced sysctl write buffer - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path - bpf: verifier improvement in 32bit shift sign extension pattern - bridge: br_nd_send: linearize skb before parsing ND options - bridge: br_nd_send: validate ND option lengths - bridge: mcast: Fix a possible use-after-free when removing a bridge port - btrfs: abort transaction on failure to update root in the received subvol ioctl - btrfs: add raid stripe tree definitions - btrfs: add support for inserting raid stripe extents - btrfs: always fallback to buffered write if the inode requires checksum - btrfs: continue trimming remaining devices on failure - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: do not strictly require dirty metadata threshold for metadata writepages - btrfs: don't take device_list_mutex when querying zone info - btrfs: fix block_group_tree dirty_list corruption - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - btrfs: fix double free in create_space_info() error path - btrfs: fix double free in create_space_info_sub_group() error path - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - btrfs: fix leak of kobject name for sub-group space_info - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: fix NULL dereference on root when tracing inode eviction - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix super block offset in error message in btrfs_validate_super() - btrfs: fix the qgroup data free range for inline data extents - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: handle user interrupt properly in btrfs_trim_fs() - btrfs: log new dentries when logging parent dir of a conflicting inode - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - btrfs: move btrfs_crc32c_final into free-space-cache.c - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: qgroup: return correct error when deleting qgroup relation item - btrfs: read raid stripe tree from disk - btrfs: reject root items with drop_progress and zero drop_level - btrfs: remove btrfs_crc32c wrapper - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() - btrfs: replace BUG() with error handling in __btrfs_balance() - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - Buffer overflow in drivers/xen/sys-hypervisor.c - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - bus: fsl-mc: fix use-after-free in driver_override_show() - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions - bus: omap-ocp2scp: Convert to platform remove callback returning void - bus: omap-ocp2scp: fix OF populate on driver rebind - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - cache: enforce cache groups - can: bcm: fix locking for bcm_op runtime updates - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - can: gs_usb: gs_can_open(): always configure bitrates before starting device - can: gw: fix OOB heap access in cgw_csum_crc8_rel() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - can: mcp251x: add error handling for power enable in open and resume - can: mcp251x: fix deadlock in error path of mcp251x_open - can: raw: fix ro->uniq use-after-free in raw_rcv() - can: statistics: add missing atomic access in hot path - can: ucan: fix devres lifetime - can: ucan: Fix infinite loop from zero-length messages - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - cdc-acm: new quirk for EPSON HMD - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - ceph: fix a buffer leak in __ceph_setxattr() - ceph: fix i_nlink underrun during async unlink - ceph: fix memory leaks in ceph_mdsc_build_path() - ceph: only d_add() negative dentries when they are unhashed - ceph: supply snapshot context in ceph_uninline_data() - ceph: supply snapshot context in ceph_zero_partial_object() - cgroup/cpuset: Reset DL migration state on can_attach() failure - cgroup: fix race between task migration and iteration - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - char: tpm: cr50: Remove IRQF_ONESHOT - checkpatch: add support for Assisted-by tag - cifs: abort open_cached_dir if we don't request leases - cifs: change_conf needs to be called for session setup - cifs: Fix busy dentry used after unmounting - cifs: Fix locking usage for tcon fields - cifs: make default value of retrans as zero - cifs: open files should not hold ref on superblock - cifs: some missing initializations on replay - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: imx: imx8-acm: fix flags for acm clocks - clk: mediatek: Fix error handling in runtime PM setup - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: microchip: core: correct return value on *_get_parent() - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: dispcc-sc7180: Add missing MDSS resets - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - clk: qoriq: avoid format string warning - clk: renesas: rzg2l: Fix intin variable size - clk: renesas: rzg2l: Select correct div round macro - clk: rk808: fix OF node reference imbalance - clk: tegra: tegra124-emc: fix device leak on set_rate() - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - clk: visconti: pll: initialize clk_init_data to zero - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clocksource/drivers/sh_tmu: Always leave device running after probe - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clsact: Fix use-after-free in init/destroy rollback asymmetry - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: dt2815: add hardware detection to prevent crash - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - coresight: etm3x: Fix cpulocked warning on cpuhp - counter: Fix refcount leak in counter_alloc() error path - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - cpufreq: conservative: Reset requested_freq on limits change - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - cpuidle: powerpc: avoid double clear when breaking snooze - cpuidle: Skip governor when only one idle state is available - cpuset: Fix missing adaptation for cpuset_is_populated - crypto: af_alg - Cap AEAD AD length to 0x80000000 - crypto: af-alg - fix NULL pointer dereference in scatterwalk - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - crypto: algif_aead - Fix minimum RX size check for decryption - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel - Remove cfb and ofb - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - reject short ahash digests during instance creation - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: caam - fix DMA corruption on long hmac keys - crypto: caam - fix overflow on long hmac keys - crypto: caam - guard HMAC key hex dumps in hash_digest_key - crypto: cavium - fix dma_free_coherent() size - crypto: ccp - Add an S4 restore flow - crypto: ccp - copy IV using skcipher ivsize - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed - crypto: ccp - Factor out ring destroy handling to a helper - crypto: ccp - Move direct access to some PSP registers out of TEE - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: hisilicon/qm - move the barrier before writing to the mailbox register - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable - crypto: hisilicon/trng - modifying the order of header files - crypto: hisilicon/trng - support tfms sharing the device - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function - crypto: hisilicon/zip - remove zlib and gzip - crypto: hisilicon/zip - support deflate algorithm - crypto: jitterentropy - replace long-held spinlock with mutex - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - crypto: nx - fix context leak in nx842_crypto_free_ctx - crypto: nx - Migrate to scomp API - crypto: octeontx - fix dma_free_coherent() size - crypto: pcrypt - Fix handling of MAY_BACKLOG requests - crypto: qat - fix warning on adf_pfvf_pf_proto.c - crypto: qat - remove unused character device and IOCTLs - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - use swab32 macro - crypto: sa2ul - Fix AEAD fallback algorithm names - crypto: scatterwalk - Backport memcpy_sglist() - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - rename first/last to first_desc/last_desc - crypto: testmgr - Hide ENOENT errors - crypto: testmgr - Hide ENOENT errors better - cxl: Fix premature commit_end increment on decoder commit failure - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - dcache: Limit the minimal number of bucket to two - debugfs: check for NULL pointer in debugfs_create_str() - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - device property: Allow secondary lookup in fwnode_get_next_child_node() - device property: Make modifications of fwnode "flags" thread safe - device property: set fwnode->secondary to NULL in fwnode_init() - dev_printk: add new dev_err_probe() helpers - devres: fix missing node debug info in devm_krealloc() - Disable -Wattribute-alias for clang-23 and newer - dlm: prevent NPD when writing a positive value to event_done - dma-buf: Include ioctl.h in UAPI header - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - dmaengine: idxd: Fix crash when the event log is disabled - dmaengine: idxd: Fix freeing the allocated ida too late - dmaengine: idxd: Fix leaking event log memory - dmaengine: idxd: Fix memory leak when a wq is reset - dmaengine: idxd: Fix not releasing workqueue on .release() - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dma-mapping: add missing `inline` for `dma_free_attrs` - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - dm cache: fix concurrent write failure in passthrough mode - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: fix missing return in invalidate_committed's error path - dm cache: fix null-deref with concurrent writes in passthrough mode - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache metadata: fix memory leak on metadata abort retry - dm cache policy smq: check allocation under invalidate lock - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: support shrinking the origin device - dm: clear cloned request bio pointer when last clone bio completes - dm: don't report warning when doing deferred remove - dm: fix a buffer overflow in ioctl processing - dm init: ensure device probing has finished in dm-mod.waitfor= - dm-integrity: fix a typo in the code for write/discard race - dm-integrity: fix recalculation in bitmap mode - dm log: fix out-of-bounds write due to region_count overflow - dm mirror: fix integer overflow in create_dirty_log() - dm mpath: make pg_init_delay_msecs settable - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - dm-thin: fix metadata refcount underflow - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm: use bio_clone_blkg_association - dm-verity: correctly handle dm_bufio_client_create() failure - dm-verity: disable recursive forward error correction - dm-verity-fec: correctly reject too-small FEC devices - dm-verity-fec: correctly reject too-small hash devices - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - docs: fix WARNING document not included in any toctree - Documentation: fix a hugetlbfs reservation statement - Documentation: ioctl-number: Extend "Include File" column width - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - Documentation: trace: Refactor toctree - Documentation: tracing: Add PCI tracepoint documentation - Documentation: tracing: Add ring-buffer mapping - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2-switch: do not clear any interrupts automatically - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - drbd: Balance RCU calls in drbd_adm_dump_devices() - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - drbd: fix null-pointer dereference on local read error - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value - driver core: Don't let a device probe until it's ready - driver core: generalize driver_override in struct device - driver core: platform: use generic driver_override infrastructure - driver core: reject devices with unregistered buses - drivers/base/memory: fix memory block reference leak in poison accounting - drivers/base/memory: set mem->altmap after successful device registration - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - drivers: iio: mpu3050: use dev_err_probe for regulator request - drm: Account property blob allocations to memcg - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - drm/amd/display: Allow DCE link encoder without AUX registers - drm/amd/display: Avoid updating surface with the same surface under MPO - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - drm/amd/display: Do not skip unrelated mode changes in DSC validation - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - drm/amd/display: Fix integer overflow in bios_get_image() - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - drm/amd/display: Remove conditional for shaper 3DLUT power-on - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amd: Drop special case for yellow carp without discovery - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() - drm/amdgpu: Add basic validation for RAS header - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdgpu: Add default case in DVI mode validation - drm/amdgpu: Add HAINAN clock adjustment - drm/amdgpu: add support for HDP IP version 6.1.1 - drm/amdgpu: Adjust usleep_range in fence wait - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - drm/amdgpu: fix spelling typos - drm/amdgpu: Fix use-after-free race in VM acquire - drm/amdgpu: fix zero-size GDS range init on RDNA4 - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu/gmc9.0: add bounds checking for cid - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn3: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu: zero-initialize GART table on allocation - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix debug watchpoints for logical devices - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - drm/amdkfd: fix NULL dereference in get_queue_ids() - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2) - drm/amd: Set num IP blocks to 0 if discovery fails - drm/arcpgu: fix device node leak - drm/ast: dp501: Fix initialization of SCU2C - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - drm/bridge: it66121: acquire reset GPIO in probe - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: samsung-dsim: Fix memory leak in error path - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/display/dp_mst: Add protection against 0 vcpi - drm/dp: Add eDP 1.5 bit definition - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup - drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/hyperv: validate resolution_count and fix WIN8 fallback - drm/hyperv: validate VMBus packet size in receive callback - drm/i915/acpi: free _DSM package when no connectors - drm/i915: Constify watermark state checker - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Fix potential overflow of shmem scatterlist length - drm/i915: Fix potential UAF in TTM object purge - drm/i915/gem: Fix phys BO pread/pwrite with offset - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - drm/i915/gt: Check set_default_submission() before deferencing - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/i915/psr: Do not use pipe_src as borders for SU area - drm/i915/psr: Read Intel DPCD workaround register - drm/i915: Simplify watermark state checker calling convention - drm/i915: skip __i915_request_skip() for already signaled requests - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - drm/i915/wm: Verify the correct plane DDB entry - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - drm/ioc32: stop speculation on the drm_compat_ioctl path - drm/komeda: fix integer overflow in AFBC framebuffer size check - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() - drm/msm/a2xx: fix pixel shader start on A225 - drm/msm/a6xx: Fix HLSQ register dumping - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - drm/msm/dpu: fix mismatch between power and frequency - drm/msm/dsi: add the missing parameter description - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - drm/msm/dsi: don't dump registers past the mapped region - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm: Fix dma_free_attrs() buffer size - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/shrinker: Fix can_block() logic - drm/msm/snapshot: fix dumping of the unaligned regions - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/radeon: Add HAINAN clock adjustment - drm/radeon: add missing revision check for CI - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm: Remove plane hsub/vsub alignment requirement for core helpers - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - drm/solomon: Fix page start when updating rectangle in page addressing mode - drm/ssd130x: Replace .page_height field in device info with a constant - drm/ssd130x: Store the HW buffer in the driver-private CRTC state - drm/ssd130x: Use bool for ssd130x_deviceinfo flags - drm/sun4i: backend: fix error pointer dereference - drm/sun4i: Fix resource leaks - drm/sysfb: ofdrm: fix PCI device reference leaks - drm/tegra: dsi: fix device leak on probe - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used - drm/v3d: Reject empty multisync extension to prevent infinite loop - drm/v3d: Set DMA segment size to avoid debug warnings - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: fix krealloc() memory leak - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: platform_get_irq_byname() returns an int - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Release runtime PM reference after binding V3D - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - drm/virtio: Fix driver removal with disabled KMS - drm/virtio: use uninterruptible resv lock for plane updates - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - dt-bindings: connector: add pd-disable dependency - dt-bindings: gpio: fix microchip #interrupt-cells - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - dt-bindings: net: Fix Tegra234 MGBE PTP clock - e1000: check return value of e1000_read_eeprom - e1000/e1000e: Fix leak in DMA error cleanup - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - e1000e: Unroll PTP in probe error handling - EDAC/altera: Remove IRQF_ONESHOT - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/mc: Fix error path ordering in edac_mc_alloc() - efi: Allocate runtime workqueue before ACPI init - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - EFI/CPER: don't dump the entire memory region - EFI/CPER: don't go past the ARM processor CPER record buffer - efi: Fix reservation of unaccepted memory table - erofs: add GFP_NOIO in the bio completion if needed - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - erofs: fix the out-of-bounds nameoff handling for trailing dirents - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() - err.h: use __always_inline on all error pointer helpers - esp: fix skb leak with espintcp and async crypto - eth: bnxt: always recalculate features after XDP clearing, fix null-deref - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - eventfs: Hold eventfs_mutex and SRCU when remount walks events - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - eventpoll: defer struct eventpoll free to RCU grace period - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: Fix integer overflow in ep_loop_check_proc() - eventpoll: kill __ep_remove() - eventpoll: move epi_fget() up - eventpoll: rename ep_remove_safe() back to ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - exfat: fix potential use-after-free in exfat_find_dir_entry() - exit: prevent preemption of oopsing TASK_DEAD task - exit: Sleep at TASK_IDLE when waiting for application core dump - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - ext4: always allocate blocks only from groups inode can use - ext4: always drain queued discard work in ext4_mb_release() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: avoid infinite loops caused by residual data - ext4: convert bd_bitmap_page to bd_bitmap_folio - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert inline data to extents when truncate exceeds inline size - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - ext4: don't cache extent during splitting extent - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: drop extent cache when splitting extent fails - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - ext4: fix dirtyclusters double decrement on fs shutdown - ext4: fix e4b bitmap inconsistency reports - ext4: fix fsync(2) for nojournal mode - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix journal credit check when setting fscrypt context - ext4: fix memory leak in ext4_ext_shift_extents() - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix stale xarray tags after writeback - ext4: fix the might_sleep() warnings in kvfree() - ext4: fix use-after-free in update_super_work when racing with umount - ext4: get rid of ppath in ext4_convert_unwritten_extents_endio() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in ext4_find_extent() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_split_extent_at() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: mark group add fast-commit ineligible - ext4: mark group extend fast-commit ineligible - ext4: move ext4_percpu_param_init() before ext4_mb_init() - ext4: publish jinode after initialization - ext4: reject mount if bigalloc with s_first_data_block != 0 - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio - ext4: subdivide EXT4_EXT_DATA_VALID1 - ext4: use optimized mballoc scanning regardless of inode format - ext4: validate p_idx bounds in ext4_ext_correct_indexes - extcon: ptn5150: handle pending IRQ events during system resume - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: fix incorrect file address mapping when inline inode is unwritten - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix out-of-bounds access in sysfs attribute read/write - f2fs: fix to add gc count stat in f2fs_gc_range - f2fs: fix to avoid mapping wrong physical block for swapfile - f2fs: fix to avoid memory leak in f2fs_rename() - f2fs: fix to avoid migrating empty section - f2fs: fix to avoid UAF in f2fs_write_end_io() - f2fs: fix to detect potential corrupted nid in free_nid_list - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - f2fs: fix to round down start offset of fallocate for pin file - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - f2fs: fix zoned block device information initialization - f2fs: keep atomic write retry from zeroing original data - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: validate compress cache inode only when enabled - f2fs: zone: fix to avoid inconsistence in between SIT and SSA - fanotify: fix false positive on permission events - fat: avoid parent link count underflow in rmdir - fbcon: Avoid OOB font access if console rotation fails - fbcon: check return value of con2fb_acquire_newinfo() - fbcon: Remove struct fbcon_display.inverse - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - fbdev: fix use-after-free in store_modes() - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: offb: fix PCI device reference leak on probe failure - fbdev: rivafb: fix divide error in nv3_arb() - fbdev: smscufx: properly copy ioctl memory to kernelspace - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - file: add fput() cleanup helper - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_scpi: Fix device_node reference leak in probe path - firmware: dmi: Correct an indexing error in dmi.h - firmware: google: framebuffer: Do not mark framebuffer as busy - firmware: google: framebuffer: Do not unregister platform device - fix it87_wdt early reboot by reporting running timer - flow_dissector: do not dissect PPPoE PFC frames - fork: defer linking file vma until vma is fully initialized - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - fpga: of-fpga-region: Fail if any bridge is missing - fpga: region: fix use-after-free in child_regions_with_firmware() - fs: add for 'init_fs' - fs/adfs: validate nzones in adfs_validate_bblk() - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - fs/nfs: Fix readdir slow-start regression - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs: ntfs3: check return value of indx_find to avoid infinite loop - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - fs/ntfs3: validate rec->used in journal-replay file record check - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - fs: prepare for adding LSM blob to backing_file - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Update the mcount_loc check of skipped entries - fuse: Check for large folio with SPLICE_F_MOVE - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fuse: quiet down complaints in fuse_conn_limit_write - fuse: reject fuse_notify() pagecache ops on directories - fuse: reject oversized dirents in page cache - fuse: re-lock request before replacing page cache folio - futex: Clear stale exiting pointer in futex_lock_pi() retry path - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - genetlink: Use internal flags for multicast groups - gfs2: Add metapath_dibh helper - gfs2: add some missing log locking - gfs2: Call unlock_new_inode before d_instantiate - gfs2: fiemap page fault fix - gfs2: Fix unlikely race in gdlm_put_lock - gfs2: fix use-after-free in gfs2_qd_dealloc - gfs2: Fix use-after-free in iomap inline data write path - gfs2: Improve gfs2_consist_inode() usage - gfs2: prevent NULL pointer dereference during unmount - gfs2: Retries missing in gfs2_{rename,exchange} - gfs2: Validate i_depth for exhash directories - gpio: aspeed-sgpio: Change the macro to support deferred probe - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: acpi: Fix gpio count with string references - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - gpio: mvebu: fix NULL pointer dereference in suspend/resume - gpio: mxc: fix irq_high handling - gpio: mxc: map Both Edge pad wakeup to Rising Edge - gpio: of: clear OF_POPULATED on hog nodes in remove path - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - gpio: sprd: Change sprd_gpio lock to raw_spin_lock - gpio: tegra: fix irq_release_resources calling enable instead of disable - gro: change the BUG_ON() in gro_pull_from_frag0() - gve: defer interrupt enabling until NAPI registration - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - hdlc_ppp: sync per-proto timers before freeing hdlc state - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - hfsplus: fix volume corruption issue for generic/498 - hfsplus: pretend special inodes as regular files - hfsplus: return error when node already exists in hfs_bnode_create - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - HID: alps: fix NULL pointer dereference in alps_raw_event() - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - HID: apple: avoid memory leak in apple_report_fixup() - HID: asus: add xg mobile 2023 external hardware support - HID: asus: avoid memory leak in asus_report_fixup() - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - HID: core: Add printk_ratelimited variants to hid_warn() etc - HID: core: clamp report_size in s32ton() to avoid undefined shift - HID: core: Fix size_t specifier in hid_report_raw_event() - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: hid-pl: handle probe errors - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() - HID: magicmouse: Do not crash on missing msc->input - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - HID: mcp2221: cancel last I2C command on read error - HID: multitouch: add eGalaxTouch EXC3188 support - HID: multitouch: Check to ensure report responses match the request - HID: pass the buffer size to hid_report_raw_event - HID: playstation: Add missing check for input_ff_create_memless - HID: playstation: Clamp num_touch_reports - HID: prodikeys: Check presence of pm->input_ep82 - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - HID: quirks: really enable the intended work around for appledisplay - HID: roccat: fix use-after-free in roccat_report_event - HID: uclogic: Fix regression of input name assignment - HID: usbhid: fix deadlock in hid_post_reset() - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - hisi_acc_vfio_pci: update status after RAS error - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimer: Fix trace oddity - hrtimer: Reduce trace noise in hrtimer_start() - hrtimers: Update the return type of enqueue_hrtimer() - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - hv_sock: fix ARM64 support - hv: utils: handle and propagate errors in kvp_register - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - hwmon: (aht10) Add support for dht20 - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (axi-fan-control) Make use of dev_err_probe() - hwmon: (axi-fan-control) Use device firmware agnostic API - hwmon: axi-fan: don't use driver_override as IRQ name - hwmon: (corsair-psu) Close HID device on probe errors - hwmon: (f71882fg) Add F81968 support - hwmon: (it87) Check the it87_lock() return value - hwmon: (ltc2992) Clamp threshold writes to hardware range - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - hwmon: (occ) Fix division by zero in occ_show_power_1() - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - hwmon: (pmbus/core) Protect regulator operations with mutex - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - hwmon: (pxe1610) Check return value of page-select write in probe - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - i2c: s3c24xx: check the size of the SMBUS message before using it - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: stub: Reject I2C block transfers with invalid length - i2c: tegra: Don't mark devices with pins as IRQ safe - i2c: tegra: Fix NOIRQ suspend/resume - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - i3c: dw: Initialize spinlock to avoid upsetting lockdep - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - i3c: master: Update hot-join flag only on success - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - i3c: Move device name assignment after i3c_bus_init - i40e: Cleanup PTP pins on probe failure - i40e: don't advertise IFF_SUPP_NOFCS - i40e: Fix preempt count leak in napi poll tracepoint - i40e: fix registering XDP RxQ info - i40e: fix src IP mask checks and memcpy argument names in cloud filter - i40e: use xdp.frame_sz as XDP RxQ info frag_size - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: fix VLAN filter lost on add/delete race - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - iavf: stop removing VLAN filters from PF on interface down - iavf: wait for PF confirmation before removing VLAN filters - IB/cache: update gid cache on client reregister event - IB/core: Fix zero dmac race in neighbor resolution - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - ibmveth: Disable GSO for packets with small MSS - ice: fix double-free of tx_buf skb - ice: fix locking in ice_dcb_rebuild() - ice: Fix memory leak in ice_set_ringparam() - ice: fix NULL pointer dereference in ice_reset_all_vfs() - ice: fix retry for AQ command 0x06EE - ice: fix setting promisc mode while adding VID filter - ice: fix VF queue configuration with low MTU values - ice: reintroduce retry mechanism for indirect AQ - ice: Remove jumbo_remove step from TX path - ice: use ice_update_eth_stats() for representor stats - icmp: fix NULL pointer dereference in icmp_tag_validation() - icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns - icmp: move icmp_global.credit and icmp_global.stamp to per netns storage - icmp: prevent possible overflow in icmp_global_allow() - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - igc: fix missing update of skb->tail in igc_xmit_frame() - iio: accel: fix ADXL355 temperature signature value - iio: adc: ad7768-1: fix one-shot mode data acquisition - iio: adc: npcm: Convert to platform remove callback returning void - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: ti-adc161s626: fix buffer read on big-endian - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - iio: buffer: Fix wait_queue not being removed - iio: buffer: hw-consumer: fix use-after-free in error path - iio: chemical: bme680: Fix measurement wait duration calculation - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: common: st_sensors: Fix use of uninitialize device structs - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: ad5686: fix ref bit initialization for single-channel parts - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: dac: ds4424: reject -128 RAW value - iio: dac: max5821: fix return value check in powerdown sync - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: gyro: adis16260: fix division by zero in write_raw - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: gyro: itg3200: Fix unchecked return value in read_raw - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - iio: imu: inv_icm42600: fix odr switch to the same value - iio: imu: inv_icm42600: fix odr switch when turning buffer off - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: light: bh1780: fix PM runtime leak on error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: light: vcnl4035: fix scan buffer on big-endian - iio: magnetometer: Remove IRQF_ONESHOT - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: pressure: mprls0025pa: fix scan_type struct - iio: sca3000: Fix a resource leak in sca3000_probe() - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: temperature: tsys01: fix broken PROM checksum validation - iio: Use IRQF_NO_THREAD - ima: check return value of crypto_shash_final() in boot aggregate - ima: verify the previous kernel's IMA buffer lies in addressable RAM - include: uapi: netfilter_bridge.h: Cover for musl libc - indirect_call_wrapper: do not reevaluate function pointer - inet: add indirect call wrapper for getfrag() calls - inet: frags: add inet_frag_queue_flush() - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: move icmp_global_{credit,stamp} to a separate cache line - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: elan_i2c - validate firmware size before use - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: synaptics-rmi4 - fix a locking bug in an error path - Input: uinput - fix circular locking dependency with ff-core - Input: uinput - take event lock when submitting FF request "event" - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - Input: xpad - add "Nova 2 Lite" from GameSir - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - fix out-of-bounds access for Share button - iomap: allocate s_dio_done_wq for async reads as well - iomap: don't revert iov_iter on partially completed buffered writes - iomap: fix submission side handling of completion side errors - iomap: reject delalloc mappings during writeback - iommu/amd: move wait_on_sem() out of spinlock - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - iommu/amd: Use atomic64_inc_return() in iommu.c - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - iommufd: Fix a race with concurrent allocation and unmap - iommufd: vfio compatibility extension check for noiommu mode - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - iommu/vt-d: Flush cache for PASID table before using it - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - ionic: fix persistent MAC address override on PF - ionic: Rate limit unknown xcvr type messages - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - io_uring/filetable: clamp alloc_hint to the configured alloc range - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix multishot recv missing EOF on wakeup race - io_uring/poll: fix signed comparison in io_poll_get_ownership() - io_uring/sync: validate passed in offset - io_uring/timeout: check unused sqe fields - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ip6_gre: Use cached t->net in ip6erspan_changelink(). - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - ip6_vti: set netns_immutable on the fallback device. - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipc: don't audit capability check in ipc_permissions() - ipc: limit next_id allocation to the valid ID range - ipc/shm: serialize orphan cleanup with shm_nattch updates - ipmi: Add limits to event and receive message requests - ipmi: Check event message buffer response for bad data - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ipmi: ipmb: initialise event handler read bytes - ipmi:si: Return state to normal if message allocation fails - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - ipmi:ssif: Clean up kthread on errors - ipmi:ssif: Fix a shutdown race - ipmi:ssif: NULL thread on error - ipmi:ssif: Remove unnecessary indention - ipv4: account for fraggap on the paged allocation path - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: fib: Annotate access to struct fib_alias.fa_state. - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - ipv4: icmp: fix null-ptr-deref in icmp_build_probe() - ipv4: icmp: validate reply type before using icmp_pointers - ipv4: igmp: annotate data-races around idev->mr_maxdelay - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - ipv6: account for fraggap on the paged allocation path - ipv6: add NULL checks for idev in SRv6 paths - ipv6/addrconf: annotate data-races around devconf fields (II) - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - ipv6: avoid overflows in ip6_datagram_send_ctl() - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: exthdrs: refresh nh after handling HAO option - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - ipv6: Fix a potential NPD in cleanup_prefix_route() - ipv6: fix a race in ip6_sock_set_v6only() - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - ipv6: Fix out-of-bound access in fib6_add_rt2node(). - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - ipv6: fix possible UAF in icmpv6_rcv() - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() - ipv6: mcast: Fix use-after-free when processing MLD queries - ipv6: prevent possible UaF in addrconf_permanent_addr() - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - ipv6: sit: reload inner IPv6 header after GSO offloads - ipv6: use RCU in ip6_xmit() - ipv6: validate extension header length before copying to cmsg - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - ipvs: clear the svc scheduler ptr early on edit - ipvs: fix MTU check for GSO packets in tunnel mode - ipvs: fix NULL deref in ip_vs_add_service error path - ipvs: skip ipv6 extension headers for csum checks - irqchip/ath79-cpu: Remove unused function - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - ixgbevf: add missing negotiate_features op to Hyper-V ops table - ixgbevf: fix link setup issue - ixgbevf: fix use-after-free in VEPA multicast source pruning - jbd2: gracefully abort on checkpointing state corruptions - jfs: Add missing set_freezable() for freezable kthread - jfs: nlink overflow in jfs_rename - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - kbuild: Add objtool to top-level clean target - kbuild: Leave objtool binary around with 'make clean' - kexec: derive purgatory entry from symbol - KEYS: fix overflow in keyctl_pkey_params_get_2() - keys: Pin request_key_auth payload in instantiate paths - kprobes: avoid crash when rmmod/insmod after ftrace killed - kprobes: Remove unneeded goto - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - ksmbd: add durable scavenger timer - ksmbd: add support for supplementary groups - ksmbd: avoid reclaiming expired durable opens by the client - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: Compare MACs in constant time - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - ksmbd: do not expire session on binding failure - ksmbd: Don't log keys in SMB3 signing and encryption key generation - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - ksmbd: fix null pointer dereference in compare_guid_key() - ksmbd: fix OOB write in QUERY_INFO for compound requests - ksmbd: fix out-of-bounds read in smb_check_perm_dacl() - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - ksmbd: fix use-after-free by using call_rcu() for oplock_info - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - ksmbd: fix use-after-free of share_conf in compound request - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops - ksmbd: reject non-VALID session in compound request branch - ksmbd: replace connection list with hash table - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: require minimum ACE size in smb_check_perm_dacl() - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: unset conn->binding on failed binding request - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: use msleep instaed of schedule_timeout_interruptible() - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: validate EaNameLength in smb2_get_ea() - ksmbd: validate inherited ACE SID length - ksmbd: validate owner of durable handle on reconnect - ksmbd: validate response sizes in ipc_validate_msg() - ktest: Avoid undef warning when WARNINGS_FILE is unset - ktest: Fix the month in the name of the failure directory - ktest: Honor empty per-test option overrides - ktest: Run POST_KTEST hooks on failure and cancellation - kunit: config: Enable KUNIT_DEBUGFS by default - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: tool: copy caller args in run_kernel to prevent mutation - KVM: arm64: Discard PC update state on vcpu reset - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: PMU: Preserve AArch32 counter low bits - KVM: arm64: Remove VPIPT I-cache handling - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION - KVM: SVM: Add a helper to look up the max physical ID for AVIC - KVM: SVM: check validity of VMCB controls when returning from SMM - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated - KVM: VMX: Update SVI during runtime APICv activation - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - KVM: x86: Fix KVM_GET_MSRS stack info leak - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - KVM: x86: Fix shadow paging use-after-free due to unexpected role - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs - KVM: x86: Use scratch field in MMIO fragment to hold small write values - KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - l2tp: Drop large packets with UDP encap - landlock: Fix handling of disconnected directories - leds: lgm-sso: Remove duplicate assignments for priv->mmap - leds: qcom-lpg: Check for array overflow when selecting the high resolution - leds: qcom-lpg: Check the return value of regmap_bulk_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: check xbc_init_node() return in override path - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - libbpf: Fix OOB read in btf_dump_get_bitfield_value - libbpf: Fix -Wdiscarded-qualifiers under C23 - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: define and enforce CEPH_MAX_KEY_LEN - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential out-of-bounds access in osdmap_decode() - libceph: Fix slab-out-of-bounds access in auth message processing - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - libceph: prevent potential out-of-bounds reads in process_message_header() - libceph: reject preamble if control segment is empty - libceph: Use u32 for non-negative values in ceph_monmap_decode() - lib/crypto: chacha: Zeroize permuted_state before it leaves scope - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - lib/scatterlist: fix length calculations in extract_kvec_to_sg - lib/scatterlist: fix temp buffer in extract_user_to_sg() - libsubcmd: Fix null intersection case in exclude_cmds() - lib: test_hmm: evict device pages on file close to avoid use-after-free - lib/ts_kmp: fix integer overflow in pattern length calculation - locking: Fix rwlock support in - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - LoongArch: Add spectre boundry for syscall dispatch table - LoongArch: Add WriteCombine shadow mapping in KASAN - LoongArch: Add writecombine support for DMW-based ioremap() - LoongArch: Disable instrumentation for setup_ptwalker() - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - LoongArch: Give more information if kmem access failed - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE - LoongArch: Prefer top-down allocation after arch_mem_init() - LoongArch: Remove unused code to avoid build warning - LoongArch: Rework KASAN initialization for PTW-enabled systems - LoongArch: Show CPU vulnerabilites correctly - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: vDSO: Emit GNU_EH_FRAME correctly - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - loop: fix partition scan race between udev and loop_reread_partitions() - lsm: add backing_file LSM hooks - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - mac802154: llsec: add skb_cow_data() before in-place crypto - macsec: fix replay protection at XPN lower-PN wrap - macvlan: annotate data-races around port->bc_queue_len_used - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - mailbox: add sanity check for channel array - mailbox: Allow controller specific mapping using fwnode - mailbox: bcm-ferxrm-mailbox: Use default primary handler - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: mailbox-test: don't free the reused channel - mailbox: mailbox-test: free channels on probe error - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: sprd: clear delivery flag before handling TX done - mailbox: sprd: mask interrupts that are not handled - mailbox: Use dev_err when there is error - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use of_property_match_string() instead of open-coding - mctp: i2c: fix skb memory leak in receive path - mctp i2c: initialise event handler read bytes - mctp: route: hold key->lock in mctp_flow_prepare_output() - md/bitmap: fix GPF in write_page caused by resize race - md-cluster: fix NULL pointer dereference in process_metadata_update - md/raid10: fix any_working flag handling in raid10_sync_request - md/raid10: fix deadlock with check operation and nowait requests - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - md/raid1: fix data lost for writemostly rdev - md/raid1,raid10: don't ignore IO flags - md/raid5: fix soft lockup in retry_aligned_read() - md/raid5: validate payload size before accessing journal metadata - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - media: amphion: Fix race between m2m job_abort and device_run - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - media: ccs: Accommodate C-PHY into the calculation - media: ccs: Avoid possible division by zero - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: dvb-core: dmxdevfilter must always flush bufs - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - media: dvb-net: fix OOB access in ULE extension header tables - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - media: i2c: imx412: Assert reset GPIO during probe - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix digital gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c: ov08d10: fix image vertical start setting - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Initialize subdev before controls - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex - media: mediatek: encoder: Fix uninitialized scalar variable issue - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: mediatek: vcodec: fix use-after-free in encoder release path - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - media: omap3isp: drop the use count of v4l2 pipeline - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - media: omap3isp: set initial format - media: pci: zoran: fix potential memory leak in zoran_probe() - media: pvrusb2: fix URB leak in pvr2_send_request_ex - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: radio-keene: fix memory leak in error path - media: rc: fix race between unregister and urb/irq callbacks - media: rc: igorplugusb: fix control request setup packet - media: rc: igorplugusb: heed coherency rules - media: rc: streamzap: Error handling in probe - media: rc: ttusbir: fix inverted error logic - media: rc: ttusbir: respect DMA coherency rules - media: rc: xbox_remote: heed DMA restrictions - media: rkisp1: Fix filter mode register configuration - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - media: saa7164: add ioremap return checks and cleanups - media: solo6x10: Check for out of bounds chip_id - media: staging: imx: request mbus_config in csi_start - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - media: uvcvideo: Enable VB2_DMABUF for metadata stream - media: uvcvideo: Fix allocation for small frame sizes - media: v4l2-async: Fix error handling on steps after finding a match - media: venus: vdec: fix error state assignment for zero bytesused - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: verisilicon: AV1: Fix enable cdef computation - media: verisilicon: AV1: Fix tile info buffer size - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Set IDR flag for intra_only frame type - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - media: vidtv: fix nfeeds state corruption on start_streaming failure - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - media: vidtv: fix pass-by-value structs causing MSAN warnings - memfd: deny writeable mappings when implying SEAL_WRITE - memory: mtk-smi: Convert to platform remove callback returning void - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: tegra124-emc: Fix dll_change check - memory: tegra30-emc: Fix dll_change check - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - mfd: core: Add locking around 'mfd_of_node_list' - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - mfd: wm8350-core: Use IRQF_ONESHOT - minix: Add required sanity checking to minix_check_superblock() - MIPS: Always record SEGBITS in cpu_data.vmbits - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - MIPS: Fix the GCC version check for `__multi3' workaround - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - mips: mm: Allocate tlb_vpn array atomically - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - mips: ralink: update CPU clock index - MIPS: rb532: Fix MMIO UART resource registration - MIPS: Work around LLVM bug when gp is used as global register variable - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: possible double-free of cctx->remote_heap - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mmc: block: use single block write in retry - mmc: core: Avoid bitfield RMW for claim/retune flags - mmc: core: Fix host controller programming for fixed driver type - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - mmc: vub300: fix NULL-deref on disconnect - mm/damon/core: disallow time-quota setting zero esz - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: use time_in_range_open() for damos quota window start - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/ops-common: call folio_test_lru() after folio_get() - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() - mm/highmem: fix __kmap_to_page() build error - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - mm/huge_memory: update file PMD counter before folio_put() - mm/hugetlb: avoid false positive lockdep assertion - mm/hugetlb_cma: round up per_node before logging it - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb() - mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb() - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - mm/kasan: fix double free for kasan pXds - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mm/kfence: fix KASAN hardware tag faults during late enablement - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - mm/mempolicy: fix wrong mmap_read_unlock() in migrate_to_node() - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - mm/page_alloc: clear page->private in free_pages_prepare() - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - mm/tracing: rss_stat: ensure curr is false from kthread context - modpost: Amend ppc64 save/restfpr symnames for -Os build - module: add helper function for reading module_buildid() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - module: Fix kernel panic when a symbol st_shndx is out of bounds - mpls: add missing unregister_netdevice_notifier to mpls_init - mptcp: add-addr: always drop other suboptions - mptcp: allow subflow rcv wnd to shrink - mptcp: cleanup fallback dummy mapping generation - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: do not drop partial packets - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - mptcp: fastclose msk when linger time is 0 - MPTCP: fix lock class name family in pm_nl_create_listen_socket - mptcp: fix missing wakeups in edge scenarios - mptcp: fix receive space timestamp initialization - mptcp: fix retransmission loop when csum is enabled - mptcp: fix rx timestamp corruption on fastopen - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: fix slab-use-after-free in __inet_lookup_established - mptcp: handle first subflow closing consistently - mptcp: introduce the mptcp_init_skb helper - mptcp: pm: ADD_ADDR rtx: allow ID 0 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: fix potential data-race - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: avoid sending RM_ADDR over same subflow - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation - mptcp: pm: in-kernel: always mark signal+subflow endp as used - mptcp: pm: in-kernel: always set ID as avail when rm endp - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: reset rcv wnd on disconnect - mptcp: sockopt: check timestamping ret value - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: sync the msk->sndbuf at accept() time - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use plain bool instead of custom binary enum - mtd: Avoid boot crash in RedBoot partition table parser - mtd: docg3: Convert to platform remove callback returning void - mtd: docg3: fix use-after-free in docg3_release() - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - mtd: physmap_of_gemini: Fix disabled pinctrl state check - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - mtd: rawnand: pl353: Fix software ECC support - mtd: rawnand: pl353: make sure optimal timings are applied - mtd: rawnand: serialize lock/unlock against other NAND operations - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: spinand: Fix kernel doc - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - mtd: spi-nor: sst: Fix SST write failure - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - myri10ge: avoid uninitialized variable use - neighbour: add RCU protection to neigh_tables[] - neigh: let neigh_xmit take skb ownership - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - net: add proper RCU protection to /proc/net/ptype - net: Add skb_dstref_steal and skb_dstref_restore - net: add support for segmenting TCP fraglist GSO packets - net: af_key: zero aligned sockaddr tail in PF_KEY exports - net: ag71xx: check error for platform_get_irq - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - net: annotate data-races around sk->sk_{data_ready,write_space} - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: fix leaking free_bds - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - net: bcmgenet: fix racing timeout handler - net: bcmgenet: increase WoL poll timeout - net: bcmgenet: Initialize u64 stats seq counter - net: bcmgenet: keep RBUF EEE/PM disabled - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: switch to use 64bit statistics - net: bonding: add broadcast_neighbor option for 802.3ad - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - net: bonding: fix NULL deref in bond_debug_rlb_hash_show - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - net: bonding: fix use-after-free in bond_xmit_broadcast() - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: bridge: Flush multicast groups when snooping is disabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net: bridge: use a stable FDB dst snapshot in RCU readers - net: caif: clear client service pointer on teardown - netconsole: avoid out-of-bounds access on empty string in trim_newline() - netconsole: propagate device name truncation in dev_name_store() - net: consume xmit errors of GSO frames - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - netdevsim: zero initialize struct iphdr in dummy sk_buff - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: dsa: microchip: Fix error path in PTP IRQ setup - net: dsa: mt7530: fix FDB entries not aging out with short timeout - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: properly keep track of conduit reference - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - net: enetc: fix the output issue of 'ethtool --show-ring' - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - net: ethernet: xscale: Check for PTP support properly - net: fec: fix pinctrl default state restore order on resume - net: fec: fix the PTP periodic output sysfs interface - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: bpf: defer hook memory release until rcu readers are done - netfilter: bridge: make ebt_snat ARP rewrite writable - netfilter: conntrack: add missing netlink policy validations - netfilter: conntrack_irc: fix possible out-of-bounds read - netfilter: conntrack: remove sprintf usage - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - netfilter: ctnetlink: ensure safe access to master conntrack - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() - netfilter: ctnetlink: ignore explicit helper on new expectations - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: ctnetlink: use netlink policy range checks - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: flowtable: strictly check for maximum number of actions - netfilter: ip6t_eui64: reject invalid MAC header for all packets - netfilter: ip6t_hbh: reject oversized option lists - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() - netfilter: ipset: drop logically empty buckets in mtype_del - netfilter: ipset: stop hash:* range iteration at end - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: nf_conncount: fix tracking of connections from localhost - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - netfilter: nf_conntrack_expect: honor expectation helper field - netfilter: nf_conntrack_expect: skip expectations in other netns via proc - netfilter: nf_conntrack_expect: store netns and zone in expectation - netfilter: nf_conntrack_expect: use expect->helper - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case - netfilter: nf_conntrack_helper: pass helper to expect cleanup - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp - netfilter: nf_conntrack_sip: get helper before allocating expectation - netfilter: nf_log: validate MAC header was set before dumping it - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_log: account for netlink header size - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: nf_tables: always walk all pending catchall elements - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - netfilter: nf_tables: reject immediate NF_QUEUE verdict - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: nf_tables: reset table validation state on abort - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_ct: add seqadj extension for natted connections - netfilter: nft_ct: bail out on template ct in get eval - netfilter: nft_ct: drop pending enqueued packets on removal - netfilter: nft_ct: fix missing expect put in obj eval - netfilter: nft_ct: fix use-after-free in timeout object destroy - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: nft_inner: Fix IPv6 inner_thoff desync - netfilter: nft_osf: restrict it to ipv4 - netfilter: nft_set_hash: fix get operation on big endian - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_tunnel: fix use-after-free on object destroy - netfilter: reject zero shift in nft_bitwise - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: skip recording stale or retransmitted INIT - netfilter: synproxy: add mutex to guard hook reference counting - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: x_tables: ensure names are nul-terminated - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: xtables: restrict several matches to inet family - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - netfilter: x_tables: unregister the templates first - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - netfilter: xt_multiport: validate range encoding in checkentry - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - netfilter: xt_policy: fix strict mode inbound policy matching - netfilter: xt_socket: enable defrag after all other checks - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: xt_time: use unsigned int for monthday bit shift - net: fix fanout UAF in packet_release() via NETDEV_UP race - net: Fix icmp host relookup triggering ip_rt_bug - net: fix segmentation of forwarding fraglist GRO - netfs: fix error handling in netfs_extract_user_iter() - netfs: Fix overrun check in netfs_extract_user_iter() - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net: ftgmac100: fix ring allocation unwind on open failure - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - net: gro: don't merge zcopy skbs - net: gso: fix tcp fraglist segmentation after pull from frag_list - net: guard timestamp cmsgs to real error queue skbs - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix double free issue for tx spare buffer - net: hsr: defer node table free until after RCU readers - net: hsr: fix potential OOB access in supervision frame handling - net: hsr: fix VLAN add unwind on slave errors - net: ifb: report ethtool stats over num_tx_queues - net: intel: fix PCI device ID conflict between i40e and ipw2200 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: fix event ring index not programmed for IPA v5.0+ - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - net: ipv4: stop checking crypto_ahash_alignmask - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: ipv6: flowlabel: defer exclusive option free until RCU teardown - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak - net: ipv6: stop checking crypto_ahash_alignmask - net/iucv: fix locking in .getsockopt - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - netlabel: validate unlabeled address and mask attribute lengths - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: lan966x: avoid unregistering netdev on register failure - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - net: libwx: fix VF illegal register access - net: macb: fix clk handling on PCI glue driver removal - net: macb: Fix tx/rx malfunction after phy link down and up - net: macb: fix uninitialized rx_fs_lock - net: macb: fix use-after-free access to PTP clock - net: macb: Introduce gem_init_rx_ring() - net: macb: Move devm_{free,request}_irq() out of spin lock area - net: macb: properly unregister fixed rate clocks - net: macb: queue tie-off or disable during WOL suspend - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume - net: macb: Shuffle the tx ring before enabling tx - net: macb: Use dev_consume_skb_any() to free TX SKBs - net: macb: use the current queue number for stats - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: mana: fix use-after-free in add_adev() error path - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown - net: mana: Ring doorbell at 4 CQ wraparounds - net: mana: validate rx_req_idx to prevent out-of-bounds array access - net: mctp: ensure our nlmsg responses are initialised - net: mctp: fix don't require received header reserved bits to be zero - net: mctp i2c: check length before marking flow active - net: mctp-i2c: fix duplicate reception of old data - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - net/mlx5: Avoid "No data available" when FW version queries fail - net/mlx5: Do not restore destination-less TC rules - net/mlx5: DR, Fix circular locking dependency in dump - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5e: Fix features not applied during netdev registration - net/mlx5e: Fix race condition during IPSec ESN update - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Prevent concurrent access to IPSec ASO context - net/mlx5: Fix deadlock between devlink lock and esw->wq - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: Fix multiport device check over light SFs - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/mlx5: IFC updates for disabled host PF - net/mlx5: lag: Check for LAG device before creating debugfs - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net/mlx5: Query to see if host PF is disabled - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - net/mlx5: Update the list of the PCI supported devices - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mv643xx: fix OF node refcount - net: mvpp2: Add metadata support for xdp mode - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - net: mvpp2: limit XDP frame size to the RX buffer - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: sync RX data at the hardware packet offset - net: ncsi: fix skb leak in error paths - net: netconsole: move newline trimming to function - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - net: nfc: nci: Fix parameter validation for packet data - net: nfc: nci: Fix zero-length proprietary notifications - netns-ipv4: reorganize netns_ipv4 fast path variables - net: openvswitch: Avoid releasing netdev before teardown completes - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - net: phonet: free phonet_device after RCU grace period - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: phy: clean the sfp upstream if phy probing fails - net: phy: dp83869: fix setting CLK_O_SEL field. - net: phy: DP83TC811: add reading of abilities - net: phy: move at803x PHY driver to dedicated directory - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: qrtr: ns: Fix use-after-free in driver remove() - net: qrtr: ns: Free the node during ctrl_cmd_bye() - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: qrtr: ns: Limit the total number of nodes - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - net: rds: clear i_sends on setup unwind - net/rds: Clear reconnect pending bit - net/rds: Fix circular locking dependency in rds_tcp_tune - net: rds: fix MR cleanup on copy error - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - net/rds: handle zerocopy send cleanup before the message is queued - net/rds: No shortcut out of RDS_CONN_ERROR - net/rds: Optimize rds_ib_laddr_check - net/rds: rds_sendmsg should not discard payload_len - net/rds: reset op_nents when zerocopy page pin fails - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: zero per-item info buffer before handing it to visitors - net: remove WARN_ON_ONCE when accessing forward path array - net: rfkill: prevent unlimited numbers of rfkill events from being created - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: sched: act_csum: validate nested VLAN headers - net/sched: act_ct: Only release RCU read lock after ct_ft - net/sched: act_gate: snapshot parameters with RCU on replace - net/sched: act_ife: Fix metalist update behavior - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - net/sched: cls_flower: revert unintended changes - net/sched: cls_flow: fix NULL pointer dereference on shared blocks - net/sched: cls_fw: fix NULL dereference of "old" filters before change() - net/sched: cls_fw: fix NULL pointer dereference on shared blocks - net/sched: ets: fix divide by zero in the offload path - net/sched: fix pedit partial COW leading to page cache corruption - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix probability gaps in 4-state loss model - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: validate slot configuration - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/sched: sch_netem: fix out-of-bounds access in packet corruption - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: taprio: fix NULL pointer dereference in class dump - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - net/sched: teql: Fix double-free in teql_master_xmit - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - net: sfp: improve Huawei MA5671a fixup - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net: skb: fix cross-cache free of KFENCE-allocated skb head - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - net: skbuff: fix pskb_carve leaking zcopy pages - net: skbuff: preserve shared-frag marker during coalescing - net: skbuff: propagate shared-frag marker through frag-transfer helpers - net: skmsg: preserve sg.copy across SG transforms - net/smc: avoid early lgr access in smc_clc_wait_msg - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - net/smc: Do not re-initialize smc hashtables - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - net: sparx5/lan969x: fix PTP clock max_adj value - net: stmmac: avoid shadowing global buf_sz - net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz - net: stmmac: Fix error handling in VLAN add and delete paths - net: stmmac: fix integer underflow in chain mode - net: stmmac: Fix PTP ref clock for Tegra234 - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: remove support for lpi_intr_o - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: strparser: fix skb_head leak in strp_abort_strp() - net: sunhme: Fix sbus regression - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers - net: tcp: accept old ack during closing - net/tcp-md5: Fix MAC comparison to be constant-time - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net: tls: fix strparser anchor skb leak on offload RX setup failure - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption - net: tls: prevent chain-after-chain in plain text SG - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - net: txgbe: fix firmware version check - net: txgbe: fix RTNL assertion warning when remove module - net: txgbe: leave space for null terminators on property_entry - net: usb: aqc111: Do not perform PM inside suspend callback - net: usb: catc: enable basic endpoint checking - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - net: usb: kalmia: validate USB endpoints - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode - net: usb: kaweth: validate USB endpoints - net: usb: lan78xx: fix silent drop of packets with checksum errors - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: pegasus: enable basic endpoint checking - net: usb: pegasus: validate USB endpoints - net: usb: r8152: add TRENDnet TUC-ET2G - net: usb: r8152: fix transmit queue timeout - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: sr9700: remove code to drive nonexistent multicast filter - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - nexthop: fix IPv6 route referencing IPv4 nexthop - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - nfc: hci: fix out-of-bounds read in HCP header parsing - nfc: hci: shdlc: Stop timers and work before freeing context - nfc: llcp: add missing return after LLCP_CLOSED checks - nfc: llcp: Fix use-after-free in llcp_sock_release() - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: complete pending data exchange on device close - nfc: nci: fix circular locking dependency in nci_close_device - nfc: nci: free skb on nci_transceive early error paths - NFC: nxp-nci: allow GPIOs to sleep - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems - nfc: nxp-nci: remove interrupt trigger type - nfc: pn533: allocate rx skb before consuming bytes - NFC: pn533: bound the UART receive buffer - nfc: pn533: properly drop the usb interface reference on disconnect - nfc: rawsock: cancel tx_work before socket teardown - nfc: s3fwrn5: allocate rx skb before consuming bytes - NFC: trf7970a: Ignore antenna noise when checking for RF field - nfnetlink_osf: validate individual option lengths in fingerprints - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - nfsd: check get_user() return when reading princhashlen - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache - nfsd: fix posix_acl leak on SETACL decode failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - NFSD: Fix SECINFO_NO_NAME decode error cleanup - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd - nfsd: never defer requests during idmap lookup - NFS: Fix a deadlock involving nfs_release_folio() - nfs: pass explicit offset/count to trace events - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - NTB: ntb_transport: Fix too small buffer for debugfs_name - ntfs3: add buffer boundary checks to run_unpack() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ntfs: ->d_compare() must not block - nvdimm/bus: Fix potential use after free in asynchronous initialization - nvdimm: virtio_pmem: serialize flush requests - nvme-apple: drop invalid put of admin queue reference count - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme: fix admin queue leak on controller reset - nvme: fix memory allocation in nvme_pr_read_keys() - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nvmem: imx: assign nvmem_cell_info::raw_len - nvmem: layouts: onie-tlv: fix hang on unknown types - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - nvme-pci: cap queue creation to used queues - nvme-pci: ensure we're polling a polled queue - nvme-pci: fix missed admin queue sq doorbell write - nvme-pci: Fix race bug in nvme_poll_irqdisable() - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - nvme: reject invalid pr_read_keys() num_keys values - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free - nvmet-tcp: fix race between ICReq handling and queue teardown - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - objtool: Fix Clang jump table detection - objtool: Handle Clang RSP musical chairs - objtool: Remove max symbol name length limitation - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - ocfs2: fix listxattr handling when the buffer is full - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: fix possible deadlock between unlink and dio_end_io_write - ocfs2: fix reflink preserve cleanup issue - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: reject oversized group bitmap descriptors - ocfs2: split transactions in dio completion to avoid credit exhaustion - ocfs2: validate bg_bits during freefrag scan - ocfs2: validate group add input before caching - ocfs2: validate inline data i_size during inode read - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: disable per ring interrupts - octeon_ep: ensure dbell BADDR updation - octeon_ep: Relocate counter updates before NAPI - octeon_ep: restructured interrupt handlers - octeon_ep: set backpressure watermark for RX queues - octeon_ep: support Octeon CN10K devices - octeon_ep: support to fetch firmware info - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: CGX: fix bitmap leaks - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: Fix default entries mcam entry action - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - octeontx2-af: Fix PF driver crash with kexec kernel booting - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - octeontx2-af: replace deprecated strncpy with strscpy - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - octeontx2-pf: avoid double free of pool->stack on AQ init failure - octeontx2-pf: Unregister devlink on probe failure - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - of: unittest: fix use-after-free in testdrv_probe() - openrisc: define arch-specific version of nop() - openvswitch: cap upcall PID array size and pre-size vport replies - openvswitch: defer tunnel netdev_put to RCU release - openvswitch: validate MPLS set/set_masked payload length - openvswitch: vport: fix self-deadlock on release of tunnel ports - ovl: Fix uninit-value in ovl_fill_real - padata: Fix pd UAF once and for all - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove comment for reorder_work - padata: Remove cpu online check from cpu add and removal - params: Replace __modinit with __init_or_module - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - parisc: Fix IRQ leak in LASI driver - parisc: Flush correct cache in cacheflush() syscall - parisc: Increase initial mapping to 64 MB with KALLSYMS - parisc: kernel: replace kfree() with put_device() in create_tree_node() - parisc: _llseek syscall is only available for 32-bit userspace - parisc: Prevent interrupts during reboot - parport: Fix race between port and client registration - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI/AER: Clear only error bits in PCIe Device Status - PCI/AER: Stop ruling out unbound devices as error source - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - PCI: Do not attempt to set ExtTag for VFs - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Enable AtomicOps only if Root Port supports them - PCI: endpoint: Avoid creating sub-groups asynchronously - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup - PCI: endpoint: Remove unused field in struct pci_epf_group - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - PCI: Fix pci_slot_lock () device locking - PCI: Fix pci_slot_trylock() error handling - PCI: hv: Set default NUMA node to 0 for devices without affinity info - PCI: Initialize RCB from pci_configure_device() - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - PCI: Mark ASM1164 SATA controller to avoid bus reset - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI/MSI: Unmap MSI-X region on error - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - PCI/portdrv: Fix potential resource leak - PCI: Supply bridge device, not secondary bus, to read window details - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Fix polling delay for L2 state - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Use DWC IP core version - PCI: Update BAR # and window messages - PCI: Use resource names in PCI log messages - PCI: Use resource_set_range() that correctly sets ->end - PCMCIA: Fix garbled log messages for KERN_CONT - pcnet32: stop holding device spin lock during napi_complete_done - pds_core: add an error code check in pdsc_dl_info_get - pds_core: ensure null-termination for firmware version strings - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - perf/arm-cmn: Reject unsupported hardware configurations - perf/arm-cmn: Support CMN-600AE - perf: arm_spe: Properly set hw.state on failures - perf branch: Avoid incrementing NULL - perf callchain: Fix srcline printing with inlines - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf: Extract a few helpers - perf: Fix dangling cgroup pointer in cpuctx - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - perf lock: Fix option value type in parse_max_stack - perf: Make sure to use pmu_ctx->pmu for groups - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf unwind-libdw: Fix invalid reference counts - perf util: Kill die() prototype, dead for a long time - perf/x86/intel/uncore: Skip discovery table for offline dies - phonet: Pass ifindex to fill_addr(). - phonet: Pass net and ifindex to phonet_address_notify(). - phonet/pep: disable BH around forwarded sk_receive_skb() - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - phy: tegra: xusb: Fix per-pad high-speed termination calibration - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - pidfd: refuse access to tasks that have started exiting harder - pinctrl: abx500: Fix type of 'argument' variable - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - pinctrl: mediatek: common: Fix probe failure for devices without EINT - pinctrl: pinctrl-pic32: Fix resource leak - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - ping: annotate data-races in ping_lookup() - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - platform/chrome: cros_ec_lightbar: Fix response size initialization - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - platform/surface: surfacepro3_button: Drop wakeup source on remove - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro - platform/x86/amd/pmc: Add support for Van Gogh SoC - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - platform/x86: classmate-laptop: Add missing NULL pointer checks - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: hp-bioscfg: Support allocations of larger data - platform/x86: hp-wmi: Ignore backlight and FnLock events - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery - platform/x86: ISST: Correct locked bit width - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - platform/x86: panasonic-laptop: Fix sysfs group leak in error path - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - pmdomain: bcm: bcm2835-power: Fix broken reset status read - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - pmdomain: core: Fix detach procedure for virtual devices in genpd - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - PM: hibernate: Don't ignore return from set_memory_ro() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: runtime: Fix a race condition related to device removal - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - pNFS: Fix a deadlock when returning a delegation during open() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - pNFS: Fix use-after-free in pnfs_update_layout() - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - powerpc64/bpf: do not increment tailcall count when prog is NULL - powerpc: 83xx: km83xx: Fix keymile vendor prefix - powerpc/crash: fix backup region offset update to elfcorehdr - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - powerpc/warp: Fix error handling in pika_dtm_thread - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: ab8500: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: axp288_charger: Do not cancel work before initializing it - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: max17042: avoid overflow when determining health - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - pppoe: drop PFC frames - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - printk: add print_hex_dump_devel() - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - pstore: ram_core: fix incorrect success return when vmap() fails - pstore/ram: fix buffer overflow in persistent_ram_save_old() - pstore/ram: fix resource leak when ioremap() fails - ptp: vclock: Switch from RCU to SRCU - ptrace: Convert ptrace_attach() to use lock guards - ptrace: slightly saner 'get_dumpable()' logic - pwm: imx-tpm: Count the number of enabled channels in probe - qed: fix double free in qed_cxt_tables_alloc() - quota: fix livelock between quotactl and freeze_super - quota: Fix race of dquot_scan_active() with quota deactivation - r8152: fix incorrect register write to USB_UPHY_XTAL - r8152: handle the return value of usb_reset_device() - randomize_kstack: Maintain kstack_offset per task - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - rbd: fix null-ptr-deref when device_add_disk() fails - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: s/boost_kthread_mutex/kthread_mutex - RDMA/bnxt_re: zero shared page before exposing to userspace - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - RDMA/core: Fix a couple of obvious typos in comments - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - RDMA/core: Prefer NLA_NUL_STRING - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - RDMA/efa: Fix typo in efa_alloc_mr() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - RDMA/hns: Fix WQ_MEM_RECLAIM warning - RDMA/hns: Notify ULP of remaining soft-WCs during reset - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Fix double free related to rereg_user_mr - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - RDMA/irdma: Initialize free_qp completion before using it - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - RDMA/mana_ib: Disable RX steering on RSS QP destroy - RDMA/mana: Validate rx_hash_key_len - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - RDMA: Move DMA block iterator logic into dedicated files - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/rtrs-clt: For conn rejection use actual err number - RDMA/rtrs: Fix use-after-free in path file creation cleanup - RDMA/rtrs: server: remove dead code - RDMA/rtrs-srv: fix SG mapping - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - RDMA/siw: Fix potential NULL pointer dereference in header processing - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - RDMA/srp: bound SRP_RSP sense copy by the received length - RDMA/umad: Reject negative data_len in ib_umad_write - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/umem: fix kernel-doc warnings - RDMA/umem: Fix truncation for block sizes >= 4G - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - rds: ib: reject FRMR registration before IB connection is established - rds: mark snapshot pages dirty in rds_info_getsockopt() - regmap: Synchronize cache for the page selector - regset: use kvzalloc() for regset_get_alloc() - regulator: act8945a: fix OF node reference imbalance - regulator: bd9571mwv: fix OF node reference imbalance - regulator: core: fix locking in regulator_resolve_supply() error path - regulator: core: move supply check earlier in set_machine_constraints() - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - regulator: pca9450: Correct interrupt type - regulator: pca9450: Make IRQ optional - regulator: rk808: fix OF node reference imbalance - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - remoteproc: imx_rproc: Fix invalid loaded resource table detection - remoteproc: mediatek: Break lock dependency to `prepare_lock` - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - remoteproc: xlnx: Only access buffer information if IPI is buffered - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - resource: Add resource set range and size helpers - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "ALSA: usb: Increase volume range that triggers a warning" - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - Revert "crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx" - Revert "crypto: nx - fix context leak in nx842_crypto_free_ctx" - Revert "crypto: nx - Migrate to scomp API" - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" - Revert "ice: fix double-free of tx_buf skb" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "mfd: da9052-spi: Change read-mask to write-mask" - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - Revert "mptcp: add needs_id for netlink appending addr" - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - Revert "perf unwind-libdw: Fix invalid reference counts" - Revert "ptp: add testptp mask test" - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" - Revert "tcpm: allow looking for role_sw device in the main node" - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - Revert "wireguard: device: enable threaded NAPI" - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - Revert "x86/vdso: Fix output operand size of RDPID" - Revert "xattr: switch to CLASS(fd)" - ring-buffer: Fix reporting of missed events in iterator - ring-buffer: Remove ring_buffer_read_prepare_sync() - riscv: kgdb: fix several debug register assignment bugs - riscv: Sanitize syscall table indexing under speculation - rnbd-srv: Zero the rsp buffer before using it - romfs: check sb_set_blocksize() return value - rpmsg: char: Fix use-after-free on probe error path - rpmsg: core: fix race in driver_override_show() and use core helper - rseq: Clarify rseq registration rseq_size bound check comment - rtc: abx80x: Disable alarm feature if no interrupt attached - rtc: interface: Alarm race handling should not discard preceding error - rtc: ntxec: fix OF node reference imbalance - rtc: zynqmp: correct frequency value - rtmutex: Use waiter::task instead of current in remove_waiter() - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - rust: kunit: fix warning when !CONFIG_PRINTK - rust: pin-init: add references to previously initialized fields - rust: pin-init: internal: init: document load-bearing fact of field accessors - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix anonymous key handling - rxrpc: Fix call removal to use RCU safe deletion - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - rxrpc: Fix data-race warning and potential load/store tearing - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: Fix key quota calculation for multitoken keys - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix memory leaks in rxkad_verify_response() - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - rxrpc: Fix potential UAF after skb_unshare() failure - rxrpc: Fix recvmsg() unconditional requeue - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix the ACK parser to extract the SACK table for parsing - rxrpc: only handle RESPONSE during service challenge - rxrpc: Only put the call ref if one was acquired - rxrpc: reject undecryptable rxkad response tickets - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - s390/cio: make sch->lock spinlock pointer a member - s390/cio: use generic driver_override infrastructure - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - s390/debug: Reject zero-length input before trimming a newline - s390/debug: Reject zero-length input in debug_input_flush_fn() - s390/entry: Scrub r12 register on kernel entry - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - s390/pci: Handle futile config accesses of disabled devices directly - s390/perf: Disable register readout on sampling events - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/syscalls: Add spectre boundary for syscall dispatch table - s390/xor: Fix xor_xc_2() inline assembly constraints - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - sched/fair: Fix pelt clock sync when entering idle - sched: idle: Consolidate the handling of two special cases - sched: idle: Make skipping governor callbacks more consistent - sched/rt: Skip currently executing CPU in rto_next_cpu() - sched: Use u64 for bandwidth ratio calculations - scripts/dtc: Remove unused dts_version in dtc-lexer.l - scripts: generate_rust_analyzer.py: avoid FD leak - scripts: generate_rust_analyzer.py: define scripts - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Have mcount rela sort use direct values - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused macro defines - scripts/sorttable: Remove unused write functions - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Zero out weak functions in mcount_loc table - scsi: buslogic: Reduce stack usage - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - scsi: csiostor: Fix dereference of null pointer rn - scsi: efct: Use IRQF_ONESHOT and default primary handler - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec - scsi: hisi_sas: Fix NULL pointer exception during user_scan() - scsi: hisi_sas: Use macro instead of magic number - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - scsi: isci: Fix use-after-free in device removal path - scsi: lpfc: Properly set WC for DPP mapping - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: qla2xxx: Fix bsg_done() causing double free - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - scsi: ses: Fix devices attaching to different hosts - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - scsi: target: core: Fix integer overflow in UNMAP bounds check - scsi: target: Fix recursive locking in __configfs_open_file() - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: tcm_loop: Drain commands in target_reset handler - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix use-after free in init error and remove paths - scsi: ufs: core: Flush exception handling work when RPM level is zero - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - scsi: ufs: host: mediatek: Require CONFIG_PM - sctp: diag: reject stale associations in dump_one path - sctp: discard stale INIT after handshake completion - sctp: fix missing encap_port propagation for GSO fragments - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - sctp: fix race between sctp_wait_for_connect and peeloff - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - sctp: purge outqueue on stale COOKIE-ECHO handling - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - sctp: stream: fully roll back denied add-stream state - security/keys: fix missed RCU read section on lookup - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - seg6: separate dst_cache for input and output paths in seg6 lwtunnel - selftest/arm64: Fix sve2p1_sigill() to hwcap test - selftest: memcg: skip memcg_sock test if address family not supported - selftests/bpf: add stack access precision test - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: veristat: fix printing order in output_stats() - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests/memfd: delete unused declarations - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - selftests/mm: skip migration tests if NUMA is unavailable - selftests: mptcp: add a check for 'add_addr_accepted' - selftests: mptcp: add test for extra_subflows underflow on userspace PM - selftests: mptcp: drop nanoseconds width specifier - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: join: check RM_ADDR not sent over same subflow - selftests: mptcp: more stable simult_flows tests - selftests/mqueue: Fix incorrectly named file - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - selftests/powerpc: Re-order *FLAGS to follow lib.mk - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selinux: don't reserve xattr slot when we won't fill it - selinux: fix overlayfs mmap() and mprotect() access checks - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - serdev: make serdev_bus_type const - serdev: Provide a bustype shutdown function - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_dw: handle clock enable errors in runtime_resume - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: 8250: Fix TX deadlock when using DMA - serial: 8250_pci: add support for the AX99100 - serial: altera_jtaguart: handle uart_add_one_port() failures - serial: caif: fix use-after-free in caif_serial ldisc_close() - serial: caif: hold tty->link reference in ldisc_open and ser_release - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: imx: change SERIAL_IMX_CONSOLE to bool - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: samsung_tty: Use port lock wrappers - serial: sh-sci: fix memory region release in error path - serial: SH_SCI: improve "DMA support" prompt - serial: uartlite: fix PM runtime usage count underflow on probe - serial: zs: Convert to use a platform device - serial: zs: Fix bootconsole handover lockup - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: zs: Switch to using channel reset - sfc: fix error code in efx_devlink_info_running_versions() - sh: platform_early: remove pdev->driver_override check - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: fix OF node refcount - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - smb: client: add proper locking around ses->iface_last_update - smb: client: Compare MACs in constant time - smb: client: correctly handle ErrorContextData as a flexible array - smb: client: correct value for smbd_max_fragmented_recv_size - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - smb: client: fix atomic open with O_DIRECT & O_SYNC - smb: client: fix broken multichannel with krb5+signing - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb: client: fix cifs_pick_channel when channels are equally loaded - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - smb: client: fix krb5 mount with username option - smb: client: fix off-by-8 bounds check in check_wsl_eas() - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path - smb: client: fix OOB reads parsing symlink error response - smb/client: fix out-of-bounds read in smb2_compound_op() - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix possible infinite loop and oob read in symlink_data() - smb: client: fix potential UAF and double free in smb2_open_file() - smb: client: prevent races in ->query_interfaces() - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - smb: client: reject userspace cifs.spnego descriptions - smb: client: require a full NFS mode SID before reading mode bits - smb: client: require net admin for CIFS SWN netlink - smb: client: Use FullSessionKey for AES-256 encryption key derivation - smb: client: use kzalloc to zero-initialize security descriptor buffer - smb: client: validate dacloffset before building DACL pointers - smb: client: validate the whole DACL before rewriting it in cifsacl - smb: common: change the data type of num_aces to le16 - smb: move some duplicate definitions to common/smbacl.h - smb: server: fix active_num_conn leak on transport allocation failure - smb/server: Fix another refcount leak in smb2_open() - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix use-after-free in smb2_open() - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - soc: fsl: qbman: fix race condition in qman_destroy_fq - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - soc: qcom: llcc: fix v1 SB syndrome register offset - soc: qcom: ocmem: make the core clock optional - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: smem: handle ENOMEM error during probe - soc/tegra: cbb: Set ERD on resume for err interrupt - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - soc: ti: k3-socinfo: Fix regmap leak on probe failure - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - sound: ua101: fix division by zero at probe - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - soundwire: cadence: Clear message complete before signaling waiting thread - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - spi: at91-usart: fix controller deregistration - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: cadence: fix controller deregistration - spi: cadence: fix unclocked access on unbind - spi: coldfire-qspi: fix controller deregistration - spi: dln2: fix controller deregistration - spi: fix resource leaks on device setup failure - spi: fix statistics allocation - spi: fix use-after-free on controller registration failure - spi: fsl-espi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: fsl-qspi: Use reinit_completion() for repeated operations - spi: geni-qcom: Check DMA interrupts early in ISR - spi-geni-qcom: initialize mode related registers to 0 - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - spi: img-spfi: fix controller deregistration - spi: imx: fix runtime pm leak on probe deferral - spi: imx: fix use-after-free on unbind - spi: intel-pci: Add support for Nova Lake mobile SPI flash - spi: lantiq-ssc: fix controller deregistration - spi: meson-spicc: Fix double-put in remove path - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - spi: mpc52xx: fix use-after-free on unbind - spi: mtk-nor: fix controller deregistration - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - spi: omap2-mcspi: fix controller deregistration - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: qup: fix controller deregistration - spi: qup: fix error pointer deref after DMA setup failure - spi: rockchip: fix controller deregistration - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - spi: rspi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: s3c64xx: fix NULL-deref on driver unbind - spi: sh-hspi: fix controller deregistration - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - spi: spidev: fix lock inversion between spi_lock and buf_lock - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: spi-ti-qspi: switch to use modern name - spi: sprd: fix controller deregistration - spi: sprd: fix error pointer deref after DMA setup failure - spi: stm32: fix Overrun issue at < 8bpw - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - spi: tegra114: fix controller deregistration - spi: tegra20-sflash: fix controller deregistration - spi: ti-qspi: fix controller deregistration - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: tools: Add include folder to .gitignore - spi: topcliff-pch: fix use-after-free on unbind - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - spi: zynqmp-gqspi: fix controller deregistration - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - Squashfs: check metadata block offset is within range - staging: greybus: lights: avoid NULL deref - staging: media: atomisp: Disallow all private IOCTLs - staging: rtl8723bs: fix memory leak on failure path - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - staging: rtl8723bs: fix null dereference in find_network - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() - staging: sm750fb: fix division by zero in ps_to_hz() - staging: vme_user: fix root device leak on init failure - string: add mem_is_zero() helper to check if memory area is all zeros - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - sunrpc: fix cache_request leak in cache_release - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Remove queue-shortening warnings - sysctl: fix uninitialized variable in proc_do_large_bitmap - sysfs: don't remove existing directory on update failure - tap: free page on error paths in tap_get_user_xdp() - taskstats: set version in TGID exit notifications - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: call sk_data_ready() after listener migration - tcp: defer regular ACK while processing socket backlog - tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses. - tcp: Fix imbalanced icsk_accept_queue count. - tcp: optimize inet_use_bhash2_on_bind() - tcp: Rearrange tests in inet_csk_bind_conflict(). - tcp: restrict SO_ATTACH_FILTER to priv users - tcp: Set pingpong threshold via sysctl - tcp: tcp_tx_timestamp() must look at the rtx queue - tcp: Use bhash2 for v4-mapped-v6 non-wildcard address. - tee: optee: prevent use-after-free when the client exits before the supplicant - test_kprobes: clear kprobes between test runs - tg3: Fix race for querying speed/duplex - tg3: replace placeholder MAC address with device property - thermal: core: Fix thermal zone device registration error path - thermal: core: Fix thermal zone governor cleanup issues - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - thermal: int340x: Fix sysfs group leak on DLVR registration failure - thunderbolt: Bound root directory content to block size - thunderbolt: Clamp XDomain response data copy to allocation size - thunderbolt: Fix property read in nhi_wake_supported() - thunderbolt: Limit XDomain response copy to actual frame size - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - thunderbolt: Reject zero-length property entries in validator - thunderbolt: Validate XDomain request packet size before type cast - time: Fix off-by-one in settimeofday() usec validation - time/jiffies: Mark jiffies_64_to_clock_t() notrace - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG - tipc: fix divide-by-zero in tipc_sk_filter_connect() - tipc: fix double-free in tipc_buf_append() - tipc: fix duplicate publication key in tipc_service_insert_publ() - tipc: fix RCU dereference race in tipc_aead_users_dec() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - tls: Preserve sk_err across recvmsg() when data has been copied - tls: Purge async_hold in tls_decrypt_async_wait() - tools/accounting: handle truncated taskstats netlink messages - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - tools: Fix bitfield dependency failure - tools/power cpupower: Reset errno before strtoull() - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - tools/rv: Fix cleanup after failed trace setup - tpm: avoid -Wunused-but-set-variable - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - tpm: tpm_tis: add error logging for data transfer - tpm: tpm_tis: stop transmit if retries are exhausted - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() - tracing: Add NULL pointer check to trigger_data_free() - tracing: Add recursion protection in kernel stack trace recording - tracing: Avoid NULL return from hist_field_name() on truncation - tracing: branch: Fix inverted check on stat tracer registration - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - tracing: Fix checking of freed trace_event_file for hist files - tracing: Fix false sharing in hwlat get_sample() - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Fix syscall events activation by ensuring refcount hits zero - tracing: Fix to set write permission to per-cpu buffer_size_kb - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - tracing/probe: reject non-closed empty immediate strings - tracing/probes: Limit size of event probe to 3K - tracing/probes: Point the error offset correctly for eprobe argument error - tracing: Properly process error handling in event_hist_trigger_parse() - tracing: Rebuild full_name on each hist_field_name() call - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Switch trace_osnoise.c code over to use guard() and __free() - tracing: Wake up poll waiters for hist files when removing an event - tty: hvc_iucv: fix off-by-one in number of supported devices - tty: serial: pch_uart: add check for dma_alloc_coherent() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - tun: free page on build_skb failure in tun_xdp_one() - tun: free page on short-frame rejection in tun_xdp_one() - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - ublk: Validate SQE128 flag before accessing the cmd - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - udf: fix partition descriptor append bookkeeping - udf: reject descriptors with oversized CRC length - udp: clear skb->dev before running a sockmap verdict - udp: Fix wildcard bind conflict check when using hash2 - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n - um: drivers: call kernel_strrchr() explicitly in cow_user.c - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - unshare: fix unshare_fs() handling - USB: add QUIRK_NO_BOS for video capture several devices - usb: bdc: fix sleep during atomic - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() - usb: cdns3: fix role switching during resume - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue - usb: cdns3: gadget: fix request skipping after clearing halt - usb: cdns3: gadget: fix state inconsistency on gadget init failure - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: remove redundant if branch - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: core: convert ci_role_switch to local variable - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: class: cdc-wdm: fix reordering issue in read code path - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: core: Fix SuperSpeed root hub wMaxPacketSize - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - USB: core: Limit the length of unkillable synchronous timeouts - usb: core: new quirk to handle devices with zero configurations - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - usb: dwc2: fix resume failure if dr_mode is host - usb: dwc2: Fix use after free in debug code - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: dwc3: gadget: Move vbus draw to workqueue context - usb: dwc3: Move GUID programming after PHY initialization - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: ehci-brcm: fix sleep during atomic - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - usb: gadget: f_ncm: Fix net_device lifecycle with device_move - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: net2280: Fix double free in probe error path - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: image: mdc800: kill download URB on timeout - usbip: validate number_of_packets in usbip_pack_ret_submit() - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: mdc800: handle signal and read racing - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - USB: omap_udc: DMA: Don't enable burst 4 mode - usb: port: add delay after usb_hub_set_port_power() - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - USB: serial: belkin_sa: validate interrupt status length - USB: serial: cypress_m8: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: digi_acceleport: fix memory corruption with small endpoints - USB: serial: f81232: fix incomplete serial port generation - USB: serial: io_edgeport: add support for Blackbox IC135A - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - USB: serial: io_ti: fix heap overflow in get_manuf_info() - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: kl5kusb105: fix bulk-out buffer overflow - USB: serial: mct_u232: fix memory corruption with small endpoint - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: option: add MeiG Smart SRM825WN - USB: serial: option: add MeiG SRM813Q - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: option: add Telit Cinterion FN990A MBIM composition - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: serial: option: add Telit FN920C04 RNDIS compositions - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: storage: Add quirks for PNY Elite Portable SSD - usb: storage: Expand range of matched versions for VL817 quirks entry - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: tcpm: reset internal port states on soft reset AMS - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - usb: typec: ucsi: Check if power role change actually happened before handling - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: Don't update power_supply on power role change if not connected - usb: typec: ucsi: Move unregister out of atomic section - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - usb: typec: ucsi: validate connector number in ucsi_connector_change() - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: ulpi: fix double free in ulpi_register_interface() error path - usb: ulpi: fix memory leak on ulpi_register() error paths - USB: usbcore: Introduce usb_bulk_msg_killable() - usb: usblp: fix heap leak in IEEE 1284 device ID via short response - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts - usb: xhci: Fix memory leak in xhci_disable_slot() - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - usb: xhci: Prevent interrupt storm on host controller error (HCE) - usb: yurex: fix race in probe - userfaultfd: allow registration of ranges below mmap_min_addr - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - vfio: Create vfio_fs_type with inode per device - vfio/pci: Insert full vma on mmap'd MMIO fault - vfio/pci: Use unmap_mapping_range() - vhost: fix caching attributes of MMIO regions by setting them explicitly - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - virtiofs: fix UAF on submount umount - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false - virt: vbox: uapi: Mark inner unions in packed structs as packed - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - vrf: Fix a potential NPD when removing a port from a VRF - vsock: fix buffer size clamping order - vsock: keep poll shutdown state consistent - vsock/virtio: fix accept queue count leak on transport mismatch - vsock/virtio: fix length and offset in tap skb for split packets - vsock/virtio: reset connection on receiving queue overflow - vsock/vmci: fix sk_ack_backlog leak on failed handshake - vsock/vmci: fix UAF when peer resets connection during handshake - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - vxlan: validate ND option lengths in vxlan_na_create - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - watchdog: imx7ulp_wdt: handle the nowayout option - watchdog: starfive-wdt: Fix PM reference leak in probe error path - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - wifi: ath11k: clear shared SRNG pointer state on restart - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - wifi: ath11k: fix warning when unbinding - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: skip status ring entry processing - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath5k: do not access array OOB - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: brcmfmac: Fix error pointer dereference - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: brcmfmac: validate bsscfg indices in IF events - wifi: brcmsmac: Fix dma_free_coherent() size - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - wifi: cfg80211: wext: fix IGTK key ID off-by-one - wifi: cw1200: Fix locking in error paths - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - wifi: iwlwifi: mvm: check the validity of noa_len - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: libertas: fix use-after-free in lbs_free_adapter() - wifi: libertas: fix WARNING in usb_tx_block - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: mac80211: fix NULL deref in mesh_matches_local() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. - wifi: mac80211: remove station if connection prep fails - wifi: mac80211: set default WMM parameters on all links - wifi: mt76: connac: introduce helper for mt7925 chipset - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7921: fix a potential clc buffer length underflow - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - wifi: nl80211: reject oversized EMA RNR lists - wifi: radiotap: reject radiotap with unknown bits - wifi: rsi: fix kthread lifetime race between self-exit and external-stop - wifi: rt2x00usb: fix devres lifetime - wifi: rtl8xxxu: fix potential use of uninitialized value - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: check for PCI upstream bridge existence - wifi: rtw88: fix device leak on probe failure - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw89: pci: restore LDO setting after device resume - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - wifi: wl1251: validate packet IDs before indexing tx_frames - wifi: wlcore: Fix a locking bug - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom - wireguard: send: append trailer after expanding head - workqueue: Factor out assign_rescuer_work() - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - workqueue: Only assign rescuer work when really needed - workqueue: Process rescuer work items one-by-one using a cursor - X.509: Fix out-of-bounds access when parsing extensions - x86/apic: Disable x2apic on resume if the kernel expects so - x86/CPU/AMD: Call the spectral chicken in the Zen2 init function - x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache - x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - x86/CPU: Fix FPDSS on Zen1 - x86/efi: defer freeing of boot services memory - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/hyperv: Fix error pointer dereference - x86/kexec: add a sanity check on previous kernel's ima kexec buffer - x86/kexec: Copy ACPI root pointer address from config table - x86/kexec: Disable KCOV instrumentation after load_segments() - x86/platform/uv: Handle deconfigured sockets - x86/sev: Allow IBPB-on-Entry feature for SNP guests - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - x86: shadow stacks: proper error handling for mmap lock - x86/shstk: Prevent deadlock during shstk sigreturn - x86/uprobes: Fix XOL allocation failure for 32-bit tasks - x86/xen: Fix xen_e820_swap_entry_with_ram() - x86/xen: make some functions static - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - xattr: switch to CLASS(fd) - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - xenbus: Use .freeze/.thaw to handle xenbus devices - xen-netback: reject zero-queue configuration from guest - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: fix double free via VMA splitting - xen/privcmd: restrict usage in unprivileged domU - xen/virtio: Don't use grant-dma-ops when running as Dom0 - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - xfrm: ah: account for ESN high bits in async callbacks - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - xfrm: call xdo_dev_state_delete during state update - xfrm: Check for underflow in xfrm_state_mtu - xfrm: clear trailing padding in build_polexpire() - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: esp: avoid in-place decrypt on shared skb frags - xfrm: espintcp: do not reuse an in-progress partial send - xfrm: esp: restore combined single-frag length gate - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path - xfrm: Fix the usage of skb->sk - xfrm: input: hold netns during deferred transport reinjection - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - xfrm: provide message size for XFRM_MSG_MAPPING - xfrm: route MIGRATE notifications to caller's netns - xfrm: skip templates check for packet offload tunnel mode - xfrm_user: fix info leak in build_mapping() - xfrm_user: fix info leak in build_report() - xfrm: Wait for RCU readers during policy netns exit - xfs: avoid dereferencing log items after push callbacks - xfs: delete attr leaf freemap entries when empty - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix a resource leak in xfs_alloc_buftarg() - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: fix integer overflow in bmap intent sort comparator - xfs: fix remote xattr valuelblk check - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: fix undersized l_iclog_roundoff values - xfs: mark data structures corrupt on EIO and ENODATA - xfs: save ailp before dropping the AIL lock in push callbacks - xfs: stop reclaim before pushing AIL during unmount - xhci: tegra: Fix ghost USB device on dual-role port unplug - xprtrdma: Decrement re_receiving on the early exit paths - xsk: Fix fragment node deletion to prevent buffer leak - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: Fix zero-copy AF_XDP fragment drop - xsk: Get rid of xdp_buff_xsk::xskb_list_node - xsk: introduce helper to determine rxq->frag_size - xsk: respect tailroom for ZC setups - xsk: s/free_list_node/list_node/ - xsk: tighten UMEM headroom validation to account for tailroom and min frame - xsk: validate MTU against usable frame size on bind - zonefs: handle integer overflow in zonefs_fname_to_fno - zram: do not forget to endio for partial discard requests - zram: fix use-after-free in zram_bvec_write_partial() - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Fix CIFSwitch vulnerability- FIX GPO Frag vulnerability- Fix PinTheft- Fix memory leak in AFS code- Fix CVE-2026-46300, CVE-2026-46333, CVE-2025-54518- Remove dead, not used patches- Fix Dirtyfrag- Fix CVE-2026-31431 (Copyfail)- Fix regression with touchpad on notebook Positron Proxima 15 and probably others (bz#19950) - https://bugzilla.rosa.ru/show_bug.cgi?id=19950- [bot] upd: 6.6.106 -> 6.6.126 - Changelog: - 6pack: drop redundant locking and refcounting - 9p: fix cache/debug options printing in v9fs_show_options - 9p: fix /sys/fs/9p/caches overwriting itself - 9p: sysfs_init: don't hardcode error to ENOMEM - accel/habanalabs/gaudi2: fix BMON disable configuration - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() - ACPI: battery: Add synchronization between interface updates - ACPI: battery: allocate driver data through devm_ APIs - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - acpi: Break out nesting for hmat_parse_locality() - ACPI: button: Call input_free_device() on failing input device registration - ACPICA: Allow to skip Global Lock initialization - ACPICA: Avoid walking the Namespace if start_node is NULL - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - ACPICA: Fix largest possible resource descriptor index - ACPICA: Update dsmethod.c to get rid of unused variable warning - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - ACPI: CPPC: Check _CPC validity for only the online CPUs - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Perform fast check switch only for online CPUs - ACPI: debug: fix signedness issues in read/write helpers - acpi, hmat: calculate abstract distance with HMAT - acpi/hmat: Fix lockdep warning for hmem_register_resource() - acpi, hmat: refactor hmat_register_target_initiators() - ACPI: HMAT: Remove register of memory node for generic target - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Add setting of generic port system locality attributes - acpi: numa: Create enum for memory_target access coordinates indexing - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 - ACPI: processor: idle: Fix memory leak when register cpuidle device failed - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Fix buffer properties extraction for subnodes - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() - ACPI: property: Return present device nodes only on fwnode interface - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - acpi,srat: Fix incorrect device handle check for Generic Initiator - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() - afs: Fix potential null pointer dereference in afs_put_server - af_unix: Initialise scc_index in unix_add_edge(). - allow finish_no_open(file, ERR_PTR(-E...)) - alpha: don't reference obsolete termio struct for TC* constants - ALSA: ac97bus: Use guard() for mutex locks - ALSA: ac97: fix a double free in snd_ac97_controller_register() - ALSA: ctxfi: Fix potential OOB access in audio mixer handling - ALSA: dice: fix buffer overflow in detect_stream_formats() - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - ALSA: firewire-motu: add bounds check in put_user loop for DSP events - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. - ALSA: lx_core: use int type to store negative error codes - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer - ALSA: scarlett2: Fix buffer overflow in config retrieval - ALSA: serial-generic: remove shared static buffer - ALSA: uapi: Fix typo in asound.h comment - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: add mono main switch to Presonus S1824c - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: fix control pipe direction - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: fix uac2 clock source at terminal parser - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() - ALSA: usb-audio: Kill timer properly at removal - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Update for native DSD support quirks - ALSA: usb: Increase volume range that triggers a warning - ALSA: usb-mixer: us16x08: validate meter packet indices - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path - ALSA: wavefront: Clear substream pointers on close - ALSA: wavefront: Fix integer overflow in sample size validation - ALSA: wavefront: Use guard() for spin locks - ALSA: wavefront: Use standard print API - amba: tegra-ahb: Fix device leak on SMMU enable - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - amd-xgbe: avoid misleading per-packet error log - amd-xgbe: Avoid spurious link down messages during interface toggle - amd-xgbe: reset retries and mode on RX adapt failures - arc: Fix __fls() const-foldability via __builtin_clzl() - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - arm64: cputype: Add Neoverse-V3AE definitions - arm64: dts: add off-on-delay-us for usdhc2 regulator - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl - arm64: dts: imx8mp: Correct thermal sensor index - arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM - arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 - arm64: dts: imx8mp-venice-gw702x: remove off-board uart - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: qcom: msm8916: Add missing MDSS reset - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A - arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro - arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A - arm64: dts: rockchip: remove dangerous max-link-speed from helios64 - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: ti: k3-am62p: Fix memory ranges for GPU - arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - arm64: kprobes: call set_memory_rox() for kprobe page - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - arm64: mte: Do not flag the zero page as PG_mte_tagged - arm64: Set __nocfi on swsusp_arch_resume() - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() - ARM: 9468/1: fix memset64() on big-endian - ARM: at91: pm: fix MCKx restore routine - ARM: at91: pm: save and restore ACR during PLL disable/enable - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - ARM: dts: imx51-zii-rdu1: Fix audmux node names - ARM: dts: imx6q-ba16: fix RTC interrupt level - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 - ARM: dts: microchip: sama7g5: fix uart fifo size to 32 - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible - ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: renesas: gose: Remove superfluous port property - ARM: dts: renesas: porter: Fix CAN pin group - ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties - ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - ARM: tegra: transformer-20: add missing magnetometer interrupt - ARM: tegra: transformer-20: fix audio-codec interrupt - arp: do not assume dev_hard_header() does not change skb->head - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - ASoC: ak4458: Disable regulator when error happens - ASoC: ak5558: Disable regulator when error happens - ASoC: amd: acp: Adjust pdm gain value - ASoC: amd: fix memory leak in acp3x pdm dma ops - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 - ASoC: amd: yc: Fix microphone on ASUS M6500RE - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: codecs: wsa881x: Drop unused version readout - ASoC: codecs: wsa881x: fix unnecessary initialisation - ASoC: codecs: wsa883x: fix unnecessary initialisation - ASoC: codecs: wsa884x: fix codec initialisation - ASoC: cs4271: Fix regulator leak on probe failure - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe - ASoC: fsl: imx-card: Do not force slot width to sample width - ASoC: fsl_sai: Add missing registers to cache default - ASoC: fsl_sai: fix bit order for DSD format - ASoC: fsl_xcvr: clear the channel status control memory - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping - ASoC: Intel: catpt: Fix error path in hw_params() - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - ASoC: qcom: audioreach: fix potential null pointer dereference - ASoC: qcom: q6adm: the the copp device only during last instance - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed - ASoC: qcom: q6asm-dai: perform correct state check before closing - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - ASoC: qdsp6: q6asm: do not sleep while atomic - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - ASoC: stm32: sai: fix clk prepare imbalance on probe failure - ASoC: stm32: sai: fix device leak on probe - ASoC: stm32: sai: fix OF node leak on probe - ASoC: stm32: sai: manage context in set_sysclk callback - ASoC: tas2781: fix getting the wrong device number - ASoC: tlv320adcx140: fix null pointer - ASoC: tlv320adcx140: fix word length - ASoC: tlv320adcx140: Propagate error codes during probe - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - ASoC: wm8940: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8974: Correct PLL rate rounding - ata: libata: Add cpr_log to ata_dev_print_features() early return - ata: libata: Call ata_dev_config_lpm() for ATAPI devices - ata: libata-core: Introduce ata_dev_config_lpm() - ata: libata: Print features also for ATAPI devices - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() - ata: libata-scsi: Fix system suspend for a security locked drive - atm: Fix dma_free_coherent() size - atm/fore200e: Fix possible data race in fore200e_open() - audit: record fanotify event regardless of presence of rules - backlight: led-bl: Add devlink to supplier LEDs - backlight: lp855x: Fix lp855x.h kernel-doc warnings - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - bcma: don't register devices disabled in OF - be2net: fix data race in be_get_new_eqd - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - be2net: pass wrb_params in case of OS2BMC - bfs: Reconstruct file type when loading from disk - binder: fix BR_FROZEN_REPLY error log - binderfs: fix ida_alloc_max() upper bound - binder: remove "invalid inc weak" check - bits: add comments and newlines to #if, #else and #endif directives - bits: introduce fixed-type GENMASK_U*() - blk-cgroup: fix possible deadlock while configuring policy - blk-crypto: fix missing blktrace bio split events - blk-mq: Abort suspend when wakeup events are pending - blk-mq: add helper for checking if one CPU is mapped to specified hctx - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx - blk-mq: don't schedule block kworker on isolated CPUs - blk-mq: setup queue ->tag_set before initializing hctx - blk-mq: skip CPU offline notify on unmapped hctx - block,bfq: fix aux stat accumulation destination - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - block: fix race between set_blocksize and read paths - block: make REQ_OP_ZONE_OPEN a write operation - block: rate-limit capacity change info log - block: rnbd-clt: Fix leaked ID in init_dev() - block: rnbd-clt: Fix signedness bug in init_dev() - block: use int to store blk_stack_limits() return value - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: bcsp: receive data only if registered - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - Bluetooth: btrtl: Avoid loading the config file on security chips - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - Bluetooth: btusb: revert use of devm_kzalloc in btusb - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync - Bluetooth: hci_event: validate skb length for unknown CC opcode - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work - Bluetooth: ISO: don't leak skb in ISO_CONT RX - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: ISO: Fix possible UAF on iso_conn_free - Bluetooth: L2CAP: export l2cap_chan_hold for modules - Bluetooth: MGMT: cancel mesh send timer when hdev removed - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() - Bluetooth: rfcomm: fix modem control handling - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - bnxt_en: correct offset handling for IPv6 destination address - bnxt_en: Fix a possible memory leak in bnxt_ptp_init - bnxt_en: Fix potential data corruption with HW GRO/LRO - bonding: annotate data-races around slave->last_rx - bonding: check xdp prog when set bond mode - bonding: don't set oif to bond dev when getting NS target destination - bonding: limit BOND_MODE_8023AD to Ethernet devices - bonding: provide a net pointer to __skb_flow_dissect() - bonding: return detailed error when loading native XDP fails - bonding: set random address only when slaves already exist - bpf: account for current allocated stack depth in widen_imprecise_scalars() - bpf: Add bpf_prog_run_data_pointers() - bpf, arm64: Do not audit capability check in do_jit() - bpf: Avoid RCU context warning when unpinning htab with internal structs - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Clear pfmemalloc flag when freeing all fragments - bpf: Do not audit capability check in do_jit() - bpf: Do not let BPF test infra emit invalid GSO types to stack - bpf: Do not limit bpf_cgroup_from_id to current's namespace - bpf: Don't use %pK through printk - bpf: Enforce expected_attach_type for tailcall compatibility - bpf: Explicitly check accesses to bpf_sock_addr - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - bpf: Fix invalid prog->stats access when update_effective_progs fails - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - bpf: Free special fields when update [lru_,]percpu_hash maps - bpf: Handle return value of ftrace_set_filter_ip in register_fentry - bpf: Improve program stats run-time calculation - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Reject bpf_timer for PREEMPT_RT - bpf: Reject negative offsets for ALU ops - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - bpf/selftests: test_select_reuseport_kern: Remove unused header - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Sync pending IRQ work before freeing ring buffer - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - bridge: mcast: Fix use-after-free during router port configuration - bridge: Redirect to backup port when port is administratively down - broadcom: b44: prevent uninitialized value usage - btrfs: always detect conflicting inodes when logging inode refs - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - btrfs: do not assert we found block group item when creating free space tree - btrfs: do not skip logging new dentries when logging a new name - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: don't log conflicting inode if it's a dir moved in the current transaction - btrfs: don't rewrite ret from inode_permission - btrfs: ensure no dirty metadata is written back for an fs with errors - btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() - btrfs: factor out init_space_info() from create_space_info() - btrfs: fix a potential path leak in print_data_reloc_error() - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type - btrfs: fix incorrect readahead expansion length - btrfs: fix invalid extref key setup when replaying dentry - btrfs: fix leaf leak in an error path in btrfs_del_items() - btrfs: fix memory leak of fs_devices in degraded seed device path - btrfs: fix memory leaks in create_space_info() error paths - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() - btrfs: fix reservation leak in some error paths when inserting inline extent - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - btrfs: introduce btrfs_space_info sub-group - btrfs: mark dirty extent range for out of bound prealloc extents - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() - btrfs: ref-verify: handle damaged extent root tree - btrfs: scrub: always update btrfs_scrub_progress::last_physical - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: send: check for inline extents in range_is_hole_in_parent() - btrfs: store fs_info in space_info - btrfs: tree-checker: fix the incorrect inode ref size check - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: use readahead_expand() on compressed extents - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - bus: fsl-mc: Check return value of platform_get_resource() - bus: mhi: ep: Fix chained transfer handling in read path - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - cachestat: do not flush stats in recency check - caif: fix integer underflow in cffrml_receive() - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak - can: etas_es58x: allow partial RX URB allocation to succeed - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - can: gs_usb: gs_can_open(): fix error handling - can: gs_usb: gs_make_candev(): populate net_device->dev_port - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: gs_usb: increase max interface to U8_MAX - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - can: j1939: make j1939_session_activate() fail if device is no longer registered - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: netlink: can_changelink(): allow disabling of automatic restart - can: peak_usb: fix shift-out-of-bounds issue - can: rcar_canfd: Fix CAN-FD mode as default - can: rcar_canfd: Fix controller mode setting - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - can: sja1000: fix max irq loop handling - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - ceph: add checking of wait_for_completion_killable() return value - ceph: fix crash in process_v2_sparse_read() for encrypted directories - ceph: refactor wake_up_bit() pattern of calling - cgroup: split cgroup_destroy_wq into 3 workqueues - char: applicom: fix NULL pointer dereference in ac_ioctl - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - char: misc: restrict the dynamic range to exclude reserved minors - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - cifs: client: fix memory leak in smb3_fs_context_parse_param - cifs: Fix memory and information leak in smb3_reconfigure() - cifs: fix memory leak in smb3_fs_context_parse_param error path - cifs: fix pagecache leak when do writepages - cifs: Fix TCP_Server_Info::credits to be signed - cifs: fix typo in enable_gcm_256 module parameter - cifs: Fix uncached read into ITER_KVEC iterator - cifs: parse_dfs_referrals: prevent oob on malformed input - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points - cifs: stop writeback extension when change of size is detected - clk: at91: clk-master: Add check for divide by 3 - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: peripheral: fix return value - clk: keystone: fix compile testing - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: qcom: camcc-sm6350: Fix PLL config of PLL2 - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback - clk: renesas: cpg-mssr: Read back reset registers to assure values latched - clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register - clk: renesas: r9a06g032: Fix memory leak in error path - clk: renesas: rzg2l: Remove critical area - clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable() - clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R() - clk: renesas: Use str_on_off() helper - clk: samsung: exynos-clkout: Assign .num before accessing .hws - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - clk: tegra: do not overallocate memory for bpmp clocks - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clocksource/drivers/clps711x: Fix resource leaks in error paths - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - cnic: Fix use-after-free bugs in cnic_delete_task - comedi: c6xdigio: Fix invalid PNP driver unregistration - comedi: check device's attached status in compat ioctls - comedi: dmm32at: serialize use of paged registers - comedi: fix divide-by-zero in comedi_buf_munge() - comedi: Fix getting range information for subdevices 16 to 255 - comedi: multiq3: sanitize config options in multiq3_attach() - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - compiler_types.h: add "auto" as a macro for "__auto_type" - compiler_types: Move unused static inline functions warning to W=2 - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - coresight: etm4x: Add context synchronization before enabling trace - coresight-etm4x: Conditionally access register TRCEXTINSELR - coresight: etm4x: Correct polling IDLE bit - coresight: etm4x: Extract the trace unit controlling - coresight: etm4x: Support atclk - coresight: Only register perf symlink for sinks with alloc_buffer - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - coresight: trbe: Return NULL pointer for allocation failures - counter: 104-quad-8: Fix incorrect return value in IRQ handler - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag - cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist - cpufreq: Initialize cpufreq-based invariance before subsys - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() - cpufreq/longhaul: handle NULL policy in longhaul_exit - cpufreq: nforce2: fix reference count leak in nforce2 - cpufreq: s5pv210: fix refcount leak - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() - cpufreq: tegra186: Initialize all cores to max frequencies - cpufreq: tegra186: Set target frequency for all cpus in policy - cpuidle: Fail cpuidle device registration if there is one already - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: teo: Drop misguided target residency check - cpuidle: menu: Use residency threshold in polling state override decisions - cpuidle: qcom-spm: fix device and OF node leaks at probe - cpuset: Treat cpusets in attaching as populated - cramfs: Verify inode mode when loading from disk - crash: fix crashkernel resource shrink - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx - crypto: af_alg - Set merge to zero early in af_alg_sendmsg - crypto: af_alg - zero initialize memory allocated via sock_kmalloc - crypto: aspeed-acry - Convert to platform remove callback returning void - crypto: aspeed - Fix dma_unmap_sg() direction - crypto: aspeed - fix double free caused by devm - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - crypto: atmel - Fix dma_unmap_sg() direction - crypto: authenc - Correctly pass EINPROGRESS back up to the caller - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: caam - Add check for kcalloc() in test_len() - crypto: caam - double the entropy delay interval for retry - crypto: ccree - Correctly handle return of sg_nents_for_len - crypto: essiv - Check ssize for decryption and in-place encryption - crypto: hisilicon/qm - check whether the input function and PF are on the same device - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value - crypto: hisilicon/qm - restore original qos values - crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs - crypto: hisilicon - re-enable address prefetch after device resuming - crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations - crypto: keembay - Add missing check after sg_nents_for_len() - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - crypto: rng - Ensure set_ent is always present - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - crypto: sha256 - fix crash at kexec - crypto: starfive - Correctly handle return of sg_nents_for_len - crypto: sun8i-ce - remove channel timeout field - crypto: virtio - Add spinlock protection with virtqueue notification - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req - csky: fix csky_cmpxchg_fixup not working - dax: skip read lock assertion for read-only filesystems - devcoredump: Fix circular locking dependency with devcd->mutex. - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Disable SLUB_TINY for build testing - dlm: check for defined force value in dlm_lockspace_release - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - dmaengine: apple-admac: Add "apple,t8103-admac" compatible - dmaengine: at_hdmac: fix device leak on of_dma_xlate() - dmaengine: bcm-sba-raid: fix device leak on probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - dmaengine: dw: dmamux: fix OF node leak on route allocation failure - dmaengine: dw-edma: Set status for callback_result - dmaengine: idxd: fix device leaks on compat bind and unbind - dmaengine: idxd: Fix double free in idxd_setup_wqs() - dmaengine: idxd: Fix refcount underflow on module unload - dmaengine: idxd: Remove improper idxd_free - dmaengine: lpc18xx-dmamux: fix device leak on route allocation - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: omap-dma: fix dma_pool resource leak in error paths - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() - dmaengine: sh: setup_xref error handling - dmaengine: stm32: dmamux: fix device leak on route allocation - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure - dmaengine: tegra-adma: Fix use-after-free - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - dmaengine: ti: k3-udma: fix device leak on udma lookup - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing - dmaengine: xilinx: xdma: Fix regmap max_register - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - dma/pool: distinguish between missing and exhausted atomic pools - dma/pool: eliminate alloc_pages warning in atomic_pool_expand - dm-bufio: align write boundary on physical block size - dm-ebs: Mark full buffer dirty even on partial write - dm: fix NULL pointer dereference in __dm_suspend() - dm: fix queue start/stop imbalance under suspend/load/resume races - dm-integrity: limit MAX_TAG_SIZE to 255 - dm log-writes: Add missing set_freezable() for freezable kthread - dm-raid: fix possible NULL dereference with undefined raid type - dm-snapshot: fix 'scheduling while atomic' on real-time kernels - dm-verity: fix unreliable memory allocation - doc: fix seg6_flowlabel path - docs: networking: can: change bcm_msg_head frames member to support flexible array - Documentation: process: Also mention Sasha Levin as stable tree maintainer - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - dpaa2-switch: add bounds check for if_id in IRQ handler - dpaa2-switch: fix buffer pool seeding for control traffic - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero - driver core: enforce device_lock for driver_match_device() - driver core/PM: Set power.no_callbacks along with power.no_pm - drivers/base/node: fix double free in register_one_node() - drivers/base/node: handle error properly in register_one_node() - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() - drivers/perf: hisi: Relax the event ID check in the framework - drivers/usb/dwc3: fix PCI parent check - drm/amd: add more cyan skillfish PCI ids - drm/amd: Avoid evicting resources at S5 - drm/amd: Check whether secure display TA loaded successfully - drm/amd: Clean up kfd node on surprise disconnect - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Bump the HDMI clock to 340MHz - drm/amd/display: Check dce_hwseq before dereferencing it - drm/amd/display: Check NULL before accessing - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Enable mst when it's detected but yet to be initialized - drm/amd/display: ensure committing streams is seamless - drm/amd/display: Fix black screen with HDMI outputs - drm/amd/display: Fix DP no audio issue - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() - drm/amd/display: Fix null pointer deref in dcn20_resource.c - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: Increase DPCD read retries - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Remove redundant semicolons - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() - drm/amd/display: use udelay rather than fsleep - drm/amd: Fix suspend failure with secure display TA - drm/amdgpu: Add additional DCE6 SCL registers - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/amdgpu: csa unmap use uninterruptible lock - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amdgpu: fix a memory leak in fence cleanup when unloading - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - drm/amdgpu: Fix function header names in amdgpu_connectors.c - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amdgpu: Forward VMID reservation errors - drm/amdgpu/gfx10: fix wptr reset in KGQ init - drm/amdgpu/gfx11: fix wptr reset in KGQ init - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amdgpu: Power up UVD 3 for FW validation (v2) - drm/amdgpu: reject gang submissions under SRIOV - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/amdgpu/soc21: fix xclk for APUs - drm/amdgpu: use atomic functions with memory barriers for vm fault info - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - drm/amdkfd: Don't use sw fault filter if retry cam enabled - drm/amdkfd: fix a memory leak in device_queue_manager_init() - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - drm/amdkfd: fix vram allocation failure for a special case - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amd/pm: Don't clear SI SMC table when setting power limit - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) - drm/amd/powerplay: Fix CIK shutdown temperature - drm/ast: Use msleep instead of mdelay for edid read - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - drm/bridge: it6505: select REGMAP_I2C - drm/bridge: lt9211: Drop check for last nibble of version register - drm/etnaviv: fix flush sequence logic - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/gma500: Fix null dereference in hdmi teardown - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - drm/i915/backlight: Return immediately when scale() finds invalid parameters - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - drm/i915/guc: Skip communication warning on reset in progress - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/imx/tve: fix probe device leak - drm/mediatek: Disable AFBC support on Mediatek DRM driver - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() - drm/mediatek: Fix device use-after-free on unbind - drm/mediatek: fix potential OF node use-after-free - drm/mediatek: Fix probe memory leak - drm/mediatek: Fix probe resource leaks - drm/mgag200: Fix big-endian support - drm/mgag200: fix mgag200_bmc_stop_scanout() - drm/msm/a2xx: stop over-complaining about the legacy firmware - drm/msm/a6xx: fix bogus hwcg register updates - drm/msm/a6xx: Fix GMU firmware parser - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - drm/msm/dpu: Add missing NULL pointer check for pingpong interface - drm/msm/dpu: fix incorrect type for ret - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - drm/msm: make sure to not queue up recovery more than once - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/nouveau: restrict the flush page to a 32-bit address - drm/panel: novatek-nt35560: Fix invalid return value - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel - drm/panel: sony-td4353-jdi: Enable prepare_prev_first - drm/panel: visionox-rm69299: Don't clear all mode flags - drm/pl111: Fix error handling in pl111_amba_probe - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] - drm/rcar-du: dsi: Fix 1/2/3 lane support - drm/rockchip: vop2: use correct destination rectangle height check - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - drm/sched: Fix race in drm_sched_entity_select_rq() - drm: sti: fix device leaks at component probe - drm/sysfb: Do not dereference NULL pointer in plane reset - drm/tegra: Add call to put_pid() - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/tidss: Use the crtc_* timings when programming the HW - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - drm/ttm: Avoid NULL pointer deref for evicted BOs - drm/vgem-fence: Fix potential deadlock on release - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() - drm/vmwgfx: Fix a null-ptr access in the cursor snooper - drm/vmwgfx: Fix copy-paste typo in validation - drm/vmwgfx: Fix Use-after-free in validation - drm/vmwgfx: Use kref in vmw_bo_dirty - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml - dt-bindings: PCI: amlogic: Fix the register name of the DBI region - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO - dt-bindings: power: qcom,rpmpd: Add SM7150 - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner - dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions - dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215 - dt-bindings: power: rpmpd: Update part number to X1E80100 - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - e1000: fix OOB in e1000_tbi_should_accept() - EDAC/altera: Delete an inappropriate dma_free_coherent() call - EDAC/altera: Handle OCRAM ECC enable after warm reset - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller - EDAC/i3200: Fix a resource leak in i3200_probe1() - EDAC/mc_sysfs: Increase legacy channel support to 16 - EDAC/x38: Fix a resource leak in x38_probe1() - efi/cper: Add a new helper function to print bitmasks - efi/cper: Adjust infopfx size to accept an extra space - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs - efi/cper: Fix cper_bits_to_str buffer handling and return value - efi/libstub: Fix page table access in 5-level to 4-level paging transition - efivarfs: fix error propagation in efivar_entry_get() - epoll: Remove ep_scan_ready_list() in comments - espintcp: fix skb leaks - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - ethernet: Extend device_get_mac_address() to use NVMEM - ethernet: rvu-af: Remove slash from the driver name - ethtool: Avoid overflowing userspace buffer on stats query - eventpoll: Replace rwlock with spinlock - exec: Fix incorrect type for ret - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - exfat: fix remount failure in different process environments - exfat: limit log print for IO error - Expand the type of nfs_fattr->valid - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() - ext4: align max orphan file size with e2fsprogs limit - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() - ext4: clear i_state_flags when alloc inode - ext4: correctly handle queries for metadata mappings - ext4: correct the checking of quota files before moving extents - ext4: detect invalid INLINE_DATA + EXTENTS flag combination - ext4: filesystems without casefold feature cannot be mounted with siphash - ext4: fix an off-by-one issue during moving extents - ext4: fix checks for orphan inodes - ext4: fix error message when rejecting the default hash - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - ext4: fix incorrect group number assertion in mb_check_buddy - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() - ext4: fix string copying in parse_apply_sb_mount_options() - ext4: free orphan info with kvfree - ext4: guard against EA inode refcount underflow in xattr update - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - ext4: increase IO priority of fastcommit - ext4: introduce ITAIL helper - ext4: refresh inline data size before write operations - ext4: remove unused return value of __mb_check_buddy - ext4: validate ea_ino and size in check_xattrs - ext4: verify orphan file size is not too big - ext4: wait for ongoing I/O to complete before freeing blocks - ext4: xattr: fix null pointer deref in ext4_raw_inode() - extcon: adc-jack: Cleanup wakeup source only if it was enabled - extcon: adc-jack: Fix wakeup source leaks on device unbind - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: drop inode from the donation list when the last file is closed - f2fs: ensure node page reads complete before f2fs_put_super() finishes - f2fs: fix age extent cache insertion skip on counter overflow - f2fs: fix condition in __allow_reserved_blocks() - f2fs: fix infinite loop in __insert_extent_tree() - f2fs: fix return value of f2fs_recover_fsync_data() - f2fs: fix to avoid overflow while left shift operation - f2fs: fix to avoid potential deadlock - f2fs: fix to avoid updating compression context during writeback - f2fs: fix to avoid updating zero-sized extent in extent cache - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() - f2fs: fix to propagate error from f2fs_enable_checkpoint() - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - f2fs: fix wrong block mapping for multi-devices - f2fs: fix zero-sized extent for precache extents - f2fs: invalidate dentry cache on failed whiteout creation - f2fs: keep POSIX_FADV_NOREUSE ranges - f2fs: remove unused GC_FAILURE_PIN - f2fs: use f2fs_err_ratelimited() to avoid redundant logs - f2fs: use global inline_xattr_slab instead of per-sb slab cache - fbcon: fix integer overflow in fbcon_do_set_font - fbcon: Fix OOB access in font allocation - fbcon: Set fb_display[i]->mode to NULL when the mode is released - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds - fbdev: atyfb: Check if pll_ops->init_pll failed - fbdev: bitblit: bound-check glyph index in bit_putcs* - fbdev: Fix logic error in "offb" name match - fbdev: gbefb: fix to use physical address instead of dma address - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() - fbdev: tcx.c fix mem_map to correct smem_start offset - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - filelock: add FL_RECLAIM to show_fl_flags() macro - filemap: cap PTE range to be created to allowed zero fill in folio_map_range() - firewire: core: fix overlooked update of subsystem ABI version - firewire: nosy: Fix dma_free_coherent() size - firmware: arm_scmi: Account for failed debug initialization - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - firmware: arm_scmi: Fix unused notifier-block in unregister - firmware: firmware: meson-sm: fix compile-test default - firmware: imx: scu-irq: fix OF node leak in - firmware: imx: scu-irq: Init workqueue before request mbox channel - firmware: imx: scu-irq: Set mu_resource_id before get handle - firmware: meson_sm: fix device leak at probe - firmware: stratix10-svc: Add mutex in stratix10 memory management - firmware: stratix10-svc: fix bug in saving controller data - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc - Fix memory leak in posix_clock_open() - fjes: Add missing iounmap in fjes_hw_init() - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - flex_proportions: make fprop_new_period() hardirq safe - floppy: fix for PAGE_SIZE != 4KB - fou: Don't allow 0 for FOU_ATTR_IPPROTO. - fs/9p: Don't open remote file with APPEND mode when writeback cache is used - fs: Add 'initramfs_options' to set initramfs mount options - fs: always return zero on success from replace_fd() - fscontext: do not consume log entries when returning -EMSGSIZE - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - fs/nfs/io: make nfs_start_io_*() killable - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() - fs/nls: Fix utf16 to utf8 conversion - fs/notify: call exportfs_encode_fid with s_umount - fsnotify: do not generate ACCESS/MODIFY events on child for special files - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fs: ntfs3: Fix integer overflow in run_unpack() - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - fs/ntfs3: Initialize allocated memory before use - fs/ntfs3: out1 also needs to put mi - fs/ntfs3: Prevent memory leaks in add sub record - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs/ntfs3: Support timestamps prior to epoch - fs/proc: fix uaf in proc_readdir_de() - fs: quota: create dedicated workqueue for quota_release_work - fs: udf: fix OOB read in lengthAllocDescs handling - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() - ftrace: Fix BPF fexit with livepatch - ftrace: Fix softlockup in ftrace_module_enable - ftrace/samples: Fix function size computation - fuse: allocate ff->release_args only if release is needed - fuse: Always flush the page cache before FOPEN_DIRECT_IO write - fuse: check if copy_file_range() returns larger than requested size - fuse: fix livelock in synchronous file put from fuseblk workers - fuse: fix readahead reclaim deadlock - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write - fuse: prevent overflow in copy_file_range return value - fuse: zero initialize inode private data - futex: Don't leak robust_list pointer on exec race - futex: Prevent use-after-free during requeue-PI - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - gcov: add support for GCC 15 - genalloc.h: fix htmldocs warning - genirq/irq_sim: Initialize work context pointers properly - gfs2: fix freeze error handling - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - gfs2: fix remote evict for read-only filesystems - gfs2: Fix use of bio_chain - gpio: 104-idio-16: Define maximum valid register address offset - gpio: idio-16: Define fixed direction of the GPIO lines - gpiolib: acpi: Add quirk for Dell Precision 7780 - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler - gpiolib: Extend software-node support to support secondary software-nodes - gpio: ljca: Fix duplicated IRQ mapping - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - gpio: omap: do not register driver in probe() - gpio: pca953x: Add support for level-triggered interrupts - gpio: pca953x: fix wrong error probe return value - gpio: pca953x: handle short interrupt pulses on PCAL devices - gpio: pca953x: mask interrupts in irq shutdown - gpio: pca953x: Utilise dev_err_probe() where it makes sense - gpio: pca953x: Utilise temporary variable for struct device - gpio: pci-idio-16: Define maximum valid register address offset - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - gpio: rockchip: mark the GPIO controller as sleeping - gpio: rockchip: Stop calling pinctrl for set_direction - gpio: update Intel LJCA USB GPIO driver - gpio: wcd934x: mark the GPIO controller as sleeping - gpu: host1x: Fix race in syncpt alloc/free - gue: Fix skb memleak with inner IP protocol 0. - gve: Correct ethtool rx_dropped calculation - gve: Fix stats report corruption on queue count change - hfs: clear offset and space out of valid records in b-tree node - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - hfs: make proper initalization of struct hfs_find_data - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() - hfsplus: fix volume corruption issue for generic/070 - hfsplus: fix volume corruption issue for generic/073 - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfsplus: Verify inode mode when loading from disk - hfs: validate record offset in hfsplus_bmap_alloc - HID: amd_sfh: Stop sensor before starting - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) - HID: asus: add support for missing PX series fn keys - HID: asus: add Z13 folio to generic group for multitouch to work - HID: core: Harden s32ton() against conversion to 0 bits - HID: elecom: Add support for ELECOM M-XT3URBK (018F) - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - HID: hid-input: Extend Elan ignore battery quirk to USB - HID: hid-input: only ignore 0 battery events for digitizers - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen - HID: intel-ish-hid: Reset enum_devices_done before enumeration - HID: intel-ish-hid: Update ishtp bus match to support device ID table - HID: logitech-dj: Remove duplicate error logging - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL - HID: multitouch: fix name of Stylus input devices - HID: multitouch: fix sticky fingers - HID: playstation: Center initial joystick axes to prevent spurious events - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 - HID: quirks: work around VID/PID conflict for appledisplay - HID: uclogic: Fix potential memory leak in error path - HID: usbhid: paper over wrong bNumDescriptor field - hrtimer: Fix softirq base check in update_needs_ipi() - hrtimer: Remove unused function - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimers: Unconditionally update target CPU base after offline timer migration - hsr: Fix supervision frame sending on HSRv0 - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (ibmpex) fix use-after-free in high/low store - hwmon: (k10temp) Add device ID for Strix Halo - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models - hwmon: (max16065) Use local variable to avoid TOCTOU - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - hwmon: (occ) Mark occ_init_attribute() as __printf - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - hwmon: (sht3x) Fix error handling - hwmon: sy7636a: add alias - hwmon: sy7636a: Fix regulator_enable resource leak on error path - hwmon: (tmp401) fix overflow caused by default conversion rate value - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - hwrng: nomadik - add ARM_AMBA dependency - hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_* - i2c: amd-mp2: fix reference leak in MP2 PCI device - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Add quirk for Intel Xe - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware - i2c: designware: Fix clock issue when PM is disabled - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA - i3c: fix refcount inconsistency in i3c_master_register - i3c: master: Inherit DMA masks and parameters from parent device - i3c: master: svc: Prevent incomplete IBI transaction - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - i40e: add mask to apply valid bits for itr_idx - i40e: add max boundary check for VF filters - i40e: add validation for ring_len param - i40e: fix idx validation in config queues msg - i40e: fix idx validation in i40e_validate_queue_map - i40e: fix input validation logic for action_meta - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path - i40e: fix scheduling in set_rx_mode - i40e: fix validation of VF state in get resources - i40e: improve VF MAC filters accounting - i40e: increase max descriptors for XL710 - i40e: remove redundant memory barrier when cleaning Tx descs - iavf: fix off-by-one issues in iavf_config_rss_reg() - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - IB/sa: Fix sa_local_svc_timeout_ms read race - ice: Avoid detrimental cleanup for bond during interface stop - ice: Don't use %pK through printk or tracepoints - ice: initialize ring_stats->syncp - ice: stop counting UDP csum mismatch as rx_errors - idr: fix idr_alloc() returning an ID out of range - igb: fix link test skipping when interface is admin down - igc: fix race condition in TX timestamp read for register 0 - iio: accel: bmc150: Fix irq assumption regression - iio: accel: fix ADXL355 startup race condition - iio: accel: iis328dq: fix gain values - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: adc: ad7280a: handle spi_setup() errors in probe() - iio: adc: ad9467: fix ad9434 vref mask - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver - iio: adc: exynos_adc: fix OF populate on driver rebind - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: rtq6056: Correct the sign bit index - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains - iio: chemical: scd4x: fix reported channel endianness - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: core: add missing mutex_destroy in iio_dev_release() - iio: core: add separate lockdep class for info_exist_lock - iio: dac: ad5360: use int type to store negative error codes - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - iio: frequency: adf4350: Fix prescaler usage. - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - iio: imu: inv_icm42600: Simplify pm_runtime setup - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: xilinx-ams: Unmask interrupts after updating alarms - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - ima: Handle error code returned by ima_filter_rule_match() - ima: limit the number of ToMToU integrity violations - inet: Avoid ehash lookup race in inet_ehash_insert() - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - inet: ping: Fix icmp out counting - init: handle bootloader identifier in kernel parameters - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - Input: atmel_mxt_ts - allow reset GPIO to sleep - Input: cros_ec_keyb - fix an invalid memory access - Input: goodix - add support for ACPI ID GDIX1003 - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: imx_sc_key - fix memory corruption on unload - Input: iqs7222 - avoid enabling unused interrupts - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak - intel_th: fix device leak on output open() - intel_th: Fix error handling in intel_th_output_open - interconnect: debugfs: Fix incorrect error handling for NULL path - interconnect: debugfs: initialize src_node and dst_node to empty strings - interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS - iomap: account for unaligned end offsets when truncating read range - iomap: adjust read range correctly for non-block-aligned positions - iomap: always run error completions in user context - iomap: factor out a iomap_dio_done helper - iommu/amd: Fix pci_segment memleak in alloc_pci_segment() - iommu/amd/pgtbl: Fix possible race while increase page table level - iommu/amd: Skip enabling command/event buffers for kdump - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/apple-dart: fix device leak on of_xlate() - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal - iommu: disable SVA when CONFIG_X86 is set - iommu/exynos: fix device leak on of_xlate() - iommufd: Don't overflow during division for dirty tracking - iommufd: Make vfio_compat's unmap succeed if the range is already empty - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED - iommu/ipmmu-vmsa: fix device leak on of_xlate() - iommu/mediatek: fix device leak on of_xlate() - iommu/mediatek: fix use-after-free on probe deferral - iommu/mediatek-v1: fix device leak on probe_device() - iommu/mediatek-v1: fix device leaks on probe() - iommu/omap: fix device leaks on probe_device() - iommu/qcom: fix device leak on of_xlate() - iommu/sun50i: fix device leak on of_xlate() - iommu/tegra: fix device leak on probe_device() - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - iommu/vt-d: PRS isn't usable if PDS isn't supported - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - io_uring: backport io_should_terminate_tw() - io_uring: correct __must_hold annotation in io_install_fixed_file - io_uring: fix filename leak in __io_openat_prep() - io_uring: include dying ring in task_work "should cancel" state - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - io_uring: move local task_work in exit cancel loop - io_uring/poll: correctly handle io_poll_add() return value on update - ip6_gre: make ip6gre_header() robust - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - ipmi: Fix handling of messages with provided receive message pointer - ipmi: Fix __scan_channels() failing to rescan channels - ipmi: Fix the race between __scan_channels() and deliver_response() - ipmi: Rework user message limit handling - ipv4: Fix reference count leak when using error routes with nexthop objects - ipv4: ip_gre: make ipgre_header() robust - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe - ipv6: add exception routes to GC list in rt6_insert_exception - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - ipv6: annotate data-race in ndisc_router_discovery() - ipv6: avoid possible NULL deref in modify_prefix_route() - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - ipv6: clear RA flags when adding a static route - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF - ipv6: Fix use-after-free in inet6_addr_del(). - ipv6: np->rxpmtu race annotation - ipv6: use the right ifindex when replying to icmpv6 from localhost - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() - ipvlan: Make the addrs_lock be per port - ipvs: Defer ip_vs_ftp unregister during netns cleanup - ipvs: fix ipv4 null-ptr-deref in route error path - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - irqchip/gic-v3-its: Avoid truncating memory addresses - irqchip/imx-mu-msi: Fix section mismatch - irqchip/irq-bcm7038-l1: Fix section mismatch - irqchip/irq-bcm7120-l2: Fix section mismatch - irqchip/irq-brcmstb-l2: Fix section mismatch - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() - irqchip/qcom-irq-combiner: Fix section mismatch - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - irqchip/sifive-plic: Respect mask state when setting affinity - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() - ixgbevf: Add support for Intel(R) E610 device - ixgbevf: fix getting link speed data for E610 devices - ixgbevf: fix mailbox API compatibility by negotiating supported features - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted - jbd2: ensure that all ongoing I/O complete before freeing blocks - jbd2: fix the inconsistency between checksum and data in memory for journal sb - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key - jbd2: use a weaker annotation in journal handling - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - kallsyms: Fix wrong "big" kernel symbol type read from procfs - kasan: fix GCC mem-intrinsic prefix with sw tags - kasan: refactor pcpu kasan vmalloc unpoison - kbuild: uapi: Strip comments before size type check - kbuild: Use objtree for module signing key path - kconfig: fix static linking of nconf - kconfig/mconf: Initialize the default locale at startup - kconfig/nconf: Initialize the default locale at startup - kernel.h: Move ARRAY_SIZE() to a separate header - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths - kernfs: Fix UAF in polling when open file is released - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - KEYS: trusted_tpm1: Compare HMAC values in constant time - KEYS: X.509: Fix Basic Constraints CA flag parsing - kmsan: fix out-of-bounds access to shadow memory - ksmbd: add max ip connections parameter - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - ksmbd: close accepted socket when per-IP limit rejects connection - ksmbd: fix buffer validation by including null terminator size in EA length - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - ksmbd: Fix memory leak in get_file_all_info() - ksmbd: fix null pointer dereference in alloc_preauth_hash() - ksmbd: Fix race condition in RPC handle list access - ksmbd: fix recursive locking in RPC handle list access - ksmbd: Fix refcount leak when invalid session is found on session lookup - ksmbd: fix use-after-free in ksmbd_session_rpc_open - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - ksmbd: fix use-after-free in session logoff - ksmbd: ipc: fix use-after-free in ipc_msg_send_request - ksmbd: skip lock-range check on equal size to avoid size==0 underflow - ksmbd: smbd: fix dma_unmap_sg() nents - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: transport_ipc: validate payload size before reading handle - ksmbd: use sock_create_kern interface to create kernel socket - ksmbd: vfs: fix race on m_flags in vfs_cache - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - ktest.pl: Fix uninitialized var in config-bisect.pl - kunit: kasan_test: disable fortify string checker on kasan_strings() test - KVM: arm64: Check the untrusted offset in FF-A memory share - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - KVM: Don't clobber irqfd routing type when deassigning irqfd - KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() - KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits - KVM: nSVM: Fix and simplify LBR virtualization handling with nested - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 - KVM: SVM: Fix redundant updates of LBR MSR intercepts - KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN - KVM: SVM: Set synthesized TSA CPUID flags - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 - l2tp: avoid one data-race in l2tp_tunnel_del_work() - lan966x: Fix sleeping in atomic context - leds: flash: leds-qcom-flash: Update torch current clamp setting - leds: led-class: Only Add LED to leds_list when it is fully ready - leds: leds-lp50xx: Allow LED 0 to be added to module bank - leds: leds-lp50xx: Enable chip before any communication - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs - leds: netxbig: Fix GPIO descriptor leak in error paths - leds: spi-byte: Use devm_led_classdev_register_ext() - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - libbpf: Fix reuse of DEVMAP - libceph: fix invalid accesses to ceph_connection_v1_info - libceph: fix potential use-after-free in have_mon_and_osd_map() - libceph: make calc_target() set t->paused, not just clear it - libceph: make decode_pool() more resilient against corrupted osdmaps - libceph: make free_choose_arg_map() resilient to partial allocation - libceph: prevent potential out-of-bounds reads in handle_auth_done() - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - libceph: reset sparse-read state in osd_fault() - libceph: return the handler error from mon_handle_auth_done() - lib/crypto: aes: Fix missing MMU protection for AES S-box - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit - lib/genalloc: fix device leak in of_gen_pool_get() - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map - libperf event: Ensure tracing data is multiple of 8 sized - lib/vsprintf: Check pointer before dereferencing in time_and_date() - livepatch: Match old_sympos 0 and 1 in klp_find_func() - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - lockd: fix vfs_test_lock() calls - locking/spinlock/debug: Fix data-race in do_raw_write_lock - LoongArch: Add machine_kexec_mask_interrupts() implementation - LoongArch: Add more instruction opcodes and emit_* helpers - LoongArch: Add new PCI ID for pci_fixup_vgadev() - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Automatically disable kaslr if boot from kexec_file - LoongArch: BPF: Sign extend kfunc call arguments - LoongArch: BPF: Zero-extend bpf_tail_call() index - LoongArch: Check the return value when creating kobj - LoongArch: Correct the calculation logic of thread_count - LoongArch: Don't panic if no valid cache info for PCI - LoongArch: Enable exception fixup for specific ADE subcode - LoongArch: Fix build errors for CONFIG_RANDSTRUCT - LoongArch: Fix PMU counter allocation for mixed-type event groups - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Mask all interrupts during kexec/kdump - LoongArch: Refactor register restoration in ftrace_common_return - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED - LoongArch: Update help info of ARCH_STRICT_ALIGN - LoongArch: Use correct accessor to read FWPC/MWPC - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - LoongArch: Use __pmd()/__pte() for swap entry conversions - LoongArch: Use UAPI types in ptrace UAPI header - LoongArch: Use unsigned long for _end and _text - loop: Avoid updating block size under exclusive owner - m68k: bitops: Fix find_*_bit() signatures - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse - macvlan: fix error recovery in macvlan_common_newlink() - macvlan: fix possible UAF in macvlan_forward_source() - mailbox: mailbox-test: Fix debugfs_create_dir error checking - mailbox: pcc: don't zero error register - mailbox: pcc: Refactor error handling in irq handler into separate function - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - maple_tree: fix tracepoint string pointers - md/raid5: fix IO hang when array is broken with IO inflight - media: adv7180: Add missing lock in suspend callback - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Only validate format in querystd - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() - media: amphion: Add a frame flush mode for decoder - media: amphion: Cancel message work before releasing the VPU core - media: amphion: Delete v4l2_fh synchronously in .release() - media: amphion: Make some vpu_v4l2 functions static - media: amphion: Remove vpu_vb_is_codecconfig - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove - media: cec: Fix debugfs leak on bus_register() failure - media: cx18: Add missing check after DMA map - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - media: fix uninitialized symbol warnings - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe - media: i2c: imx214: Fix link frequency validation - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - media: i2c: mt9v111: fix incorrect type for ret - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - media: imon: make send_packet() more robust - media: lirc: Fix error handling in lirc_register() - media: mc: Clear minor number before put device - media: mc: Fix MUST_CONNECT handling for pads with no links - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() - media: mediatek: vcodec: Use spinlock for context list protection lock - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: ov08x40: Fix the horizontal flip control - media: pci: ivtv: Add missing check after DMA map - media: pci: ivtv: Don't create fake v4l2_fh - media: pvrusb2: Fix incorrect variable used in trace message - media: rc: fix races with imon_disconnect() - media: rc: st_rc: Fix reset control resource leak - media: redrat3: use int type to store negative error codes - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - media: samsung: exynos4-is: fix potential ABBA deadlock on init - media: st-delta: avoid excessive stack usage - media: TDA1997x: Remove redundant cancel_delayed_work in probe - media: tuner: xc5000: Fix use-after-free in xc5000_release - media: tunner: xc5000: Refactor firmware load - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID - media: uvcvideo: Use heuristic to find stream entity - media: v4l2-mem2mem: Fix outdated documentation - media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: verisilicon: Fix CPU stalls on G2 bus error - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index - media: verisilicon: Store chroma and motion vectors offset - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path - media: vidtv: initialize local pointers upon transfer of memory ownership - media: vpif_capture: fix section mismatch - media: vpif_display: fix section mismatch - media: zoran: Remove zoran_fh structure - mei: me: add nova lake point S DID - mei: me: add wildcat lake P DID - mei: trace: treat reg parameter as string - memcg: fix data-race KCSAN bug in rstats - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - memory tiering: add abstract distance calculation algorithms management - memory tiers: use default_dram_perf_ref_source in log message - memstick: Add timeout to prevent indefinite waiting - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup - mfd: da9055: Fix missing regmap_del_irq_chip() in error path - mfd: da9063: Split chip variant reading in two bus transactions - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: madera: Work around false-positive -Wininitialized warning - mfd: max77620: Fix potential IRQ chip conflict when probing two devices - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path - mfd: rz-mtu3: Fix MTU5 NFCR register offset - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - migrate: correct lock ordering for hugetlb file folios - minixfs: Verify inode mode when loading from disk - minmax: add a few more MIN_T/MAX_T users - minmax: avoid overly complicated constant expressions in VM code - minmax: don't use max() in situations that want a C constant expression - minmax: fix up min3() and max3() too - minmax.h: add whitespace around operators and after commas - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: update some comments - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax: improve macro expansion and type checking - minmax: make generic MIN() and MAX() macros available everywhere - minmax: simplify and clarify min_t()/max_t() implementation - minmax: simplify min()/max()/clamp() implementation - MIPS: Fix a reference leak bug in ip22_check_gio() - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add missing properties to cpu node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - misc: fastrpc: Add missing dev_err newlines - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - misc: fastrpc: Fix fastrpc_map_lookup operation - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Skip reference for DMA handles - misc: genwqe: Fix incorrect cmd field being reported in error - mISDN: annotate data-race around dev->work - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats - mlxsw: spectrum_router: Fix neighbour use-after-free - mlxsw: spectrum_router: Fix possible neighbour reference count leak - mm: add folio_expected_ref_count() for reference count calculation - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() - mm/balloon_compaction: we cannot have isolated pages in the balloon list - mmc: core: SPI mode remove cmd7 - mmc: host: renesas_sdhi: Fix the actual clock - mmc: mvsdio: Fix dma_unmap_sg() nents value - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function - mmc: sdhci-cadence: add Mobileye eyeQ support - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode - mm/damon/core: set quota->charged_from to jiffies at first charge window - mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure - mm/damon/sysfs: fix use-after-free in state_show() - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() - mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() - mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() - mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out() - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() - mm/damon/tests/core-kunit: handle memory failure from damon_test_target() - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm: fix arithmetic for bdi min_ratio - mm: fix arithmetic for max_prop_frac when setting max_ratio - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: check ref_count instead of lru before migration - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - mm: hugetlb: avoid soft lockup when mprotect to large memory area - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/hugetlb: fix folio is still mapped when deleted - mm: introduce and use {pgd,p4d}_populate_kernel() - mm, kfence: describe @slab parameter in __kfence_obj_info() - mm/kfence: randomize the freelist on initialization - mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios - mm/khugepaged: fix the address passed to notifier on testing young - mm: kmsan: fix poisoning of high-order non-compound pages - mm/ksm: fix exec/fork inheritance support for prctl - mm/ksm: fix flag-dropping behavior in ksm_madvise - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - mm: memcg: add per-memcg zswap writeback stat - mm: memcg: add THP swap out info for anonymous reclaim - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: make stats flushing threshold per-memcg - mm: memcg: move vmstats structs definition above flushing code - mm: memcg: optimize parent iteration in memcg_rstat_updated() - mm: memcg: restore subtree stats flushing - mm/memory: do not populate page table entries beyond i_size - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory - mm/memory-tier: fix abstract distance calculation overflow - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/mempool: replace kmap_atomic() with kmap_local_page() - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() - mm: migrate_device: use more folio in migrate_device_finalize() - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - mm/page_alloc: prevent pcp corruption with SMP=n - mm, percpu: do not consider sleepable allocations atomic - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/secretmem: fix use-after-free race in fault handler - mm: simplify folio_expected_ref_count() - mm/truncate: unmap large folio on split failure - mm: workingset: move the stats flush into workingset_test_recent() - most: usb: fix double free on late probe failure - most: usb: Fix use-after-free in hdm_disconnect - most: usb: hdm_probe: Fix calling put_device() before device initialization - mptcp: avoid deadlock on fallback while reinjecting - mptcp: avoid dup SUB_CLOSED events after disconnect - mptcp: avoid unneeded subflow-level drops - mptcp: clear scheduled subflows on retransmit - mptcp: decouple mptcp fastclose from tcp close - mptcp: Disallow MPTCP subflows from sockmap - mptcp: do not fallback when OoO is present - mptcp: drop bogus optimization in __mptcp_check_push() - mptcp: ensure context reset on disconnect() - mptcp: fallback earlier on simult connection - mptcp: fix ack generation for fallback msk - mptcp: fix a race in mptcp_pm_del_add_timer() - mptcp: fix duplicate reset on fastclose - mptcp: fix MSG_PEEK stream corruption - mptcp: fix premature close in case of fallback - mptcp: Fix proto fallback detection with BPF - mptcp: fix race condition in mptcp_schedule_work() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). - mptcp: only reset subflow errors when propagated - mptcp: pm: ignore unknown endpoint flags - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR - mptcp: pm: in-kernel: usable client side with C-flag - mptcp: pm: nl: announce deny-join-id0 flag - mptcp: propagate shutdown to subflows when possible - mptcp: restore window probe - mptcp: schedule rtx timer only after pushing data - mptcp: set remote_deny_join_id0 on SYN recv - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - mptcp: tfo: record 'deny join id0' info - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() - mtdchar: fix integer overflow in read/write ioctls - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds - mtd: nand: raw: atmel: Fix comment in timings preparation - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: relax ECC parameter validation check - mtd: onenand: Pass correct pointer to IRQ handler - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - mtd: rawnand: fsmc: Default to autodetect buswidth - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - mtd: rawnand: stm32_fmc2: fix ECC overwrite - nbd: defer config put in recv_work - nbd: defer config unlock in nbd_genl_connect - nbd: restrict sockets to TCP and UDP - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() - net/9p: fix double req put in p9_fd_cancelled - net: Add locking to protect skb->dev access in ip_output - net: add skb_header_pointer_careful() helper - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - net: allow small head cache usage with large MAX_SKB_FRAGS values - net: Allow to use SMP threads for backlog NAPI. - net: aquantia: Add missing descriptor cache invalidation on ATL2 - net: atlantic: fix fragment overflow handling in RX path - net: bcmasp: fix early exit leak with fixed phy - net: bonding: fix possible peer notify event loss or dup issue - net: bridge: annotate data-races around fdb->{updated,used} - net: bridge: Bounce invalid boolopts - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct - net: bridge: fix MST static key usage - net: bridge: fix static key check - net: bridge: fix use-after-free due to MST port state bypass - net: bridge: Install FDB for bridge MAC on VLAN 0 - net: bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry - net: call cond_resched() less often in __release_sock() - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts - net/cls_cgroup: Fix task_get_classid() during qdisc run - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates - netdevsim: add Makefile for selftests - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - net: dlink: handle copy_thresh allocation failure - net: dlink: handle dma_map_single() failure properly - net: don't touch dev->stats in BPF redirect paths - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: dsa: b53: skip multicast entries for fdb_dump() - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: fix off-by-one in maximum bridge ID determination - net: dsa: hellcreek: fix missing error handling in LED registration - net: dsa: improve shutdown sequence - net: dsa: lantiq_gswip: do also enable or disable cpu port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: microchip: common: Fix checks on irq_find_mapping() - net: dsa: microchip: Fix reserved multicast address table programming - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: lan937x: Fix RGMII delay tuning - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: do not transmit redirected XDP frames when the link is down - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - net: enetc: fix the deadlock of enetc_mdio_lock - net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - net: fec: cancel perout_timer when PEROUT is disabled - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not register PPS event for PEROUT - net: fec: do not update PEROUT if it is enabled - net: fec: ERR007885 Workaround for XDP TX path - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan - netfilter: ipset: Remove unused htable_bits in macro ahash_region - netfilter: nf_conncount: fix leaked ct in error paths - netfilter: nf_conncount: rework API to use sk_buff directly - netfilter: nf_conncount: update last_gc only when GC has been performed - netfilter: nf_reject: don't reply to icmp error messages - netfilter: nf_tables: allow loads only when register is initialized - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - netfilter: nf_tables: fix memory leak in nf_tables_newrule() - netfilter: nf_tables: missing objects with no memcg accounting - netfilter: nf_tables: pass context structure to nft_parse_register_load - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: remove redundant chain validation on register store - netfilter: nft_connlimit: update the count if add was skipped - netfilter: nft_objref: validate objref and objrefmap expressions - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation - netfilter: nft_synproxy: avoid possible data-race on update operation - netfilter: replace -EEXIST with -EBUSY - net: fix memory leak in skb_segment_list for GRO packets - net: fix NULL pointer dereference in l3mdev_l3_rcv - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - net: gro: fix outer network offset - net/handshake: duplicate handshake cancellations leak socket - net/handshake: Fix memory leak in tls_handshake_accept() - net/handshake: restore destructor on submit failure - net: hns3: add VLAN id validation before using - net: hns3: fix data race in hns3_fetch_stats - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - net: hns3: return error code when function fails - net: hns3: using the num_tqps in the vf driver to apply for resources - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx - net: hsr: Add support for MC filtering at the slave device - net: hsr: Add VLAN CTAG filter support - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() - net: hv_netvsc: reject RSS hash key programming without RX indirection table - net: intel: fm10k: Fix parameter idx set but not used - net/ip6_tunnel: Prevent perpetual tunnel growth - net: ipv6: fix field-spanning memcpy warning in AH output - net/ipv6: Remove expired routes with a separated list of routes. - net: lan743x: Allocate rings outside ZONE_DMA - net: lan966x: Fix the initialization of taprio - net: libwx: fix device bus LAN ID - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup - net: liquidio: fix overflow in octeon_init_instr_queue() - net: liquidio: Initialize netdev pointer before queue setup - net: macb: avoid dealing with endianness in macb_set_hwaddr() - net: macb: fix unregister_netdev call order in macb_remove() - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure - net: mdio: aspeed: add dummy read to avoid read-after-write issue - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - net: mdio: fix resource leak in mdiobus_register_device() - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - net/mlx5: Clean up only new IRQ glue on request_irq() failure - net/mlx5: Drain firmware reset in shutdown callback - net/mlx5e: Account for netdev stats in ndo_get_stats64 - net/mlx5e: Consider aggregated port speed during rate configuration - net/mlx5e: Don't print error message due to invalid module - net/mlx5e: Don't query FEC statistics when FEC is disabled - net/mlx5e: Fix maxrate wraparound in threshold between units - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Fix validation logic in rate limiting - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Harden uplink netdev access against device unbind - net/mlx5e: Report rx_discards_phy via rx_dropped - net/mlx5e: Restore destroying state bit after profile cleanup - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload - net/mlx5e: TC, delete flows only for existing peers - net/mlx5e: Use extack in get module eeprom by page callback - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() - net/mlx5: fw reset, add reset timeout work - net/mlx5: fw reset, clear reset requested on drain_fw_reset - net/mlx5: fw_tracer, Handle escaped percent properly - net/mlx5: fw_tracer, Validate format string parameters - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Serialize firmware reset with devlink - net/mlx5: Skip HotPlug check on sync reset using hot reset - net/mlx5: Stop polling for command response if interface goes down - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: mscc: ocelot: Fix crash when adding interface under a lag - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - net: netpoll: ensure skb_pool list is always initialized - net: netpoll: fix incorrect refcount handling causing incorrect cleanup - net: netpoll: flush skb pool during cleanup - net: netpoll: Individualize the skb pool - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write - net: nfc: nci: Add parameter validation for packet data - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy - net: openvswitch: fix data race in ovs_vport_get_upcall_stats - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - net: phy: adin1100: Fix software power-down ready condition - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY - net: phy: clear link parameters on admin link down - net: phy: dp83867: Disable EEE support as not implemented - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - net: phy: fix phy_uses_state_machine() - net: phy: marvell: Fix 88e1510 downshift counter errata - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - netpoll: remove netpoll_srcu - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() - net: ravb: Enforce descriptor type ordering - net: ravb: Ensure memory write completes before ringing TX doorbell - net: Remove conditional threaded-NAPI wakeup based on task state. - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - netrom: fix double-free in nr_route_frame() - netrom: Fix memory leak in nr_sendmsg() - net: rose: fix invalid array index in rose_kill_by_device() - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - net/sched: act_ife: avoid possible NULL deref - net/sched: act_ife: convert comma to semicolon - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net/sched: cls_u32: use skb_header_pointer_careful() - net/sched: Enforce that teql can only be used as root qdisc - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change - net/sched: ets: Remove drr class from the active list if it changes to strict - net_sched: limit try_bulk_dequeue_skb() batches - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop - net/sched: sch_qfq: do not free existing class in qfq_change_class() - net/sched: sch_qfq: Fix null-deref in agg_dequeue - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module - net: sh_eth: Disable WoL if system can not suspend - net/smc: fix mismatch between CLC header and proposal - net: sock: fix hardened usercopy panic in sock_recv_errqueue - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - net: stmmac: Correctly handle Rx checksum offload errors - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - net: stmmac: Fix accessing freed irq affinity_hint - net: stmmac: fix rx limit check in stmmac_rx_zc() - net: stmmac: fix the crash issue for zero copy XDP_TX action - net: stmmac: make sure that ptp_rate is not 0 before configuring EST - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: tls: Cancel RX async resync request on rcd_delta overflow - net: tls: wait for async completion on last message - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - net: update netdev_lock_{type,name} - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - net: usb: asix_devices: Check return value of usbnet_get_endpoints - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock - net: usb: asix: validate PHY address before use - net: usb: dm9601: remove broken SR9700 support - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: pegasus: fix memory leak in update_eth_regs_async() - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast - net: usb: rtl8150: Fix frame padding - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - net: usb: sr9700: fix incorrect command used to write single register - net: usb: sr9700: support devices with virtual driver CD - net: vlan: sync VLAN features with lower device - net: When removing nexthops, don't call synchronize_net if it is not necessary - net: wwan: iosm: Fix memory leak in ipc_mux_deinit() - net: wwan: t7xx: fix potential skb->frags overflow in RX path - nexthop: Forbid FDB status change while nexthop is in a group - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). - nfc: nci: Fix race between rfkill and nci_unregister_device(). - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() - nfp: fix RSS hash key size when RSS is not supported - NFS4: Fix state renewals missing after boot - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags - NFS: Avoid changing nlink when file removes and attribute updates race - NFS: check if suid/sgid was cleared after a write as needed - nfs_common: factor out nfs_errtbl and nfs_stat_to_errno - NFSD/blocklayout: Fix minlength check in proc_layoutget - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap - nfsd: convert to new timestamp accessors - nfsd: decouple the xprtsec policy check from check_nfsd_access() - NFSD: Define a proc_layoutcommit for the FlexFiles layout type - nfsd: don't ignore the return code of svc_proc_register() - nfsd: Drop the client reference in client_states_open() - nfsd: Fix a regression in nfsd_setattr() - NFSD: Fix crash in nfsd4_read_release() - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - NFSD: Fix last write offset handling in layoutcommit - nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr() - NFSD: Fix permission check for read access to executable-only files - NFSD: fix race between nfsd registration and exports_proc - NFSD: free copynotify stateid in nfs4_free_ol_stateid() - nfsd: Mark variable __maybe_unused to avoid W=1 build break - NFSD: Minor cleanup in layoutcommit processing - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: NFSv4 file creation neglects setting ACL - nfsd: provide locking for v4_end_grace - NFSD: Remove NFSERR_EAGAIN - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - NFSD: Rework encoding and decoding of nfsd4_deviceid - nfsd: set security label during create operations - NFSD: use correct reservation type in nfsd4_scsi_fence_client - NFS: enable nconnect for RDMA - NFS: Fix inheritance of the block sizes when automounting - NFS: Fix up the automount fs_context to use the correct cred - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() - NFS: Initialise verifiers for visible dentries in readdir and lookup - NFS: Serialise O_DIRECT i/o and truncate() - NFS: sysfs: fix leak when nfs_client kobject add fails - NFS: trace: show TIMEDOUT instead of 0x6e - NFSv4.1: fix backchannel max_resp_sz verification check - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Don't clear capabilities that won't be reset - NFSv4: ensure the open stateid seqid doesn't go backwards - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4: handle ERR_GRACE on delegation recalls - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - nilfs2: Fix potential block overflow that cause system hang - nios2: ensure that memblock.current_limit is set when setting pfn limits - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot - NTB: epf: Allow arbitrary BAR mapping - ntfs3: Fix uninit buffer allocated by __getname() - ntfs3: fix uninit memory after failed mi_read in mi_format_new - ntfs3: init run lock for extend inode - ntfs3: pretend $Extend records as regular files - ntfs: Do not overwrite uptodate pages - ntfs: set dummy blocksize to read boot_block when mounting - null_blk: fix kmemleak by releasing references to fault configfs items - null_blk: Fix the description of the cache_size module argument - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - nvme-auth: use kvfree() for memory allocated with kvcalloc() - nvme-fc: don't hold rport lock when putting ctrl - nvme-fc: release admin tagset if init fails - nvme-fc: rename free_ctrl callback to match name pattern - nvme-fc: use lock accessing port_state and rport state - nvme: fix admin request_queue lifetime - nvme: fix PCIe subsystem reset controller state transition - nvme-multipath: fix lockdep WARN due to partition scan work - nvme-multipath: Skip nr_active increments in RETRY disposition - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - nvme-pci: disable secondary temp for Wodposit WPBSNM8 - nvme-pci: do not directly handle subsys reset fallout - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-fc: avoid scheduling association deletion twice - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - nvmet-tcp: remove boilerplate code - nvme: Use non zero KATO for persistent discovery connections - objtool: Fix standalone --hacks=jump_label - objtool: Fix weak symbol detection - ocfs2: clear extent cache after moving/defragmenting extents - ocfs2: fix double free in user_cluster_connect() - ocfs2: fix kernel BUG in ocfs2_find_victim_chain - ocfs2: fix memory leak in ocfs2_merge_rec_left() - ocfs2: fix recursive semaphore deadlock in fiemap call - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() - octeon_ep: Fix memory leak in octep_device_setup() - octeontx2-af: Fix error handling - octeontx2: cn10k: fix RX flowid TCAM mask handling - octeontx2: Fix otx2_dma_map_page() error return code - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - of: fix reference count leak in of_alias_scan() - of: platform: Use default match table for /firmware - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - once: fix race by moving DO_ONCE to separate section - openat2: don't trigger automounts with RESOLVE_NO_XDEV - orangefs: fix xattr related buffer overflow... - padata: Reset next CPU when reorder sequence wraps around - page_pool: always add GFP_NOWARN for ATOMIC allocations - page_pool: Clamp pool size to max 16K pages - page_pool: Fix use-after-free in page_pool_recycle_in_ring - parisc: Do not reprogram affinitiy on ASP chip - parisc: don't reference obsolete termio struct for TC* constants - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace - parisc: Remove spurious if statement from raw_copy_from_user() - PCI: Add PCI_VDEVICE_SUB helper macro - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/AER: Support errors introduced by PCIe r6.0 - PCI: brcmstb: Fix disabling L0s capability - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - PCI: Disable MSI on RDC PCI to PCIe bridges - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - PCI: j721e: Fix programming sequence of "strap" settings - PCI: keystone: Exit ks_pcie_probe() for invalid mode - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths - PCI/PM: Skip resuming to D0 if device is disconnected - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI/sysfs: Ensure devices are powered for config reads - PCI/sysfs: Ensure devices are powered for config reads (part 2) - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - perf arm-spe: Extend branch operations - perf arm_spe: Fix memset subclass in operation - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() - perf arm-spe: Rename the common data source encoding - perf evsel: Avoid container_of on a NULL leader - perf evsel: Ensure the fallback message is always written to - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf lock contention: Load kernel map before lookup - perf maps: Add maps__load_first() - perf python: split Clang options when invoking Popen - perf record: skip synthesize event when open evsel failed - perf: sched: Fix perf crash with new is_user_task() helper - perf session: Fix handling when buffer exceeds 2 GiB - perf: Skip user unwind if the task is a kernel thread - perf subcmd: avoid crash in exclude_cmds when excludes is empty - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf test stat: Avoid hybrid assumption when virtualized - perf tools: Add fallback for exclude_guest - perf tools: Fix split kallsyms DSO counting - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - perf util: Fix compression checks returning -1 as bool - perf/x86/amd: Check event before enable to avoid GPF - perf/x86/intel: Correct large PEBS flag check - perf/x86/intel: Do not enable BTS for guests - phy: broadcom: bcm63xx-usbh: fix section mismatches - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - phy: cdns-dphy: Store hs_clk_rate and return it - phy: drop probe registration printks - phy: freescale: imx8m-pcie: assert phy reset during power on - phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it - phy: mscc: Fix PTP for VSC8574 and VSC8572 - phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path - phy: phy-snps-eusb2: refactor constructs names - phy: qcom-qusb2: Fix NULL pointer dereference on early suspend - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() - phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() - phy: rockchip: inno-usb2: fix communication disruption in gadget mode - phy: rockchip: inno-usb2: fix disconnection in gadget mode - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: stm32-usphyc: Fix off by one in probe() - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 - phy: tegra: xusb: fix device and OF node leak at probe - phy: ti: omap-usb2: fix device leak at unbind - phy: ti-pipe3: fix device leak at unbind - phy: Use device_get_match_data() - pid: Add a judgment for ns null in pid_nr_ns - pinctrl: check the return value of pinmux_ops::get_function_name() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - pinctrl: keembay: release allocated memory in detach path - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver - pinctrl: meson-gxl: add missing i2c_d pinmux - pinctrl: meson: mark the GPIO controller as sleeping - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping - pinctrl: qcom: msm: Fix deadlock in pinmux configuration - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins - pinctrl: renesas: Use int type to store negative error codes - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: samsung: Drop unused S3C24xx driver data - pinctrl: single: fix bias pull up/down handling in pin_config_set - pinctrl: single: Fix incorrect type for error return variable - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling - pinctrl: stm32: fix hwspinlock resource leak in probe function - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver - platform/x86: acer-wmi: Ignore backlight event - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led - platform/x86: hp-bioscfg: Fix automatic module loading - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names - platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing - platform/x86: hp-bioscfg: Skip empty attribute names - platform/x86: huawei-wmi: add keys for HONOR models - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic - platform/x86: intel: chtwc_int33fe: don't dereference swnode args - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks - platform/x86: intel: punit_ipc: fix memory corruption - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - platform/x86: intel_telemetry: Fix PSS event register mask - platform/x86: intel_telemetry: Fix swapped arrays in PSS output - platform/x86: msi-laptop: add missing sysfs_remove_group() - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup - pmdomain: imx: Fix reference count leak in imx_gpc_probe() - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state - pmdomain: samsung: plug potential memleak during probe - pmdomain: Use device_get_match_data() - PM: runtime: Add new devm functions - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - PM: sleep: core: Clear power.must_resume in noirq suspend error path - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - posix-clock: introduce posix_clock_context concept - posix-clock: Store file pointer in struct posix_clock_context - powercap: fix race condition in register_control_type() - powercap: fix sscanf() error return value handling - powerpc/32: Fix unpaired stwcx. on interrupt exit - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format - powerpc/64s/radix/kfence: map __kfence_pool at page granularity - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - powerpc/addnote: Fix overflow on 32-bit builds - powerpc/eeh: Use result of error_detected() in uevent - powerpc/kexec: Enable SMT before waking offline CPUs - powerpc, mm: Fix mprotect on book3s 32-bit - powerpc/powernv/pci: Fix underflow and leak issue - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION - powerpc/pseries/msi: Fix potential underflow and leak issue - power: supply: apm_power: only unset own apm_get_power_status - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery - power: supply: bq27xxx: restrict no-battery detection to bq27000 - power: supply: cw2015: Check devm_delayed_work_autocancel() return code - power: supply: cw2015: Fix a alignment coding style issue - power: supply: max77976_charger: fix constant current reporting - power: supply: qcom_battmgr: add OOI chemistry - power: supply: qcom_battmgr: handle charging state change notifications - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() - power: supply: sbs-charger: Support multiple devices - power: supply: wm831x: Check wm831x_set_bits() return value - pps: fix warning in pps_register_cdev when register device fail - proc: fix type confusion in pde_set_flags() - ps3disk: use memcpy_{from,to}_bvec index - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. - ptp: add testptp mask test - ptp: Limit time setting of PTP clocks - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() - pwm: bcm2835: Make sure the channel is enabled after pwm_request() - pwm: berlin: Fix wrong register in suspend/resume - pwm: stm32: Always program polarity - pwm: tiehrpwm: Fix corner case in clock divisor calculation - qed: Don't collect too many protection override GRC elements - quota: remove unneeded return value of register_quota_format - r8152: add error handling in rtl8152_driver_init - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - r8169: fix RTL8117 Wake-on-Lan in DASH mode - r8169: set EEE speed down ratio to 1 - rbd: check for EOD after exclusive lock is ensured to be held - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - RDMA/bnxt_re: fix dma_free_coherent() pointer - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() - RDMA/bnxt_re: Fix the inline size for GenP7 devices - RDMA/bnxt_re: Fix to use correct page size for PDE table - RDMA/cm: Fix leaking the multicast GID table reference - RDMA/cm: Rate limit destroy CM ID timeout error message - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() - RDMA/core: Resolve MAC of next-hop device without ARP support - RDMA/efa: Remove possible negative shift - RDMA/hns: Fix the modification of max_send_sge - RDMA/hns: Fix wrong WQE data when QP wraps around - RDMA/irdma: Add support to re-register a memory region - RDMA/irdma: avoid invalid read in irdma_net_event - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY - RDMA/irdma: Fix data race in irdma_free_pble - RDMA/irdma: Fix data race in irdma_sc_ccq_arm - RDMA/irdma: Fix SD index calculation - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/mlx5: Fix vport loopback forcing for MPV device - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation - RDMA/rtrs: server: Fix error handling in get_or_create_srv - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure - RDMA/rxe: Fix race in do_task() when draining - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests - RDMA/rxe: Remove the direct link to net_device - RDMA/siw: Always report immediate post SQ errors - rds: Fix endianness annotation for RDS_MPATH_HASH - rds: ib: Increment i_fastreg_wrs before bailing out - regmap: Fix race condition in hwspinlock irqsave routine - regmap: maple: free entry on mas_store_gfp() failure - regmap: Remove superfluous check for !config in __regmap_init() - regmap: slimbus: fix bus_context pointer in regmap init calls - regulator: core: disable supply if enabling main regulator fails - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex - regulator: fixed: fix GPIO descriptor leak on register failure - regulator: scmi: Use int type to store negative error codes - regulator: sy7636a: fix lifecycle of power good gpio - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - remoteproc: qcom: q6v5: Avoid handling handover twice - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - reset: fix BIT macro reference - resource: introduce is_type_match() helper and use it - resource: replace open coded resource_intersection() - resource: Reuse for_each_resource() macro - Revert "cpuidle: menu: Avoid discarding useful information" - Revert "driver core: enforce device_lock for driver_match_device()" - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - Revert "gfs2: Fix use of bio_chain" - Revert "iommu/amd: Skip enabling command/event buffers for kdump" - Revert "ipmi: fix msg stack when IPMI is disconnected" - Revert "loop: Avoid updating block size under exclusive owner" - Revert "mtd: rawnand: marvell: fix layouts" - Revert "net: Allow to use SMP threads for backlog NAPI." - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - Revert "net: Remove conditional threaded-NAPI wakeup based on task state." - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Revert "nfc/nci: Add the inconsistency check between the input data length and count" - Revert "nfs: clear SB_RDONLY before getting superblock" - Revert "nfs: ignore SB_RDONLY when mounting nfs" - Revert "nfs: ignore SB_RDONLY when remounting nfs" - Revert "perf dso: Add missed dso__put to dso__load_kcore" - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - Revert "SUNRPC: Don't allow waiting for exiting tasks" - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - Revert "xfrm: destroy xfrm_state synchronously on net exit path" - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - riscv: bpf: Fix uninitialized symbol 'retval_off' - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - riscv: clocksource: Fix stimecmp update hazard on RV32 - riscv: compat: fix COMPAT_UTS_MACHINE definition - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - RISC-V: Don't print details of CPUs disabled in DT - riscv: Improve exception and system call latency - riscv: kprobes: Fix probe address validation - RISC-V: KVM: Fix guest page fault within HLV* instructions - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - RISC-V: Remove unnecessary include from compat.h - riscv: Replace function-like macro by static inline function - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: stacktrace: fix backtracing through exceptions - riscv: uprobes: Add missing fence.i after building the XOL buffer - rocker: fix memory leak in rocker_world_port_post_fini() - rpmsg: glink: fix rpmsg device leak - rseq: Protect event mask against membarrier IPI - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: gamecube: Check the return value of ioremap() - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - rtc: interface: Fix long-standing race when setting alarm - rtc: optee: fix memory leak on driver removal - rtc: pcf2127: clear minute/second interrupt - rtc: pcf2127: fix SPI command byte for PCF2131 backport - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - rtc: rx8025: fix incorrect register reference - rtc: x1205: Fix Xicor X1205 vendor prefix - rtnetlink: Allow deleting FDB entries in user namespace - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target - s390/ap: Don't leak debug feature files if AP instructions are not available - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/cio: Update purge function to unregister the unused subchannels - s390/cpum_cf: Deny all sampling events by counter PMU - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - s390/ctcm: Fix double-kfree - s390/dasd: Fix gendisk parent after copy pair swap - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - s390/ipl: Clear SBP flag when bootprog is set - s390/mm: Fix __ptep_rdp() inline assembly - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump - s390/pci: Restore IRQ unconditionally for the zPCI device - s390/pci: Use pci_uevent_ers() in PCI recovery - s390/smp: Fix fallback CPU detection - samples/ftrace: Adjust LoongArch register restore order in direct calls - samples: work around glibc redefining some of our defines wrong - sched/balancing: Rename newidle_balance() => sched_balance_newidle() - sched/deadline: Fix race in push_dl_task() - sched/deadline: only set free_cpus for online runqueues - sched/fair: Fix pelt lost idle time detection - sched/fair: Forfeit vruntime on yield - sched/fair: Proportional newidle balance - sched/fair: Revert max_newidle_lb_cost bump - sched/fair: Small cleanup to sched_balance_newidle() - sched/fair: Small cleanup to update_newidle_cost() - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - sched: Remove never used code in mm_cid_get() - sched/rt: Fix race in push_rt_task - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep - scs: fix a wrong parameter in __scs_magic - scsi: aic94xx: fix use-after-free in device removal path - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() - scsi: core: Fix a regression triggered by scsi_host_busy() - scsi: core: Fix error handler encryption support - scsi: core: Wake up the error handler when final completions race against each other - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: mpi3mr: Fix controller init failure on fault during queue creation - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - scsi: myrs: Fix dma_alloc_coherent() error check - scsi: pm8001: Use int instead of u32 to store error codes - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod - scsi: pm80xx: Fix race condition caused by static variables - scsi: qla2xxx: Allow recovery for tape devices - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: edif: Fix dma_free_coherent() size - scsi: qla2xxx: edif: Fix incorrect sign of error code - scsi: qla2xxx: Fix improper freeing of purex item - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Query FW again before proceeding with login - scsi: qla2xxx: Sanitize payload size to prevent member overflow - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp - scsi: qla2xxx: Validate sp before freeing associated memory - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - scsi: sg: Do not sleep in atomic context - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls - scsi: smartpqi: Fix device resources accessed after device removal - scsi: stex: Fix reboot_notifier leak in probe error path - scsi: storvsc: Process unsupported MODE_SENSE_10 - scsi: target: Do not write NUL characters into ASCII configfs output - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - scsi: target: Reset t_task_cdb pointer in error case - scsi: target: target_core_configfs: Add length check to avoid buffer overflow - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error - scsi: ufs: core: Disable timestamp functionality if not supported - scsi: ufs: core: Fix EH failure after W-LUN resume error - scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() - sctp: avoid NULL dereference when chunk data buffer is missing - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). - sctp: Fix MAC comparison to be constant-time - sctp: Hold RCU read lock while iterating over address list - sctp: Hold sock lock while iterating over address list - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: Prevent TOCTOU out-of-bounds write - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - selftest/ptp: update ptp selftest to exercise the gettimex options - selftests: arg_parsing: Ensure data is flushed to disk before reading. - selftests: arm64: Check fread return value in exec_target - selftests: bonding: add delay before each xvlan_over_bond connectivity check - selftests: bonding: add ipvlan over bond testing - selftests: bonding: add missing build configs - selftests: bonding: Add more missing config options - selftests/bpf: Check for timeout in perf_link test - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - selftests/bpf: Fix failure paths in send_signal test - selftests/bpf: Improve reliability of test_perf_branches_no_hw() - selftests/bpf: make arg_parsing.c more robust to crashes - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - selftests: Disable dad for ipv6 in fcnal-test.sh - selftests: drv-net: fix RPS mask handling for high CPU numbers - selftests: fib_nexthops: Fix creation of non-FDB nexthops - selftests/ftrace: traceonoff_triggers: strip off names - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: check no dup close events after error - selftests: mptcp: check subflow errors in close events - selftests: mptcp: connect: catch IO errors on listen side - selftests: mptcp: connect: fix fallback note due to OoO - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: disable add_addr retrans in endpoint_tests - selftests: mptcp: join: endpoints: longer transfer - selftests: mptcp: join: fix local endp not being tracked - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: properly kill background tasks - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: join: validate C-flag + def limit - selftests: mptcp: pm: ensure unknown flags are ignored - selftests: mptcp: sockopt: fix error messages - selftests: mptcp: userspace pm: validate deny-join-id0 flag - selftests: net: amt: wait longer for connection before sending packets - selftests/net: convert fib-onlink-tests.sh to run it in unique namespace - selftests/net: convert sctp_vrf.sh to run it in unique namespace - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - selftests: netdevsim: set test timeout to 10 minutes - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests: net: fib-onlink-tests: Convert to use namespaces by default - selftests: net: fix "buffer overflow detected" for tap.c - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - selftests: net: fix server bind failure in sctp_vrf.sh - selftests: net: local_termination: Wait for interfaces to come up - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - selftests: net: replace sleeps in fcnal-test with waits - selftests: net: use BASH for bareudp testing - selftests/net: use destination options instead of hop-by-hop - selftests/nolibc: fix EXPECT_NZ macro - selftests: openvswitch: Fix escape chars in regexp. - selftests: Replace sleep with slowwait - selftests: traceroute: Use require_command() - selftests/tracing: Run sample events to clear page cache events - selftests/user_events: fix type cast for write_index packed member in perf_test - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - serial: 8250_dw: handle reset control deassert error - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_pci: Fix broken RS485 for F81504/508/512 - serial: add support of CPCI cards - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - serial: max310x: Add error checking in probe() - serial: sc16is7xx: fix bug in flow control levels init - serial: sc16is7xx: refactor EFR lock - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - serial: sc16is7xx: remove useless enable of enhanced features - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready - serial: stm32: allow selecting console when the driver is module - sfc: fix potential memory leak in efx_mae_process_mport() - shmem: fix tmpfs reconfiguration (remount) when noswap is set - slimbus: core: fix device reference leak on report present - slimbus: core: fix runtime PM imbalance on report present - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - smack: fix bug: unprivileged task can create labels - smb: client: fix cifs_pick_channel when channel needs reconnect - smb: client: fix crypto buffers in non-linear memory - smb: client: fix incomplete backport in cfids_invalidation_worker() - smb: client: fix memory leak in cifs_construct_tcon() - smb/client: fix memory leak in smb2_open_file() - smb: client: fix missing timestamp updates after utime(2) - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value - smb/client: fix NT_STATUS_NO_DATA_DETECTED value - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value - smb: client: fix potential cfid UAF in smb2_query_info_compound - smb: client: fix potential UAF in smb2_close_cached_fid() - smb: client: Fix refcount leak for cifs_sb_tlink - smb: client: fix refcount leak in smb2_set_path_attr - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path - smb: client: fix wrong index reference in smb2_compound_op() - smb: client: introduce close_cached_dir_locked() - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - smb: client: transport: avoid reconnects triggered by pending task work - smb: client: validate change notify buffer before copy - smb: fix invalid username check in smb3_fs_context_parse_param() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: don't use delayed_work for post_recv_credits_work - smb: server: fix IRD/ORD negotiation with the client - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - smb/server: fix possible memory leak in smb2_read() - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix refcount leak in parse_durable_handle_context() - smb/server: fix refcount leak in smb2_open() - smb/server: fix return value of smb2_ioctl() - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - smc91x: fix broken irq-context in PREEMPT_RT - smp: Fix up and expand the smp_call_function_many() kerneldoc - smsc911x: add second read of EEPROM mac when possible corruption seen - soc: amlogic: canvas: fix device leak on lookup - soc: aspeed: socinfo: Add AST27xx silicon IDs - soc: qcom: ocmem: fix device leak on lookup - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: qcom: smem: fix hwspinlock resource leak in probe error paths - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - sparc64: fix hugetlb for sun4u - sparc64: fix prototypes of reads[bwl]() - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix error handling in scan_one_device() - sparc/module: Add R_SPARC_UA64 relocation handling - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: cadence-quadspi: Fix clock disable on probe failure path - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - spi: cadence-quadspi: Implement refcount to handle unbind during busy - spi: fsl-cpm: Check length parity before switching to 16 bit mode - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - spi: imx: keep dma request disabled before dma transfer setup - spi: loopback-test: Don't use %pK through printk - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: rpc-if: Add resume support for RZ/G3E - spi: spi-mem: Add a new controller capability - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-nxp-fspi: add extra delay after dll locked - spi: spi-sprd-adi: Fix double free in probe error path - spi: sprd-adi: switch to use spi_alloc_host() - spi: sprd: adi: Use devm_register_restart_handler() - spi: tegra114: Preserve SPI mode bits in def_command1_reg - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - spi: tegra210-quad: Fix timeout handling - spi: tegra210-quad: Move curr_xfer read inside spinlock - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer - spi: tegra: Fix a memory leak in tegra_slink_probe() - spi: Try to get ACPI GPIO IRQ earlier - spi: xilinx: increase number of retries before declaring stall - Squashfs: add additional inode sanity checking - Squashfs: fix uninit-value in squashfs_get_parent - Squashfs: reject negative file sizes in squashfs_read_inode() - staging: axis-fifo: fix maximum TX packet length check - staging: axis-fifo: fix TX handling on copy_from_user() failure - staging: axis-fifo: flush RX FIFO on read errors - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() - staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0 - staging: most: remove broken i2c driver - staging: rtl8712: Remove driver using deprecated API wext - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing - strparser: Fix signed/unsigned mismatch bug - SUNRPC: call xs_sock_process_cmsg for all cmsg - sunrpc: fix null pointer dereference on zero-length checksum - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - svcrdma: bound check rq_pages index in inline path - svcrdma: return 0 on success from svc_rdma_copy_inline_range - task_work: Fix NMI race condition - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - tcp: fix __tcp_close() to only send RST when required - tcp: fix tcp_tso_should_defer() vs large RTT - tcpm: allow looking for role_sw device in the main node - tcpm: switch check for role_sw device with fw_node - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - team: fix check for port enabled in team_queue_override_port_prio_changed() - team: Move team device type change at the end of team_port_add - tee: allow a driver to allocate a tee_device without a pool - testptp: Add option to open PHC in readonly mode - textsearch: describe @list member in ts_ops search - tg3: prevent use of uninitialized remote_adv and local_adv variables - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - thunderbolt: Add support for Intel Wildcat Lake - thunderbolt: Use is_pciehp instead of is_hotplug_bridge - timers: Fix NULL function pointer race in timer_shutdown_sync() - tipc: Fix use-after-free in tipc_mon_reinit_self(). - tipc: use kfree_sensitive() for session key material - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx - tls: always set record_type in tls_process_cmsg - tls: don't rely on tx_work during send() - tls: make sure to abort the stream if headers are bogus - tls: trim encrypted message to match the plaintext on short splice - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). - tls: wait for async encrypt in case of error during latter iterations of sendmsg - tls: wait for pending async decryptions if tls_strp_msg_hold fails - tools bitmap: Add missing asm-generic/bitsperlong.h include - tools build: Align warning options with perf - tools/cpupower: fix error return value in cpupower_write_sysfs() - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - tools: lib: thermal: don't preserve owner in install - tools: lib: thermal: use pkg-config to locate libnl3 - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/testing/nvdimm: Use per-DIMM device handle - tools: ynl: Specify --no-line-number in ynl-regen.sh. - tpm: Cap the number of PCR banks - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - tracefs: fix a leak in eventfs_create_events_dir() - tracing: Do not register unsupported perf events - tracing: dynevent: Add a missing lockdown check on dynevent - tracing: Fix crash on synthetic stacktrace field usage - tracing: Fix fixed array of synthetic event - tracing: Fix ftrace event field alignments - tracing: Fix memory leaks in create_field_var() - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference - tracing: Fix tracing_marker may trigger page fault during preempt_disable - tracing: Silence warning when chunk allocation fails in trace_pid_write - tracing/tools: Fix incorrcet short option in usage text for --threads - tty: fix tty_port_tty_*hangup() kernel-doc - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - tty: introduce and use tty_port_tty_vhangup() helper - tty: n_gsm: Don't block input queue by waiting MSC - tunnels: reset the GSO metadata before reusing the skb - uacce: ensure safe queue release with state management - uacce: fix cdev handling in the cleanup path - uacce: fix isolate sysfs check condition - uacce: implement mremap in uacce_vm_ops to return -EPERM - ublk: complete command synchronously on error - ublk: fix deadlock when reading partition table - ublk: make sure io cmd handled in submitter task context - ublk: prevent invalid access with DEBUG - udp_tunnel: use netdev_warn() instead of netdev_WARN() - uio_hv_generic: Let userspace take care of interrupt mask - uio_hv_generic: Set event for all channels on the device - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe - um: Fix help message for ssl-non-raw - um: virtio_uml: Fix use-after-free after put_device in probe - Unbreak 'make tools/*' for user-space targets - uprobe: Do not emulate/sstep original instruction when ip is changed - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - usb: cdns3: Fix double resource release in cdns3_pci_probe - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget - usb: chaoskey: fix locking for O_NONBLOCK - usb: core: Add 0x prefix to quirks debug output - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor - usb/core/quirks: Add Huawei ME906S to wakeup quirk - usb: dwc2: disable platform lowlevel hw resources during shutdown - usb: dwc2: fix hang during shutdown if set as peripheral - usb: dwc2: fix hang during suspend if set as peripheral - usb: dwc3: Check for USB4 IP_NAME - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: keep susphy enabled during exit to avoid controller faults - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: dwc3: pci: Sort out the Intel device IDs - USB: Fix descriptor count when handling invalid MBIM extended descriptor - usb: gadget: configfs: Correctly set use_os_string at bind - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - usb: gadget: f_hid: Fix zero length packet transfer - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: lpc32xx_udc: fix clock imbalance in error path - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - usb: gadget: Store endpoint pointer in usb_request - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - usbip: Fix locking bug in RT-enabled kernels - USB: lpc32xx_udc: Fix error handling in probe - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - usbnet: Fix using smp_processor_id() in preemptible code warnings - usbnet: limit max_mtu based on device's hard_mtu - usbnet: Prevents free active kevent - usb: ohci-nxp: fix device leak on probe failure - usb: ohci-nxp: Use helper function devm_clk_get_enabled() - USB: OHCI/UHCI: Add soft dependencies on ehci_platform - usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal - usb: phy: Initialize struct usb_phy list_head - usb: phy: isp1301: fix non-OF device reference imbalance - usb: phy: twl6030: Fix incorrect type for ret - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - usb: raw-gadget: do not limit transfer length - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() - usb: renesas_usbhs: Fix synchronous external abort on unbind - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - USB: serial: ftdi_sio: match on interface number for jtag - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC - USB: serial: option: add Foxconn T99W760 - USB: serial: option: add Quectel RG255C - USB: serial: option: add SIMCom 8230C compositions - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: option: add Telit Cinterion FE910C04 new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Telit LE910 MBIM composition - USB: serial: option: add UNISOC UIS7720 - USB: serial: option: move Telit 0x10c7 composition in the right place - usb: storage: Fix memory leak in USB bulk transport - USB: storage: Remove subclass and protocol overrides from Novatek quirk - usb: storage: sddr55: Reject out-of-bound new_pba - usb: typec: tipd: Clear interrupts first - usb: typec: ucsi: Handle incorrect num_connectors capability - usb: typec: ucsi: psy: Set max current to zero when disconnected - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer - usb: udc: Add trace event for usb_gadget_set_state - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. - usb: vhci-hcd: Prevent suspending virtually attached devices - usb: xhci: Apply the link chain quirk on NEC isoc endpoints - usb: xhci: limit run_graceperiod for only usb 3.0 devices - usb: xhci: move link chain bit quirk checks into one helper function. - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - vdpa/pds: use %pe for ERR_PTR() in event handler registration - veth: fix data race in veth_get_ethtool_stats - vfio/pds: replace bitmap_free with vfree - vfio: return -ENOTTY for unsupported device feature - vfs: Don't leak disconnected dentries on umount - vhost: Take a reference on the task in struct vhost_task. - vhost: vringh: Fix copy_to_iter return value check - vhost: vringh: Modify the return value check - vhost/vsock: improve RCU read sections around vhost_vsock_get() - via_wdt: fix critical boot hang due to unnamed resource allocation - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - virtio_console: fix order of fields cols and rows - virtio: fix typo in virtio_device_ready() comment - virtio: fix virtqueue_set_affinity() docs - virtio: fix whitespace in virtio_config_ops - virtio-net: fix incorrect flags recording in big mode - virtio-net: fix received length check in big packets - virtio_vdpa: fix misleading return in void function - vmxnet3: unregister xdp rxq info in the reset path - vsock: fix lock inversion in vsock_assign_transport() - vsock: Ignore signal/timeout on connect() if already established - vsock/test: add a final full barrier after run all tests - vsock/test: fix seqpacket message bounds test - vsock/test: verify socket options after setting them - vsock/virtio: cap TX credit to local buffer size - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - w1: fix redundant counter decrement in w1_attach_slave_device() - w1: therm: Fix off-by-one buffer overflow in alarms_store - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - watchdog: starfive: Fix resource leak in probe error path - watchdog: wdat_wdt: Fix ACPI table leak in probe function - wifi: ath10k: avoid unnecessary wait for service ready message - wifi: ath10k: Fix connection after GTK rekeying - wifi: ath10k: fix dma_free_coherent() pointer - wifi: ath10k: Fix memory leak on unsupported WMI command - wifi: ath11k: Add missing platform IDs for quirk table - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode - wifi: ath11k: fix peer HE MCS assignment - wifi: ath11k: fix RCU stall while reaping monitor destination ring - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - wifi: ath12k: fix dma_free_coherent() pointer - wifi: ath12k: free skb during idr cleanup callback - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - wifi: avoid kernel-infoleak from struct iw_point - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - wifi: cfg80211: Fix bitrate calculation overflow for HE rates - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() - wifi: ieee80211: correct FILS status codes - wifi: mac80211: collect station statistics earlier when disconnect - wifi: mac80211: correctly check if CSA is active - wifi: mac80211: Discard Beacon frames to non-broadcast address - wifi: mac80211: do not use old MBSSID elements - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice - wifi: mac80211: fix CMAC functions not handling errors - wifi: mac80211: Fix HE capabilities element check - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - wifi: mac80211: increase scan_ies_len for S1G - wifi: mac80211: move TDLS work to wiphy work - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined - wifi: mac80211: reject address change while connecting - wifi: mac80211: remove RX_DROP_UNUSABLE - wifi: mac80211: skip rate verification for not captured PSDUs - wifi: mt76: Fix DTS power-limits on little endian systems - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() - wifi: mwifiex: send world regulatory domain to driver - wifi: rsi: Fix memory corruption due to not set vif driver data size - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - wifi: rtw88: sdio: use indirect IO for device registers before power-on - wifi: rtw89: avoid circular locking dependency in ser_state_run() - wifi: virt_wifi: Fix page fault on connect - wifi: wilc1000: avoid buffer overflow in WID string configuration - wifi: wlcore: ensure skb headroom before skb_push - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 - x86/boot: Fix page table access in 5-level to 4-level paging transition - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - x86: disable image size check for test builds - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - x86/fpu: Ensure XFD state on signal delivery - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers - x86/kfence: avoid writing L1TF-vulnerable PTEs - x86/kfence: fix booting on 32bit non-PAE systems - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - x86: make page fault handling disable interrupts properly - x86/microcode/AMD: Add more known models to entry sign checking - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - x86/microcode/AMD: Limit Entrysign signature checking to known generations - x86/microcode/AMD: Select which microcode patch to load - x86/microcode: Fix Entrysign revision check for Zen1/Naples - x86/ptrace: Always inline trivial accessors - x86/resctrl: Add missing resctrl initialization for Hygon - x86/resctrl: Fix memory bandwidth counter width for Hygon - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - x86/umip: Check that the instruction opcode is at least two bytes - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) - x86/vdso: Fix output operand size of RDPID - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - x86/xen: Fix sparse warning in enlighten_pv.c - x86/xen: Move Xen upcall handler - xen/events: Cleanup find_virq() return codes - xen/events: Return -EEXIST for bound VIRQs - xen/events: Update virq_to_irq on migration - xen/manage: Fix suspend error path - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - xfrm: Determine inner GSO type from packet inner protocol - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - xfrm: flush all states in xfrm_state_fini - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: state: fix out-of-bounds read during lookup - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfs: always warn about deprecated mount options - xfs: fix a memory leak in xfs_buf_item_init() - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - xfs: use deferred intent items for reaping crosslinked blocks - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: decouple endpoint allocation from initialization - xhci: dbc: enable back DbC in resume if it was enabled before suspend - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: poll at different rate depending on data transfer activity - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - xhci: dbgtty: fix device unregister - xhci: dbgtty: fix device unregister: fixup - xhci: fix memory leak regression when freeing xhci vdev devices depth first - xsk: Fix race condition in AF_XDP generic RX path - xtensa: simdisk: add input size check in proc_write_simdisk - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Patch from Hans to fix SYNA3602 touchpads- Update initrd size (kb#456)6.6.148-1.module.8814au6.6.148-16.6.148-15.8.5.18814au.ko/lib/modules/6.6.148-desktop-1rosa2021-x86_64/kernel/net/wireless/-O2 -fomit-frame-pointer -gdwarf-4 -Wstrict-aliasing=2 -pipe -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -fPIC -fstack-protector-strong --param=ssp-buffer-size=4 -m64 -mtune=generichttps://rosa.rucpioxz6Tx86_64-rosa-linux-gnuELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=282b88354b5a213e46cc2ffad4375b97cf3c4423, not strippedPooorosa2021https://bugzilla.rosa.rubasesystem-minimalfilesystemsetup@@@utf-87117d6d5c6130786081b0b5ae6ef57aad7e76e3d7973e12e231a73e79fffb980e8d867c3527738abe94a8fb5fb46cab2a510aecc2e9c72d95b6e9e1a8c8f7c0f?7zXZ /!Y] crv(vX0bRb(9v~?A<c6~֮RƅB@}(^[АB"_ꆥfA $ WGTL(:uh~?Oz)WUav'P?۾ 򮂕TLI!A.uǓzf 0pB}auө.#Ny 3Yz\]|wŴGa`^KI00f3߸9X߇|d JQ_xӈK k ;]u,L}Gb*DadibAyoZ9_D уۈu[bv B#LЫz65[^ic/eqh7\<3nܐtXo/,Jqft_ Q{Y2W  J"Ь#$`OmwRv̗։|iTkwJdA O.ram&>`W+-bNʋG)#RP%A<.5\FQm, !j*2791tݖjhFk ߾xUI-f߀<:PmFTȶ9җ"vH\1Sb"ECQ~K<$>>Is\OAyI|:56t5cEă{;7/ &&Ş.1"{6obJE'ZqG範F}BY7!!\ܨNMX:D yE>q lW{k]o%>nQQ%Ֆ_QL; j7%iYu7vӄyvbN.H99~xifQj xP 1]xml! >y]eiԑ.EJ3|"^d濠V:ZY{/ˑc- zԈ|[2:dbc!UFO<')0E^䲺Vaxd%PjC5G?$wr}(Tѧ->2**{P %*UNmK)爱%͡h?)!2Ae$BmW1n~=&BQ>9 6^$t(?fF$x9$n{{799APn;$t!iN&!@j,U}i0 _ fo ܢ J*ŒҹSUd ` ս_n\~w8*?K"6}SBHp v-A_eS,u4$݃Kt.7 &":m^:1fəxu5664;VRwOvKp>Yz^QysߌrB:> )b+!dĘݫ̀Ȼ$0 hM:u㸭nyY9&AlKvNe5O"`Lc7/8mO_v@eͅ~Q #k\4TǚOMe& :̔s=\@,nyDv; |5Z ,8MCi%Ғ{L4 ;#,qqws8aX"6!r "&#_|h@}h6>}"6(;&~epQ D0f|U)pI!^A '8OzV(XY?pʫG)zgOCJ=z2GMI$ese )//GnjDxPj[#>&lzK)Lu `271mTX|+].B,HH恱`k2cZNG|1 Ƣة JW襠֦e۱ Nߌ)Dhi.c: {>u'Wo5B ܛX**&kԻӑp%aX|"% dgGPXoqZd!"uwqKJn@ efwGncNU@lIDZ4ʼn1)A3q$(/x_j"h`9UKo;{7Rz ҧ~O3;WW (_[I:D{n q/_4jpWӦ\R,r)&L9wpr1>(cϰŮIR1xSoesB/@-U͸*`ԫ>Y_Vz,ǿK'j80EN%j,7?PywGm9yшxD卯_1.K?-SD}[uMq*>Z Bo#}z2JP`%Oh(@ϫ!阒hwL+3]OanCVj\NG~ 'Vd9 l)|zAF-b}`$.;H'cnn+`M7.f͏%HV_K/۱H|lSԋ~ҎIa 6gM^3L&I,n 8Du#w͔}D"}gaA#!h$huGW#3˞$8 O B agyp:)% ʀQya~Kq"oFOW7e#FaI]ouE*=3w\SRBe4 |ȯɤ Gݔk hˉTv_:OsY=~&I&T!3Iaә:WW wB;z2\H͠q#.+~G֝02fN;`سti!_=O]w@P>ⷹÝ+/Hq|/Cy1:rh!b̧uCIBfn]n]&c|@"3`Ubrn*(dY!%8s(FQdl۔޾9TB\t8YYFKW ^Pўdlt2ј(09Krau˼o˔_@C[#zC1'РzJ|js55 =M )kko@UK_.gH`}48݊Q:?Mo$:zLRy _=l).5^Rސ&`#LwW3ژ-Ps36;=e)u-2+Ei~E*_Zޭ W^O#ȏ;Da"(xg.WepSOhܸ$VP 6c(εpK/>e'm34.R},n@alIC)p?I'Ifg M|`Ê 41Ӱ\E9 rmE͟`Rj{9 H6V#9;X Y^;j l:\ N:T͂t-"mNy4@Y^~[c"7xމil1;><ѹ{ٿ N(LMWꌤ9 ?ʜח+|vx38Wׂo@18 cu)㌑d%M`34>{F6ӧ鰀 Q1] i*RZ4HI6X' X{W *%+U*J@ø}]w%љj=;A\ic<iksxWJTWJ+VDQcj򕊕miaLN/:u89~1M_0K{O FA(-uiW rMZE/e7} Jmb`:[ʿ,#y Yj gŕA `dY1|rs#>O-])$bC vf$k05 Kvzx}ZAXx'Q\'&UQǞicб`n鐂جTxk"b:\݁|;A"FB-̶G@e[ȑc?hg|Θ1 ,M 4"~1Y"姳5?$BIѐm966Y}حd5&{FU{]ƏܢCȤ,|U@4} a.S1۔ TjIl'E^Ն3B xaR{EsKSٙ9cM:T 8ˌr>T6Q!%D]gfk$*E~c)WKUٍ"{`ΟS/xBץ⳩/H-ʼ/[&Ɂ4ߘ\_wTR`v]~ 2ܖ *_cBT걫ܡ4/ 3Z=sadr+n/TUi5K vd8i֗Ӻɘ# 4xS,ؔ;7@8O,9?- *:D)}=W /ceA/11=e+sم/1C/sהqx )1G,_.UB'vׂU`5E(gF)4[T%8BvH4)^G%wDiSj;tj;[G 聯4f-3^9̓&TmtdG"q&sZfhnފ^-Kzhk^)˞ `hCtAmd$^N<Qpx;Xn)KʚGL6͌' $ .n '5؂š2Oٲyl|ߋ:;`G T 4Hn kM 8f|S+SqJia)C@K:e&] F9WBhCze&^6 9-"$Fgp+Lq֯V"8KH 2SϺw>-ñ;/`mMhɹTH"عO[VW#~UCOpJ_uL(Nx >yذk"ad C=R9+CP-DF,OJ:@ s 2J̭HM Ob #E#&6\e$m囻ղXy+9rƓ2 ʼYeg&NbuX(t]qhwKdMݙO_=ß6D3siM#$1{l6jY!ϳT}]н)}`?r? B~˔c+EyY݄Gh>1J%iH y!6;PM&3b@il"1b&=_T&W} 8{1JyS~zm 0J吰G{h"+VFa ꋮ8yApX#Sf7}%JAHd#jzоB·v$H$oCP^7A0ؓq);ԣ24MΗd2k{bVent Cs-/b.i.`0)@ǡL!zM>^;,Dp8RKD=v ޅ TK5Y+rc"OGn=A"ZpT:-:}MQX(aA MECH=Ql/X IF]~Y뼣NG# ʳ2ۀOFoCVf7*yÜIvnFʝ;!:Ԕf)FWzL|36tco -Fg6f__=zt80FM$~7<{$B?oQ@>]YeL[1YWD#.x־#=QEܹT1h98 M@PKMO3=u-\wE+n7 'Rsɾ==c:w|CH< cܑ@G#2hW|o{z6:.^:dz꠩ HnXr~h/<]7fauV^1Ҫ56վwi^y?hrS4x$w`Ŧm쑿&`QaJ'B?*?id,8cA~y/~\GGN=J!}mI4#D>Ѱޛ$K.N<Ɖ)Pg9į䥰(ߐ7\anh d yA((ZEX 4b6@;%`6 FkG*BЮ,{pWo#zJhcD1hͯ! ZkNIཀྵX$$+FA6L*dJ1_xLzYrV).P %ZE0*١Zmq_]F^{A?EV.n:&1۵Y*Ket8ug_7{bPbp6*64HpRa-jtDU_g/?+rRJ,O#{9j-n2FF"Nd3-\9#;h᚝[Զ\?dmii7>XC?m c]CSðT4,7?Z|6PAFlgK㰜{>~>ޠX#& xh ;Fr:LmVCVRs!Wap# G<-BȀ )tr`\4U{"U|r"|~>?goGӡf&n b; 90c1ɍPzv,? ZYj+T" z8g:&<ГrǸ "er vS`Ue`2 <Wģ֎!P4"|s,\ o//* TblB* ;jc6#z0SƎ~Xeol _F_ 馽o&/CF8 Q9dR(f1*zY]ړ! wp 2v85VU&}7;AO7ArD%N5S^YMBʐlGКbХE-sڎeC!__@ Ԃ5Ihdi 1{v4xdy+/9@o{ϳQ9jƺ>ˏ: ;QF[-t% eIB,}^g0P=-aYȞ^`Ix(DD:_M>WP iOF]4q5lu9%ioH>2Ot#V*Ua:Vd"ϲ»3#dݍ8-_ɽD%r<}_^ᮋJXE;2➍` 6 8Oujy}|C"%6mJߥ!g?/Wl Ml`?ߣ-m* HTiѱmݼ)56A -tM~:az;9nM+̈́ԇDy ZdF)jcaNG=,`Kɼ6VEj&ui~79oCa|M`bWUA| iF}iג™~fz"5v#J0١nh"= -I҅<|Xf'5_#kB9GwZ$o= 1[c&:D8dl1Їs6顃eNPX|wH qBﻟN]f;O)!ÜIywѿBqNy[&i#:O{S~\0p/[oZ/Fo VH$TMJ (Ť ZuK/ TC'C-rcsbmX6"*hfCHV"*]yjp3ro{Y^ $*%8] GUGDUů(:BTz))9H  Un{9"%6Q'[)g6(@`N1- DWcl2m+|MS yNRHRxdd,q]k"Wo8֤{efN_-_z7$h=~$#mԆ5L,*l?T(03Q^QOת߰E >t}UPq=o5*GmG:3wcYM(h\:{,8qrs0T&ِOwqa`ˌq(Bڌ֓F{+/2L@gѝI B״iUo^u\$A]mf>=*"Ӎ1N(_t$Fmq-CGzNc֣iB*Hޠ ;gijtLL.ѳYjW;@ ܳe)peAYI2)䳌h.pQyPdN;tVms#˦(Ӷv'r_ խP|͕95Ɗ&8Kl~@*Ԅs4"PpIeAْ~InU5$B9.*CPq'3d,NkW\'{=I_7$x9K]8oU4qG~F[rHjSh "_a)ȰJ Y|椄$oj֒0 ty擎>g-"uDU_F!mHE!ERL_CkQs=@^\KIu+G%M/Kgσ``rMMiOp[D{xeG;<} @_KHx1`%:~KA0@ fѷ,y@MFNPx3`F9νwuˋӮ8 -ٜn,k\%CR ;ݒM+-A`uZH2qc<0`GDJ(jVNVpNݙU } z)G #vGMbg, -J!4::4<~ 9IjݺSM$L,_yO Π(ހĩ]>۴\e'X6UC--Y^[A*2 NV4`{N9H DtGڝԢf4ÿ7()]"*  [0ޓOL߇GKAHvmw]Zc.VV#qЋŸ'S,-LwLW><9B77ӆ"T@#dת0rTj{Iʣ)a]4" ~ I/|vy.Whr$DtCtLۉ_7* ·i.VªM}w`<j Y(s6nBi̒7OTh|hV$j>p9,@BiO`eQe?L<B[Ϳ(@lJ3 bWs7] ? _V~X+! !nrCB fU#U_lvvX 8*Fv @!e}f Vg$ `x 8 w̓$҈';TqzeDTy4Wb#14XEn6n BJL%,mKQeIR M Nc/9x5_'{CD+pO#S>kep|u:@>pИ0b߳=jB{^~A+A`{n'3iC{ݰH)%!LwgA8>fKbs|?UBGחX2j{3?q1 @LNV /w9A_hΒ|}M"bod%Uy%y{'5'=}ޯRj].֭=J(DQO]<7_!\eMh T=2ZkjXc, &yڞ-V7Ԑy&?4*PH"~:;fNH\ÒmUƢIZ^]0 h[فc@bse nkIO2u̮}f̔5V:L"h ڌ[olxkiC٬9ЮOk6thiWiuMMr0h幵 _TQ12*!sM3)8 LlXAu .بtc[jr_PU S W\(vpB:+ - KZN ]XAïwHBn^t4᎘UЬ SEv{Ni%9|s# 8wR˽ %P˱ϛ-NS ֆ+1{Ǵ-szYlk9 'ֹyJ4_H`d/+mX!QbwADƈ+˓ZQG e6$)a@Vs/6FL̩CsS9L *y^mPʬ~I=@Orʕyq H= oiwmW~SG˳^`Kl1Xd(itԮ&Ԃ'J6ݏgT(FslGeޭU (SwFtiX$!t`a2NF7"L5QSz35lL}Pm<_wVa]r01 L Z. cA mgr~agkŠ \S2N * &]_ iX%V=MG&T.ǚLn|RIT:&6-CI>/?Uc=EÊ|OPsMWВr Yn"Q=_EŃj$F<]RQ-K`OڽѾ" % N._9"T7">H5 Pyo5"j .5ZTK})`~A鄰4@fEh`ZccSAy8:v{d&s; :epچe `.|a`[ۋ] CMk#娣)^zFivO^F a-7/O~Ȝ͢Kz:[H`GT5šPAܨxP>P |Z?C>`^!jyJ }PC\HNZ]wP>ij!P)`knw|qH*hqP@'4HW'Y|;Z5g:*KCz҇wBi4I#QSkٚ҆f?@* yFayz8;p=:a.I\E&niz9gӪ$sT4XF= T>-4E؅s]CvVv&[UIS+=M=ơ XOЂh'>gD)8 'NzgFo'"݈X 2(V桖WPyx-Ays\zA \X:;ߖmE)!J$fʯZn5c.JGH)婨R p2Elf?WT%~T ȍYv[ϑw4KA&KxZzf)CPޙv9_^lDp>@Mc5 htwsH7hSٹ-rY<%z!ļ!́Z0 VN\_Ϥ,lDOsre~o6ȷ354!&2 Eƒ=U{(]-a`oh;ڱۢ[aJ&vvj$l2c^'wƴfzC/-gWĨ½\rU?5փc\Ad:6u~T5 ^#{{j\c$ΑͽfMе{qnWuZNld> A"*ʍݖE:7]"XQ t"c-*v(d txoI 3goI`ZUЩ1mX }X!ٶk\_uklmFdl6Bǧy$5㰙Rvp(Mq+7[g]l  *7vrãc37/uDu qRDT҈!9#sϡvjK2vUaPdU9. rk$zbte}U9 Oxa%UancþkGK)̩!7bahZ۸2Wld.!- kZ'iW+鿋*(rr1o.XraVSM6vYd!. oWh=ހ1wjLڲǟTߖ5^ >u*9zIgX8;>40Ќ3ޏxYENHR8n0Bvʝ|k?o$3Ms:kbȯ\p;"sy=[-J)HiԤZ/8ѽ0dD8HSW*Ybn$X3[vPAlmۚLHbjF dVB5U;辦} TOQy@ Tߴ2],7{:.$F˜J:sF}f*7[Lnw=j/*PUzMZ)U6C$AR@fYv BYlxtT~ Y*Z9+"8"#3v\)4|A H8l(3N\x|d nC([籰`GSj9bo 6hSmZĮVO9e2nKf4M,\laĂG}X='ح4Bi _ LSmAU Ҋ̰n!~Ad)f<['z{ӄ seHD{2d .r {ImC=;AWd4LvIo_5.WD!uqTu(^P(Ҕ 9h@jί8 EG1N?yZ2m]-I I{Qm Y C$_[_}>%a& !1PV[l$Bp_u T$9a?'><>mzG"Xg{DE o4 *m:6#x\6eB;lK +uoOEk p#ƭЯ(ubyv]K?1XQ2m9G0A~9DT@.Eylffֆ"W'SM˄?wy8GE', (l4)( rsQa  iоԎ3@=q]?Lbr^_I7CUj#ҿpS9E.JRzB;CN`{ͮ/:Ϭ6<0\+؃5եf(]Hf34E'$ `1750I`@F1q 0ⶡ&!]\yjcjetu܉u51,YU9ѭ|u(e[irRXW (.sڄ e^+yoNRj `f2vCgecn}$$|Jgw[c2(wmh[oH*'RճAf;:zŸA#oߏ+n6a"+5.oncox2H 5[! b($.+|&uhg3OѴqgu._)L;&vm;]{0Lu!=uލDJ5*<{0\[;CކitdVOϲHt,MHNӳ=0v`dћm/äi%&VK3گ :}fYpꊺDB.*A>a4|-u\''16o:0М 4:1< gZPqᇩ\rKBU`k9)a2vLt/~,6\/`냯}ch4. ,:vI Y›讑(Q*qi8+HEf3WW&r@qE'%?7lK-B<38!ZQ:zt%6_4>OI&:wPTS U<+ y+WW-iNޛv3f][a#Pㅂ@y¢2*3 uoiTc?Rfs0{JfCs6ƔE$V;sP":#T^79`u&$e0j'z@耉,e;'7 K#d7}P$ e?|% e$u')-(4/9Ck=6G>q% ;+܉|-ijj2G9עIFd'$l^sѠ`&d+5*ɴl<HمY7mkvL%?弶軶YgVJ!0gӷ$$!>x2$8(tiq8Q`R6s?ѥ8N~L}E) d{:1ypL1dyiQ얌u 1] U@cذӭјq~rVÃt?Q_X _,x吨R8*?SwHJi-Tc eBG qUKI<:_yJʂc|1&. ^Qv( GCI٫]gژ>L&a"xIj9Qg~Ň Sar"kUI p99ZV'os. &=i&+m\?z_ޭt uOwy(~ӯP9jbqc N_Ҩce 2f2X k--x&8\E.$ #F($nY!FoR?ZyQhRAzi[!"ܦGۿK-ͱ?aW_7FDxRWlg﫳IUziHFCnS0 RQVYƴ歂*Yg~~]AmXϔ{0{BB7;M\feypZqٜ+(!IB+޲ aaaֻ~])+9Y*Y2 (C\^\LwK9Lwf|Iwpc|O(#𣏕 4[ċ[Y){3ȭ!$c v\mC/ec{aAHww^qߩlUOQ "sMzcY~Rӹ4I\@L'f"%\# cĭVGV]C=;ނ(j[:=/K0lycD BJ,Ze 9WݹOO }L}h,Mw$W9CMhe(†f"zqC洮^9|Z%Ҫ-C@gq@{{2%;n=>&ONu+𺲚%YYift n5sxjgh؟-yD˫vl9EdЬ,d& 7bҁp\UG_.H{0w.J0{cV=I FDJ 6{HV?vdJa|ILN`@OAFHǛjGhϥSg.A4n^"V+('jF-ܲGc̭ ײݚmlRoBA7Zuj 㛃RMIuCxklK`h.HjϿ%@g@Q(5 }+%!mfJ, t`YH7'4c W4݈*WFz>tg!~mI9I@frH$'-ؖ W#Q:YʎwG;]z :G$hu@+ c_o^[ucxiϊ^q"AϠ;4Ԯ2?"XYF*z2hJ+2VٷF&r<_I6@'(\/)H_lg`YAɫ{z(1D⼿~hL.Y %ޜ2D4L!|žl$&l/-^(~j ^»+B73(4<For_M\PZE7&c3\әasܵ%,4X N{ V Tό 0*NFn4R'qko WV.{|1c28L  xy2M ӆ0Bȹ("lbyF|Kh**Ax3xԿ`]܉)ʭ*bO*"DHqfI7?fq u97%?ڰ7z x t;;l. KPD:q‱9lS BN-r!2$KQvə12pAm48Hu GuȜ>42rK}v[*nh6{' 4 [2^sX+[CKv'Z7j`TRM 1,HnH+lTT{n %mJH -%auG½u3n'-6M WTP!(YNuU.JL_o [l#2lSz {jh"}C d}\Q͓";{SUQ Y3O8 ga5$몎Ab,A2@)`nw DܿR^lm:\gPYnE% OqP]聉~*DN{n5R[fb!sD2ϘمûM,GօgA. 'U i6ϙάaV=jW/ ${0Rܮ5v2S= Zr BAQ־6-@AwECnb"}zzdoQ> eV꒑VR a0jٛY+]L{O8TOUm7 {`(j[džt˫:1RеHO&֮ fHeeV_ 蓳n=[ohn"%gE34=ȷ( ['0T6N+kWy-ƭ '[ A/,PsHrN[kf)`)nf&2e^sY8Gw 7M$5z͇'Ck r3!.,sACASLݫ٦2zpw칥#E)o|&̛9bvLA;,< #&2p2Ue4áy6mĽK4a[L|v\;Y[IK>g>xүIUEV\Ɲl)U1 -ͣ.5ٛTͫ(S5$ ( SODz Ӈ!woztGٝ5 !НؗNвcP{=`RdP\(tw C>SMSGhrE0!}@gt1 v?uϵ#qR2V:V"IB?bA-P tYZ5њ܋ ]n^e4Ds@sҀ)D_ڂTVA6;8{zɱÁJ',T[H9<ր,lT_t`K lc\4k+Y8BNůAV y>,rqt?mf[5Ѣj1nFCPS\ Ҍ]ԀyF')9~!U-.@ywch9O $HqV8ɴ{QEdx3uHmA&֦`4&Hqޤ67݌)c+FC`lj?pVQ- +Z; LE,03+&f,0=gtckT^e{7 پX^~h.0Uy&@|7"_.lNA5#dQS;.sžo7U: jQFlqwrwl,}pn衧LfuM6\QdN%y4N[9YgW+;wH-9$GОCHjȘm [y nc(xd`x|A3q.*|kYm~/+ ="\6n 䥐q;P7['yxBg슑_UЎؕYTiXhA.<;10`k,(ƛPVDQf ]C0-4wMgJ=>W|\c{ N):} UgŸetv6yK.S tq`ߖ}iu) ق{;j>oߺæ E8ؤlwj0| 5bkK&$(!)`5w 伥dZQ8kגfAXwԫic@:~ mPʛ RD'ݼV-/0]K]3#M^چbRۋAy1H0i{N|ɽc'J4 Zb3hZ b Vbs"L[g,l).4Q;<'x=5p0)7,C|qd[qv{ɷUj \ٝM!$7"OtZZ&> a> JVpL'1)%fl{K8+fgШ7noJY TiҎ(n}6td߂'j6hdCP~ , \hw\Ɛ xApl';NVuLJ.䩠Iy,9ΪlPэ,UHDaֱkVÊ-茟$(/FoN9!2_gC]uh=k mk45C ].}h3! |QÈ{UWV 3BoT!I5{a4؆d/u6.]K>z\‹'زS婑6ULbldD{~Ag4GPB!S3}1s輗L7xiʏ@<;sQO-6$HhogBŬ Y3 5nd]f^0PAYnJq^`1L=b O+^UCpm#߃}֟"Z@@\O]k}zB&;ܵw"5e'mg$glcl [Jtܒ) !{P> @k䝽AkyKjc(%v}d24*{Oqreiu)x8]b6#/D%:~۞2%M@tԿL/s d zS\EN}!B$[4+QLf"8vú`K?mBcLZ< +u5RvpCԠ#I?7t5jF3;7E}Ky rQ [~uDHIi6{k/p++8#Qn T+9x}ia2i)AmTkѭбY0gU-ak[d7+9PZ(S'ͣ%v2C׍T15kv, XQjnG  ֵ%]r3Hӫ6F'Uj@%*T0.Qy'1:G;qC>OI=Vb.;:||mKHeRv 1o^`a+`j2cc1׸݇uzΧWs+ʾ -*c7N CS_s,Z#;QIQ|n+L8ir}*k `6߬4ɟxL{Bc1윖t#ӊڟqzx`CaОLToi7Ѣgך(*EņʚHkA\TC41`D@J7h !er}L )`)Na?,,$e2(M3,S1$4FȺb^ *6q&Gf+ J.V}npxE .,y95xϚU|`Z痖Bv&Bb*v[|iЄ^LZ gӇ8 n%d__f\A,p[:jU{f.@!2`T?Sf?:6WTǪ&"ܛj):FYČ&f$0sY4$Vu'Y뒠71htõEʸR+{N3wT:׬OX~ռHj mܜLOcz bTDKv(C2ok2._d0G/ZI->`VPM w 9)>  Qֿ0d3M28Fg :xހ4CTlDEČ7"B*{Sc^x7R] O‹"t&^jhaF_N4v_ +_pTjct; m ](ɰ<_͍e&h2( (]v!kc5 j>Qq\9$gc^2EPt=D;1'X\d_u#]':jcܐ sF&+;V2R@+CB pF8M>E,=Pd JkׁD:,ONC/,$£r˛@>tBuFqKq1@>j-"]"`$o؞U$ls&\DCS-)]V V%%D<br,#ftF! ~#T i<8aZ ̐trR?}8f2SxW, HƨA@=MM<H8ͳKZ4`:lX}9١s:{B v8M5eZrͺ Qü QJƆ^KhppCbuQiWfՇ3OxM5|wqԙc|`+Ф6B6zS2 ތۑ7f Tl%hIclВղ8RK0ne۴v~΃3n#8'[F)~ϐf6UA2Zb-+G=wrY520ģIJp1 %S~)B㥼,@! wvdF>fN9՗1ÅͺTwD?Ed.qW (,r/[?8 G:&蝼CG {|[ kr j&C!!E 7p&-K? ʅ-qݥUY=r13auo 9kXi6~.e@,9}˶6 W,iU54<׍ dCv#h{$ddYEbжc>]x..i (5@'B]婲o:p=L2FlA16qRMԁ:O>y@ew>bn>|JҢ8Ԏ¸tu2@ӺyeuwmDmvi4 C^[] 9bo07x$5 WMє5+KjkD nC |lڹh ?ŵI6 2Q1u)2&v1=mT}H/ trz[eyj6T´ .YѤeJHt*Ԍ噸J$Gh·6B-)=\ =-'rYQpg~#L[wm6Ӟ$8K E EĞe>,}8lY(cr)K~*ByFji7c #wyY8C[ϖ+Nes[jﻭ Sb(B,~DUrKepI>sV m c0Ee8/)׮:~69h®e*kl!鋁_ʒ!CƸ6D4W1vyD-?Qq[,C+2v4.>O۰.dFQv9$wYAn }+[ԃ+B^)MNJΫGhSba2c<>1$p=t'[3l&uZcqݜ]=n`zhSǬh,g^:.[C̷47ߌlGc,t+?#= f5 f 像Φ/U >te=UG nq^{$k!'.=%7L Ab^$Z(Uć>sMԒw[U&Pu#kg2%>.ȣjP"Ҷĸ׺Dꦖ u[@a=H3k[U`ѿ8'##xSGbkR1$-gNUr* ߑ+h:ȅ8 'Cڡa 27v]KԌ O-׷O p]Jԩk qm da`$$Pa~PWO#UU#yC^R:k֣--n&Z (bhX 6p9I_ O:y#J皳q9=1mpW8 ðR%Ve9S)B3Qua&@U ]0 'o6U]9ף{ 2F3kFgHAQaE5F yq\6`EGe[f0fK-K?8kƁMu^ -aX>SCZO4TٴkEZl?G[{x`^FMuWad<N AHHnPeµddd/H.[عYP'a6rP)ql_b)]Zf*b:% uvpXp=0&`/^A.+Q2_]:˄eqU6{@4:;qmeDMqLa4X쒓4qƸ^dtЎK973JnÚ~-l8 CEbp$m_p)t,L8n~+WaI{/4n~Ktr[Jȡ 23h U/RuQ*hfBNjw; ^Qqwks!:>k~Y%p- `$l3|f Jh_㊸|^U+m'}szqR pꅆ`)AU {c-ձ^FnҦc,p 5fh"::C瑔߿ }Zcoop݁8ƞ%靗*ODMvimmni H:*h:#ڹzv? =(_AXd^u;_V+ $zid^ rLCU"3*tb*"^E4:;B͊u_Y؋!j> ~Y/1 5áLrB` xI_6?.6*WO/( Þlp2" 9fE!F-c͋:kPu,C~T)hnb&GEy+P!tEolB#g\MP$jS_4@?s҇Mf׳kZ\hs*gL} }ky T= vI 戟:_=A-JξBD|{п@'4[%g;2-7E +z-Wy 2XLUm6B"6b9%UH6Nz-}njcP k"wYs.zM{M%llh |!wzHyҬ1b:rƼ~Kۈwkɍ$CyrrfO /#Hۭ0q]ɀR3ό_<Z4^gn٨͈RG< BͰ=*\62nvj)ji/oE+x}3dAyj3I?3D!CܸC]Ρ緞eyZ]`ׂw˜| a?n3\(<\tUŲ8ssO5 N,v{?;s!lOİ;0(n!b [L>\6_}y}`6O}ԉON7Y2\j: 0@=鮓$;Rw' br|&\mO%2GbdaT%rk_uih;XAQP0{Y~Boв:!$Z!aɗH¥L/}S#mׯs1zE"Ųr\njAhFP(d(FLJ 8O b(5xaXy} CsU 57I:"Hu-I:&R-_#mg&Vh8a#dVRhu-̣ةݛKc]18 CUG&'*(JO3ǏHm9eH3E|0ri z(nfJzz(l/-Hj> )Ļ5ek"1?$0GdM&Bԕ68q  WNI\UQvkH:8R7Om6 4[WoDl`P~߀hh .K" a-fy, tDT]^u^":$nlQe>ˈGv*}wS|#T,0g[1TlĊ++q4+7'6]em7u&AG$Y[!<ѯiFH~@ڑ |1`VE[ZFTQ>GHjTZ5 i8lg>1hzczՒD/LF\j}8:Kue.ĥW1 UM!=c?MCSx -v(}هؙa lH3(fOW}oaNN#™Xsv{ȉJL`[,A3vBd7dwI/8tߋ');K+lqWYf 2XB]w+gK2u?$Yp+JJiǹ!/YP274z#=AYS}0)0!T_L[WR!xG̊l #GP4gG6g@EJey/W*r w\+u"IJش݀D,hhݘHL!BF.'=Ԑhbx*݉U ¾l{5/|pb]:יpǸgi,CRYx數QM((!ޠRa70oi3`OVY|c/)nhw2E%u#v&RJ`I' #f8+z@-1arhW i "O1oEgN`-C͋^I.Ʈ=%tc?vDo#m7=/LuJV8뫩_imHZ͌Iȗ OE`T x8;!7m݂^Wd5P7غ@Ala ɈrmR.CQܲkCa ;F2tY +ZXH§9E[[ ]IX3'Ä>}[#q)kgc9}[6mu95MQtFP!P-ۡMWzBtW%f ˞.x/ڂ,{퓵3A<3 dLtyB #'C5Y9cc?k$wרZ\\yK #_L5ѕ/幖`|"Pㄭ*ftˮupJ)%Mę 9ax59kBKlSqArtn9jۃǘ<=!ߛڹo8=s@@BbXGZ۲nNl & ~ ~ûVUPmΠPH\Afs6w )J[`~\:cOˆYr'j{HbP[4Ũw=K*stau-Bݷ D᚝"˜n:)hUDıOQTQr;A־73[APQxmx3Au_͌_~*OxBp1_愇1k~`L,?RMg h PMk4xC-}KJ`=-Gdx bbo50N4牖5EKOk00T"N!O}5cU^d"$ )ZCs0# <S`dG!\)bQxd'"B[ :<2*tݵ8(L|=˰cH^rPs{y_dSu͉RC\ER K/)$nc!lY@CD0"%QYy~aG$`GۈM/ZP0I?{7ԵDMظ<=ɟj IRg Σ^ٳ6mE8TKm -8<>@ 7Q$3<+֡YNf"&3!DS14{~K?eP%.T41y0mCy80}G,c|}fLYTu/1h.|Y ~뇡Y?4u](k?Ï*[B")W(`tFnD ҆+g8m|%Iaz'vDBY:ʗ^OANF5ځ%Y$FCC!J%urnՐSM[3&r.DjR}GJt\8Fq5TIC>zkv$<*CQDgr =B(ؘ@->[D(ސ}kS_Wļ|Cr^"0 Vݲiq>SPFXP݀ݛ*t Qf@ % O"hE8%}$rBO`8sqxA[E4ަ_ byQY_֑nY c$b*hTDU.x;[-^Gɮ|kyTXg{}~d:B3C by;n˼s EFsOK^+)p^?, e\)HE?qX#O&Upe= X#5p<Շh^-ՔLZ/|$+|oQ;}|-}:K[{㩛80 ئ ppZs#!;|˗]XY C  &Zu17n &J7SWW4=N{wM`Zϐ"(DY/\(~ jdzE:7Ӛ\UI4F !w;n2nUAh'IL`'D0p;*U.2 h,jG Ń#-3\P'3 e ΔGY ^ryp3|[\&I.M}[l'e2%c28̦ϧ+e= /(\`lo}qp-klBWlRD"=R>?UI|(6S p[N`О|!HZU,eC sG h]J [t}p2=}/@_,Br7Km,yF|īzwF6!?BsN>b1zT~pRwճZebʴuKր\#ڃ$z$ ~zGSȡ>\Qb08:@mAiL6PZx֮ K=12X}BXF=>R¾Kg@aJ-Gp~bLp / !aPO~G,_A e-{IaTR~1+@$#KNႈ5Np$,?PWmLz f9tai\d2N.^O~)Fa{Z C vql; Ve[ ^|DFԦhMp`9蜛)Do[?x~d'lЪ3 1agPiSڙlnm=5x/Sl㡷"<l;߾"[~:VEɷ{]j60u2NKD ;ɍ+RN3p3rdl !r+ϴ_LA~w  0hNx}-Tfk`d &gőTĥ0.Q.(ixռRcA -q+9~6s} 2l!Eon~ tXcwIq3[+ljعYyQ0o6qXAlŭ{S0S`ЁAB֬V񹵰ŵf|FiYh4ڟ?US0?y3DX2&%Z6)󟠞Jԯ9PR& pNC]G`YTxM#ɚ2@K*mp0=l>5:6ʥgN$NAFJaHQ܂aYij9⹀qMAYds@C m!RD_i1Wr7]㣾 K[ۇ/Ja7;oCjiM @|_(m^7!*sZSUQj==OAӳB+w!odUk5qޘ]~^|3Cbh%z6w)*M@s0uc*ڄM RG52=/kuKIΜx: T>52GM΢vnw΅U]U ?iH-A7\g4d0w_S 1}M}#lhT0-"&өXX MjYEb5qxzY_E!浭Qn.)q}}+)!-u ` 4o+R\N[ހP ϒ̵dĽ1;wwVs[S#*3ךHSpHtN]Dת)lLMN**ʀ"E} yog '!PI9CkH~#돀',lRlFUrZ u90Ubju]o8~ eWlJP!+OȻwgdcd^Wş+I0* Mz K1SέH bRE A+ЭЦ xb8T#vLsB5xseh~Sn= %=Srw]Xy_c5r1^fZ]'fEA%8/2˪a~ņ-Sٞp&ЎtXd"Y&(z\ :qi/y5 eaZZei76#tPw64~QCÑUCZ-Bc}:E?<|S:9`eSc)i Y7n[~s!w><+Ul\$orP[q\Ed~@s9:Dƒ':ѢmQI%H@"jtԹMʑhBÑA&%'I5;J:X^gm^щjrYW5%ޙ_%xe^41qϭ95 %qe^{D胦Sx!|jg\7Vt(yԾTVx&Wgx̏7,:TDŽ!DC!fAL}XO~9n#31:Ui̮];)6җ:t!V I>FEeNQ0z!&Ջ*>W݋lOc5ş "-84X^q:&Fy'-gF]Xu N/4 Ga[h޵X`~fB +ZStQwztd&gguHm ^*XZgt"EdӃG:`q򟧆QEHҽ>ԡ 8GA_[]Kd0-KK@D9B4V~5LG00D&E~,Y_<1~".6;SpbKqdꫜ|Gi$b#(' azZiPQF?9 8$p?+/~*;W4b08m5Y[՛c-ZbHT/ёj1?4ӭ{`!0AIMfSWEXv :M_.BhYjz I{kFӵߢD! }TC"㾇6C^(s5l&Cs@3Um-쎖D`ަ##p\PU8U@ݵD*M<@CPSɔpK.*r1:&Y@ȪZ)"0Vo :/l!_%5*VpI~+B*rh\P׏TO>ss#Mz3CވsvBű53e 1 ؏6-XJ3%b Mڕ|[)By'.Pv#lq*J 83AUw "ϋ?! 8,ZU*#9R% Pj×|iNjeH\gr) b49m"fϠZhƜD9R9?F^k#/$,,%z͙'wq  j:q'Uh1#PA^dz|V01!0J.[eW$~1 .>o`f4wJ6Tz0M)![Oް+UEѴEw9|΋n=GL֑C$ ;ɰP-"Eb!uS !]W6TaC ">BpQɛUyxVҰ Y[M.Yp_ ׶ۍ- ućjXP-;ܰTLot] Tb4\ !j2J6I jXC x=WfAMLJ8dj@{ 3$}Ijp=]jh?K,4f?*?}A+nq(Փ + ͹C7Fb6&nk"2h ME9f>'H>jLOӑt4uܞ)&G#D)ZֹW%z2KCn1,0mq׽9ڍR;`"Tx 47~+ v L0LzXs-ڊKu::#D/y`9lj`ѡ rrLLmGHyL .-+Bs!=oN>[~Ao3^YL`A}BM0a8r7 փ8f`h{mPfKI%Vq ƙq`W%PaE/- δV)6_2ped¥Hi߯?X̢%ڔ?ɮTC$ F.7/G'S5m[^vC2oW3"ff[u9D 0/P5 Rn74U=bݏ}zI藁E7)'̬rhn=)2lM"2ER1ÚUppE i;r'FUCXOǴq,+ݨxTjtTTÜcnsApȭh{TXpX!Ϡ(ţxn58E 8xW Q jo{Fąob,iVG$0RFFIȺ;RT|a>%mעM98IӰ΄q{0\ϜM0wPE#,f=E (G/8cXO c`fa\ӏ\H;}ԱThle`,Y0jLe'w+H#q.辎!P@vbŞ|ĪGZfaOf2s.psz / BWo *Jqn:)Ho.tWZxYˇ;}l6x w+RKcG|79x2^gzU?K&7m]i]K&nQmЈvCfP QlsV>fQys#F͒Ly0~hE W=F ұvh%!nZŠ3 A$5Ep IjI_߂jZ|8g$yGL+#j >k;6@uaŐmA{4>*4P3{1LH2FDԅa yՓѡ<6^wn Z0p>=#]z_Zj9AxpW6q'oL% 9FS)`Ok$THJL'mIĔ`XDn )Y~<څF.TZiWH/˺3\`0,X$܃?u4YS{cTcm{ tڻFHdxq(,/"$W.zRʴh,ឳ.azIu*>\ڇ?ޝϕ:iqiǀ 94{sgh**)ǁڙL]wK%kb;J5G M fCݟJ`M`2# գ@JH852$Ht±ʩKTT^3#[ D'SSWsQ_#M oU)\Ƹn_Gyq[{ BnU%.?ϳ[(i.AZHE>AcEŸe)LbˆCKk'ou4xE zW PI> LsiTb4w7L$P7yLǰҫ]Xt* M^+V~n}8^TS4je:n[kU8>klʣbC T,J@;E)[@L'?FC}Z G#cq8jÔ<ޝzNi9 k5pa:ֵ޿` F߷gY9' eM@ss^ Ei֑B]QWq7PZ!Qudh~o:gg2*F |"@kf0̆?Hqd\f?6 }G\ ?2]6?)85,}!\ W*Ӳl?l"hAeh@T8]._ʦP$f:c{LBtNcE3=W r:cKU*p+^l=ΖQeyӳ0Hӛz> +ƻjNv/aRG-1?Kbi 2PD`xw_P q]%k,x6N P.,H#K>B,z Z苗O-`.JK.Gƣ[!/38]ZIxyY#t>'|-7^w3M<8C]U#¶s<0zYٷ?rYu-*r.ъvCD$$=]Kݍ,; zLEґp+,}YxNP3LѲ}̇V6PgZի~[yC{'3l0bO ߎUNQwM "b9f`Yx5Rgg)Ԯ"궪7+D7TO]:x/3Ws\(]5?{AA_ν(gyKN"iL&T«RU=Ux4*2/x?VvɲN-6IVk8>4ov[ D/XZ[ A'+%d~IhCvgL3˸yH1Hg6O L9&'.Y^3.ȦO@@-XyPl*Xl[M%JYmD,s8IF.g;D=G-ݠv\-b IhC"kĎ}KџZMBXV'2ua3a)YϬxzݚy5oj9^%XhqݓȔVϦN_ov#Q&3V,S{?' 14OϛR$>(|xڭEqe%@aO0vo!g_hX~TkfQo? 85#r ~&.eƕ.}8.f_{+@׼#^J7&V O" W%肸) R=QA9P݀"'p]6NğS3vGKFdIak6aQgz @]"R֚Qi.*DB%ڨrJEHj@撟L|%$1s3aqT GG. pG'B`i +mhțBr_d fy{M{:4O ECua'0NP'ZqRHJ|x-!Ź|I\!A(̳8ZSTU+ϻb>5c2MʆoVe 4~G!F^8wn},|寂*xx 1iZDHza<*1C@=̈U3 z' '7CٿJ|E~<ҙOF6Juq 7S/ O2"-[+> B<ߨ@7G HilDrOUv똮H#d*wQ%!I4ٜ cng QG6À3l3RMqQwx}G2Kॎ7ǵSɨf~M]\0w(-`8uE4&ԋGg B #a_Vc=}T=Z<%U9v"z%ܑzvLAsdbAQW2_ܵʒ88uR-qrzW CS})h9U3NdM$}HG_I^s)%"وY3|pO'IxvLO "pݗht-h3jA@ iySDrA=^{f;L FPICǏ[,i2.4G-A5A-V!ۑ# @hƞ:l,7?9>l9nn=7qo&o kSnJgPgl4m[ c uN[q4Z] !h̺lôeY%m {AՒ3> ӱcU5*ƸL!G%ec!KbPkj@5o^2c|oUpXuڮ w#tIkmgqUt?YY3ufS̸j8|#K5ֆ ҩds<"C'#>-^M Bs܊a%RY]Sn\iFOvtuWnJD\DԕMQ)k0_SnSeKMOXڼ3OEUXѓբڹPܸ)$x>ԉ d|%NoCL=>m,$RAsv0>4 ۓ_q±+XOe̻OjQy̐ *>cWOi;#XnUȸwr=L;\$W,L( |%e`ʗ2iFw:!JI&{r hY螲Š%8W_""GIK+ #*%C~\r%.TT~y[oGED)9ƹ)Ӵ9w F^8)ISp~x ,z1cN*0)w4)?MFA 2R+#t `"qj&nTt˅HK'0?>?m>f:J{ u{fs&d廈_= 9\o,֊kvF5f^%I:W YhHoVL>z sĶ9z|l̽9sirV-S &yU,F? {Uc/b1Ǭ,^n%j!*;x=YtvďKBOͻ Ȉ7/ΦV6TR%%ҤBo1xgCY"b1<3e5=3з`I%dWg kx3gQƉI,Љs<#C xnoHTLޫ-ͬn(F O k:'S&%H="YHCfG{[u,=<în@.+,O϶`{r:xGbY 4{ PQ JK`Ve?L@}K%o !S$ ,'.:@8(O06i QJ!#cOc\wnd(To{ "ξ1+qFv Z<}"ܶ~δ4뺗@AXO{쵺EZThL?S8oA,D[)-"#<6ּhV6\1yFЯN-k٫w#@ $ӥ^> q꺂2f_&hMD%U4<nApKp.гazH9m'NhGv̥B>LA!],-|ud0>.uTTj~(lD\ECǪz}TX$ h̶<3*߶w)|x}1uq+TJ5{Ҏo0ZV[]8heE-C6kqt|?`@ӈ!'TiWkv/ٚNWw5! t) .wyjlTY]Slkxy+I+lqR)Sʟag=֪Y۷N bEgśVğY cI2h1@ ǭ+,>0h`4=Is6(ex>\fX Ǥ&0kyUɿѦF$E:tlE؋ WБbǒ23&[Uڗ0 u38]jKc iIX~@76U9L6O' W'8fRuߖ'wEu3)gkaIekg~G 7-?c<3kF,Q @av\ܜMZR .Ըوۈ%ƈK.|+U'hoP 6F*Byin,1FV9SID0q ߧf@!x>T1fPű\\ CnK?.xB+Fqjt,jC}c #ړK?kIl%D[M ܸ^UOL/gIQ51t\Csp>`-hoǝ_etH`)IDSviiׅoSZ<*Iܐ(ϿXL7/.!v[wǼgYT\Hq` &H xv /#L_7p[ U9b8M~Z+(P6^g[I4,mZ50"_W'l |8-c]osưڶrN0YG*xlER|ӌU( xL̷3Qxˡ7c*@YE {SY MrDri1} #q]bxŒsТc4B5sWMab%JwPx0l4nwoMc]ZSM*fr zN,&?.27i;)a3;/|ON4"icT_=mf#G t ;6zc,?XZ;&<&{*͏:8&fE3+X9:A͢,|E''ḧԵk2O([@FT7X`'$6H|u9oLq l\i0Bk?hb܎ybFۻZ糊 dzD%Tj#KJ}W1Ҧ#,FͷDY8UC(wu3P֜.Eeqk"H9(7Zqc{TNi_:X$o<}CIJ6`^6MU2c[P9<k=9;dj {=߮*B86=TJX| #N0LQ3U+PYb#a+v}[eS3"^TH''e \aQmǟ,2_+5?zk2٨F'<Qx4WI$e>OBRQ]R7lrϔN輅*-S> R#xA־pXxg@1qY/#w,=0ѥG)m]]^ZwѯkОXA1 萴&z7PZS)J)ukn!𶪞5͒f.XEX ^؝ oW_؟Y,Lؽ>`W xEIߦy]-I)dg̨,Wpڗ>r Uk ~]R ݠ.26'i@Oۖ*۞.t:c@JUťU؞<)м1#.wKcTN>3#:kmޥh}ǒTgU2Mrr)7%$Ճ2KT5l\dphUvV_.5Qi!nZVSQA[ꄧY) "*I=zk^ͥlk:"hXtm/|e+O *Ԏ!dX@0y_`k{ƫT}3Ё=)+i劼O%eNRS%fА6_]}Ʉ92m7ΡNJ-/u|"UJDAp MZ:W3S<{ZDkaSrv <9DF?&5s/]36h Syqo*,QX̏ޜ9]"#TDz_(M?+k#7La!E4siG:hބYE%{K0M7F Wg @?x.Ʉ8,K{{*?y8$Es!Mr~f%D0[.Eq¢7ď-E#h'zHTi|RbL '(@sAAOWv&o[Oz^/Jnx?7W{W,gf*~z9i2xvp @)eEkYp=ϗlGݰ$ yO1ejXhh`3A=#Ib!GGe\D/W6҈sU;ŸIF*fo{ѢSBTvh~](QF΄):aϤ)o6Y _Dvэ#?X]'+$j6JS39Ss kH U6&[QN;5[OYnd*Ul]qΫFc$y'A =nW]L!2PMgIz౻_wY/6 ˑ^K`RVA >ib 喐BC;ӫ͗l%W)iFbɆNgP]AթtR?@LoO%C 3'-Җ:DVT_4Kx]!;K 7 s7e|öM]1\0bs@&慨ֹe@]2X{9?6v7=1G )O8w.f8l ́-h\T\J=zHin*`"ͣ8*'7>0z,q#/ 5ɸK[Y -PLL*#>1FS^g?@xޑ՘$Zz]#U4<.(H+ * y9//og0u&ehm:"n:a]o?adk(t~MiyAsTyG "_"وgf+uC?.㖆́p@>\8JMg)g3c_㲠m7Wɋb/\KysY k5YS08|ב镤Xi4..m /9vQ?\u 5g,jtpẃFH*i!Q6:y [$4r&~I&x !Vͻ` {_Dd. "e#)|ԫq8 SiL`hL1OmK7l r$dKoP˿n] |}:>Jpwؽf+ns.ܖ;e/[r ks)BA'8YXR[ė8T0"+bŽ-TuL}/ux㎢3Y̪CNzr<34ΜGt+Fl<;‚āI83`; u^z4PvwK6(϶ VZHڥ9#8"]SG eEz܆adƯd|Myu H)#elWJm/έpZz=o?ж݉ax!&{p_$b]g 5+QޢS7i q\9v4\zܢJJʹת8!Lj-LNY'2GZTܐfͼ5 ~$aLLTN=~aa"DqZ*lEξػ,*Th1 K[3,.pRgb']:^d reL |GtbJ ;Km2_skb[kI$Xe١I'>Md|ƕ_y4#+.i,||Lil&\NlOd8 v.edCq%wzS 4E+yUrY#(glĜe_sQ݃EMF>xgcD">^QF x' erCeC"/nGx)'?/OR;B:n3?9!?eyr]mk;KObDy@_>gk<QoE^ۿ:>ycKVjca(PvRgzr sDz3OnPvuPшt#":si'('B@|mydwZuFhp EcJ|gU<@<o'-U)gҥӂ짫iάz\Zɏ]BaNW@udH[TMR0w˗o36}|}mY) Uc'](~E@P:bg;}2'F@kFj^<`/k/J_;ky]uZКXWumvJmtq^ASMY>՛O*}!946{ &73vqKw1(nx+Ձnws8ݿVh[]iQ%.Pg` S$$Zi5KNH@ zҬ#bSC(`A#-c T1YFjŦ-Q 4DjLF;e%ޔk$S NX5xj]M|ANi5vh=\MC7^>JTVZIaّf?`SÍSZʃeQ<Ҧ`zDGdm[N''@Vȟ-Z:}mLgLS4>B͋h~m_pO-\6xXCvt ;@Dާkx8WKmgkW`4DB0%e(|Ų DMq36*1bة#Dz>^ǨF?_rSU_] Z`)H}yFD\ W 7POA~#Yp N>2H4/+a9R7+@ ;`o 2TX7{+KjG7}w!!N>=MuÉ_|IĞ>²-4sѐ$T?7{ s5d(wm]т߉4+ naCTSWOmK6Jź? xáq+cGA y&*߆ _f٢qZr:΃aypYwZyqƷF, O;mL B h2*U,qqW8{yaD?%GX({4B+J$;:?8q KOAr[UwmZ될1H" Ưqn⳨hma0/1vր]oqN,c>Dv)˃ 2`D%nK|aH+MvWe7mOپ'ٺ(LKz;<ʡ™'%S ]O)2;ڛo8\7&.IP:xEs+0CYŬzZY/S:)?S}/4aOM9.-i 9ܕ OJlq Gq(,5:+;Gr+VQְ.ێE)ʎ/M4a.o7KD]XSf]@U@v&IF.4 TE9izg6L'WMfU:Mӟ/">i-#AըY/pt ygvF%+(Oh"n)4Zܭe azUb!_G)MS<'j[ҩ>FsE/Gk QW%ܿ|7NߑRY݉t r T0CÆKjnnyMCh捊? WIUiHlQCKcj7r[#&|DY1(S-mGI"x25aO@c/RDIF\} Ԁ-8Km~ F X9uӂw#GK-u#ͨHO O n 2xaHtK K+ЀC w5%G %7i:r패vZ 19epί,Alg'Lfz-a}ԺA"hzHwiCl YAP6H\jD0|0s8=>N3 z|/`%^A=9b.rlGBQGR܆i$mAC\*]r^\چb%s-Xvhcpu{BZ^BOì9m0m046go ȮĮ.tB/ZNarDtؐEZAv~>SHVqLDav[]Yó׽$VA9𭄭c0tʩ|kJk7Q'V!_8 !FEXK?v_"rXC wx:Z~'@-T~|&@f)x* L |oRdmbݎjZ#M[Zܑty1"ˋЇk&Xa |BkSƳ kppaKF-:ő7pswT(,gyպҡ:VM% }cm:{)%oY1r: (lr~{(Ջ5{wUz Ԩqm%Y;Q ?..E|AFœo/?B C ^ҹ $`5ogƟּ}7 >%!3 {M%ˤiA5h F#kY&:ypp˷ Nz0DMN_R@WRn o?qy$9kܧPOJtFuZwKsEKz9ǣ"E7F0aY9l_ܖA*!Y\jLHA Ue`g$ҍ'_<OND{b0A <D(Yv&b_"Dވ4 秴xe{ls>{QzzH@ĮU)j@QvɜZEr9 urXt},mBT]e?}Ь>9Z*;*OK7љAsw.{ h >ٹR sYW+aPp,9,y0;Ⲿg_ZPv9bDƅP:Txjm*i'~"'?>+ oqsh4.6 jXeH _SSGлe/^5]G0ceMw cp}zO]=5V߃ͥ,$e_߷wݻ0g|EN~ט~b7g DgjZ$B96 }bKUɠ=/T^Y_҆] :0۠Ӧl<Q7?:kv*i*.;㗐A+"bDKrߎx? 4i@+:,lw'q.H{cӺŗxts`j`<2|&#d;GZq` __ $;n,o/q\}|j m͉CY ֺ Z(h7mqUȧ,\R)b.hPQ]͔ Ø,i!1uro%eRPde!}P#I:G;"jo<3-1gЂ 2kvbzhnrr7},skO& kyb*nt{20`A=d2!ۥ?$^qeL#O*v[7Yw2NJWcrũI_t\ӠO~$,Ənq c@'{XUy3wi3luaSCa"lsV[ BX @nF4S+YœQ4a{)ڮqodAq,V7BYLQCTmBX{-x߾"jn cE7K]n0y# SQX,L#nQAmt y<ή7 7Ō$_hCʛ]j_2ގDA _Swx2{0GcތD 2X~jhf(qnx:zRӴIi"b \BA#}lM!(n++r6!+ C%E 5+ŁE$ςjO} w՜:$ݮՐ'2,:G|Sh (q%w ?ǥA==<9h$N|W_xhy4my{T"7W!lai 3W~HNz9w (l%)5՞M bM;R+#)o_Aʥă^ p>:Y;B%;U8U֐Kɭ&~TBP&2|d&=uz" sh}eIUoӰDJ:ӭljL4R4Sc֜=Ov٠C/yBOw_:o 2K#+[[4ڄYM=<›IF! ږg ?/gʓW3/-\ZfgrM>Uo0>W2vX0L6,-w ("uF8#Sgйٔ>p'&9. !W $v( t.SrJ{i%sl  U{ BW^51Fxb$[˸^G(څnM%xᆩ5rHH ¨"s&Jw^-#UNG[فD,/ȑWH}UV4̀yM8 x+.5@{1:[3cMj*%OW[i%q~`HϺ7-|DLG*}2@=\a7pqj_ ؟2q,F_zprT\o$ !SUD9a)YkzX v ݯsx/ǏqAčwB8:CZj來nӲƭ'_S9桬|RJp>٘1X Haq4 {/vD>؉'-`s8PEy?_>E ܨ%%߱~UA.#Jؕ O:sʱ(id.amC :gMix#µ׭kÆb:/k]@JL7u X#ڝG-Ma @#- 7f@h,v3)7Iћ[\n-Or@$;2 FlKw;- &gp᳻(d}r&.pIe3 Kf@3g S.=&naݟǐM~-TnSKL.%E_#Y6t4F*L!VU㣐xf9:a0\F_BmknXSZ[%Ȍ!J3gSQoy+4<~ nk݋"<>9g{K "`NX[wY? {/ j# ĔJ/: 'Ben)@T!a2gj੮ {F ̭A@ D2=Tۗ \ ;T~ܽ²)7o~S }@ L=v( Q|3b}Tg Eu"9}ZN˜U&ETR+HZGs/X1X$?xۉzjWt6ItvHN_ڴ?0\`7ztͷ0Ds$fO*Vn^"[bb* :eLy+7(s)E<$[lWafbz+.>^ Zbՙ!(0lF'N\ g*|2#qXL93;(0 6` V#t&Ŷ|Hҵ˼fPc$B "7E4DC2 {qH L5QXvl|TAҒ2:Q9P}`5 #kP5ϳl = D g :+~b&~|71L"{C&Y>u=NsDQwĠ&9^\9f4B_|#V!uW2٣tU?Tjw$.=Jh)0z~61.xUdhy~6GjiI5Q?Kpn ƚǔ.T }f]H,}w S`Bx)D8 JW LW=:!LQݾ@p.B.6OG @Pct;PbG1={`o8W*ힷUqEMfG5Z~T6Vg}׮:kd{`e=<~ cBdݿ엪2_1!cH2t J}\ Ah' Nu8XIHLGzL?߉RCl!Ci[?.t頞>{Jv1 WIq ]]`L{sWpkV}v؄mN GP0Wu`V% u |7;O[¼Z4^ӗ.=~ }־{um>M]Fiw9J!ܥl/KBx7p) gꤓ%O %MOvUh\:{90E8>P>>RJ XFēpG|bGXߑs^R#@bµ ޚEU'>XH|s<%~A\5R4AG3fΖ˿o'jlȇme*q+˺6bW#Ӭ#{qnG~{-L>El)3 LU"Xb#ju={6uoJ DL% s,]O_(e/`i \Bh م#o0¾Zqk>n/״ΕľAJ UIN߮*pO4>oeՙٛړ.At~F"QRYٯ1,"<$UpYլ[l"|_?U /:ǃ8:_3y뫋x'-g3Jx,+Gx<& On_u$Y3+~hjN;>3CpDh \?H*c>C!L"~^2|/GY.p+pF-L^tSg:ىVy()0]Y15Dm^"f'مdjN,7uz, FZ `FW3V ov#_&%ë^Bx(6FQ히=ҬBÐ6ӫ:3i EhKjTp{VTu}4c:DۊqX(ӏ“'me(FIM8JcNNqfAv虦p` [1Ǖ(v3hE$vt?О\Mf{-+>KF]g7"G hosB9b^:dKݍEÆV4W[*,6TG3l;i;h~[n-Hgv_?"gm|q$t {[5}EXi<9DzK|FY`}Ywe}E;/ۇHM@f/GD360Wm`tGII;OSQr*}Z!Fqc]ӑ @d,aHƵ8ot(I$d%aP!N}\*8JX(:v0?!ҳ`mheNwe~^QGPCY<';ΉP=g.W5![VKWOLY޲*2&wZe/ p%"eĄ o%`#s4O$;3HHkåtw~4cPL&'5=qP0EL8 |}fs?[-߿+h6e^W,ݤk.X.1Ių}RoI/zʃت+} ž&ߥ>9/6_ha;m4zuoÁ3' R劔tM372)a+[Yl+(iީÄ'H$ߒVQY!d%N9$VsܮlMEY!^~}`$.rfSWBpf=ˈg2Y 3nA6 S~+ɄՑ>gE%YXΡe=ֻ$8x(:[,ȧ/愇[,eXٌaC5i~nU 0q4S]<"[ RdBߨ TyGBHT{:R܂eQle*DQsݷzi/󶹭o j 1)M,QB="8SyU3 NF !0iTiBjƪmг?` 8%WuMWEz>vnJ>e Ao~c{X^pf(BMo 0.IƬi7TH^7찝*F$id"!2a)2Z.5qr.cNR& ꞧ@c:eŌ9,VRg8v1?p~Aa43^ Pˇoɇ0Cil-n4ءD WZh$=]Oz{~Y;:=}}mS;u%nVmhH8O3q2A6rś*DɨC)@fЪP$ uK^Oed. <Bů 6Syv&F%`ϨMlKЂ Xx7Sa:5Pە=! ΃Ψ:G@6򋠭#*-)IZq\~8lȎRErv:6j8%D_%z0Y ]xڻ{j8yd{rYGڙ0woF:r]z $+T z7%~>7Jή m^Ex>$.O~Y>&Ylc|ɝ ˏ!roajQ56݋D82Hlqsn4R5qκzįlmo Kn*}y[->@+0uHEڞJ4TW|a۶ Hz ۋpP ' ^‘VpչR{PC>~vqi̙JwZspկ('+~US)R<5>(gAB|l&j~ vwށF@pR ?.5|ʋXU@Aoك\zd/!3Y*fI! "8՜:` ϾK龭{Xvna(%4FiB*"F;kK̳Qu0a9uzͰ{i,]'HN@:)r(:<'>jm96M\CSVoݶw +SHZ%N&`O Ng7;Dkғj)WC |mW -V 0)E_B%hdݕлR.!ɲެC-@|1 .=|mWĚ;*ne0B^5 #C4ui Bp\r:C;zD3X~m+nXQu~|[0Sbr`L\UBg=! L~+g㌖9(ɝk Ypd2>X]ݯB"&O$*SNg۹`LѿAyE\J.=7sIC0q]a+":Sz%\O/r ^@ ?:Q=UilB˿7V잷-%^J ;/:蹉ͭ\2`vݣ!יM1 Rwx|w4eook6IDׄ}Nq!nW:'AU Cw f)t#]3 3mTt]C|0) M^ jk5G*TJf |4 bIKd4G[q cS!q~q̡X wk`wn{ז ߪXC\o]7t?'}_׸VUTxiDfl20:`Hk:`z}~ 6~P)? :mT]KZt})Qirv)@00벌!Rlv,CnܜU" '[']t hnCb'R +A$i$zŋ(%F,Aq]-!µe ``؁Wf'G~]I5[Cy/d Qw(xvv]_{mC3hDih;""PN-uxw Du[F]]+ e'nyzYt ˉvl FY[C.+h@xp njyN+&K? gRF;OrJ"U賘cu?J]:qq*7l8(׳pk m(x[r'EqqTw\9GA ixP?~ D?ہ3јhޘS 4DS c|@׭I{;d)8~!D?_Ƀp6s+2dCLw. k3#6ګqܣW3;v?x!+ɭAS8 ѢR8ڤgm47e"[k񇐢 mj.uyu5x|yVA4 _yZg:=OEUnŴ:˔vA`3qFƽE JNvs#={ubOo9u"11( ԵDƕ_ {U=whuNqhXP{bJ@JT\QOa\%حbDew"95_m߅8)N#l9)6a2{LS]?($jEܮs'pdebt=*+=hb{t,]@碿W# +`ayEuRB{iU_gW_U7-/Bp;!>Z{ & ͯ[ L-l Qh"T.@ת5;d `UG =gwj$m>"0 p< w!vJO&Ĭķ9 3Q(w~?UaS: 1P !3Iw\-!FoUeOE(jm$ֹCeܕBi$ɞՐ;%xŋ)#xĶm'Vr7<57L";fB|K߿*y8`)3> DZ4$]'YH SMs%:9v5۱V+5x֬bX.E+Bvq,ŗy{h nq!1:"\Gg8ϒo L,FAc]&=B|JOsܠ=iAI=Ar /i ɓ-H,"sp&LZ 9E+{TSڞ]Vbvi>ox'nh3~ 3!5@y(p DtA>>[ѡTKOA/RX Dɐޯ#_'贺cMVStss!i)+VC$2'耇ֹ7N{+Mr7֬vY.Y^y4:txdVuR^aail 5-}Fz EKU&[܌dc2xeZ+{@uց,SUڕdPo$V\74qeO}ao7.Z+㞗wХNpN~\لdtl5x&5Ï@P!@C7i  @SD Eδ6e syN²n۶J;aK} `X,ӵEI#e$xJZc}8룡[3xԷߘ=dAt=TN6B;DG{Ә\a@@Nw @Y%9P\8!#8'`?aE]BђlL_o+0_y'$X7EbAYm8HZ,-)79Լ¸G-8CUUrZ+h`-0Rș^&{+MZ&aBLGj,C>VNie8>ʩnKZKS,l=q͸$DEФj]*:vvyja{K}2Tw1 [ kԚ5 uaaah 4nZ_ES`_*t_9̸}3tW)H@;=n͍9QPT!i7r$%_ν$׃/y9wU"Duf {Q~B?ioh _Vt[KF*![zD ؉Kd΄V*IUQᬶH5_G]1Bm`nGB\`L!:!ǜtUV/~ 4"'v( 9L=ڬ ξ{ɛ*RY hƛ٣QuuU*^} }j^jm{[Ƌ~ J;dBE{mIOvf ǣ^|5UPA{w؏Dł.arM"!i)=RtNLf| 1Zj|b[0xHH!@C6 Fqoq5H_ SP ډ 0a,k`TAᯯ'jH( ?Gp$l@4|ք<,=ծgc-o? y9@Gx'LU%UH, Br2/KOjf2h[ؗXK/!KUw*japޅUs&FBW3C;U4_3jlGv{EuN4s|.9P+{N =ZXҪ^t@PwRPK<2ƱP],ƛB ~4 :|,ZJaC53tsccI#{.j`9VjR ՜ET7\UnOv}D`.̤/)NmRR8h&]VXĠ(t$\Tk 2E&Ϝ64,cɘL?CF}i:Y$µa_aN5NRLeE(a(Pc/;ʹ %8IDh$d8Ax niۆ ]Vzv+ҁ6䁥;ҝG5pbt^1N,M?.^O4 kͷ\GWlJy\okqTɻu7T5 ȒIơ@CE*YMadGݸ VF| 芞;x ;Yq u߱| QE efɧݻPIf^< b.#/ vc2e7C};Ggs+pC' X0 4~\ePk":(jpVDP%D"G BpVefhBOE|q)8+q-e!4D;{Olt5()3M2Z5(Sեzz>F؍Zb',̵K3@{0C%EīhtWd?qD:96^@=@cR!zdM9q?&0 '*دnw c|9 U04B>Mҗ TUSYUUn1>%gE w)l=2 ,*>=̈́W$M"$:iv^j8M;ll w4||ӭ : '9LRd5Q>4e%fJʦW|2%חֻjE7oYa3B :m?tG$,"YxOLW1q?Vʆ߬4|dUg%aW7 M8(sPPa`#tg^˭Ge=m"j܏aeg+œEs9N`-ؔՑ{'uo= _Rg~N<"U'x[fGd ҋ/)<⹲-ŲEz::E8ji*Cp*5%ۘ#YĹiNg+ǂ(5fD{wy&LI%ju*!˫4|UkZ`Dlׄ4_2ߊ]Fخ-y[KuAR2o+/>Y!wa9h}L'V΂FBxhVȶQ.z' у.[=lb4$Kj[u(H="![< Dt|Vaf _Q@Ӧ*.-fXaq}](Z "~OJtP&zé{[6 "M{j /o09'W-w{&.lh/ ].V JpZxUi@M /,ӀV!c1Cw,!(϶iM! D=fhfc$m7Ǐ/"{BɅŅg jh9gx e/;F{=" PBSH\~zesYpJ40%C.x&tbNbUP9S!Ƨr [\rZuJRgHSs bFݱ ۋ?8l56jMzd$0ӃR} S~0܁pV1}髏Z/:>f%!g5A&J-=Ug9[Y{ۨBNan/Ĕc75/ AGF9-X^iЅ,_~ۀ4⺫@ǬGN[A[UBP) bȍ'֜40 Dn]'8v4Q5 ?7'U"swt<7¦|lYaKv$8C[[oec:8mk1F; qIXOxiΧ_ ܊S) c<4N5ۙ0V?۽RAE6̬ѿP[iO97 LFw_%3 !f0Ȯs^M h:B]Akl}{pcms{lzbUkc5+nV:P*Biݙz}]t9*iB ֫&LO_!xԟIx̨'!sr&gHˌ^g.GwAMYrq߭#\rg^,`3Z^[V1{W0Ԗ;BLR C.ϫ,P[ʓ#Tvޤ iwǰ ,ra-k.dl*:HS$l&.Rt3$/!IK5:^=Y\ڸ@tkVpXoH"l"J= <`T>Ǜ,ցj1l>L4*C4)Zy VyGN~<(\b"9GB6ʲPqqy̏'FoqO9ޔ}cN Q(T4h%>c K u 1T^V6r.Q_Ie=Rv*N`}G .h0DjGI Lghȥ~s3}CHp 4 ^1ŋ;s枣l 5U} 3ꚏ^jEtʼnURO 8%\p|.-uޮEMv$r8y1--{g_fcޏ 7vɛ&8eTc\|3+q <Zծ@%9[NiӨpNN׹Coʭ֊pu~HQ*xB 04`.R* `P-qfhy9*SЯr B3qqr5b#NzF?Klj@731v=k.Im1D+׭MD{ˬOcV3 Aj^:91t'X;$9O@=7u`[W_!D\Z\E@#Df" ztc}ūD0;'if)Iqu38`x Ew̳Dl&/#-宵J50WQԴ,^ڍHqҺѓZ5,ecnAw_|'(.b"fg5#u 8 BEoXsp_cksalN!$ij4{|4S1~a1KS=Yپ{|\,Bъnq 3%b\ٕfueZ%T~>X2n,9zS{-kpGS2'J0eW2ǻ Qo+B9!Gst`**|Z\1eEQEBWBܕۭ;Ԥ?MԦLO SN߾#_ + {Wk Yd? Uϙcں\L I`XH턑 㩜JчbGxi1(fZ ȕ3S߃i!`OyKSPaY=m!`ЉM/D-/'qy'1;~_m@C܍KDdXHćۋ wn } jj: 1,MՋ3'oԣނ,0-b'^"}jauj |Q5#?7k! cIaNzG`!->Ai`FVcF10cpy<=n[>و"W@8^CPп0<Y'=<*{$^d:N,IT{@V]ȑ#~EķӇfe0!~P 3 #/ j1_ Y 6>NE 0?3o}9{̭>)_G;Q`ҼpWwf8 Lq)l'ٞ=,eRaIC:E% hM4A$~j )x*)o/4Пzlmt2ʣN$adL+R+xMc8Йesܰ.T=KA-Zc^}j*=Ӯ0ma]L)ׁʡr:̤Sޗg<ƶNdix\{s"y ĖWK 'O`ˌ '"JMz lE=E[ OCB?e[ K0 |\UMd26>+MqJ5Wj'wE6{s 58B1Iq:V \̞AV-M̍pn(߰˔[B.Z|$w#| \O^K>1SFN//pIWlKʹP+؄aسI?gw!%y-nF=U]}*`أ,p'@R:d{Է2KR]D\}쉼Pn=j<̧1Uzsh {m(Jm"[یOpyу_42rp 3WMQy˯qtKGEIB\ d''NʖDv%{Y>&B"r7u4]g^%5rDcZT%QIkq-i2Q=VeR90RknrOR,^UݔÌ-8aX&ECJbG5X<뭢ss\rGK5=i]'U| ࿨s9%[ЩiX=D:hF _o@9{ś -daGdAS%M@&tgMRIT8$\MAqD`|U' Bc3 \Cp/%?gUF.%Pĩy'4i?XɱqU6I@4|̪&,ts#`&Ь^)F4ApZL.\ B)8LƖ-yb-(~HQyk n¥!B)\ePԼ6RҷG]AN~6+o J[]/).9᱇w^Bmv_明H_ )z˨{.cGc[כⵁ tƚ  c,HF + 5mr& ]Bk8'7R]L,G-5I%qOe:>&FiO9$M @ U^ ;.*n[4>L;L*c;g "=w5kM&GO6{Z#KיWXX{R,BŬC̢ܶLBdƹ~@u&JpAq2wvb?+b t 5O (.fiUOpotH?TERf\li1I70yO\7"lXҡos_ P܃Yi&r(<>Q!߼sQ*:Ug%Fl6QZ-w<-[GLc_ЗT0 sr'5'M17efvV hm߇%#{ejcdlPd\Fd@\ؗ jw"NB>0Ln.3z Aۅ ⎚HC{ջXMk 용Ɉx:LW:[FkiYɳ|}B5dx4 }[ &CIϙ9m WoY@DQu' QgWeO(bՅ;`1zy+<Ό 1GzVTG(z}n!g:##~"][٪>+za]'H)dO3Dv*^P5W-!ta^Y =Gf=P2epObkIթ DyhY1 (YO}%Zi}Y lJge$ݕ6K0BXhiN6\ެm#vU88]ޟuqDKtP}uV g墪0/d*iUოW6oh$/drXSo fK=fP;pA.*j}˿G.;6'`_>i˂h LK8}=<1w^HgFџAcWc@FX:J*Cggg-S5£L1lZ64GCEFd_I%ηs{򭇊z$^AgϙrJ b!ɿnC0vfZxUg5@#nsOtr,pbk-qTO N75PQcKjW&PN]JN[TI=`A&VX=w̥Xa-5-}E #O3Ak{[C͓>Lz}Ӹq7AH1pcH}`R/PdY62JA$Z#7D.a'TK`_2=g-४Z;6h [}S46ۼ*7XVfq\/"C@EaFYScJl"s|pL< FEe70{,c FI!<ְtdO C@09PMʤih|F$'ҿLnaBj= Y杺La:/qH/ʒBB -}ʫB<"I%8c9k,(Ab 󓥶޲mueSAۮ {mo_P"vs*P|S;N졯)H m,BZ}[]5QRkUJE zv5qJ|] &'ġX֙Ӗnhuo:lmfߠ q,<2eRQ]}PFp 7A"XU0Ki=hrk@~}]rv+qeC)w<.^{܇+ܢuqMhH ^ҖJD!(. s۝5XZm1VݧBj]TO )1 !TvnSU@S8 & B ;5PϿˌF_r<=ky8Ø|C)`}i׿h;٬WP\&Gtɤn["+oo3)V9pR d*c@I8kc)0}kyvH=8ptBE&X'pɇ-"p}%4F_]#n 3N]/8L6IdO[|ׂR;ՎY`_)#j ;<[=: 4 wC{"*ow>&kv2}@EALu'Aֈlګ&}蟣 p;fz$=YhJݞ}% @``G=oʎ#D|x/*F_״*y)o>S^s_.ܭ:`bn}̠\O{Hm#F Hs]5OS!O$hO* w$M44E\45B.GvTHp!4SgY긴K1B%ΗsOa`4GTmnUZ);"FcMp-fzp9EbDY93SXKzgYD2{b1eC&q~DKu.seF E{hc)w&/dnJ͞`mpڥܮesN>*hJSZRd{_+/Jl0:TMgD{T@̰ o]@3/J '.]Ux<}_G6e"E=7 X{ÿXtF\Gle!va㴃RPoE &r1&NX$菖ZD]'qVgţ8wtL}NUeYS0}qMjҴ47_z:`"'\vӪ‘@3 iUO_q`N:֒i@YNMs|p x%XǮ=fiֽ$m1Τ?Q'9F',.PWeu,,Ɍ_xIgޞ>R ܤ<,YRMqU8X.1H$Ty \D*^CY[xި>GGl6GμhTI ۮ;EΫ U1qDY J}7eQih g V\ɕgGybJ2l=^y> 9=d^U+wP"s69C;6~׋̰0>~{je6BL9$ߟSX[ā.fחQXՍs&Tl]C0oږI~>M#AifB!zY.bBDB똋659E-4 8P*J/g||{_<*s[l򷈣\3F(B`fS\gsFKN9'"ĸ+y"HC\Zh.C+~VaL淂X ! +QEj!νN&rٯu?ȓ^/̕gj#j~;gS!|wX-]Pq_ s^vԅ_wԁ/fqiR#$Š(/hZ񒒎I>; oA+|h%ڶ&+ʹ`d/KN]}Ѯn5dqYĢxϴ#a~|P  !R]nTSVR7Ob *9ڟд9O&./gAN(6e"ElG('{jnнT)N.ߦ X\\*[]*%sM.1iв?*\0krCRY#v a1v n`)zQIIP}.J%]$y<O8@>'ٌFװy2\r[3x="vxDqkkl-G¸~ᨣ܂xʉ?b%/ʛND5ɔ(HO;=;bn+hiGD2`+TF~IP[DDogH- <8,z>*CC[Bp|}ٙx}M~HY?6;4f>fPsVIDIM00e-t/©ȋvl 23;k4Yc~'-_Vf!Ape!᏶L! ]Ϣ&Ɏ$L؈ 'd}:|jgJSIvMwy/G%04?Gz6y`~ efw[;;L篞~%,^ uƒa>rMp3[0_oJ}K:x焖D>OE6EKoz nְzp<!dTܐdx³4Ul#bi@;]$Nt]fPOʝ;M.?G2tlml&GŤEgO_l:s*t=k =FNh7n&'q xW(̦mR/\Q}E'j_pe?TXV n3+^#ݑwQ_mO[qJϔX:~9봮Xߨ7H!1́?0R SM90Ð)K~sǐѓ]WHx3 i%o ((?V(5/ LUgdWw䡔w>G7Q-d=A='[MJ "H xh8LˉQ( Ё(NZJP5*ώE#Azc!m('H8Oz3ac|1kL+׊.JfZ,p4rfභS G> RtZ,ԷPH[fK{As`=e !q({2U:ȕ /s!V5 ~˧NL˂ضG< I|Z~WwXPx1lة6 3B34ޝYk/"i9bEեWDj˄/-kӀ1umt|gD&NsoT{9—E:wv88V׻O!HL׀=E"Ǿ Мb=l! `(W\Mz=) /LOED(2IX`K^Tr1J}ѣjGr%N KgNN chKbh_ Jd4x}xod ].$aԕ@1.oDfDea.ب9Zg{ayD/C|G~8Av `qoLu4l\wu=E9uz.t&/u3CdmHNٞ74;)Y?&`wR8dL:Ltk@%"QyV Cqj]ҧHꮃ╧Ov5ɔ[gvR*|8D|. 9G&uomp"ޖAWzL or]K}V=8i.Q0u[m2uxg҄@>y{=%K whbع@-"nec Jo-7Gdža9ɦ C"ء@C sAB Ruk&ѭHPLBbA ާH[f2,y1Bx#:d)A0(zLWnySdevs@Z׽B 4E"61Ǖy EF2/YeưB`}g9?BO%F/~[|1:Ԥ^[v"{.D:Y}hY`޲ivK%lR*WLfS=CyK4GWh<#s g 5!@T8~Rtř _=G )"KFfZ$pPk0pDl ͍:jb!?P53ƓX M NPT kWΟ*t@lŋx Ì1Bcm[vٙ~t#,OP] /↡2IέhNR.oo-}Ak51Sql'bO.a̽T1˓hkɫ|ya}l4hLx1Wkn.n[DǞq`A:2Z˝0yr A3|ÿl*ġ}4h5/Pw hoeano D xCAEyڝfT={Ԙ|B,(t,fov9S !њUla;4n?ڿ/l6NXy?ӂfJoW_KM8X9S2%- KxpCTh%tOvkTt]-YiƝs,MH[q6 %g*L늀9RX:J$<*%rF?]9yĤlIAj`;? FEzp̞gBYAܝ~bN$ff I DM?YT(na@Rfح3 ߃[ fUCՙNōfv38e1Z93 yER/fU֙9paue -eU,\J C6 :_u寁$cnEȜ5SV!z*ljASv dpTDS;Kcz΃tX|?B)R:ς+2 ےDlaLwvػsx_tvhYe sAS & 2Iem"7`\X!%FӐaΖTCnx-NC`,dz6th/ MXaAz8/oChr"ğ࣓w78r(oqdIlr[*KllI:#[ qm\8v|+m̑ot FL:tv fF\zE_Ö bI <˸;쟮:vxWU]Wfh$6٩w|^a10xDBitlO10}?7{aJЭ-3;4fۂFGi; :8LL^C)~яkj}j2k|yNVԺ[E(qN[dG Ob>@<(ܕ-舖dK- ^k(ٴe%ō7nSLf0#ϖ.K"Ů/ r> @5GN5ܽ(4 Baс3-Ϻ}y3}d[>pQm/}]6Yr$"'뗨gX|u !tY~p>"9xLPn˴J!){bO[.}!2U^Co%XH'`A']( ee 7Vrm6,..'l^BQ{!lUtM\y/Wןe:΍y=- U+1t(fGrDm'l8Б\NnjoIL][rCJ0coE[ m JX:Gtd\&;+:_bۀ6&Su)RpT7OEwt5,g-laz9+;.plMP6k"-.Z;e 8n/2&  ߇jxdzA'=V_ +1 {n8@9 ,on\%SۅvȡnZ%;0SQ#CVwO~,cRRGY,o V3AC(a?`u(^_6.3f<DžRI0yb/*6ˑ{2X F5EzñNyi"`D71Hwe, Z ~?77^OZ*@5 )c~kǮϴ ^T&˵2XeP K+V|1_OE+wfDMkUk-~3Aɕ=!,k2 2nVơLp3(' GGVi~ 5UEVe>Tn `GS^05RR+<'^V̟iwEtd;GOOK9M|+3VSZOoNpjrHuܓoQDXp:|U]`)JE/) cf]EMVw&#zV hOwi,Z2YYf C:*^CG+)Ohm~c ^,|G%φr< uau(us\]$bh. 37C m0x#ƻm GhfNk.aKe\"0ekGU ͪw7|Gc;1. GQTmRgQA\a׾ V ܤ"ucx{ XI"LLQcP,_-tHɂb CbQ0tG4Ζ*o14Tl,R+G;}T}t9/Z?ޙw[Leⳮh:z=L3حBJ% H۪, 4"V)_28[bSx 81gTwW'AHZ|Z2{^2yW\$9QMܭ""W > u=(xhCk/v9.Kf/!vo|w$Wve/k +c؀bոLY/.#5iհjN<йlQ@bVw}Xe f&y #C|)J (%,a Z[D3T`*L{H̗EZ,2ynw0*`O :7>{P9!y3:';W?̋A_ɨWk"g^W@N%aAD4!dV ]n K7, OxHD iɳL7a*hgKg{;ϺJV/࠾c%ZLɆO(19U$ůԭ#9~KZpXWD ́ObO'.ߞ\˲$"jf};̋[b{lSsf -؟ظOTxjq@zi{o[L_)1p,4Ƴsi^lOv26{*[S[m}`< $KHU}Z_]8fQf>K m #dVq9n%;o2!D u@1uT|gv+!J!:dϣ{yEx$;֢ݞ=/d; Y5ؽ㱽8ԓ,LPpxgPF&SѻSc>BxA4!L PAUO`yE&9iBy^[! A:\͎}PW*|Phl 4f_à0VwURe$O|XXPP, [ht?-N*ײ8^-\ ALHkBW ./A-P$&^m(w.W4͝!fA&z¬ƻOU#K8r*bLvd{J@h0kN1p{2T)e ЇzGM dMyph+%*Pf?'p#И|zǿ{\grH]Dקax\}ڳoNB~_ ~_ew sQ<0=t! ( 7F9A= **Gzв `+G-vf_21d9p@8-reiGb̀Εɠt2IYk1\8g79Vs*h`w]isW !E uMrYDN jW6ayeq j)ёR8ed H51Zc\4CJP~ގ&PƬ`-MB;62'iң®v{yԫ]wG:O$uVIZ ^ܧPZ6=ZTSde(7i+s‰ž W;ኦVE2 ȖxLhsǰꡳpå%OBG̦xڪ`Iܑ( 23D_tmEG(=0lFZ@1I&n!Hd%鞵սqhu@-wp{1N#y1feM#&G]3hK%$Ϧ"NPLӁ@h?NAI; JZ,t@G庸%@*я~PD۶ڨ:hO&8/yg "+KREhy:1^X֕}̖5׻NMepbElr>1ُ&eK#54/Q =.F-# @=ameH>yrZus>.'rL盡,`,x}4Z?zE6ń5 ް6!npy(:Yyp5LW ل3k8Ĉ 9* ]=䃚WW%c+^ǜ @\Lc-e.n%H{0P*I\Z)Q 2ҡoҬzY$B 1 5h$ةU@{!UFpP3%VtaIzAY}=8 ?H@(q ' E85Buo`'A}/5Fk;O¤N\!_o? n_Bxy'Vq? h"s] >1Xd G G$*G[3*rXuen% 1 k8?t^ ե 9{R^% V@DDOeW3!c 1ʔoL),rͪL"sLk#*1PvG ɸ~䈔prV3=:dN{ia]D{} p2HL]b/XvgqIsWr|^m}BW|(0R{Ol ="z.cǫ1>K zaaf|MiY6A2ajK^*rϦ A{9\ w`MC4~FB!T1eRJTq"4"[=3(7ͩ[cIXp^6̌_P 2,Def;_{F[0Tѷ)7 u>RHaG~i<fwݠ/ǥs@t \L _a>}J[N,b eK#Dў@ QUE(Á$D&GA`&i$BBnI>KcxgŪ|/!kb9ׁkA{YWD_c>"Ko%hfuw?@'q&Z'|B)V!.\8d.)G(Wz*Cn`j)o hˈL⋓jd12~{~0VF*f= uYT BCh;YF!vQ,X}NΩB BBZ=F {]`#[2&ZƺztY w&1\\ TZbqj;̺'m&I&0<ُ0=Ќ[YBHj,@ 6xyYf|?r(՞S?9ξN&^[nuՏbQ]7 R=7XN)92wC4fİy/N/KXEv %kABf_WNLU[56ITSzga\zs\xtp4^:c4jq-a WjʤH\9rW=OkQcLRrv"iM":R*1/[|X;6Kч1i^cy!3uܹZʕ#joDW7 ek*7%U2uU:l+wʸmw7籖 {ta͊b&n;[+~oCAS6Oʂڱ7圴)T",9EiV::^IXQr%=tXF@;qSP.'OF3īd@ϓf,[VJ8ҿamOs'~`,(8ir`<>Y͌V0\J3R*?eSvVGI"ҙEڈP 64-QQlWt첰SћLߛ)?|U zw8 \m+n_;M0E*gḬ(5g & B++9(=-2J#GS~A33ӀD*V [$AYԜ%I5Țƴ)0uuO{03QɦZ%_ok@S8RX ؁.ؠ!&J_T?.{"P 8,toZMqSR׮x cTU- OU33iB>&kN4iN I u#^@ !ܧdà{8LOP)E.UW @i_qKڭf75q]Ť"dӡ㔞 " MkbaDCZii׆8)lo!+ imO{"׺~5]m%1tfs)HyU6]]ȧo0M*O T oJyyW 0r1;/GȄ) BGy|)ʆX~Xno$XHͰYDm%v}ӵS3ZhxvI\PW (>O 13+?fV%ǭŠĦ'գ#o+̠ 58#J&:B$u5C'ؓ\ PuF^1vVyJa[:NR=d,| Cn L\tp?"wS7^A0ێ%6FR1/ŋ' IMpBdl;orf>D[1QRH9Bω'ikQ#R L$V2x _A=)" $t -Cdz7jmd5&j QtuQ_< 4=.K9JU:;RM =:NK<<ۙ Tw6 O`PiĬ,Q #ήAoC[k;Q޴&P(yMU.'`/z7ؓ*KB-pBb<栳S?|$l:,s&鄌#JHweٟVo Ӎ(Yk*)XSsd>vÂ[{ΪU p AU! ~S=TǕHQ^$ϔ-7uLɔ=oe]4 lJ$9qn讌 ט/nTtoCH"{2 ~wT&}@=wW 酰?Oo: &h 3\FHq*9Ьo n e)լ: +XXR gY.蠟Qe 0S(Y49]*EɘkNU-McstaTPm7 V8o=9ӊեIQb;_AdKi `䨦&)`|%%MbM 4 䖴3_/[MtQ%ZR1tI\Z1{H6Xf\OUf~:<}]=NN?; ` 0]hh p*E?^Vp]:aw%2X-3ہZGzV40}ȱô*ؘa~y̑jTFRa` buyP08Ο߅c +iMlu c3j2]ddA}PT!s]ЙuĮAZVvwc>Rdq9w)G&LJ~{ ~.+MMn-y*4>3K~v";ξ^%S`9eܷ'Vtd @#j'uM^p*31;43 jWr: Mt~Ӣ O~|ڔ;PTMDr/x}Ǽ "@`E8vW_Kn-"q&AO͘KEVWqcw?0[zdB'"`iqu]aF{J^ ILtIz!T׀=5[jc}u}~C=fJjI>J|x;NtFxq9K<=?#(W:rnjgcW5dଌ` ZKJ0G`b05q"{v6r8Ê NI^G|!Pw!\x\4utD{,L_돵gPo?3^&6tḬFDmXhI([~4r 滳A^{ 7f>{߷7[0dEG [ga#xPFK\ wT%Es1.ˉum$S19(<W8]s9Z 9ᘓp  nvsl* bRk':`ݪ9٢^w;go#dQ 2[y/EL8)cF#-î 3KZđRO3xb4 |im׀RNPVFlТ;1*)^FjI\'ܯFw;nj(Q` g~%CtJeƪh"T-Ke$k!bJ}(V%֓Y*h/*[~ňӠTivco͟l? 0#lO]4/x{I{皯ZONg8_Kfu!R2q0 s T2& "5JaiT~`>b2R"ɦ[{0^tjrghTJcG :Rg= v sD6i}0mWi#2=l| Xv5~'DIC,9١`[;{j5ͦZ~~Yq':D)ЉT[)Cs/%CZ+~ؚS4quwAGY*91,qbVLq99xql"F;đ(CC? {jWhK<@zl[@HM(%iߴ@Q0<Q&- dS@Oaq]iWgLʁgjt|053ds}%):.n&^|"#7༤NU_%o#K̷%MĄ-Tt}/hx&9p@owF2ڮ/Lm?bo 6NN+j =TFptFdz' ;yE`ep  S\s7L)_ f>+LlDO8 QNsnFdJ\nzr(_u|4r UdoF,kCZ ^઱Ѹeq w9v,}ڿs%N [{a2 =B43{t3z <*H:6{gsPF\cM$6sW 1p2a8;"V \6=mYN0k*-?E 9&ا4$ LRE `zq,ts}q<7Ѩ'uQ.3_/ <\Ndq{$z z>w;ff0!UuɃ(>߶4_Y[~V }m~ |=g 8,meluXP\V h)a74#[?PWg@JmOZEzKIj.;M5FCt]CO4=I } g8kF,fi i&$)WW.OY!\YIUi10ͳhŐTaOY,su9Ơj{nTlu\h#ER\T6ijIx_FX"[WP0f1kx>Q$8ߔOShxm637{uj7 ]aoVI%C-t1/4~4f%wmRHgKBdi5"S^_9y/nyII4/tO" >  ~Rr7-oK#$ы(IjUʌF>CO"J X ~î t}-q_ c0~)ܒv5+/4#{+7ſ=ftS- =kDmJhg3,u o#1b+GuQɧ q‘sEVz I 9Stsd9c6=+MTJE}f ]k^U21ېl$pd?٢ huӼCPpLE">\__!ڲ.h7}M;P$d0)z/H~ڞX!q)J *_ _iZXO$4XReخ -K~2Jh$7?p#Sth}k{~H.. K!* Ix@eA@1"ecc Mf8)63ʭ)4 4=BcyTx0JӀhw4w7)g.(육oGO&t/#W?Ŧq /@Pbxcf33ű27Sʵ,ZE 4^zD5̆Ghlʕ@Q{3˰org!m{G?ijP2$H;yfo1$iG8dJ?jッ5kJi蚲7+THzCT% ,,[YƪyLfgu$Z+ٜ5ʎtydYdH+$V `%ߌ0CMNe &ON:5i?7yيfF6kR` 8%irm2R&LV#3 9feRGFܖҞ?!C(G15LzQf_RRAVk(ʳο)0?@ u 3F"lȷcq1.hze6FJh!Alo,RL{%v/p-~!53űU-̏Hms({nTm<hSCg.< :pX昝G})!ֆyDt[d P!֊<Bt[+t"J#" 8_)\\b M^|5q%z>ܱ8a2zrg& MMtt g_'("}= &I"S@ˮ2OĄ k3ىvaMzήSդmH΅6cjr_ѥ- ]Ε*zM$ƌQ VS$Ȇ,o>ó`fKīSc j*8-WּYDS^4 6"b[Ngh&ྞ>%"7܆Ћm%8>/`j8@JVoM~9[S@aVWs@∇D GkG% @nM7YC]\X'/1j "Q|dbGS6{opw !VMKLNYEb3dI:#k$O}FݪeXOM'2N;r|F),qB7PQPqр:V'@>p5ĺ"bsGZ?/^'ԕM~_⚫||Y8/$?%0z|\.`l9ƞxxʦK<?Ws+QŢ{eLJ~VQ YqUmdu\Y\y>0?ZH)'qex' < @%#S-P$oμ5aqs.EM9<|: c)8]*T*qY$laDaupwuW.Ò4zl]-,T2b@3ͬcܢt=P:xG񛖎5j%,Ŏ]@-TT[g@mb=r.ˬ{^dFiwi>Xc֡`PwpG[bZDեհ(u|ko2QTZ=bۻGӚ;f1XOS n6̷U80U%qw:ݥ}Qބuniǫm.U 鲇X:+4Mr:?'CvqIAyBp!>'u}>HkmxR,ho(l<*D5? HK0l >:Yh^C& JhEbp8@n4[j(J~2f0=Vn]`#١1ìNj 4606&W94폷iSENκNqZi{x/e=̖Q\un65|zJJdbz=Um&s)G]mǑS"z1pNĴFgSya2!MPޓSZ, uӽdƳǒ]Uzv=03oƳ8ޛT#WQDXɛG櫖|C'$|O^?yWbKżlxcT^Ok9}^,& Ai\"Θ{!Vh\rkآm"xOc@tp#?'SRFUe iMiao+xUh5 >s[`sYPLYɅ[IO%'w,jlּ_|IގmT7j}`uވ8]7>إ95*J|~[%A} ۢ`|["vھ|> 7h-Nvs]E4hn\bC (wkY_A{|9~Jp|_ m/fG]U߹eG`S"к1p |SWˀImjZ+ͼ4D&G-l#Tb2PwxBLjdJ$,\ĘHH3@†Agc,k˄r$WoGA=0` |.(}L"6 Q`Uo@*m7A}'$U̬Pv \ 7!Hl0S}X X&yUYkף*Fr>mT [\b6~G؇ GřeV#bal:{B;+;['2F+Vޘ؇^ˮNܮu&73r"B{ e8˴p0?~puFT6 ;<~٣1UD.$ 1otldGBaayrt&W 9GmΤίA=2O8(K;Mƍ{ikCC8ǹ0dxѻ67 4y(Gv񐱸ڃOSg@#95*e0C5& q3Fu:^ qKpP?z&߬ze.)h6g 4ϙ[ִR%'PAg WUq Í*k4$޴lgܰwv(^dPU59ka 1E_b/f^i2F`YtcNlwmװ 9Ɓ#Gy ('UK ABWHA~”u-,}Wy0R:UTTFR?nj㴰7e -u7ivUYrz ܄W% NT=e8*dOŷ#@e Re;b*$P%9]Pt UE<_T ,,ŬCjZ(BtQMӎ9w|W[vpwH5T3!ΰ;lʠsi \=̟@"@d.G^0ҤE}", % %aU+oP5Cx6 _cԪN {lͮN~gk} $eزA⭾'[:mٹ!0]9YV⦀B⹿/HpT*ě&l="߰(Ӧc=5 URٿܨpWڰjR+%kˑ>,]MUJ-P_ >W#f@z\$|.ۛf,#G*)jKFDW^)9)$hjE1ި$$ML2%j g(T6T6NjT!??ej80(*KJ90b`C?N_g],Tx \_4oxw-IJ5fl{ejfH`0gmbxY)y.wܺ"v9?P{!J&t2]s'O4Jc}t7w޴A_#L\j;;t$S;FXD֓pz7g`Yj{]s!tW $8brwӸ}bbSu= L]}͝d C@O:}NFS jLe26*ː 2+ʢ,p6;vwIE3.:IؙN' yg(د>}>șÎNy0q0{q. fW6@`_cīb#Xi+_ε> o(HqKD7CSxblfCJ.>#[vڵG /(c1pg6z$= 'rF 8y=vh) GIRNw;V:[f=`FWqVh+cE$sۺz 2FKgqFwR%`^'Sl)&^ ,iNrTRo͖oH XNRT1Ok 1tV%snbuqOK2w ¼+ }1WƬm{J5qK?vNIQb _W'A'B]7Dk,Mi{Dk*TeF˸F0 ohKUmlZkgCa!oK,1rE iy*FM,~&@!5NW&Ck߯ N)^xf@ ٔ.y'ouޞKUozXi*UgN:g-%*2o]`A'Zdqs"̕߆nP5 s'HP7 O`Q@z Q!p4Ǖ%UpYF0mR'&Fдj71cV.e3'!̗?jfQ%D!8g(uMp9'6 -<ճe]7_I=^Rui6 q 4,A)?V,=GIUK=+ e)`o6.u'*"]a^_\ dj8/ܬn>O ~"> "fχ[aW%(Hew-<:(E{VHQSݮQK4]aJo=n4_s*wzIZYu1:dz~{_0aZNBӭ 6jㆎpHnA}]@6{X%i) OR яu9UXqu1o'Iu@4- Ӊ}-xH)m,F})O)ATiTjŝG7IMb o|yEI*./Ԓ>q`U|a"5 bMۇ{ glez͟R?WyR\[V4֢}N XmvC\9-p[!+J? u y-_n^zƇvZ!ܺ8ݷBWJtո3UGRF6؊? )_Z.g-<>ʧ>Q/q*, ^;_`nެܦc~Iݲd#S3w`U)X!l [B7XV:FC$7\-{pV'3nkFZ.'tZ|\_I=vr WY**ѽ#mད .P+BQbQn2H_.æ!^l2u1ĪYsV{k$ Y5ϧ)I/1[tg)r>#zw}9/r!6. &gUaR*O8ĺYTnzv R|lu()eԜ]gj fIq'Zw fy w0&/BIYnOG6v!f,{Kniz B3?l҅\Vhw9Q]聆3[xig';6f@E⇷`a9FlݛId` RB\Ĩ+tzvEEz/1FT!W~s c VoD鹒.@`9LM\}6ta}2y[ klӗ.9*F{Pu_m®ad;O+7,m%nqc01q»?8>2(\T軁~P*L%*alKYhO˗"oذypc6l-BقH<Ͳ~G**%L=<otSIpXS]<1a6!PZ"vsͫ7.)zbY ^g8xU,^ J4&g*}:e\+9ulhSMW-: UxƾL>e¼Ÿ迬OܴMCU;:H h[^\+%[+\)"]!9s&H1ɒbV!(At (vhw(^kvn<g O }g=꣕2@CIn+{+;ksn!>a5*Pw]cx2b@+vOD/@'$24/bǙJݙ.Phعh+dV"L<mtK"<OЋ|2~Uִ8TMOf"=tuk+0\ۙK}Vc v0˓QlQw&ϩz9ni:\ S'9e\)Kff=m Ɓeb[j 42;PZQn>/h~"x 4}oWjEZ֞7ڌ=QOC:Nw]1)̫}gM5S+љC'a2u6p0ŢPwYlfYY@ߗڰ|̆|AZcHlS)\IOB%lrKqÛb*pjU=%q p͹Ev.cVw 4,7>&PAhݠևT*+1ߍv06Ng 7&?q.s$D!>DSC~ d<K>IȘ&x[#2q¨_n8 :8~%NlϬ4#Lf<ҷg&'JJf|hZ)=v=ż!='^524kRtKAH[0{%Mkf T@C\tZuEfC 3 I vWByҡim:W%az=gr1k߰$0K5PhՇ AOE(1> HdO/zI>~ '5O/tю@D)XL]b6˂=b9]D 3%ܗJP'vO RC%qs0 #DnP F%Q8[3An9^߈/Q~ _BlC 3ݯS uGNL}܃ bP/-֔7HA;a)-[E 񎅬OQ[+0j%_KԎ%0o(%G !Ҁ)(βtP_;kT_m? %`sc7Ft@#* =>\y\?Z4x Ჽ2 &(sʥ:~z{t5wKk5$cy5S]Rʧ#/ܙ&{TV.W~ȿ};h )\#Zm`)]~u ':ZQ֬۾T [_k.E)7OxMw )_NumcvhcQ|`xx괔o߹OLԦ=Mr~A o$''\&8A ^RYyGSDy0˞͜ArjGLxue)'6ޫ}u /;hF. !=?l[ nWHϤpB #d֯Z3Qt Bkz5$XMwa>:NoUAuF#j'ԭPsٳ:.bӔ'`zQ-+}ZjgA~ 3F[N4c-/]Z^ӼP b Od? hl@<7CO],T޳"U/8 ̮2<J,$Y0Ys[3V&2PvC!ՖQ[cSz? PVA4S3+/%.(SK?=?/qOdK] իu쑞nonap?$[8]ej2]n9'N$-^ ѝSg?J__aI12ɠʔ*Z[0e'nrl06}LvhriH{0yGZvY3Φ᾿y xHTLZ`Ā k1H/1@"ٮ4Wi&Iޚ[5pDadV9Յ#>,a|ͱu8fy 3177rGJ'vU͐S;OsBV5-IfuWBau3af7y4O+DI80,b>ƹY6P?z-]G]F`Rw}sOi1ٟX6k!?H.?*OZ u\s֜QrH#qZ $W@uB7D]OB &o" r~dNGE)Ul-,3\(E^}'-C>Wm->߁B<+sH.UA< fSq+MK* %QV ub-yh"]3?C Cv{tKh(LLf-€8JL-/17Ci&S"x2ol5sKh^KW5(Ә,GLyb #oJzZ!PSvxN n(Uڰtjf]OvӒ;fQVO¤/e&JSݓ mj (1՜V+hPgN8$)yNԚR^vD\0`/ gH]ag)NlrF_lfKK Cg8JN7Vrŕ5KqI$LR_iiVZ#eIGĀҎR) iqx7H,u!xDP7M/Fagp>wc+2jVUDJ$;v )YJݧRdFV=eԸq+0&:ڢO \º\chh_9҄p:QphXe;pl؋f ()IfM, [1…?xAjjoEP-> &Cm7+p/Qy%" YWp$$ -Vm/e^*R#1WSAz} 2|>:GQ1 m0{wJpMQma`ɐ&"abd' Hs<02I"y+9t a:9rX-¦Ejts2ª/?yPq)\uܺoZ[I׫,fj$iJ+7gE֒Tg;-zO(秖#y=nxxfre+wg?x "&qSK!Ll:Tb%#!ؤՏCRUc8`$>FIuj<ۇ$/PkM,B_/zbÜ""x`߅l*K5dИMkTf$>н:Ij PZv҇3ŠWm6ć:U9\i) -Hv/U $Yޭ=&KFN^:dR+,B0KuL!M{  {֙~O0<$`ƭ!?GE:A^eepvRxćSޣJXa*fj/juCX9IwY?JȂ`k>f] Y6L x;i%SQ@lZ`tI]!NP&zT!B?;24HҕҶ#Ƕb#ϖsU-ҞT`R/ Ze,:9)*`IofBphuD~كRqzk ^1%goKrR16flf^,P( Fo_P_rU.((Л7CEӡ)24'cu20=Kx/(Rh}( ]h!?m,TM'cvR _<`3Wc8У;u%i>&*?ؽZB`)1ĺ !(zH-5.5+*iRƠEq檜9&ф[.'ܙU;Es)'椢|7"evK,b|!߲;X 7vw-dfMS<[(‚_Vj4;OQ?ԇ>&dtbvF&]"px7݀sx^PȚ" #{ݷd\-*X8_rzbuHN?ѡZ }M{9f`o$HKώ]K ]u-YrM&2آEcmDӥũeh= ; Õ6UUJ ףh|)eX- FjR&RJE(7G)v6BMO%mh.3⩪+ ec4:U~.?p̤AЙ#ioSPm:`U P^,bs(lYVz7"ТhשRy!9 Mc{5QdKY~rb;Ɨi§"~F{q\'uNz2! M.s&pў9qT|>K[~W= k 5+c}ȋG(Avi0S G-oԝY30@TElMI* pL U)aո2h` c٢{y㮉Lbg`L v3w4%r]zF{|)0wl)iO.h~&y:jms=ǙlxWyy/t?-q*f_翷>Ups 3-R LK82ea 5q\i"Iy"Y^\=F:B1"yۂ!<[YdeIg{~-A슠[M',|pܵ3c8Uq1(ԋPoM} PкeR]Wj"\Gb直q4نhO֔HF]E}& A7g}Edg:*|Ȳ%Y/5wkF5H[^4<ه M5ƩXa>{"FWrFW;5B[2XLKY,P&-iXe(ke*j5uڍ'}mh-0wM3SdY@u{'A^ٳҖV"Hj5 #fSm3+r "ЇG+ؑ"|WNOl4k:eU=E؃iF)2J#,+,Kq~gVDBGsA|DDPwVk=s >Unմ+@憗-X7ڦa[,fz0h\ 苽 &aXsЖ[Ys1XQ[69\K{d]0 bM-[_EcJT fX1/ HII{g{AdM.syN<%LjZoϚ),.'kt3#k<=tNZɳBn, |XB7H4 (ix"uC#6o f)/-lDH=`d9-}fKaTg$9̲/9%ygu+ZOH!) L4j,s;\[1e ϯZ. μ 9+"U.NZj 37o?U nAzϻgY#YSz!_(z@;MfžG`rzЛvQ9H9_-Fu([8ј'_?$ ])2&ɢALd؄mh}ڝv.<'Ф# >~YނOouK+< VyXe^/ECX@MYM^kJ76QHԪN58#WnlXVK@pk5 wmh˫ʞK{f^}K`$)#1[l FcG/wVvGꂃ6e-n7ь K D_ ʸ>#\$%ϴ0euHr/\&Bs;'o^EOBG @qj2 W:Jh _|Cwr@ 40 ʄCbrpm=x%56PޓtB"Za[cWu|U?c qA,i9Aʄ)zƖpk.g[d5^ $L/ԅH]@`Ye sY"b/R{K୛Syo8BgMmyN<y6t%NC8s8I *]t] +L h,%0m|!3l< RY(JGNn(\QmtF?5{!*G:\z,c6E {r qyVj09jZxyo~Kԍs  QbzijL "[NX_ Ȏb"j70PJfC5Q'x +tR۪&j $K[:c1R{Jo;0'X\GAaULr4cʚbж_[hFfz\P54LUU),= TJ9RkӘA6yeZØ 9*]Jl-WA9+x D봔>Wmq#~?_fHm[l17Jx@(5li擸WD+:s7"nsE$\&r{rFL mRۅ2a\[rz?{f-Geq5ֳ>߯2(x!kY\yꏀX"LOZЮpCşU i2+٦O0YPlӘ+B AP&M59m] 6C2sjJw ]6[KT3' ԹZBغm.25AYnLs}1]w M w[6f(HvFBZGKwdG}YuĴǀ͡_AX2_Y#O`$ e^-4˨Ŗa3x1fiT3<.ZC9e-9g 7s3*RU{u*4},NW\F ;)cPgX168nLQz?;};ŇN VD%>PA`%4+rlAqMXDb٬.z"Pɾ<ǤfewM8!l)V;aq(s jdO' T;I: ~ʃp DD965p3aV}Q1R&[<}Üps"ⱅYLMܜ%/v>8[*SC`(^#Bŭy[LW.{PZ,}դhB=PV WѰoeQ4 NV߄Ho[$͵ ^EG_{4A[@Z `[37scJ~+㚃 Dˁ] Cyk7ZGl B쁟lK'V9x@u FJnBG+.`ZT~uc=MmaNWwsK>SauNf$5<Cc۵ͽwfHcEN($ "_IᏠ^W틔*& vU]5`-1rltiTVi!@{l '64iVV( h&LFOltתHFBI LW.JLb:7@.sy&/UA\$%]`מr'ric$* fgedle:5k]8yhf`Fe&xy;j(Qa*ݛڟEM$,t/`is@[ c)x;͟Ax,Yq} y b NrBŷYK2>3O9%;ikO;VoZ,Ҝgy`02oq PħIОn˚_jAcE`T]~85&!'ɗx|*<`| E5Z~9OhMWX! A;b2YZϖFàbb%LcuL>ٚWoMnfʡ1.4"E-}OShѪ6RǡH e;]9Z>Kr5",!"yxϰs7&꿨9jzm UyDJ=,Di%SmAF|jF܀$ov1ݽiވ=Dj gO&RA(D ~:=Df9lݐ2h#앹+L2 AnnOxT1QFG#S'tYR ;u^肔\k䱭k-"PPj22g0(?t4^e.w~)w̧bRHȯ?|p^ߑ驢 /`y<횰/ OAYSbˑ;mdABד-^Et}-ۦeEyQ>$P[e+||V4Fx=/8;p(p!Qܚ_Y9Kt&&B$ 这)a x$_ce K Wf_@tT7fLQ]*Bi+9MDj /QM~>JHAoR uN`z;:MzXֱ؄*}{<򪾩V!y;a=]snRRD+B"YT(CE hMxx2{`!K.&Dn m&:j&bLTD{ǕGnӮʸ5G/f_5nB1AEOQoPN'?vu*th (4%ƯfCi9MJ~ҁ U{߾v }G~Ŀ(.MtvoDINhSdv dmo,=22[ #©(d7lF8hb%%OXfupfJm`WźaS>gQX$lM},⑟$_͐E["@'6ZaZ|M`*H9;4,\kćOX\(A,xI&:;xYPv`N#臱 k$2תy2#ߪS`Et.`0yYl&\{֣t"U:~\ėVM3;_ͫ%CIEK"DjgYM@Dk|Inpu C/Ķmys?UtJiYD ]Jɀq)Jܡ8`fl}O)ƛqLI14y l~y s0 #u|E,fhltTfM M/U+퀛SK'ؗ$ӞQ(lb(tD_*WeVj}1tnj[EfFRu$ܻ>u"l>M J,=x&&Zh7 ]ƱO3i:Gg;amCIW| Qde{?]c:gxh]JUH3B=Y>-9k4<NH?4xQʓu>@b<ȡF{Pު ]BbjNo\iDIz -wjIj)} ֙-UʍA3s kɖp>I#t6Ig+[qIXw,$Z)P)j([6_F!}nxӼB. mgD_W $*n'/AN=m Rɡ2%#YĽtlZfɿ^`/*B3ѯ趍yk4C*-%˙AS5,ݖ WJP>\d}~]Kca-Ut(xI, ',3z&˿Q䦃%$#(5Vʼ3N2\FW{ Jj\I_Is^,Vw*kYFo"1}vK{.S.D̴9@c\KoEe#GGRM*,}<{ntkNApglY^;@*WTH)cV]0.b=S:zJ@GAA+e.ێdWֹ]cAj ?oD:wnzX=Q}W}{F؏9(F"/ u+V-:dAlKȒY=EzRB;ْ\=k#wud͋(ytF'>Y@{5'jVqwkY/=gFPX%lwu>;Y1PA ' {G(D0|ٍSQM5iKπXep6մĐ'jM?V:X" R$Ès%..^4JO+D; j^Пf3ڷfH ȋ%ȣ܏OBxrDP]27ǾkwWl=$e93f*UTnqkv.1Z:+]^"a?ro}BYaQ( Zu>6AM\y܉4WsxLςu A WĴDKK-\E|cTQ54r~^7{iN g_`7DF0(aWQ*\eYoȬ5%pSO"2CK/MqJU:%Z| ƆNeN٘o} ǤY KnFY$D<utI0J AV)=Ep~s\u=dL5E۠#E+x >_;.&r'$-J0 ' *<'|'$CڗSxY縟𦒒Jg3"0Η+}>/Lli%d@8^\SFʊʭ]9f5fKT{ t[I)6x^Ͻ6jzGm@~>bg:5<`Xx*mh_ɥ^7at ȼf!Q/͍b~{s ąE)b@,/,ǜ*v7Y\ȎD <>}b*.y:4';&rTPX\R3!^7W?CUWZ 2ACo+ߒ+xCЈk%Ac ʫZ1ceQ`q-U#傉 6` IxKMl7]q,O<*be (IYVV o:V~U䗥![\ɵp%dx6^a-ts1*t* (IMeZ&\܇-mwڕWo/f?ITO$y]H)oX[z~|/]7gel%x4nNn?Q>Dnsfٺ8RFcRYִֻ+)8ݏhNAI3 0~i.^Қn`3kMF@'1Op": /}?!B@U]2Vt%X^ypn''vQC2زJ+wEH>/2j鼛>lO,})j9 &u. SbePV:GMj@Hbjg)<÷OrgjAC8Ӫ :2 E$TAjު?77a-S)E}U 씄Qb\iؑ yy+&$qEU [\N9v#0kxu\o:%{A1Zpt!l3L3 멜oJj"6r"Y:ެQV u™->g}N&ь T O mzYy.CaKֹ4W쳝Aiz$li.e(GN\KqB. %\rVr^DWEC>^paUg_a唥5D]@9Q؈o A1zdz̈iY>@ަoc5/oVlN9 }8#U1aˬ%בӇRls65HS_6!rJh?:T#PaRo&fdʐCDpNS!9#twPTM+J|_qHP=G{y^m`$J7k~'J34P2@nnr7+F$3ޞ6,D {Ŋ’\˫EX(>qw{gΜ;{Ao@"Dzk3PzɴrD0uu#RXm(~8G =A# hr8ي_#[.&b~Xp|5`EgtoY  pcFFHDzwBMP1 5p!n|zt[B2r# Wuzwn(nba@:N5͉ywt}TIעP,ϛ2J7}mp2"LC]61?tG(i\3O:\=בjA]J)p.޸J*Ey\$:m6uies.~xu&lktPbXA7muLJ$P,8DqTa ``J[ P +1",7q#]Y\ 8l?홰" D+_:D|\Y>1C}ywڷCEE.hAocY+NNaIhEۯ::Ԕyȧqx4Q¢d|FkdKmB4Ÿ<QScAGL[5ܝ;EVscB^OIm]G=ʡzz}_:)s/ T;J:cR^\@H@!C!1?cKKk?amڷSu3)gbl~7YG+pؕjNyf۴p#W]c|WMLCDPΠ$vYd 𤼩ʫJ4EOg(/k+EP Lljy? C'V>kYvl:xPFhm S_/AB|;MBӵ 1AAVJAVyyXg&'fN?t=O MBc.Fz!Nm9s 3 e1Z'Jmvf z|)X͌'\K?u /#\f.h:̊Yu{ܺ{Wm7 <= x[A(_er~!ٓI-%uQwQtwbTg(T:)א;=sWTĄCG7}M"2wZߩ2e^(δۯ߈OʔV!z%&!bȓs&Ө-VX*Axզ,Ûj8H;ӗElw4?]W:u)]+kGYĨĤWLmL*J{^6CRCצ ~ ǑiFχ8쏑D7H; P آTIO?ĂW2 hw*niNb؜]$xNynfvNV; rj߸[ҪCF=4$ XeؒSC"Pm$)qH{!F3E^iQ2ࠏQ-ցeJ-TPzw%B2LxSpvR̛W}+\9WL `oIOɜ2Zӟ!?vBn7/L딜/*Ҵ[*3@0vV,TYlKXd)v{`'2#{g'*!–;2*Hfc% xtܫCI0cNi=6D~-~!omӤsýjŝ+ꛃt5e\ٙ2ݳ?˔RոLj 3E#H~GpH%;Q v9]Q[Ђׇj"{xǚ1$5ڎoܢ"{K&8F hҌbCjVoWhh|)PB G߱hŬ,{vdq@rrN$ǡ0APllKPiJ:P]9^'Qᾋ?yZG]#EKTm/@A_fR|HH\4qni1GsWs0=hUP: n ̶|kљ`wH^ӗ|RG w(tɿr{,Ռ9{?{=)^rөVfQ G뼶&+lAI<|Q2=hyMHW}^p&5DzsP~{/e,CA>{>3ܵ RY}'$5%擃2)78{׿>"a FdފY§pMˆ-,QWg%er[ :ƒfH cDK9I zɻt3S5)*41}3X̡<>YxDndwY Ay6ch*0X-smYjB.|`8$'~ecm5+d6R$lS|dہ԰ ·7͔JmdrgZ>n#F,2)m6ԶkY\X-`@iej`;7-a[r E:'M@.;Yt >=dG[ |Wwp,=Nh =\yXGكɻˊ 1uvm'4?2"JAU`E}Pu{%'`BsV{S>x=PZМBIAmUaf7q QQ[*7[%UG;D^T7Kl0-R48axXDaz͛?(AyuiF+Vt s\[ϫ i_bך>^2CK>΃(R,~>G/cudcZ82]iAK恕"HuR9ly[jhjr)KXvCRuqjy3Ct09aoęNv^˗!47*EݾSs0bi惉 =MTu.p0D]'X6]jm~BA["#}jjTU6tP`a)XZKN[Wsqy#/S!o ?i؅:=E3cw2V(B vJ&J,#3Q9%Z["nЂbD䘊o+aJv$j>OipiAկ띅 4ڗK=5,\ Ogx!DHM- 'UpAi&JRSO,݀hQC)*Oo/Sr-mAId׹v Bh)2DvZ0C/;"˨omٔ~ I]' YvnB0D9\7s۸x!E<N$9d@⪘x7S^Pc1:^K Y/yPxcXH9Hoi,~\Eq!z& }pUF[W0#BqęlN!Ea4!iÜBLk-[8" ,Ì}J TI(M \ʿtK` t) xLX@A_cס^i<|ijU.΂:i koƎLc? | زkT=% HC{!&/$9+6mDdm6߬%l*qWf>WoT9% zśʡ85O,\Or-9~@L.:hf(X&G:/ל*DU+ho7f``;6_LXj~cy&꒹bN{ H049ÀwvIJ5 \~Kv́w%!M-,Aa ukepz|F\Eݖi)3o4e黟ӳcqZgr^,粶cR .[OA5g̻@"I~^ّxࣧVƑMɊ-i2͸Z;DE*2wd̃Ct̔)Q'ZTnHcӏN`1ۨiu,^_S׉D\GB0D]WCxf7VMb]#u-VvBӜɬoC Fi*O*¦X 渕1T2̈AM .ŋ.>tДT|NI5b d$mfY>arRWGfFf7^=-M(}0 洍iž8g~hcOm#1?Tqխƿc }ͨ('cӜܛ⹨NfakuOgڤ7޽n OE[} N81HR^:P&oI? MԤ-SJVmYA 0aŗO9Fm4,b74>A(Ğؤ %k %I@' }A Zm5S&gC֎4AZ,/>)CoFL)ca}n<@-EFA|۾DQJ׽EF mR Yqn=8,L0o cEQ |+?؂@o845k282Ն:!?C%pfhn] ^9&+\]Q he5 uUcK;S0ܪ 4MV&Y6NP)F㨭DC0s5_֝(f5G('P]MyW`z{uvzFF" 8rpى=ESw_C=. -.9$ `P{"%O_ޡ$=\j(FEW' qM&'Zcp;П#~?9r(>kye 癐r!դ#p+ɸ+# ZXF2:cySTM2;l?VSz$(d g!KyE%Kϔa3ÔYMa%oHA)Mr¤@S6ź$L*֋ {ŖީBK͌ zZrf4/Qʛ9 i _͐26"PuQ8cq=V!v<%e0 <ȆV 1C?6,Q:y 2te #բ uΧc5; "%7t_]s3PTUy ` wX5VgG "i pBDĜ)0dOcNt:תcƒ[UCkW' zxL(4rh?( /< pwa"p OvN}BҐF?)?rdX_Nj'cs2b1NcT]Pe1"XǴoeWlFiq sL\WyԳaSUm{KҤ + D " k@(ի8D6i_ }C(R4:W"RV !1 Ě'spTDvY୉!lmj =r. ;ȗuUp lִXB4 %~xν @%7(JDkb_'0|OTT:pqI>Hy9i!zK;_$wV/)& ݒgu.95PY ͺo~z%gtO>Pȧ6ut)-+L?v7E,@V>!A t[ )R^" 8Yi dIT%O`~zl '~ґ?#Z{fF: dOgK}-GvSr.\ DZR^H)uHұ-욝'ˏqBryUwCnۢY8J%($쨟5-@,~m 8{fvQl|pDu)5:1ghw(lwFOa Ȁ% ט9,fCP8F/v(# ?ZJ7DJӹRھp{[ W_ҭ:U7wyqVwd"<ܵZn>" /AG1<N;+0Y)%j֤e}S$ٕV.k`oԲϰW;UɊ7Ӷ4F43CAL<8>FYPș0^`EA"׼uǡ0ٮ+:hp#G4(߫$P*qCn0 DNbn,U_9<5mĐk@/tQ(Ʉ_ف=4xsdj8UuHZѴ 1.Z,PU4ʉ 4A$`835+t4sNipN'kT@I<*&pc4yh'G7KO6OC&-U ҺV(Lbd -V4" <ؗrMdӰץ.'X}Ԉ<ul21*@M/g䠨c.<++tp VG_߭%{wY2~+z\T=@j4ކZ8fXۿkaJ  Zr$ESβZǘr-/7N;X$;)@X#T B۞S0]eȊ&'s0bj[_R?#58*RY%H_dɕ]{T>-_*](f.8O25KQE<t󛥤#\f?y89w޺Fdi8& U1˫p0HE n=)2}"y՗% -wu^yN.*. z2\WD #>(m'"Lṩs1O= <9v}0/xy`#>(s=0qO"=hxUAWJh6Y lhID)Ij^1KFJAÞ$m&zhpFn NI(y4$"Yas뻭3&fCC|ZUa/|,+ {\FѨd*lNRup F~uY n)Q4(xTxhP@vy!U]ZSueȘ$Y)"m^6z&io2Ym1dlyZ_|X }4&5\Df$)i]D1}>T#'e XxP1 EUQe' % m6ޅI5U`д刂Y+ 1(]?g$vɷX8qV:! >6Ԅf Ycl6W35L*~˓MjlWȪ_j,d4yA2[QuԺ٪,}v`rf+e3֔ܵ| iHf#uAmBaug(wT{쌭yi5k*uoѧV?_ F~ntԊg'["vCw@(F,XQA9HM|9{pl^[K@pS¶+|cO-؞?o)/:`p OG,Tg眜u9PVwzfOZ5.GLn++pb ZŒY=}\P~l+S'):P Mb j@v64H%}2P-sQUq @J|w1ϕ425Pe$1;h<&L[0Kq,326!ƛ~̲1: C/TצS T2l1O}ұ.=>6 /.m|::˷̬e4Tj<80rawZ$U!ٿ P\ZQCJăK'5ڈׂ!g2q*%mi8,P};+s z]/Q7"$. X7DpA UnǶNRJ O`B|d2ViMhtMf@;N&jo;x v),Ɋ qXo)ogO-Ibxz|%X8v.aP{&C RI BUli,ҵCe@n(qبU_93UP=J Kn-锼EsF j(j""mٓ>3X@3D) ^ t\O!̛]NHF*Zyx}Q*̮oq~1`UtmH`!.vޥ  l̤y7[[,ܺFZ6%Z y=ԯG1gEIir^d-@it AYQܠ}/Yh<@&\6!>hUG=a .Tz6]ŋI@_v Cvwt.(I.vɩַuU] a*B 2Aۮ Rx:|Ma |hubɄ&7'c&sųnuƖS$sm%Bk^7:=Iޤ\bk lXo}hl} su MJ™,iX/4-#f"qC8$jmL5zMz8g&Q)%68y\;FKqE$ 00L9G8k&$zp #l{e?N;#e~˨]X+DF NfL(p[& ;/q^+-z騭f)v:eB~p]XxQH$ĵ>A3::|ȱu*,(+ 3H+{ߦ9w W* =S"k|l!' ୱujQ;(`=,J}Ux l |%?ykSv{&_,Ŧvvt1U2ͽDJlT8Z1 Ѱ:O:R` )폟W$P'0'Bg R+B~vE α78Nv н؇~LڶJ| +-:6¯];M23A2yĞXմ{*KĻŒ&Hɖ/׃<@#s\3J[W\B9waFU度sݕSS\t`y DZ6+$V6+ ^!=RH s[`>D 23@rQ.ԌUT5bf&Zm@uOi\Z1R;6&˹V5hשoEUbӃ}I4_T'Pz+k,m:0Ա;yy8Z^[1w1=mHethz5wCJLRL[?y5rYv^ )IF{(ܾ%b u~R@a*rm怪\ln_j!+Tˉ*&rrY3!ૻ{{d~jRF^R躍[dJKa!F=%l6GOЏ3˚)kvLSՑ>Tݡ֚Dki Nn<v]Vu-kڟs1`QEp>Ojtf$x;_k*#K_LS<=iv$E*woyԻe݃4Ǜ.xR"Mi-{: *cYtPHI`i~yٱ@4^uhjet}?OXX6'oIG75ͫ$jt/EX`> ntʹțޘuXtmt; = (HIq"'{ʕT'Dw@[|`)R"}?nQ"x0A aWjۀ[k *8Cسc常f9ߋx8I ]7N'(= %GvX? Fu)jo@ru£Ṹ@gGK`C"0jMR/Q! 'ܙI@xlԺ/Ajk4;I/#MI*=-NS~u.5kpI" &GzEw]?­SjULUkv1-ȻRaI!c9 8'{.%~E HbV*1xqbovhBF+4O;p.cy@]+1i蟮6Y<nW!z83⊆3k~ 8dœwa3Q970"֑O"4i>&_[B"a($[=[||6-\Z!E47eDˈѝO Ȋv3]EP.t#)`Bz Gܪpy~{w:<ރO#\O܍NRpot<\Xp$s_k7Sڰ>e'<,-6=cnhu6eeݮ~t &_|Ä-A0ʠ&86BV75O+_8g`7cl2 aUCW{5KBx=4Ly2zbLbj'`&{= zz2Z7w5R35hdUZUS\~<̨?-t9ZA-jb^+#b '.)_B >hRn{US`.!'IT_Jmi1Ak \!6_) $(,5ϭi`CSS3ܼ'Y[#N4_f7?-4x(݇iܡ#G0go+?u?>nD 08zΐk_墂1$K@dUcn!}Fl%r޶z4*uI9J2ͥ`$h&%0 ~ei|FΧCD@v| d R250F=M]\:^X\rG:QlA:x]R@qOj&޸*%+חd\=Xyt_v"E˯kw(H+d5DH_2-BhW &Lz8Au ?aIrID[xHD6`' jpyXJy1g^kv{H<*]NKN {@ܬA.n'kWR(* q7o!,Ô`?}Ҙg-5 f٦jj.z|YvUTgeTU FVOMB)ksYUr,BKiw+y*>[]qyJ=_xi.O՚hXD:yo-`{>X=?2 .X Ҷv %^.'~mQͱM3NDj/a"}7]:=@z]n=*N_a%!|צ;566/s4~Kt<&/Q¹'<JSl3i-EUbȿ5Wl@6R@$+g)ݤpc)瀨zu`2l9Ѱ8:ə?w,TG-F +ZT" Sלw^~Mվwڕ#QO.g*zP޵")ѭI.3Xբ+ J/pa.yLwF.[EQRvD : thv@VG֒"уC0*q`',Cӂ&[8{3\惘G|b9}co\ H" XlX4lhZ0p$ cHz|V 'w()jH7 kIdrf+#oelLTZfYwdm0~ZN[8V!A<Yx_B]w6ݿ`J־hu"bLCJρ7,HyX*llhmG_TRA/ K:(HP}FCaONO{0`T[XEE&2ѫ׸-w_q? i>BP'wDHi=WOa1)o f`&'e) kщRjoTP]I|(QV"}YPqN"1Iwlkhߑv ~Xܣ3*_<&R6+4z=DnQuן5ayEP)-J]/sQ\#b%9x'ݍs `qEz:ҍmO; 0񞴜=g`=9O\Nrs7(=\%+8\sfbH8Wi?Ҷ.q-pbX)P3#*e5ZxuD㋍>1$EG )ֶx#KpB4ePpVWQFIdr!ߠ`6;ɞVى/k> FٟwtQXh}0nw RE@oSڳIbC$l)DN]{4gݽJ8)uwTlX;@|.P+QVtޱԏ*hn/5lη(E#9BI.Kx]@/L V.H  9c}vrߝ|TU -|V`+3ԛY!`H㛉ń/ЅAp[!6EUxt:Mwh u/Eͻ_h@^9͚T\Es̀T#Cth@` j۪ lDXحElIEӪ"<ғ̈́ ϻbo1fl!RvHfH"i,b =tJ#DIW"ECš q 5zKW(,\| o Efnؿah=d*Rǟ;ɬ᫖h>9-U!t|IެX_EgggL5H@zfd9C1a߹ b;Nʺ-bx4@/GtͰ1宻17նH3 ιp$3D@ Cr'yMӂzz'ZofϹ,u4TVi-~@3SxԔ&?_65?Go؅ r9 ؞O FYdz2NԅBE+:Y圬^Zİ.;\|԰!jw)Mj }zOZ!q?L1ZAg`}p#p$fM^\'#u(X$k2E`Ve0[ڊ-ۄк@ ؾb]&Q/]AgX*j{z"[Cd*^ qڮ?*+QI)Xnj^ۡ&fhh맭:6E3OC\@oJGTZ-1\莙 ,d@7 ^6e}ϡĆw0cM^fNiC7zQG;=mjg>sPv+j=cLE`GI"b٧HT^5mO&\P~!92Kch]mU5шluV땤 _w1ѱ: HSI",Θ`&eYJlF5aTbкal[u';P3:!->b Y˽f ^ WaF38+>X-`Np.^vks[_ YHH_ĹmƎǖ/1Ր+x0m UIq5#1BobEؽ 6]X51*ueHmn쇜GRFxeXK~&_4/q17'?OmRCN M_,`Y#%*|ps7ELZn|·Κ %30{O1T^o/blg&<&\xԭ7?Uڽ-z/m_-=)wMBjn۲ܷ a~=aWIW.3. jsxWygȥwS))Z?qʨF[j2~ĊCjH8K9g΁VB )0Gi` m!xjAcAb店5ouF'cE\sR{pbwL^nn2lsC͝w$9Ꚉ:SU2> \xfw_7g,潪-NTQ ?ޚN\ f1i67;#s6d?--0!I{<6Ŋn0uiހMa#ѯlhuqW[ {~G-͎Ɂٖ&JLem!t>(ϰbCAC?/2E$ܡy\k|T8짗 FȬ"*S̟w l(q3XG38)uze/Z2mB&HR<1-NJcTUۻTB]o RUHU{ґjeZԩ!9Q/Qjit2COԏ4{5 HXZ1Zb [ laMsäq݈PBՏ Ev -ZC x0;lyW'dF9{V8@v a9$J@Gh7yԗ %Osl`͙Vl?m6W=.T.e#%b_]V#f9flM-Fè&bq~:uԆUG<IiՃ:srdF|90py E_fC} ;őB* });45􇩯 A1|qI<Wp=Cr;Wf-tZ2nv1U?%ibR=f1I*@8U@,)&P4;nD6^vr/zwFTry_5 Ƀh}Sp0 w@j5FC|n/8EAr75|4[5ȐIj#[*ĻQ&ϯ\1ll4vN(q:nPayh:$rEu\#Ƒ2\1SqV/EdnR6ԋ$ϝ`` SLF04+z]4ҤRHe^8ƶOwȞs`]ˈ); 76pwZ[EA*5^݊an#Iʐ4q yv^QEF#c#Gz8.C !qd}܏}w^˂F"16 bdƅP=IP gAi=_Bj f%-ho@(vBo[Eh}{NFQoJ;W.\y5j9 Yl3݌,ᵄq:ZW ?`9PicKA;3" GD*[;h]$Ԅ,͔fFH"oWؿ&%H-aѓ-U65* 2s`QMuQqeQ %#VŐ8zÇa [{| E(] [MGa&7Q2zkY2[fk[r+cz=j/xnh\} )9ln~H&TAܐ1!}b*?ݳ~. h: _.44ΣU,Sb|5Pt<5'!"!,i\Y;J b5 vBxA0oE)%ٛRa$KcnaW{' |9X'mR˂ߨWC # 6b!٢p~"ևq$m!i@,ňp[8ɹ2L`/Fdo4\ kJ䧆@ Fy#?G"4i&&IZb;xÜ&n0h-c^X+(G&\+|JߏdF`Qd%OI.0?w ^Z-RH:YV77r2žBGqҿ tX/t˳NJqUeoDҡL;P&sMN۸UN*LCr}ejM/SPkM h94Hq'{N7I=Ze4ee7<!j c=\uR]5.vÄo];1K!Mz{|;>g}H)BhDù)zQzk36&\GѨq W,Ak?H=)J6^ SLaŸZZ8>zȼܭLv:G{)ğkP3.E ;A"LltaCz]o˫Q\oІ["Mŗi(0g FAyK":iʅbCI(k(n\j'uyvpgo B$[' 768+l_UjKP \dKm+a\{ʹL[Gprz6v=t N`9&_G% ,**Hq>Z#L0TV0%.7O@z22ɫF>[ޖSf7@{ԴZmVڗ[mϫ9Z49JURhZ=yohe ]e^.A.U31T;w~]h"謭yjMӐ~ͅ +[)6mt !]G_y,~@?E1o?&{57<(VCe_(}Bs2VDq9ڹYT{m%޶ym;s`+F)8acx~g%(@ݶ|s*pNx-Lˮ<|L6 cpwJ+wg3d~vo%HlY ç89Us~2g;6m|y@L~{q#Q83+oƸ{q6LW"%mUuCfq&>X"Ģd9.{?n@(x*uI[_+A*u5I"p ޯ236I/?3h.9C5 Z(bֵ]Z|V+ƀ_>x:U hw8kҽ72%g,`=ֿ-=΍Nm7-3u~CiXP+la~<>D(A u/>>v%2dd߇օe= .N8#*=lA˚@LZ1ϓrIfgc:NaXv ?nQjp+Հݸg^ %uQDzeg_j>I|p(dMVt)TvA_# HSN_C;nLu6efh52,?M'n h *[&ʶ4QKšWxWXKl$vjhDS;).fb[t>L7G]o< qL+21WcFr$W!admW>U TƔb mYS-PRuX%|Hl@Z. 1<D-|JTD]H1 uY3t 4w{]K`C>/:~o]s&\Yrޕ{P:k9"n01E/?R'$jy/4#gi3"j@83L@cQ&rW!͸@IrevwȊQAm +[+\fn_Yׁ:)?60ř33<L]Qx(&y:D0&a嫣Pz;4/2N&vab .p؜epةÌq| #+ W(w߶OY22i$t 'XJΆAR;$TK ^UWp$ e]$RC#U`mMm>δ'ҿB}``iPg]?6%SvQX;\R _y+ԍpU'U@>oKtJjkC\l9+~Ỵ̂?@rМ'h_Jo-Cx FȔ y'V n ijk%]w206?Dzք'Q84knm ăc(1=5/|.c7(vh`+6 ?bNn9庵my593.Z ī]\YFA%d t.^B&.\9zրdD$ 7ۏF]y0_*Hskm_ذ&nL2`QxgӾKfpSzʧrMr0% F,bt%d^2n~S~ջ{tԅ./}bt헜vNZ@xx-KŝVH| 6DE[A#DK*EggBN#wF4ͣ"a]걪{JyA8p~6SםY- }ߦ~dllN.!ܝ^O[H9zdudbE(MXVFC5Cڧ)|!HLEf;kQT&rNC?n #ߓ2 yi^9|}!Ugz#r VI|ΥJ.;F:OYɇʵ~&]_O99T]T֩R].a6=oCﴙw*o 8tWN6qT`DҬGX;P){gF(4q93q}>j z+5wˀ!^{Ighq迭i)jk"`Uq)GXl_`K8?(',9Fį^G}$mrۺeK[B;ўrj="F-dyL+YK};nyht]hYo^}::RFё$d-*D{%\G5_jȍS$Ji҈xFEr݀6Z d u1vnt$(|s þ o1x TmĻ "-$)hxkhdVz*: ;σ,c#voS9ya̅#G=J68}:ie@ňWybٰͫR1WEW8(O"*c& ڋd?3 "{9tǺ6})7&1Ƚ]n6U=_DYH4k=jC$6a{F(BkPc_42qVȆ%]X/cB[Pp|΀rLN,/!~6J7íF7#՚o;|Rh4jZȐe!vZ@U"+va(* # VL8tٝVvpJEXo÷oھ^눋bgl9IK5.&eB%( |'8]١&c]IqxW㿑 PdB3ԥɆڵdu \jᣗ'y](§TtlxeA*3aX &ϰXvh>T3wkBjV?_L.UOD6M6 lQ3 n)'8&sbh#p#2)Ţ XbC9Mdpq!: Lq1^:}7<[yb"ExWX̏y>g<)l_|\gS5tgM@0T}钞L0-J}`zR6B7rO2¬M P&૒cGP6&IMYv  `+"w~\+@X!SS~Vvy'hH+WF(f6;\ɨYe8O 뿵RtwmүڷaQCd JxA9lUVgϡ]44=*#"`sƎ.O͊5<ߨ 9"Uk{MD;|!~~G`M-W[^W5QzF3P*AL'PJe!dʔrDh7 1Z/y$qT-S9/eVBwfG82P<c=}LnI"oUaE-hX D\;)2 y4ЧXFu{2yXCjiW0db 6 (fMK}}._~#S.:CǨ~p[29F b8GwE)y 5qqI$+ *)ԴܳRLg|,(&|!w"v[UN F"YfP?'·]߫nPc^i iEjNTGoQ#]HJ|У55Ȃ@HB 2v1Hv@;I] W$N:$9,Kz)a(+ʝw1h.3K%uAkL ]=p%* 62"Iag1zH/8nں™)$^њ}2?ӱ W)JCE|P9t$M>/HV[]eao2-:C&.a|SnF~EY9]&n,3PeZ@X*?!]:ɕyeV1G!A2ڎH?k4S?1r} 'di[հj=N(q*mUZEbʼnY.!NyE`I B'e䶑AyN{e(hzaWNN7aِ/m{bTՅVJ,w!{|\Uz2R:s˰)fkiWH_?9'VhCQ]tD8 !"WbXQ7L$$dk ZIgK,r*z- 6#=iwZ06LP!H'bFG.wYYc %)]&9أ'8B܏l BiK1kNk#v 5_#Ě..*s( 钁}I@3QbWl|kga *g [U27lߴ~\g@*L.Be BqBkdx]̩#1ɑ leI?h){|kaUg}~'7 8G'_+A-j)1aǃ5/` Deu/9f:^ʀ*["ӱ}샢YEs?n]b] Ʂ+%{B05Bu0 0TM%BaԂQst(O%5 qY oMnj3I:2q6n0o2 F=ih`V4`8P` *>Y'"Ei?qN !PC\%h 5@)촀GN 3jmfT~'s ZWw c74rFJ$1;yˇv^?Ty؞N?u_ .I m'O$$"HESzH;#Ћ@y&`}G_IvitwͲcQ,Qӗ%NQeM5a=AA>ΔhLDY{ ;wlz2E]WbTur ?M%MJ=fys6pY,' NBSiM>*YbJZ:6ijn6=K TZM f,\A p2*c $횣5`ìvte_{1X֋#V<9JsI= =V@nH1ndŠ=b,G~NY6\mO?T”/1q4U9 I=Q̇ Sct-*H87qJxĿz%{r. 9p{^n=&O!oL:Wh7`D-wm`еҭz84zux#xk~k[KI4xn%KJ@V:jԉ@bN"Q T$] 4Lcr'%?}S^`O!rQWKOG];F 8ѹyE[`y"J E388r^3΃ IXyRyH`Pma3[&_OeeP5[T˫p^1:jjγو\.7%_/,9|41W*([&zC+`,"ʎøbR쀰Pє8\[);2X!t:Nkw CC"#.Q3a־.7h#1{kZRU;qR:XBw>+ƃr'fϗ )°;~0^yL[#nV=Ԋ~ȧ"bX61,Y^U/RmWo?G3bOzw՗GS1fRWgtqzL㭵s??)ڪ:%8e+N7)Oyx 7-Z3(?c*\"/ uh1NIAquiH|/=W귣e#=Dզqϣ!;>KăWЋ*@ifO_aZp9KN㓟&w} JZÃ< 0١S.I[;L GYw+R:V``Kqt:S1VwA9SCUCVW倀eTLqO.LJӞ;c@W%_]6A1gjfluu(.L5N3P7E 3+*ሾA(|3LuQ F.>\,~j~^-Wc_xBJgM!<iN>Ӿ?CgJ'0~؏Q?.wQkɺIrA Č#2"U4iꦕ"OU&{>lE*N2g"\L/d^GzWXVݘ)zfGT^aԗet̀ƎB'@iˌG<԰gr7vZVf$OBn8օM"2(dcbHP؝8؈%,F SCIL;fks7I8YA)>TL%ة0uxcd>9KWV$VڭF:H/_  E[i!mma!US0>+P(fg>sOvTϫ3DBfTɨBV2~0_rK5G*s śAtvAS[ e<M/d*w fWUBъ%XbqjGAslZSXb"=pΫ֕eMJQ Ɇǵ,$o)(QZ?qC OvS*W0j< +a/#t$uço\ryÍl[.Ѯ!X_e4Np'jOa=l;FuubW7)p}9$s]CHܾBԫqG;W!߇%]3nW¤r0 | ˻PY% kYmCŒXGC? 1[Ѱ^[,@rOoj=ώN]:rY7 =a=CB&WtA~בaOGI{0JY:_#Qɑ"` PD^=$&DjlD <\VZ8dFsOS&26$cEb*tfn0P?e#]OrJRwtUs(p_ TI`(XP\"ǺlHȩ,:W2MGle8{I`Źh9O9H119Se|s>*2xY5.*V{ vl|~z5+v/9x Ƶ!GKEVohp#F=*eO>[Zփ o߱EHyy.8 #fk݁W $By=gxYsak} E/Z@S,iaͤYjyf1YzF{n2 69cx!"6+?l,>aDXсq4Lr}:[iPNPO}`bcM郇ӌ0{0~? ;D4haoV:yArΚ¢VW_ᭊ}G#D +Ϸ }^FlJoOU=[vM'oyWbuONӗUyIWPĬ=j# 6f@ b|/lqBOpu%^*ڒt%%_sZ:=J9 eV=pfbOÂ=Op4VQ^k^.ZCDڈ`vIm]ԨSΖԂ#&<0S6+2&T6Ȟ/1Reth}t[2f[r44|#݆~ Ei:] # fNqʜ1Ā,yqc.է}|F`3uIY0 ?! ,ؼQ$aL\z3+.Hx!XJ9K?J4SLWE]6N8 *Fŀ' V @%0y\̈́'H~ojoC@9sÐ⮀Z,c"P)}J$ry;~XaLWP6/gkl ̰Dp 5[Gn IܼQXo0G ]|'T66HU{xZbg"fRP6QC )m*RRhh>N" ^j놼CLWN<,%y0GNJlRa`nyɱ Y!@ mT:F7BU4'm!!" aMN'R=2u56AV@VqtG cA9[|; 6O\GR-PLSYYMC*ۨqug3U)`[q(L-p4פF9L݈T#̫>ƃ*B4L9wmezРېoqrΉ\wdgI/?gѫdd]^ O4eS8܁v$C8aӨ(& 0]y+.I(;[(ܦ5%ZE%ޥE!Veaŀ2c 쭶יx/?-1>T5|dʶٟ\g:"DhmQlo%ҧŚ=llA>5x{6 0GCTa>4>0Lv섙.85ΑmQ^tpk. Y͇ d ̿Ò\C| _uCIm]6=?jV'OcuZŤҎ1L8)ÒIV-'+a;ĕX}<9qqAY|d)[!ְ-5M¶fM5|ךwjKk$a"!.^}XG!BRC^Y˦CJkS(Ee%wųk jUNu|wdD}G<.@uԔa9}.@cPyɊ\Ek&J`ZZ;(.<:hQSF7I|) {)hx͸?fT@s/a1PP(-ێ Y ʇNX&S#) cx#$v2:g{|DTgZ F:&ݦH i^fli1f7n5ڑ&:*RqQv<^'EG4 -qAʂ<۬v|KC6РsiN}W+:T/Ec. M^C'2ޥ;-[FNahyrXOPnAXe=!zĈP_טWa9Je}8p&pqy#]8 Qt*ՓĒgrgC&GBtdE85pbH1@b7BD$svVqc[Єz%IUNH77NDuVgvX9S'4"vtN&! 07ۢ R*=HC1 ) ٭gMk0&S־-FeXYJ\uz[[̅M]`q]Kt4ƙ$r%O EJQK.MPgoTBMJ̲XdrO$dMI!u2Ӥ_akn Y+Ĉ& uK}Zϡ}:c7:9̞y40^$H^D"Q0 Co\u D̄M5Q\X0ܓ5Η$"7H{'|Ml߮"'T=,;iRwB}1 qyH0`˃M9t^g0ȉToIbls[ ^&51ڛC-DńD Q ~U*g":,)/N{uVDK?4S|FJ`m &U|y?Ёd*겛{ }#JIa(ҥd?%K_/PC{L2\z^w-.K6x6wYC`z~Rݬr54~P;S!DF htkdKL%>xf%F ZM{x=+b`AI~}NAUGRWεZhDE?<˫xJ E!Zyy\SptD}ϓ͙&тtF:thBq-=`~b])ju}Vcu)AB0F)Vo` 6+9ާSIwPh玲q=XCo@S@PT;RozR.UIv}8U 9;"3Vtn1$Ro3lk"W[\k ǰ9B9 |#v)염 \ @U0EɨUzz?[ ?VI6SgHK>AFnwTOAzy^I:\(z:驰`B?*R?񯞇gX?.+vН0TB34c炮oR3lf[PZVm<%LEo)@l$]=,^ J)ḜK*ÞdsvM; h42Ϋ[J_!oS.Vq8$$:JfDv^+:tb/lJмW jD=jOm'9WƔdZ?g pƼ@:f2кu<Ge;3\@()%2Jt+ |  ΎX&jBo<[.683) Y|NU2:@6S3%ͭ 6Pݽ( 7d*a㐄B>>ioTDrq9uѨ@oI(*F4 CݛVP[ԗxΧ>sdQ z^2 ە1OITi(#{V{W 榚xӓ1`^v 7zC'5vI0OD;b'²_ǿ;>DcͯLܔ.J"catx1߫`L)Q4xf;\u$\֞o_֊s]̄,᪆u ^5)2p^>sբ6$R (iߑVW2s%(F!:Hq>\YT8ͳmrd(r!{CĨQ̮Ԅ42rPȿ{=(]MǽvO]8x^#vnV 3y[f[~4jL|2m SEs6!G(m/F!;Ӭ 掾X+MukI\}T\ᾯ@bMcKs2?d`,]|gXvw^2|)N4 yK7E{˗F5sQFae.-lMAXOz 8b6f|t@b{+2ّҵu!w1S), n(_ѶB/UQHgj>XS&!6U9y77r%FePla4!G,rɧVYc~qi][d}$##)\AA{| t!7W+c 'u~=Vx6T[0Co7jPݴ5[WRϊM.S /^Z40!BwP.+ P#3fs >-/g SN*|*\Diu+ژ g0h;`I'90gB"tOV+4y&szqu{r͔u}<. S/W?FMÚHgbء/lV 2NlQ?z-"0 }s2?.DnUi'^JAtv!M>r?'d Z6d XG)=̽)|]Ý7'pC4QnG$^XX;.s#1Ef1{uzې:6Ί8["SJ>q4>VB'Q*#kz"k<\}G,Լc]vPPWG| iFoEѶ kCyʸC}ժF3H)ja*k7n9PR|ߞ{E8":*D:Ż^)e;7w/}Ocio~qx)>i[@ȹ^sE>e= gV& ǐ5_D1TI gG9cZ"'GU)Jx);/gZyF>vDO:"2bzxf'+'7OB~dmnl̽^ƢδV=h+T:3Ōm1B"i ;b~4P^?+~V(HE0R`6:&z?e _7pN]6ܢеj/;T/׳CrBy1[ = U$ug3WOLS:2X%SԌq}$xh#úӭOi{nf O/zOe,a*WG%'ɋWL-JP5X𰳈ωEn7 wѹ1d-uEub>n %!g]t^1lM}a罁V1|ZJ0`+MxS pJeM&b4kTJ}HcV +>sP2$nrMѰݝAҨ1ʤ mgȀ.ۍAFy,owTQrAMc끔! 3@bxo(D~Qvaq5N#O산=^cW*!V;xwoo5kO/o Jjj,|e]Ԝ0AaK[ ˑkwڜ p `)"#!8w.H> O|te4lKDbBe E=uDX0z[4O$j柼vt?5B̘e`0ʘ_^S$PQl[jɥpHoY Q-iJ`tز- %2lN7\oOrmVfCSi~3w0WLS@yKÅyWQOd>;:{S%? jBUJ}<*LJp$΁>3-f=0s $10"XmiJOj ZK':Yi.ȶ)B=M!^N@OsGr l96\?8" car {ٝSbkmE/^rU|u݅ךd],Iϙ]z,~$KvM"}8xj&F =R?3skjq6}=C\X!vI8\ [8Fq~LJi֏'y#V'qa ~B^uБw(=f,QnaV٘ЩOi%)"0HLUzh*"PG sqR RheT2^)6`j:$(9{>M"@@gJ cS8osrJ.4v%Ƶ$b|bG428)"Ii1<ЁjR˜tJqrȢ*ݘ&%/z -ܣ(Nۿ0%:˖-s`\I?Ys|{,OB\_ rmo1:>$7W$ Ur0#t %lU}u&Ǽ]~'6G+Yu>5dR#kK֝'[__8^AzH!T;}%{B6슍;(>3pA,tLS/b/=np+|(Lica_ݠd )alonV*#xjº{ VA'~@o^ɮEC s`524-:K6uҜm?an!#ml_ qZL_u0T>O(ܪo)Wd9\.X3k5_/VyBكս ysf9o0/?;(Qe8HɄwW_d!sɩVD+]сJ=BkkE3/d5K2&a&hm%eyx_7~9E[Ǝ-~bv-_6&FQ0Q#BFA-Nx.x2&;i%Fw)bI+_'(\+n6PAсT{h, oKf7uŁwpnf!nuVk>rVVjl7 յby# ~bO}Q,馳*Glk]]XPmhf&- e#(_ )PSNj2ѓT=RAʭCY1j $FM-x&OcY~S zxP"o:RJ J:7n|(6ڊM5w?JH~ jҟԗ),|,,FҜGa &>4MD@7-gMgG(Z3Y3R۬.[A!k[jVcbuA$bwvܳAbrLp @MJݏ}EdQ08_dL awٌf2}sCD{;uc^H.hsx,љLi(jFXHmrs ,7Q[q˂'vZU;)W _vFaȆ횹 6:dfI=`hYм R9=G zegQ_X [2YETDy3<٭~{Г.:;Y Y)yWr#&gsyV`aI3aKq6Qv]XW*FD;gҟLGĎUxLK qxB}&'T\1JW,ޕ_#Ay;s;!! Su1q;-%AM3J?7@8++KpϞSM[ A4"b<?!8gf, ݐ@,3نg~;5%alqQcNG!ٹFCx?~l*| L:>$3m{IaѡڃyMBmesV'k%?uܘTa( v*:JvȐt}OEjHh="C_m9]|RM3W)t 2OךUCP| :s?7j7JkjX:{Ai+1_Y%>x(|ܕ㨠7r/3p@+^s9U|s?lOi{#Q.Ym'#v4Q ;K8$\u:6cT?}0x[c ΣP1Jڵ1}2ʈ&'7p "r>Hk v#w<'K&HiBd|%sLM;3X牿6rM³G3(n~VNfduG[4+Q:jI)yAp{0,xF%GifwZPH]L°7TGۘJ ơ 4/u]wEFMJ''y9hJ;8xHpξ,wmt[B @}5kՐA/ơDυn{D}w- ud͵.JwY"VXwb*ūԭ(?+E rFD4+ (w{[qVHlj@)b'"nuCK1OeDtfK"'#zN-G(5ض- Mh<=JQ4fqy3ixM<9`v]"x4ZnYqg+sQ!i'd}NOn Z+:Im&n׷m>fY p }Jsڹ)0%SOL3pDDƳS~b~uP:S%LC*y)¬b@m-g!sCR\4dkכ#5q1z]3T5#AYO-~n^ل7qnxP0d!$$q-jDmy1!UN&JgcOpy MQ 4n^u`E^LҔ1FAtP=T; E[`+V{3b~%:}~ kTΌ. > y0$/z rKangvty%rwkm'3uߗz> jR>n]Rcw m>Ptk Sj+)˂K*4WiԼ[ʴ 9uzBPP^#PFRm wD(*1B#Nt~rc+/p(ג£D'#ש>=Ml;6.SDE2wB_Q[{qع$NT`n~j j :.΀P@X]qwjgJ:wŧjG62֌`G{:Gi\Ϟq\)o7.Kt2IeC{d c4k\=KFR#lT>Rat#VoPLHBdfӁe-/6s^nl} e層P#-D~ |!97FM;q%H}2buCb6GmC줸q#3I༡":ցd]y?t(Tf_߁֬Y9IGzc+Yի7j(ǝ?%J\-7^]Q=vzlkn6POUv.in2:$|r(ٻ(O=|4FJ .wi@%@*>1P ;X}7GYagHZD eCP`NP.-0t ഥ;DS Lnz garAg&?AHʵ'jW7*%VrCC _m7pyU CR&#/' ~Kdۖ "cgg$e\WN$߿7i9#*${#Pɱ ,(2y<}vx _sàf~%[n%!icE%pG9NYñOqk,碁`LTWgfԤE>xnbI8fq\$vP"h]*Ml<)K]s&>T` T&:hӹ"A=0"YkʻN$8AA[,%)VplG-T@J1?e4jϵ3 AZ4=,5Ic?~W/K@/Z2~.J@\٦]ef>htdRO#]|<\Y6v^;l)l3XUY 4 SѲ?7~>X E8B?'V%mE!BpPczT@)S8n"bˆwA6;Z4) cpP?γiF&Fz0ozvAG G@{F)4w*i+b2o#q/?@nL)RY8Ad~:$oxW gm`͞2h:[B vE۵wz#'՜.V'$1tDxGpe{dlHF4ݽK5rV|[:"ѥJԷZno+q%j(9d=lI!T vLq33^jڭ;G I@.LY'6)瓫SzhhJ9 ݿijsbQV}PsLu>ٸ+j 7ILƴq򖃝d}]!O9ۤYvte:xMJ9p`³Jb7 1%ic$`$NWE%pP%9sh'wD^ M:x.o+s qҧutζwsE恭`V6[2nvldIns_g{DaWlD&ɿݑx'g]ٝr& Ǟt BnE~` ī1M`,j؊9J_@UzNiFOW"4Mj2>tL,7eJHÑJ&݃&J<-?f lT<-~'}*(^ Y T;#@<[6M fMnCafUa;P\jr˟S|)] HAaWoЀ>)Zl DD7)e4"NcA:Z)H M%Gҡ* 6 3Ȩ< Ԕ`8QXQ}(D]\}qwYM#e)?a T9Ay;ir-IQ{m7R5 eUkp#oIFX_3Ze:793gC7-Ok./v9VtO@GPc̚#KVLb,! /8%{`ECf|st:_ꎦ+/..Z46ifr HI e+3U-g]y }Px1]Z(bn S-J,ɮ+lPKXǝ0R-̓MStcVCeSJY yEp눍vamQ)tZH6LS Y35.OB6q'Q{q*Z<̃Ioa-lq kAnmN _ojW&@B(RqЁ;oe!wjSpJ٫%%MS˜N JK57)>S-F;WV;[& ʷSiT%z ZHs\lo$G>-U>=g#Rdn !Vvl^- EC7p$"v &rgh U sM@"=73&xz)&J~/εgXx:Tx{ >/-pB[C^u!v2~b]e%>GP oANTn7mD !O7I=EO4@\Éf6e/NP)̆neJ<֚'ݞ#(keJk;cU,ISFy*y!:&jibX(J_~_^=-QKI45|[X֒U'zցOĀ_M'.uJgq`X BPB搜̝s1آ1f-?͍boM'{}S7 A;8cWk'JxexӚt:XT0}gę*}[E%w/9Dz3PA%~<0 f$j70i1܁A*)ZS[Q #6e`;IWA[C7&f~`$nWX$`xr'jzo=4G=m ҩr":]0NuHzY]&mʆ+ ;w+,x,26khɱ#L3A-(S蕩uudE (M: RC`NEy.uC 3"+xf~Z\"ÅmE7YjnT!)됊byRJQ o"VRXaʞ^NG(2D+g|&W Q:B>zS NY:"wkz[٢I :ޟ5'phΊEsv^Op,Yprei ᎮA`TLhʵ2_6Ѭg Zh# C!7Jh|AT zVG@hhrޓ7g+w ʯdon6-VUp-ֶZ qγ "[jRO_>PF?bUjdʂ>J e#=F U}쩇~,Z;QyղMȶ:1ERy)x(=Z^G~~Zt5ޒ8@]5r`䟿9no.ҾhK7C0`%zU(ֺǦ/9sikx{"!_te0 c_!wǛhWB!O.h7fGz,D]/ ]"_ .Xc&+ǧ'.E+j:-@e7pwIQu1wNZmKD$UDS,;@;o)F%JKϡ?9iSޟb"xlp54B`?+X ܸUuڂׅC#B`O0Kb'/ff!ߍu/) '{a|m@A{͞{2fvrA_Y_9UㇳVt|h".Zg골YYc>H]ppvf`ɊW+#UV^M$Bj|̵C6VDJ'aH)cE->tq!gN*[(HWփoKkX !ᓬ_KBȋeL$o'Sͬ|`BhND~*;+4f/xN܅cڮՖ*艳d(j**JwJ9p _Lyv'4rJ!ӥE¶Υ(\P (s (2o>Kn\1LJI]+@}2`hͶb3znaΠ!8n8Q"<j#z;f-|$[ß5֫PtX>Eaڍ6ƷYBbit >Zd7P6Q)|zas9oZ`^$Ǵ6{ jB0I{i6-D]guGwliqR3Q_]M2(?(B+z0kt:}$8s WGLcyCy0QaS2&Z9r)8/eSi9Ax;`A.R>19ױ}L<úo;ڪ3b TjABg5KsGE&Qt/XUZ߱Z=mLd׀XLreRKZ\i{66%90|p ;rǘ]t5Y 1L }ڛ2P+ROj5=5d8uf.S˹ٰ+_ \n}2s$jA`P\<ت蘼o;bDVSn]A,!@J7r^@VCn.&z}3G"7ŖiSX8^ *5;Cq3_ZG0nۿ1 Eμ7M L`詹qlJ]?OgQ؃NPL0ZjSNkc+ s/iđlks4ך/7yG1 AfZFݜT-r#bkD&*a_tbK :Oб? Z( gܓ`hPm %Yn@F6Tx)8pY\ey]*%i?pmpz}.6sH~%U)PSC@BG%_,XUry ypbQ)CIQDxOK#Y/P2@I(jq65g/`[5aOgH|#zS3Flk庩#!8͍R^4{!,蜑w ]JŃ:(Dw)JR3˩RI ͋vl bb8{ihhд-45KK2 xԹы.ĝ.!BfrجWh6[}z[U}2Oߜǘhe#X!TUE -s|g`Ï]^4ݻ;N\fhݛ$~N>u=;B-7>Vqzmo8Vhj\%k+bB+ )݀$#~<)_&:J)IͿ򟡁t֘v[CO!n*<ʂ9V}V2] j0\Ɠ齛A+k޳hWy fOr݌Y/!g_֋Wchwglބ9ٕA5̤\ckZ\$zKSyoAh5[WI᝿ԙ"Dā2N[03}L2Ŝ a5m3} HeflU?<ÃLY$a{&(mϑ٘Kt2ʧe.κއ.rJH$vgǯR+; ;fά3HAC~Ԯu 5&XbvU8l`G8+s; ϑ΍NP-q=yR͂.x GWVߥ('P ݒnsQڕttmmVHh7_fzp"9lSt}R|Ucvю90 ޶P,Qlq;E ;c'0<& &GNM\ә$օnQFM3 ? yqF|q+d7&3Z/6挦#.u2X(kZ7 =G F6lXCȉY&1GzӴ p8=LH+Z |{a:*{`BY [qmw׵ѥ9Gâ;T nlP _ ͍}*U JO@y_{3-L]#9(J1S^Kz SaYK6ey>eutL#`܏Wh a(UU!\_`YhlNH2nd?9Iqn7Z&%%tiQ .vYS- -(p2`-MH*U鸰iˌ8˖ugt<=DƧ6f6' a6b&1Fn[ ;n83qh\Wl(<`Ds;̂NUL`[z$?Y裪aD_+af85~2n1yI + JY[Mxoggv%9oor.z~0 y)l5 k i8AA'ܫ'7xajQmwCL !QJ1i"{`I}w~!]53L [|Uᐎz:$%z $.g}AkA.8Cz\jA ŗyڅ]zfLf2Ru5p]ImQ9l>> nFhZ|^643|L?0!RܑAӪЁah$N;/a,9"rpLr1A ~Aׂˍ\"NN-_ cj":ÂO-с9#.M# YN^'l?kfToR-C- s-ٿ}dm E5^5_BفGDę.R0d@Jxv^[4rpgKxE\u/Tj/.ޛU~Qhf_Cud VHl>ߓ z3/пSuIFU|BSeh5_?$(p\>z4ȲgP&D]IN#~~ KSz ê acR㉙yN:W ߉D`ѓ}wڹ>J.d,Qm.sx42T/>yHn=' ŜP_=B \"8l=}A7@)Mu*rakA) *ÃiT[ 4o V5,|*P#.-JS1v^]\l;/?..*AShԼ9)FKxlupco4T 5ϋp?(^E٘u<*(i)m ;tyKDgCb؇FZ\=-":C*8_]"P|jZx>>rQdHЕV1Qz/nqݬϧ鯿PP*/%$8d{*3:Y?;?H  mbh>gh)S@Jڛ (!5Q{,%hgU =l9:61ܢ0jc|?{ǚ{6O{tkxusx櫥[|-<6bËNYO}%@^CI"c4tɄ78'X+@*ӳZfmn(2R xq&YyǗIJ锁͜D9DT0e`jyQsUPǺ:ڕIDcO'up,ssϑ1]s' ?i˰8|;C`m$u'42LۄA[.t쮴6v|XT9b.Y3aܺyt*.~d޿Qh!R/), owxcv"XI{-O[d Gpl U˦f\aYJnwJ^K χyЌɰʇ C?jzx(ci`giRp> -nN (#`` b'Dujug-k+[_a94 {Wb ?0tUѬseTXI>2[hccYRg'NwE 6~] Pvm;.$N)jܻB k.!G Z3xxqs鴔HD #JFB_W߫Tdtx_ϰʡŮ+m'Ku _Eg˥~Re3ܦf ~4t*# W.IbZIFgp *ٯD*k!p*A'uBSw}) 4VoGkUg=xɒLF/e⩈JWLL)T5O-)ZE^ΔvF{Fbs 踫#";!)t3gEhFrz$mx7PIYbz9pà8S>ݔp4a8C4IXdkxdp|)[qO`6Ӵ\PSCrE ;zHG=Y@'7k3L%Lb&F.3m9hl/?\h˱ch <?qAk4{-0k[̝ϼ59+QtZó|i$n sx?;;ɨlszwP0P!wjπh }Vj7@O w!xRdG3'aM|՟q+w.K_yLdpZ -~:!Cc>C "ʖ&檟E5;89-f<']Ȁ:A ?h)N5Ђ6etb6c*cG3Z=.N"Aˎ퓛НKJʕ%k#!1e)P0Dl6>$4D=I|7[y#ygBz _/]FIrRRE)2LaP5$ e< D;KgzA$(x#~sԶI$tA {uzKr71m Td%w*R3 /$0f(p׹j#IvH^!V}9-IqZ"NCZUҁ!m`Z%gx@;`?xz2w zGr~S(-BbQ fD38`NpC Sr\e͸m$ %Rifju({b^ 2<~cS> Z:ˎ:ΔCS ~ёV^xO`%3;9!φ;@JqI͏ϮDqK顇>hwA`WlZӊND/rD6."RLSp bb.S)߰{ |*;Vzt^V#:oӸX؂CTPobfJ˳ S;xS ̖V{'c|&)v7^ZZ$_Y,7_#UV1Z6krXڇjv;;h)5d^=?%,١VMyv9 b#Hf 9+]♡ey|c=`BeB9'. ,D"qHOɵbp3!Y\G64^ʛԝ8F~<㮑'U71t QE' 6HIkq**ohNB'p`^up6FT݁ , Ve@XX>Iǥd&̛@E}kwHVju\ޅ;:YGso;zKe-L\)!B;QH:4̈́7P%\p:q;jj4I#ks9X F96O2 (?2DaVH:Ԛ871ijV# lj@f2K3Æ$dcp+ ^krr JElK\Cd J>B7u4*bzUr9 p Vl(|L87ZTev tF偼8r%w ف9;BmffoW,ND`AQNcu8i>@vsUEGz^MqZ';15RK٘/ڻ呣&FQVu%ʒEz ?N hű ].R[#j\!(wU_J9$:pkWW}R- vO:AUE̩Tt$pd ŃPâleb-lv̎3#IL a:.R@ L&\I3M^ FN ֈ\o* r6q)v)qϊ~e%gH.#\  ]ۯAgh :Hq`Fiw/jD\JjYlQ浪sY&SY\ܥzgqƷvZ>/bht\i["TBXG U'?(/wW[Ck!6?DHC4CJ'hB>`>xJraTN%]ZAxPㆉ:845/FAc H=ͫb(U_`~GE]؟eE>g_FچoɫQtX3fm_ނ(L MiGזlj,ۑy̡%Lq"<ܿd4;R]35몈5QX4~W;8A;!ͥYӽpw4%!kH @gΜ]ɜoXJ}I/,E"pT㹧? R_?Mg&Dy#PG9ui !lL@:ix`(päxcf5ЇpGb=٠=1 JH?\`C upGUܿhD &l7`fϛSs<1 ]y;X';o ,eVޙS@j_}Afcs% Vʶ039^z]WcZsdJOy4|MiDd]7݁!Xai㩣v<|!Cq=_> U*@/Nl^-K,rA nt*O*Q\PfYr퀠NԠ=j-Zq%NצPGrugCRo?K;m a06`%%辽]j Hɐ9שupl9 {4 !B VشSaP ;m2ЦuZHτ8qcXP/> 0i2R:6sྪSgmjCwVV^JREe#mDoA|wUzJEGg~w~N(J(Q7;>ː砽1)I(ɬ'mU W9@a n`` ۏv.Rvr]w۪\ds0QwuGVgs>Ef4dQEEewW0!O,2 1ur:S޲z? X_w2/ XfohpQs?RedY|s~--X8*O Z DɋEfK|ĎGs;]ۺnP_bgL^pCymMe<6֑H'] x㏯|Jg5/Ox;j,Bmbf++ OLʘbl!S%ϤGXk^- lt_A7e3NM];u0YICP10-Ѷ&%zMR^ؤg8?ri282:iń *;<{*XSS2:[2y%&4>뻾VA0 y>0{*gvzv|<zIJGL)w"B2N^ Mt&?ԥjW~01>VZ( +>j wiS`] %mkN/eZ meArTV*kp^Iz2msA B<.mo2knCG휵ިP*=UiddX}O5чR' /Ss.~q XF{\mr!QdV  F.^J4e TDh/U@?vɲU~ӹE!(B!{W'w(~F:7It}hْ:٬ձ۬!B<Uvb;~HkLl~*r:jFqX C,(S|Fj3 T.1xelGqR%P^cr'Jf?hs kk}$4TڊChct;:=8SO4#DCvE]J%5G'<Α),047+ e'F+(% *mRjFB%췞`j->wEPvs_8{x4koeT-u /;ɜPoRd b0Y}ƏL;m3 ~Ba%ظn/Q> v)ձBy0lh\ak8XX>ZRqxy/ͬ);2"[ LFh`$FP@A 45){ rïb噤:EGa+IVN:3$|Wq d-e" k&931Ck\93BOX /j]poQ`)Y@K}SpTLlw'),9` xԒ֌3_UC,rN(*@\o#92nPmw2 ԸN1 !@ D䒖{"D$HH|%zx'IXKx*khy5_6"J6e1yi]?^x%9Ԏy6IRܢXc1™w=SX M:O0s/1JʹĢ4fgx ⛂=nvF p5H'&)&W e5uC}"qh.vdof s)`eƢ$ipGu,wwR!L4a>ڍk~Avp[$0 1[L KROt1+pSxT;v%U?HQְF29mchDxxiXQ1Q/"i":i#A#'&g!3|́/ψޭIk4n-97<43VKD(6|-4g -TZڴnW-zIZMAɸd!! T+ $3d9#:+IM a j j eXǦzQn>qbsp >ώwVLZal2)QETe:Dմ|I +7q ei [lz&ĉCrٓ:}FWbSx. Wx^}/|v2 45AHq|wV}dq6l<}B@nMTH#.~ !(lLS4EF*K9sNXx?|,6;=3Lm?(i; yoyU9JrJ>:"ܡM :Zj\g7܄$טhs>Ľ'NI.KBڔY50#!f[e% TR E܆+!Ĕ/G0%W6fʚ͓yLla:\Kƍ'L2nr8[ YHdA^Dœ;! g@$;B>0A~֜(89av{ 2h#jm(m\G:51x/Wj4.#2՞M+)Ѵ"l}{3zU&'ri݈r<$d=^X %/ 䦅TϾ 4/?^r PJOOҤPy[lʜޤ~xER+%eG:3DOMg^Gr8t@z?,ksق@^\/C3Pr,Ao2Xg>))1P!/Frm/j20C]o+AGz)_zFYƭTaPa$/s)uLB2mUq&DRm_k3\4?Aɂ֌RAE~$ƒU([~A6`aJb1[+ʜlq5 A^w}Я77XM`&-ښMfg'GLjc`|>̳0'6rj)?3 $5s?'nIo>4af< #dB\CCEHk^0+Oj{4w*;/*p©_6ni@hJ(QX79x)Pө[ԑ*7g.FVJafҼP@U0SR H dgI@;KҕG²Ep{CN [vЎ2zcBHe6VcB# _Ko&haƞ"C[fS0i,1.[EnDv&6;) `2b{JFV"2+3ٰBw׎k[V H"7!,_Y`z\YB= ,;[zۙ,DM:4~ey1q:o ORm|!BH۴mH' (]#zx"tE5Z][i ڪ:K} o P@BJxLXbrscE5_%&&=WYuK`{ MkF…u!pj5tjjhqrIDnFw;,"韋T8DR 4IfaČ`%dˢO/FМI6ʶGLᖂ*YH:)-߅F1DB$ 8% =q>6EkR0OhO/e mz~he,[x cc7GI8Aƴժ$d$1iS">|;\~#gp @ F;鸅D5ۉE][}u~vZb3ǐ;a^jcbK8Is3W?Q5,Ճ)[]OY1V)]%3)>>!8#8,x\h#*ᆚN#k8΄|J؂/bIr@P|[ z rwhZNaӥBh P:tp d`řAT3$s_%d^jQUX{IOy/"NpC(y-#HF9k1};w5aWVae/d[Gi'0#<FW3/YaczxORT];e_x^ ǝ ";K'a; ,7B59ӏTk iI~g;"7FlAC l(}nrA)¤zඃ4vzK 0ZzUZmI]uS@|ZAE:s)vyU'5NQ| /27RD k%g!98}4CHQK?]BҤ]AetJ]DZoT ;٘Vhв45a)pP=!r!#EVǍ3eMs%@`}fd'Czo89F $E:6cv!2%'bS \qƑA9c$kYȈ¹f&mF̙XBEh|zX-g j4Q&-_iJIG@sF5נ_o~F\Zld8'`Q 06$P@w0)I  d8[ ~qHN qQ7Mk)e8'[ Y;5N|z8 XU8)T" ۬)-̳jx&%ՄȔc("i϶e$e6JQkRSU-ۣuysuM]woU_FH:Tn2@کLTdAk~]yK\5IM.SD5ϲ[wm! x-㕍FTfƖhԡ/zGo6"@ż|E:2lIba%uǂ2%еO"蓂!ջ!Xih0v $V!!UB?51: (zn JԽQlZ0q 0 pHw4X- 5/_T培4PI~_08ꦾ쉏};]0>aow6fS1+LNNtv:wЩT^P1$8g.Jf;Bje_n#I&YV*BxSZו,FWZy"ͱ&[:'kaU>mJ*Tu_I NUꉵDo.WfH %IA|8?J=29:&oI[qB!p MCQ= W!(BrHfPcơXZ'׋-gCP:+@9Y`<;qSu™Jץ* w/үX#c͠L51X1fq`4靟Dڻ<蓦G'dI3ːT`[/8զh$Mv&'7 uПV9N0' UnKOaFL@?m_1|[Y"|P#m 5((sn+T/0Jr|[=vn-0AXxsjm!)ŸhpT \5(:n{9kӄ+r+2z <"/z+p0gPqGRY( a:pRSޗG(Ͽ_fK Kyd聇^qӎ{+u!eΗϦ7 $Frw>,i+0l%oH4ԎFИmOv6EO+q3_a [6ެfs}@+>~X]5TET%-͌#0fĒH x[ud 66G}af v}u E%׉bGKpfO -Ԝ|Po>J%wgmj)j*!kՏA =pD'ƒՎ(| 6WiL4I};o"q"Š'Mmm@V8j3 N[zIS  W^=ܪ c`uţ)WKP7}Τnߖ=2ϢK9;_PǹA;2PAA2ge0MmIG.4d{9b{C5q|N>Qqe1 :' r>⒮XҾvb'zevfОmmw%PZ2^dIy?Ly (Vh0A-[b+ uw0כk F.FDT ̂[\@2T&EC"m]"uv6Ro( SŮ> iIu{):0%v3ϟ01mП1=1c`h7 Nr֭#ЧZ&&6\ d">y} g'A'&"5csusctrX۸|#(dX& !sԪ$Z^w%F fK08 "F>BSJvH`Ԡ|Ώʖf= W'yR\Ȉ$\\e] lJA۩z N+uXyTQ)goWi%R9,?dy8[8 #iy 76NyFLMInlBd+r!+θKnhH9 !an.-I%uSE}cdKc69T7JWbȜ(ڋMEEv.YcG9;( Np|U"5jGN(H}QTe"ɱF}#ԥcF 8S額jLпZLesTZ2@;BhOGlA xɼ2 3! KVȥ(0=ci}&\3'PKf t,B$i@Mڭ* 4{Mj.7}wzՊq{ 1` ~1w9@WKxM& *o7|&EP%fE;*S@3⣬Zj/Whdkzg>AD^N*\FbxhKmb$i} k8ٽۀGnw 1'%ޓIfD>@ʷoFc&"Xm]qe!e+%(2ߔPc]xi>*@UT/D_ڮdw?Y3 ֡(Luܻ Iv+2/0"d]]=OIЮۅ.gtFxc78G3%jr$N((poc ]*-Lɾ*l^<ſ1Bt|Qc/' c '8F y,1$#<Kޠ#h ?T[LTNhkoTXeL+?g7*vyf? h LKJw<iTqS]&&'yitK.,+.7%@,V3c>O9Yqɹ +u71VA?y :Qhҥ غ|B(EsehV;_a0{. dxOy\> l\<42Vч O1<weq:Vf .`v`0=?'-^FbY\)e J Հ޶Ӈ瑿 ˏ֖,]n0GS}"* uI^O%Vsx.Iѽg@|=U@8DgMQz k壕1%Q, Y=^gsC=V7]34YG\?waRYKUn >RJ՜ĩa-F7_p~C{}jP. DO7gT (۪DS@)GC䝒C˩a:8VKBUr_REcis)cھE\f緗黜r8ᅷ 6S[:(:sb&-m+ՔBxJC%ihE|/C,@6 z[5MY8 @[F5!B9%5^.HNS~`\HqOwߍs%uulqP"`MdL T;;bnZd[ׯڭ{RyT =Ӳ[Ӳi:4"ÜZwH2mYXǓ3-דSЉMTw6%?z.s'7Qe(=~N8x:K4%W>sP5yYȠ@VOf `2F]j86'|W *9ut[}~"l ?Do2C9ZSKlN6v3Gb{U0Fc@TGbG9ix% |pR0G:I>\xߒϩj@T[0c~ڝB.Ww^[2Bi3㎌aXUE`ja%1y!\ё_QЖSq Ngܴxlwzlif hf=y&($hDcW{Y/X &;֐V~Rn_q()Hh&w4"dZ?"d¹X{YXo`dr~3R D/W֗trUMKુ,#N9߂U)0Ġ߄iwZI-8 5fO>CviD0q$N„ 7q0+4%Ѻ'~ ;V}r!}.%wtSK)'r][9#qv xqFAn,t$or)n:wB{ArRh!,'ʼY`{"@:aSRN$S=o|{Ť>FdlI+$)]jD)v:|:XrP-[;Ck1 PpTV_^9pYpxp<(R(1h={zb5XOgzgQ' g6):;ΤsbYaT83n. Iַ#:%l .z@_j'TÔ8[V봙]r o'Ɍ+E*g{tlp8 6:r/9Gg’%b>-UfG.߲ouHFXQT6p}H aaǎOtdf{rV<%a`$5\Z9 zqW$E}$N 4l8N›yLn:ik̜qZU.et%ʃԑjs(3{^Gj[b8sxܜj! ʥc[m uPP'~͙WvHiGOIĠ_v)Q}x%mp |=c=Hl1w &w|au}#M0J\\GfCE q$*r.*DrgJ[; &e)ҥ7ǹ cB9(SEʠH4 \#z3 FM|inDGS)ɞ%М & gP`x Vf`1W+苡+F6PGV&|3ѾIΓegvM#*xl5igQ@ō*ۻ8]tEibBl#ҢKX<_6 wI>zpj,`sMcʈ(f7Rn1nErsګ7{ Gr~!5]ei"j`9c0csQ:.l+RK:pˌi/0crC&fjHN>Jې/R4[UIUk)xǽ^EvPwTc]SpaL;Rs J=IS~E@Uo !@}%&rC9yP#od~ymu#>lt&ZXy2^!i1i>c(?J:-0|Qȣ C\W 7ACŮ6PD=+"j݅itg& hD۽xz޶K{~1&{>"F-G龝nc#M1PG66%^Kzp& 9=bcŒ8,ce=ըI'F )շ;O>.(< }]$p.@ߚ3}\QOa 9Ó}ReV-~˫mBE.73yġn-Jm=[//e#%4sO/H(1緤Mom&uj-oڭ&:X޷/ޣ8zyo9}БY.8rת[~DNv3\4oQ/ (M 2faatpixlhW{~3 s>P"B1&!0cXhZ)=؜8^/'g'WÍ@R}VXkyrk,O4KZAqJ,{ӗn Ly´OL\kMhgL@.Y~|񉐚\0H굡ZcvY@1H fsJj Xe [ 1Ev0gdK}dn%\h? ;&WO*NƲ37mH!ٙ{3OQ`8_[i#Ö̖ėq2Ę+1Ŝ.6߸Ǔ ֽ(vňS%yO!::LA?7%771 B8y' s?1+Fgȇ|hݞ${  2Ev_j;F,1tsy.BcO.]s̃ :iSr^˳PwvL1%qhX0+'NXGE?i:2QO5tt1ǀ p$g܏E~x&CNO %Aǫt-MXp? C{Kw_W NN&qi՗[~: SmD4"}%>m:M`:N(ݲ}̋kGL7n5b߬v"2E%{L{ɀL^>sFY6N"GCmO9/tFQtoAW.KQˮ\Z`%8[9. Æ=#nW&)E ȇiͶ{u}]bG-۞G$ziW"3\h 谐J` <l _OPH%ڐlEX((. 䔐@쒹Nry'jQ`bFDHPg:owz"O#E_YZVx_#tR|'qL+CwX3zdҏX8bfT6P2D?eP>" )&g@ bwya%JyT UoZpD qkd |s &!6(o b+nܬK"qv۟zhOPdcAI> `Ap@۵c!*GsET){}p-9nי/W}ƹLf=2|۽`'3vk4@|ց`x? lŗX20%fGW !(.7}^cjSOqRq:p0?Ik`4[9}4RY"Xd1j&s)+bˆ^ ~&֪;TcMB @Q5 RsϬ 'G=݀Ltjpeܬ4.* ^OSz%x\pu(`K]oi}=d:H -}؇-ExI5hNJ(8:M{Zu;;?QP X,xпCRzbmo.7-c `Sv¿JJz K?(o5<4m2Qu% 4<%%^'a%>'s"N@]_ϥ~&)Ɏs5m6+0hK.=6&9hUP!\q-bMI$}%qmWMXcJ35e޾0f w[VѬ:cü/qkMDžkZ.At?PV3eK9 Q H?^J+8 -ݤfg ?> VW(m (ti:%j<&gNƫc4` s *W6D:淧l /0.4 c5/0w.&$)ѢAsj$LZ5A"Xmu0 qa%AmѻeE+!w7}ا%Z~* ˛*C>'U5d+dBuiULZe.KJ;1 xՔR4Yo_ؓч]7io\M&hlY6>=MsGHc8lCv$W%UH <[# }<7Sf3FjelImm_M 2f\:ڭ ąԄByj qcGy-^QD=wAiZvy`Kt"z)Q24No򨣼!| YC"*Ӑgq6Xs-Aڭ.ω RdN A`MGޠSByZe{rǨL3aq'E%PDü4c h6 Fo ۿi' oE h`)Rw÷ @A; rmG gB'M)BkQ]:B>0H)i 9t͟G1ezߺ`}"#* gܦj96n):_@NHJ>fUseIy\2x}8:n\WyQش zk_-] st1@㿟)K>wz4X@F|W, <3؜Jf9|Ak*,Yug7>7ajX̾kFtg$3q fcI<_mƖݽ)@J5xb$TYUѳ/V|y'NS\W%ͳ<_/]\hRqS*ꥎ,ڋ vYU*{]Rjh" 4^#-vʕׯL\)F_/kR.t\awյ''Zٜޒ:i^CZDD/ ӉRHt'!6Ȥ=Uf'l,;]R'1T4M(( 8P&5{Itxp rS?Bϙ]V+un*1q®B@@\Bp&yo_(9 ~ }=CwvAuձ7+#rx1@m(rHTk lS~mIL.q0Mnr=3 Ac4ǧkUS>LiOtf'NOI'TSߨ"@LDsn#]EH*3FfY4|e8I߽)x mp_@ۘ?189<*^"(Bylo758wginvo`6 yO8ĐbŠ0il5b[l1nFEdp؝ s_gΉZ3%+Zf4yP,:c.,/KFxc/Qx')[ +\t je,U8/(UIP&1&֌|vrӾ th /f*"¥6*@;y /9^Gk/Y5πΉM|?p+e20"<2ISh: |C Q} 0WQsF!3ߒ%fV5!ړ%Z"G|OoBw0k:?m+c g{I< tt=ＣE|"Q($U XRG?<!JZfrj^qQVo5%L-WB> \=i/aI.([eRpl WVo2o֙5~% 3, ARD[ YvW}rRD|\kH>y,պ#2M' k+ʎѥ͜j$S!)իU=8N ljX%TU)GDoͥ/$(4Y* g0ǧiR=> X]M!>&+gިn~Ф;b !mv dGzGR" +L&,FVQM5?~ eaW$8FuFg9yaEy-;\F eCR┩ԙhk},ԋv[ n= %l#hKaOg |;NţjOo`yp50矂)~ uj;Yas}'eĘ-5FCN ӇƨJແs|9;{L;RpWp8@(4mxDEۧ3S(}TMPW(@H%b aŬtkU a.4ii-j|g2k%+S>urLMMb/T ^Rm1ϜWp;k72dWA&KNG.EXZ !{isF%Q(bߏ,`uҍ?xRG4*&i9fOȽoÿ=d#\AjKyo^m1f{?P2wH]koҭàdox)UT bjp"1mG1U T>XrT5cOp-O[܁FNxN$k%aohDTJdc'1/0Fq{p>smmE d֥%veR0vh(|+Oy,1(8ĜՖeh˾6ZY;&+YQ#ƸYzw@ ߼QbMhQ`TB'L<pBO5aXGvyźꆁf#+Q0%#T2Aڙx: d|>j)ۢvw]G<7,L̉uZ,ѡ.'IkZ<= )K )wXY;t%'T8Oǭ>oDg[ãbBtyf }3\ h-p;=k|Jrs-!uGDX~={Q!Rݔ@Z5ΦC:VU㌵ef%ƌm]\%kqN9yيI51nŮn{̄%joɣjt'sOʚ@y%Iuw{4)`A!9^aA9_5 {XX$(9jj3 ^Y<{u!+J;W _Y+ Wd:{r7π=Otk_gvM0p)cgRsjVO%vgs13dPRd;h} ݢ94Vr4& .NѲ嗦ށyV}ԲlZ! ",t _e13f:it<[ CE1UL'#cy:CGseNƠҿdDՂr,)vݲ+z(-AOti&bUzؿln YA5'P'P;*Bꟓ|qF1r|ڹ̄~s':ݧTD2OmL ։#u8X(&L Wڣ:rd+2txPBқ/W+.&d~?=hH+XI"2.=`!E@jl`Ar\?z2ߏ_JHWu68Я2nXdk贫Ш+Ϣ̽"᳞GR<e/*>[[ VC7Y E5Fh#s'*ԩ3 ! < !ddx4U7c~\|$fg&on]#P|dbF-+hꓣ%\hYbg[hvK9 rzyGק oA]kSyk;NdVcBŜ>-_*~r Q^q~PnP&}0j^{e\ 4XR|+zI]ɟaiMFt b9@٩oGt@U,KRrnSg- '#4񣷚>e_B 6^Pּij?cT@; Q2̈́n.:QGGN޺>&KvGlp[jXG%7-$l !ןǥlqQyh32r\7'=!}Y={WfhM=\H3ah `E bYtf']ƤQo󜵣5R+Y{kH3U(Su}UBt[ ׆xNv OZU_̫@i9FS_p :.[y G6l*=BɍpnPmt8-ڄn{[;O^]& BOp.}Gcl]6_FIVZHȶ$A9o)DM;w ͙x4k Њ44jH⺄,rw-Ǝ=vz{_Ҩj HzkTiJ=k'=ljo.c,sđǬ-|qmfv1; az 2RQ G Ê9[+@x_V[|Aсa>be9Oz8ħ-taQÆT)CcE\svSa.toM]zN_纍3W=qr^ /unUbڇ%`&*w" >>]&$W&WB #s0{RjfJHxO?IWkg)K zld(fmr \aY(9aIuD'Fg5 iQHs\?mF㳆nB?d#*u޶m^Y\".1$kӞ8"Ͳct,`Gt[E X-RJ؆(t? ! 4Ϧh9kJpšfl65ֈewMmCUt}hSx^jt`#ӫD\b¶yYYg@kB=F\jUQdcKeo%}ڱ(O\Bj7h2e%SPW`UșHƝ%7CH;p?yh+1!,\ȥNj/崿 dtC,CX4kt5ӏd[Rͺ\loL[gD[0ޢĩrXHuW[2y\BUQ%+0guV cv;%򳛊ǑMV Bn]|(yceSuO =N\ٴ" Q(l;ɒaуD*M6EUݗA#y#pe9ǧfr+^l'jSWJj.]kR] V\%1bf|ѯf8 ٚ` Eա"I ֔++ʎDqArxC'ga[,tXd6fQL|qRVgq-PI :"Ex-?U3YеUTFk_9(Oz.zx?EhM R5lFP7'PGT\}U&DRe|_6e|bi2Apr5w(!iAiJaH_jdTy0fwjUg~]ܦNA~wsF%XX;ƶC)KMPBp؟:z!0a~K5m>'EM#ootX,p[(ي%_f;s_JsU.j71iRԞ~[WuO!Wk ьcNA.͢@eOl\9څQ~8;s=8کpfF*`2wʣ.ȗ:$~.kgvъao$)NNv4@xLL%ڽޢ#3q9` =g1G4<L: 'gUҤB>ӼuUO8|jڧkH_7*$֝# E|w_I؊~ƹ$ż c)/}iKf hxp MIUg0/do&3nlL\7T[t1ϼm1%  9+^J9hLME];$员J$lO(uV>"LnP87&nCS{< qZ$(f=+ԼPLIH 1cJYV9oЖm  Cw&2|;"aj׬VK>]ZnHpVLQL5ŏQtӖen̶k?3OCg+?X&_8!EbOK* 3͊?Sm`fRxñ<+U\$ 8q-2E)},xxIKm"9Vʈ#qL.(;AYȩvSeviV`\M78zq=46eՈ"?90ûaE/aƊ* * F(}an,),h]dRpOǭ-=o*t:$dP0XhTpU>34؃R .ujeRoҧnO G ?w-TyJUnC^<]('J4Vhu{TiZ0dg{P(eʠcFo)3!.k&M3sP|.SXqmYTC|JӠmvlBMxlV  VYU_ʠ|))Ga A)kHE_2 ^~ڶܯP1ele|wŤk1>Ӛh|)J{}D) ]O ;mHfT\.xrS+֮9͛sRn+ؗi}fYYyaHg+b|H7|$w,҃Zb6,_Ė.0ϳS:`hbq7"'<ƾ1pyjU %__e/eL g8JY~2WSDa#3"MW%v\HfB  (2S^%)sOQO@TdT99wyrm{CEE nOؘaXJ)-$oА*4j!EV" al&/Rvw` _yn-żHŵClA|+^3꺰t W+U u9귷 ) 'Mwᑚו7x&}<âlEbnϞ??yUa8m{U$ ExnKJgcœswj7zSyŊ~5|jW 6/\Ī 09޺U2_#Jms3Qh0wPsKP^/:!  qiʋmY a@V29Y]>S3 ,4sf(@g}t_w,UaAUP2ȽAI]j(oISNL&`2p]& p [b%HU¸FTr=zͧiL\F0.ѕ}|3\n(:SnAXkjIf5hQ('QCd.1r"G']zTF{[џLȸÉM>4`֏ae6̳F‚A b*SSӏJ\:%TvTBj=ug9F]'e*nT!,aer5:pKbɷ[5"sg?8M{<CEw1}"7WY]bqQzW;ZdRzni +Afmg2Plc5ͅnۡyϑ^P͞8DCr&"HMòbArLm%h0pN;X_`،clO31ΟK?]l1/Đ!xk g  cNݡ-o $:O<`]qP)^Ȅ v1#,kBO{ҔkRَ Zռ; j+yV ``b,8EW9RE%y̱΄N0W ё}Jɦ*Cݗ9ga })VK:Y2٠v?y0DI9mF ,o7T_{4īpQqNϱX yCQȝ3Q=[I}~Ӳ#S6ٳ tH۠2D0th!AÎYt%r_$~Z}=AһݻvڜCo՘H$atnn]iMUtZ4FԟHN!u>`!sWbQ2[[d BB_$aP9Q m(tUﹹn/~g!K2Orp2'4@bl|#޽񪿻+(E U&n{p "ұ*Kq+/ŎI1ݛe@E+Ӡb7#}aI oп-zK~Z>^] ߄P [tks˖5 qۛggS o١()C۔gE`x&Z%?aʗ/@~`Ij\qDWJ(R6V8`͠#-AZ{#uӛ֡ CA[%]ǔu4o۞$\^d͞9U Ⱦ5/)m/2/bD$Ѳ8k1LL2k3GRSaJW ?}b ,^\· k.c,VT(5̕X:r aZyn}v|q~mŰ7|X}AI ǾeZ5,erN=i<ʵkU/e~bhBi=POHlH6+WeV(B7A<pne!wH.:*y;[i%㜣or1"R*6v^OJ/u҂GP\o9x39 lJi$R>'ʟ v߲4xz zZ@ٖn/#$ʟCѹtۄ}"X ͋8 )LKa3ecB#A"tѣkPd8_՛J)֬y py?c5뮽jǜ90d'.%bٝ @h<1y*4.#~HkӗKJm[`Ù_$?*qƤ8O5(S`1l(F$U"H~3~8/ (Ȫ]2ZpN/IhpW'Nc\\Z6mws ^,w'F_R%gWPn01@3X$DmӒT徉Uwf)&꺀*H܄HV::=.ҍcݦVJj,L!&~_x% <\S15 ʹDkrr칦HTNL'p8NQ 6zeK`nVdDcVe"R2L5j})kT`7H@a% pH=z ^(5SDvB -ngl*mQ9 cԙaamePso5XDi\ΏPGj*#2t vq8yimUpqך-%8.WO=p`˼J[3U>ܙG4Cunol̿(ّtY789OHN%y~ѡ|~+l)RRXZ rj*U *R}E,'4=C $Lt,u|fCC&Q!™LmfTW9df⨱dooK6-O FS"*4Q#cUKtlúo210 ̠x~n-%aWrLZ$ ']k~ngs ?28?x Lw=)ؕ< 'N 2}39VB"9M˸I. ԭw,ZCE)R'Y VI=]0Bz *˂C8b??l6ʲ{7[%|a&.b)Ehb jO84UR$߇~ianɸnu}6u{LA+RS o4x'W?)MTF|*^ﰀ.8;i2jXhbQTUbf\,!1 Wº.%f ]~^ƠV9Ԃ%?ID_,-B{Y҇-7Sۇ_hutx""Da`$S"[5gzp1~ɒDiFz %-\QJ:ЖKa9ҰLnG{EꊰH8bbjIe)V4@w`Rwy }{Go#hX7f]~-he  P Ԑg\؟Mypq7uU@րPB,< @,NBS<-Tf~5-̑/GYd,wk7g<3!&s\Sqs8S퀎7@{@qɀBryR쩡;g`.w _Tc( }4c$3Xl5g}`=oLܯ_STKh|,5uoDI+Œto 2wά j\i?4V02qQV/ۡղ`LPerAC27&k]hZ92S_EtR A n/i3QS7$URg|41oe wbN]XȱX5ivRҎDy 9ןq(>Yps)oHOi!_ J$KLήh/㏧D{ -sLp5d gcT,0؃0}>J(AKAVy3R-?+]bϗ -F{Ug,.¶ +hEѢ_v-r!B]!Ֆ-4 Ԥ+<񼡁Tר4dea=Ƌ>&T*uYªcL /9u nKZ˫o!ԄPA/ \}HFPI)Oъ=I0I9Y'`q^޹AOxGoclՉc 9}S" ~&ɓ] tqE,*ug>X~cuhټt@p@C`b?Q_ѧk6q焫&; I݂Kw^+0own%O>Rl MrO>eB LI7 1úU`m6Y"Esڛ["hp *LFG6צ>r8]I|Q8?YJk||_d.Y,ժvN[>I,|َL4FD\+'_X^˻*ڨ}}U!ZtvZG"p1RL,a 5KEvK|^AVUpvS/S*\зvznd9^ڕc?.zxbc\ڴTDM8nZaXQgޑ?b3\ K ߜ7b`g˿VH ^kIe=nxP:!I挪z't[C޷0e}9 rKWL7A"} ֯q `niXnI %_;CdGXZ3ǧ!k{{*yO\nw>M^[ Lz=0p ԒTQv0j훏ٸ_png'/5ʭ(8(;ŀ[3mnZ8*!^غAZG,vpgV܀ ;#-W e RjEsol]X\ғҲs-grbT]5-ltE.Ng,Hڅp^@ ("]<ҷ'A:6eT\R(RbFHv141:8-k-dFU/Э*gzjQCZ#w~MRJXpƔ 5c89jSBHQHvT{/]&:kر T4Y"hXّL%[hfrzj<⎖O;y#zha8aZZK9v\&Lꏦ̳ōAF(qQZhcgpLKnb?BZ#t:j1H'P3=]2u}p{ ̂ {VS;б:-dwW7iRX!@Rk{PwTObMf c_4!J>xBݷ‘AFKҘ:t`A#̭[UR&v8)v5M4wkŇ&,f@>5.@&2N굾vэ(yK'\#: j{jEJY3{Ӑ tx6+bb}LM"+>G^2Fe\(ֽc_ ?&?h.Wɞ$P6 uSe1WKB'q(?O&(Züu܏ *VAihy&nWo|4?).nA@̞TgCsV[R_"<4TdA;wإ 5塹 _;:ek=WHYFOb>?wzKz .^Vw kY5aoڸo %[)$/M\#Gw5X9q)3j&i.>";\ѹTYP¶vߺʒhx1IuC-CEMqL['nuEk (F̋TtD3yȗp4Jݾdû( Wxr@Ze ce5*՘VJj t;zLxwpI.} HP0:@mˆ81Y]#8 >T\ _AZH"v/,LL stP_ZΰWUҎ#fmUJY(~0lf)B!(j ϒfW:5luk1xwD"Ga%9WIw~E&ג莟(4$hP~JNamrLQ~ v .*bIy'ۜ'NGI$ )%&s*q۫M,q& -"+n%!޶^ }rۧ4UH9/*87]kODrO@i6*Nj嶧ܠlܟ`0WghIr$5-gAKlP 5舩c Oj7Nxwe?dhbU̓d!p$ecމGʔa A{R;M :-TDb?0d؂;[!*&b# _<v #+C.Gk/bJm"iN. U?)6J6}`=_^aCl 0יo:76Q+O9Xf_Y$jMd^Md4^aQb;t!lmm#J?-@Po%W$1皧"E$M%p!OS-7|Đֳ8dᑒPW/BN>z^Ͳ,_Ж˲."a˵Œ{,#/ɯ\8/nzSAٵ3c^$GzfcP4 |{m]-dщ2ҒMe Rl9(˖Yji0Mc< }YF C6GN(ĥC<-ޓq=o 8 S/MsrĿT.8FE` $呔fI8ae KW)"OltSglf>ﳪ7ju6N-uƒg!<QezNBxlr4\*\Q{d.e: 0f3HݗاΨN WCo!+ɸakqjlX[K|1bKO=_z]D2mD?4ud݃* 2L&2se?gFmL.>#*Qe%ѥ~x|ݠ…FhWbNh}RH~x_&r)%]#lqGAK34_ [VS>jtFCv&:ȍ AzeF2St ^r,Vp#SHj'%v"dkf@LI}͇"hń_.`<i*_B ~{u~|{L)s Hi9!I1iWp8iXCD35I!k .' A?3S2 kݝ!{0 ߖ27g-׭uEh6_wf:B-IŚZG,wBFx,m S{Ogr9BaMGoO7N(NY_kRNJ:/.w8b AkC:Qq_򷞷|X)%wKs)8;@5>FSՓgh@6G/nAlj8@ዞPFϣo ;Z!ڜު=Nϵ ݌_.@` fZܛ;@# Q%oyٸ9נP=MK+m-ȉ^H%o z#رXD(q|UExic>@ tCsܭ1 X Sp(ۣwI 9L.y c x]|DuhLS*Ϭu cAbjV"^x^cdA.A7ʅ0Y|6mGhzeEHyυR:9HCiG #خto:Uz36bC6j 9gN Ɇ~?(yPe)\bA| eY5NAUa6M[0Pv4R9V gi؜RWRܷ;K95sLW}$ֹ눋ڿ k9˃_ć9 <+~A5 ,D1/\5ht!ܵ\tbz nH`w &᢫LwX 6t7%6KSQ1#2&] L(&PXY 'sR^mQ,;2 5CmY[@5(F֋E }/muv3 t6mL<&DH㇙[$u 6B,lbNaR5)_ZhȦNĄ*p;a^ݬBj\{7|0?ģϮO|n|c!{nkFK;Dž:A&bӧLNKS1Vv,t` hc?x(@Pze9z+bWJVPLi31OƟH0~cЭǭ-{D-sJ)_ p <"_d;% 'Ar^IQ`me!l(\nhdObxyx7.:O〥•&eE [?XK.I%K >Cͪ"rqNe"^}4-Ta1C,£+k\<TK ݾ<:vNmJ_{3|Lq */TVY(k.J |]o6͛]u+UPC,rY 6I)A: 4eoLq)aCh͓! > )t, )Dvwj{<[prMK rQkHg;1rWQTT &V.$;L 8Ŏ˳+xgLH^߹%畖1-k)w=J(N%Zɚi75ٮMMcCj'F)8zĊ.S8`QA7wF8Vն{S+Tm !Z=ɖ`]8 # 5v}W2` .ҊcM4(T wV2{p<\zR ^; $>6s>*ᝎՅ K eCsֶalGo䆹UJeUeYtIb2y6/7&~M^)׃ud,+ tT7 GJ" ;\D'=? RQB*\mg')nk; ;9&◾ʉL̐ 8Q\!ë/xjyӼ+u>}qeh:c C8Y6NVtn=u,E:C,ߟ~8>,6SR>hh6cp0/EIb}{Nhh#&,XKN~uDyxmWBHB2%W 4ͼφ^~ *6-EFAC ] [:+Tw2-l-Ui48\/-(jk?^յJuA`%U8^Hp뙏y}b?QĉMfy`g-ԲR_q %T[[,ЇЀ2k:[ =sJN{4RBد\h/+gі5J!f{b',^]i`vpBh`g*GOXV {3ڰzpyt9׵m4( c6fJ[# )C6{%uteY22___것&z^ T ^ȞJOf\nRIC N띂g;;c>ے]xIY%_)هq!>^ݠޝ QGAȟ9ZSNBYk>(z+W7aʲI]-/S}@wxRhd||th@\FTX:Ѝi%1S# dE;@EA$VY3$lzynW+l8@2OroZH$4T]c4롨O5P9BZbp{wDZMK/n96*:5 b(ӒYpWz!=ԖNjtzT_: Z1~iJh UvEmȅbqUtk%z_E[fŎXKra5%LKxC+)׆\"t6Q'Fm0$ɚ⹐fgt +Q~2ٹŤ?HRVBcp2!64`iTt뗙&s z.8h*FQ=^f 7[B|%866Zio" L7<}?t4xJ>mZIiB*8P% 8| t!!m=;:m+*  G۲CȎz Šˑ*!!4ҴR[yb#`BaU2nnlRu٘ :u7{dkvH*2{q@g/G׀d/!d D46 F~WvEv$Y!|떡.j I{ 6OcsFڈw`͍K}d_~L[{Ak}q1. -lmfB w~?R+ ;t8@yp^}0 Zpq;>]a#HC`TB\6zBK@דB5N뎴>D.O3 mpR{q{W3er;Uup#2hJhDCk:2Z'ڷe9uF`f225J ,`[2SYK_yݾ]HI !//6~3Xdj+/LykV<9/B9bܖA9!TD76* gH'+^Rd63 i>4A_n'sDžIa믆(xi :.JHv/ =RydU{l^qšc,1+v Rt\%-]{HdyB=*Ee s^>gwHV=\<- s`Kc"7L=#ӵyLO]>;eQ3c^VJc +^rj[ۓicr+n}><9d P''§»){vܬfd;ع?( >(t %>#a֨8XP]^NvDY1qQ ќg=iN9,my߫B 6wӋ 'g(/:3Jש"kh'1 _]}}!v⺄|N a@ktobrwC)q80u WMc%ycGbe"d`j @u6'0qNbx&_VEHW{jY&ZMf"},6N/Pc(Rbtᇍgy7qN&^8V5hO1Uo@,=s2ל #Piߤ=:mc{D3xᱢc!ճ7/;_6z2`6980@!oʥu*a:+T!2X2gAG Ii̪F:3@;"o+W:^r7A;^9*q'ō_zKU|U!!)--G֮< iDҰwsmJɉ2+J(}).* j\]7{A%_`z$ 82+m`F䡧r8- 3ri:1ʔv1xSfvY[\;W;rPzZ{C6|'Q9d_AN97 fc}Ve$d]ER1PƻG+Mҹ"7t<>6&,1?@Zѻ؊]%$O16u<;w)Υ5Ӎ3ݿ sk $jkhϟ]]*k!< Zō+Ԗԁw~6i1 "GG(x" E;5p`~u"!Hr BJZFeÉ"nr/NcC6'[^q{^ 4Hiyuqd4>M9K_9:~wc(1D>yOed]$zXoζjEŨZSWZ6C@\uc(IF qY2 LH㸏jKsH&a/9}Qlg} T{ڥL}m,Ty$)=i(0 <2N]Q>b#Cn_ѭͣyr>)GU8!YLoH),7':_˲!PbbE~9DZtwg֬'3{ī!%qos$Y8XTȪͺ¬+>"-'qs(m<`{s搓(B+ugxDMi0`J 5{ۄHEiP#ORı$drQY|rm玆#!{'}b"-.DwjN:LtճgD[`\%dY,T8ǻ}ݾZ{YMt]8r)_[Ljy=vHp}'$cQXZ'xK 'K=(Sb86^[G`Zk֬(ݷd1 Z2z^ -k=GB8EA*:fYL#*L_<`Օ仰W(~;-}NΆ5B~hW tt̿WM?jd>!Gp2"udԍ 9>$7 wmiF=:VI%'4ARU\[ԏAw5C9̯(5xA"%>#d\3ǐ uߥ`A]ƙө`EQ_ȁ+O:$ 3Ϝu)eI5Okp,A6ɋ ?? ׽f;EDġҸߚ}lJ#;TJF\(|5ER(rmzՒd]PMZUoNG7*#ҋhgPиAS$[ \oCXk`JԞddl %:ټ̋US.g"'!>i5:2!&Qp̰}ov(S0vӾ&^TDFp!.,_0G0d`^cH[}'glKi&Cr;|3)>S ^VbK]ܦH=<*R)ůf#CҥA zB.GdZ%A ?YCa͗RS_ {g;.!sTL=v~fKZhk>eUЀ#ġm*`|1P]QfcP9\̯pK2 Q6fev8p9+T c^ ⃇z v,+&Ύ Y_( Vv5h1?c7CD[[%"~Fw\c|]*0V2" kgit= ,]m(;'b=,]-3CJ͐#N0iSCJţRt˱#Ӻ3(b_5oG-,+QJCmP#554o!(r^onj{e\CQj䌯ޯh]ۢ)fE6cy^sI1#`$p1!R[!_`#eTKQAB^ `@rr !">8owpw+ڀ$w+%oЊˏF?[tj*7y `v)w+CC|NLuuPɗGJPɛKwV}jg5,s\>Ȉoٝ]E` t՞/LJ@RVroUN3qgR!ۼ3u}H- NPCGI;/cXGj9BݥSn0 ǣt&H}TkaKGr Y7n?>I(ڋJJ|^`tZh9oLfhFQU+Qe/lSlQ4@ Kx-LǑcs>UEė @zWIC.i]lގX#Jʤ~`Akd }٘_G{Yj. FSz=&o 7=QsHF(ia_@p1`O>13v{״v F;|c}Ejѓ !To/&,ΦWjJ-ᒩVZe8Z8$HHO&Ro6މ JBƁk?[vO(L9%4*hd:bRg[h5 ҉}+2A]4#N̙nHuD ̫^C ǁkTkR e!pklV d( qð$ۣ3@ֈTw m[#w`'uR_A:9add3YTx˩ PY{Qg1B97Xs1S4z_Y4'3]q0 w! Ϫf?–+o᡺ &&9n\#\ o~y"\8mms_BH涸✛[Rˍ?EjQیVayٸuI~2Tz* #DE0;&h%z.YW!B [%L4#ü0G*Ӗ&85h ~OTD2& \nLWu=-m@-g`.- Sy6[Te&'I 'HO -kCjs _ڍF#`)Ս@SXk5j^ ;0`sl!"p/Yr_X@qWs P:LO<.Q3ψт3"Ơ@r WwAR )YNYJy[٣ Q?Q,{ Zt-KY(ڢ% [9 sA7;wpb&'=ntw~;wP{Q?ۢ.3vkwZwN 2_Ыh"Q UVhtB. uc5CW1K=eMɁa 7s{P>|".ыv|;rhcbCtsQ`ǀt.t1ҲwB*ߘ煠"܋m2oUsGM"qpAQQzTjjDD\11Ƕ(o$/|0Q g' 0ݶgj^'OE}6hVDa%ͭ4Ԅ[cq2nq@`@ @))!̣sf+zM7J 24TtxqJKG+Bb]g|?.Cd(ѱg0%}8'=_Z~ )Sc:8Ծ1򵰂+KA:JDĥ}]Osԙ h=]eʢM%;c >83`óК / $|{+G~gyxH D"eD%:HLb%6c>lm f#b O.PN-b}@|[S7ijn^SKɑYLFaZ(۩-mʑ@h%"(/;j͹3@ZFz+l# d+JLD8N_߽uC=.1qrOȘT @^f) v` ?C{,p"/YQڼ#d7g^zoZO3kLQ_D[(~!ԌW@EnTvl%ћ|BP$n]vWē`3ʹZPB(tRWQ(# yrԵ0 g4vm?ʎ_>r گS#>6ȷv#mc^:po#hXH=&81Y,`< $wvm}kVӹq{ҠR )tu*!cK.nόoA}0Ib]*LdϹVW(1=.7BE,d9%OnϩvbGgȳMR𹤡`ԔK[@ ,D,qP<"W2U$+n382dᤘ"C qf0y|rvn= ԯPR6pGQ-qGJ5U zxMZbk!rZ[@U{o)5 # re2'(<=A7ӏw3X #q/`DQmmAcd85W&çV=-ak#K3u !̓OmY7ÞLb;;-wڂu=mCJ6P/](*ZET +;za7'z;[ZA&TChjﭙ@0''8!zy=ɿډ̰`}kjOp5g!b禓xT*i],]2r ! P'M<|qKv+^}^oRꁚ IJj9\b+;-nwJ#9l/mgC҄1 L1FD9?tM+ */Ϊ5 WB_<މ$@W r>[!gw6޽KTtrz]ۊ4-5 3:;G~-]!IhDT:xTtlfȄGR۫'c UZA|=`)(O; ;ɬ&@{qMǡ VS>gi\C}7&lO/>J- ?=$E:xY#lRlJㆍxkjlՄRCt0fg(kŤЈU!Lt(6:ݴVP @WNTiB7VRr{q0Q|23es^a@fI'"ۉ35Kn.gA$h`}8EYKdҌZEi?]bgCJ^WDed-Ck_PIW6-or!d%ƬET yӾG=VsEqw =40m23LIg+n&v4A@qwt37nj(ks'M4ej纩dJR'+)*6ZHLz`f#cY5s8f}x_$ I]r.n= #.RA]C|9 |KR(4a?\Z5No ) ߽]6C|aBB$O6c;_~CPo/KXqP^ayGY~7aX8,IZϭ<UF #` :p=_(2WfҡTip7P}p"[ ]X.QoW:xp2)D[+^Bn\+aM>㹍TY Z *@0gx0 R+Mcy;.>6UzCy֖5OBɅyå j#3Ye謕3Z^Ξk+NH1L($!UX00+tme=̑@`tX9S8t@ 4W )4J)I}McC|ؼ]&m6ePތ w*M$:ZGOob}qmAƯ&/okl(D$ UFGMs? q2]pϦ) u[٧H/v`67Rۘ_LQ7ZׯB:;LOk:QQ_? LTk= bx[4K~){G@-=Dym5|>3筇E : ܧ U7T[P)n*O E1d é|V _LZA'.Z68n-6|(ob `-uq[U(2˜g /YČ**Uk\'X&~v{3&1ϸ QRONmfNRsDܧwF5TdUQB/eFk(%JWO׾\,yF8NS,`J*p W}e%ߐJH(uʢo*LRQ#BQpl:{a{5^7b'e-ioPpgx&kZ '479f:0k?lő|%1.Lc>vL:Gw0`R9_Am'=l #r$j"ǝv^u!vsJm*~2#ZL_~@R&_ |UZ! @4Og}e$ x׻FT&yjaa ܟYO\n)lnR j)ɓ5sp,OÕ' Y;(6EC–C>>L]kn8Hۍ4c%7N)E>ݴPGTՅ-I9rpQ6")<:GoE9aVXR>ж =FAY|aeq553)V)v٬c\z𸳍SMtRt14z>`E1 я=~H_{q)a+~\>WL]ue:H)j sI؎HI_;Y=#RӈbGQcUi;L#$*YcȀil >־I; f/43ܦR3:FDPhK 'W@暌`VžWEsV9h2Ґ*} yW-klAOx/'4+Yay}v?^LJY Rq,6H9:< dul 7~˟j=7y+ڛ'k6M|f֬!t*7dPF[A3GYܯw!7.Ezi}( HTU9Qy&a5u[~UBn+G^A:Ј FtfOpX:0Z3 p%>\+\CǍ[ۂ' 5,ayی>6q m:2ٴ٥vˉ« WNh Z]ª}: Nm,!=Yv|l[L:#d`-l>?>DZuk.å ZWf/ #FvLl|=YAr%*K/tA*:P?*|;oEI#xZGq}Ę#H~9qa*&V|,hw61 \c[Dl~赨ILiWP'e̦ Oȅ`(Rq*PC9pէ꒰(u[)٬28AzZ4au{4W.<HbQ=8o7S"^mU3/[pj\&dR!Ƿ *KjAy[WD^Fu=BZ{Aj uV)? kߓD[4"T@$H>跙Q3̽u6 Mi}WL{\c--XО Ba͏/vlƼ̀%<&$ף8mfaLR`PEG: 恅'J-X! dLL)}@l'CTS8q$'‰1-Hy(d\YQz~*Q/MGd?b0cQ_aidzz:y;N !Ѻ5Ϯ?\ĨZ|U'v7кIWct)l]l\o-&B8cwZW@1|@>A a4 Um"Ѯj%>Y“k!v-P{x^_.I:R#e.~fAC1lX_{AtgĬE'ĘpftiR81vӱ0Ꮁ_Biv0p%g q?p ? zQ+cgnP6[kt4 ]1pC?9qô^;|QbVe =߻c~6儯l ֚OD'Jo\iCz<"f//O U(>jށY6Z\͍`(97(,c8R:Zf6_t4$b_ 4+oz8qgR?}U`.zu?$Ś06 3)r$#bG{QH5`t<@Aho-zߖMlCKλVhJ5rDjjL{&2[7Yý"Zf!Jزb` SFs+hG;[5 vʱwQG(Ƶ;7[zm\U3D~ǿݽm P 5n!P+&\m(#gH4??x,p՛=]i&˜P\lИ%bx#g,/w:+tFP_lH,y yv:vI&F=G{8&[5Fgƪ#sj'BtEWu5h ,&ck㙱Hp~'Ubfwm/t9'[H#H4w3ys+% ,vhu) ;snmoXHTHAb;}8s90 sd0ҽP"CeSraRS,$/-ڡJa5mAduܡ=̼6c`JMg; BFALgh?/} VFV&fWKҠtec'+Kœ3qK m:bЧ/I:cE!НՁ#j6 ΛL 4@q Nc9C Df&}uy_ڹ*^`waP2.s-K 5hiUޓv1N,4X3;`1O ήKhg}AAbFɐaw_]]^1 3Q++mXʍ׎["364IK/eD?T fmşUI\,z [$ky'%zL%iHM$hoZl3{3isDgBd,kƮ8h FWfyTdY^ q&+~|@\K7M $, CK{*2u}` )҇lbYtT1 { !uR7p^aZ7RunY2`+"q_:WԴD[ b' +Y=bZBqH eD,|#'5ڐY;REiXGkdB$*;TZU#듓=1#CGP8؉ J 9=Й/6 6%$HPhb4J-0 ?B3m $wp:EDVU09\ Tom+j:?59BY|0fz7?\8va/z[ifo =fSsXF\Fw ENݥ+烼K T*eVͻD$Z|gRPˋ皶,Bj*No8aQaiK@?v171S3rܷ^x;APyXn~0.]/ﻙXW||Un&5H5A97 acx7.>iOx &zi8$)v$6ҷ"f˗e 7G%j/,t+ao+;#| V'n ~|G-^f#DlG[h0UN>Pt|.f)֜C_`,Q0svYz[rkDKF:DHLu*J-'`Yp ~xZvjX@,8szG]eIYSi{w4Jvr3(eO)Nv?dQf( ;\0!sF$gup5Yx\Pb8hTJ pC׿$o{C++wwnp7)I.[eBH%$*B GGw?zF? .WHc%'.Gp]?l03nEoN#M\؁xӀY@lN͝0J8$lb8^7Mm xC٘|&nzᮖ 7"n)L8i C.ܡDH6Oj-/S2A`)Mp*ws%8 ^UEֆXyF{JvFCMZ![@[cdr*A-gXX.c(1uʋwf I>=+#5p.BMRr};VL7ƒtq*0:7s㶊;2yyA :+O40F*#vD)ݹ`ղ(* [:D ]6s;"7c:0n-1:4#N*e;G؍܈o.K 4uS]OGg,۷ 0Kyt/4Dk:pɞn*)yR2zf:?8砮tMJqe򎕕dvhxd{UMc߽"ugCEyQZW$&ŔETm DjXTe`9noz9gחfm,tĔC#/1 |Py.x ٪MUvB%S8LqqGfWIn#`+p!$FzS]!wM-@:O4Uk'S'S^lŖw(<'tdS]L@ӌSDC`)Kn[wT^m2Npm2J_}1Mz!8V$ 0jeL)^5B?L1SƾM\=^%5ໝX#5"$UItTjC. (r<M)1Jם|9 ۪8ؼ؅1⋯bVyu#!1W+y?0Fg%Lk@_;oڍ>1QOM:>_?$voEE=10%!GÓsg؛bV]$.?e+.)CM n Pr(Cy%RsF N]J?4(p6="rq LzEE5ًr'qN֦{f›<{h$((iSٱjΖᜣΧPn,#a`gȴMfx/' * tHI<@!+5[a=KK䤃c}SG NY9ni'aZk$,*_?Qc5Y TNg2g{43U=^(CkhQ@^z[l8U#fy33u* ʎ(WmφenyX+aRTT>HctR7`ݼx [d: @nx~ V_-hCUŎ— .wFH6,X.0ut8ۣ 78zsB6~W2!CK?BC+CB\fW_4nc <0hx@3P.Z) &O'<ˆ3 R;byq" IPU`rNTnދ? 0 )qKF3%ZO8Uj,nho,|;+j,H[$V{$Vw:齤=&nJF6"pV_΅B9̗JU.V \oG]ϸ\XT{pA!ߎo{hl bCϵ7Qt< AO'8 PpCBHmK21K;3:Yqi]Jkd7=vSM#=+.j |LY4Q~*m˟U ”Uб)EL8A+ECf\¯Y ;`bכls}pK%' *bcb9]N~Zt`f2Rrkzא͟ , Ocs^֐aG-FY,&gyٮ c߄w:lj$txW!PiLֲ$B$k^X$blb eµ). G Km]KRɋU{ 뱄aܰV:ܟ?=})Ġ؋| /.4t51d #fqM)ʄca: SȜmR4NЎ䢓s=+0^6@D&HM`';>iKr'ܑĖ`UTs/h*iDXj^Y2 F~ֽu!Crهg6ƪx "A{y &8u<i6M"tkSj|[hm *O IGՀ9Kp XzG4:#@P_.Z{mڀԈCH꩑h'WW4fcH/79]MB m0oL)ů@qA1>Gn$Э\D-yQ2'-M5d~Ϻx]g#6^ĪH31OڿL|փU,Lڽ_X+MF΂XGɼcf:- 1J mE-Dv-rx_-jpK'*5uͳ(&if՜;W^CJ0_ #OU__ ^>.h h5Sw 3l'"oJ1e[*({&Т[ҩ[tpG>OtN:@T*ŞB,,o qE?6hZR< ,ZGEO) 6cs3-7u/*2̥4zw -A&a{ Ce.A{s#ִfY쩵9J:$8QoiW= #iI;׺x{<_Wak@X@M6Ǚ&q2+̱1E=2>AXTJe͒>t0 Lk"6@ GGwbV \pKg-<5b[IfxAvd5D5\엖l dR:_zYBJ? A4šXOeP]lHUR?®@~]=ݙ26ipYsZWrmtXJvrˮHR Q9meb3rPn?*wh{[AEFP:M:}`"˝r}+=U ny/'Iގ͆7NU:a.ʔD (RȲ0Pd}{k kRNkkpCSڐg^/dXE:FVf`@]># ݸm4?xUvr]]rGro՜P]tAie1>dQxnc}ˡL҈ {*Uܒ++e$tFe qUaMNM@N>߷BaG{be,(d={=5^w:\Qh*I\şq Q5Ʈ |hhdߒ7[Ds >jQȜOIӠT.MoΎ(En5gꛊBad|}ZQȐLbcx5[xZ [NݖW6Kuo grmXuϽҧ.WW0Ps%-H5)Vs$77;b1v*p+~!mLg% ce3 VI:e]p9_ n0n $ë_ߣ>4>-=; TnՈ ٷd[.wx0+)$`tz9ƫgk`l @]Qm|joTD\.$oԉcuzte7*V&@Fdއ,V#AOCVVJs!Nd! 8g*eyŊI~ Xml{&bMk+2Wi[rU$y~&=CyJ9?ҥ?(<(Z(qW=KU##{Nb͖y]W F HMcL<İg7nٺ5 S Y2Ss *f(c۾=ÐL ҜJm&:iۋnwvx3$OUsxrlM\Hʦэ?pȇTWZ.AwvӽOFaj13:]/PpK$O"{vth}K`2PJ!zo E;v7uώH=^Q}قK{We)&q 34Q~sGշcqrcF+ }3\f{ {&5ewe%\]֎8 ZBނM-$n1*a-J,j6JbW2m F45'ۄ=`-<ԚDżjw6z| 嘌]d>{8 ]9Bz)ʘfrsֆװ,2%32gpz VgX!#%͋ @iyCh-t\}ΓD.g % H1_>z,8e!VI(6m=Yyd5Bd?ӟd5ry?!1GPקCzW N W5/˭׮sH,Ļ*o035Nz&l$V[nWK-ZilRdw?*<%Jt%a^큆SK)NkI!u#[d@v:#4HӐq8U7VzͦFV#\YFO{r~HC-Re6I P?~q4MQ):@0&Y.k-o4 i-at3ŲzAi]gY} ;+? !փz8SFzS(a^)gSrj[|-*G ܔ=uG{MPJd˛05< 1x80o ?biՎxTO &wQ#NN715 97>#j9:SzCnEc]t!7D 2q?SIbLJEcAYV2թQ_*޲)]T @0|ej]P^6~=`$Ń=@+~LüM (X۪I2fG!.! gE9](b?9SOs.d-gGjBxÜ|]PZX c]`ܬ'Z&Q FX= z5i'"^*Ai2!?TlqavU-; YDH +ջ۪y%R-y[q0w*{ kjʖb)6UM[c㶉ue;_& 6&X7J`#"f[Kf T`mHƴj'hzU&މ'}-rpz8aMn%-_EAg rmG~YcI zlF2[юx/ XvŬOn W-ˆC:dfv!\! ZCR-Xp`OmD~73$xKZ)[)qGtdcn.BdT'?*M{I/j@ӫa7_tnr!lw825ι|E> &}Tʣo Ll^쪔)yaT)—̄*ٝBnCT򉝶{̘MKz-H`FGd˿/ Cg/ᢘAޚtU΃-QX͒㰹W䐟J7m=VZlt9ɩn' PҙЁcG7o\0d mmf9w,/w> <=,.mKx J"p\vz@^+}xO ZM()j/P~%EjM/M+h]#aJoseԒThWz3`} dWٳrl .MqǭPY}RKD_ KRQpP6]aQ|Mf ^@Wq3D/p"M-&_\jIb "ĉ w`C 0 IɳQloWݾsja|| ԙ3cyi )ۙgvaZS4X!WV;і ``oۣ\Cʫ#bb$hJdBb2[ AL;ʛw6^ ")3*5ѺK\! }\xHxIt+ЎFiűFPhK1IKbXm]WVҹAHAǿ`Iy_8oR,6KdYwo7Lbp[ +PCp૽4;msy3TL^UWר)Vzo_]%"ʹ[n}BnԦ١PVEnwa;ߌ^@8g SQ!I Y5AE@FY &E{m'MK{]VE"٠?6RDiI9X5il;]cVmOe8Zxl.Ty7(Ng-٠̒DE5 (6uUp}iR%YРt(F&(ݘ6 M р*et7A"2,Dȵsn rƑ`ط|67QO̝־\/N2 EqĺUG<&mYZ<_sgs5XS:;?HCG*^+j~/4(27C8 Hgmh3xf(`^U! ٹIB2 %.xX"OX0VCO+Q x8\:>pFVU,r KnI~"NE'=7JWiD;Y3ȜOZS3"&-_ywjF+MY#Q_9_=?_]0 IR/B 쾣KH'}|U=%\> -ˢG,mbkLo:KW!͓W|;FYdqwؘ%zz] ;hWnAaFt݋[H:)lj NOER*RMOm@n6XjZ:z)*Fls [(iFX6k RF}j;9oAFRtcª\|W5H 'W˔L+_kY8\ بXE$d3~_z(DCorJo y 3}I 2rhe|K*"dnYֈnJXLD܊ʶ3Yإ=ΙbWL7<(QSPǁ=\C&j6}&G=1u`ݭ'1D¤ҲI׻>MoYm{6U ^ =fRǖTuev!H~̒=8S DF F{SnuYWj-, By`>Cd:'=:vOBL ~Dl"nP(5y07>!#'Ek{x&q~ pʅWL8׿1a]F$ Io\gvEv*ayǥ;s"F"ķ3f#ULxt oޙ&& x4zc6C`yxE /ԅHSM /ŌQt54()L>-=,iY`,,Ba:b߆K;TxjΧ"-^X CRlO0G%8v 0`W3h?O+\[m& _FBX2AH?7/G! 15 .tl"AHLV]; y|noF~q[>.}]_t% i  [$V=h9 b).jμ%mʌ; c G}Uj_xZ+NPЋB}D~ cؙRUiViM|3'b'T2 !8Q yIYRп%1ͳVkգOܕ4go ` So¬N2Q`ihRaƨwⰀW!!dp.mlx q8N6I@um;%q[QgjUnP=뇛1Qs&\~"&[k&6'չt]h":hvyNqx' =Lw\4:y5c E Z<i ˕>SQ%2_vHIBȃw:tq,Dku488J;5j~FJ0N<_X$Zs@{"ȈD̈L2kD_3[S@_e{|yLgH郵,^Q0J~nD a?C9 '*=&v'+۹ {kRF5aKA~RE̱ 3C=Dݘ3VoBWY5uop,˦/ Dr۾EC'zA:=eGӢ(1㿮eW{j }'7#bx)$h0Wjw`=s}f|J ~M 9,(KNs`L۳C,k:+&u{uIɶQ?k>dmdNiE1lzRٚE/T+ƪ@V.QM=d{W*kU|" ^iijn>`EQOvvxs5*bxk؜pzHfbkH6~k +_h2iCRYpuj cPBB3Z*}|'p"Bb{- EWmR[ZS;'b3صQviXc>]Ph@bAZ1_Z9KѤ.[kE1CȄ"ț_̜` Z ξ0I)gϪIYqb;Q')/ch gȝHcE;NK|),.…`L}9q>b/yB]օ*WdQ^q+0z >hASE.D1PNI7` }Xl{Kg auM+ UEOhF?x7A]j $K֚[i[7ŭ/M;oنt,R*IB&c/DZN ]OiQm@}YW?TxP p'~odox &&5u6C,  HhT VT9XF\8'sIph&V'.SqNjW;uߙ{qKMv8-?>\Q(BG!tRB9dIzaM]~ޙQ M.eNjFNiTw9K|ŕWP1@ĭd"X^cS^R1u)ݓe^:Gq}F@OGV@ⲴM57-P˗HX |pzHd |:EZlBen >]`3`="O]־z6[BPoHKSK"_b'AyD|sC_]F!Kpxp]x$猌U5"_judx~-P.w6ί2*ms=-ۧGG"lLj1(6Da G7~@ T/i!f(srKsFN-SnM_O)^i 'wu/N$Qͪq$E m?1`ϞE>S\Nӛ. 5؂ڤq,:uk@MgK*kI##~S^vw1|J(Ye&Ϥ; X{L[nX!Wzo3s$WBK+Y^*牻lF'}Lw.ыg91-|,[mP.u&0L#c5<$e m4^]@p;vJh!r')*2yҊ"d`W_LcpO!0RΔ $U9-]2&Jn@t݃!τ`FU!{-=giuHA{m_ ]ͦKoya$랫IjcPNZJ9nKKN!ۧ;v>SOe|:(!U֚tn""s쭺V6&:L!ML6>A61JU Yכfo*LP4QȤuҮ[$KG˰1MX~~&Ioܼwi>hӟs :6-+v%휆5fn:yx1O … g>?L_I^4X޴nѝ"V\y]a{]+B9ZGbf?r=^Sj@M,VEe 5ja/Cz%3Q˸mA& K0 7qzhfn# 0?o1ք6g}eZ[EkM.vAB:>NKgXut!h H#L|C%=N^(= 44|Jvz{ iK֫P ^z)Ai gW:#Gl?xE:V[I$~!!9^u BH|Ve^'> h0ұJmTwsPxE>[LRK uזly(Ilw^v̝Sz6 Iu3,/2Dk)%#|`)v9!ܸ%:Gfk:mdL}@' v3 $#3++Zye&!"s4tj@f}<_YhV,|[|0(H%S6<{PSTPz$Uc?ISLI_S(&P',ZAMi}ۃ ɑ<@Q񫠥3]8v셃s7Mh9jl_5]BYhF.ofE~^_Ie#* 1ڵ:lƛ6̡dJ%ieqx\׷9Ԃi+;`u%LD FȎm`c^9oq"t[ŊSs>"M>*7C>.Oo޲A:,(QNxm>a/"{#BY6Q'O T=G0GV`ObKS4}rܩ??]>cCh ˱.[!m\ɓZb΃] $!WG-jPiBE(W1C'PzsaS U 2~1'[joOD鿸.EHq:/׵d$_Ǽ8Dh aΈ <ⓞ@wyɲ x>w{5|F'5 A f\B`kf7fVW.0+?5><,4I+Ȇ9D93 ALiIټxм&=Is <#,efLWAT~<6_fNk2|l{$5Luku䁒-0ʮК9ŶftR06w$$ ++҉O:$-z+S(pl,53?eH #\ |])jcP)ߖM2l'}oW<|Mp7  Nb>N\ ?nt0'c&%1 Ѣ64#?T; sK oJxRU{X`x~]`.}#7jړV()]Ƞn%(QyrK9HQP`H 4wlNHʅCrww[Ł^E=tr+ݸ6Fȥ؇5l/>dXp Vi_\Iir&R_w@ȸFvFQzE9.qwJ޷d]HϪS1 7|@~Lq&E4qxևDYdj^ M+R#S??&8Ԝ^Ocp GNcG'-uq%Gyܦ3~<׻G"[(|&_X=Q)!M.wn_c-0.n9qIw~U;1 ojWՉQkHygNdA*RοoQeA.܋ZKX.qya %Ӗڲ#"{6} t85,"<~LEDr}VOy)@q[1ɉH/;ãnׯU 8KsMK0`o}OC"Y^V,iCJqJ2(*U4rIo9re2>U$l,cy1d,uIڧΰeċ}5Aά!uV)iv:"a 'ICeYBub=ہjS&6 TW{Xψ*#\ tZvj M= bE2u%*^^dm)(Uʅ4 g|rN!N4=x$NV踇 A}F`u?*UݼLTۑV::SIҕ{]ǥv5_I=A!E uuƠ@Pkn ;Nû$2@ˣ.M0vЍȖK)ַ_=5/:k*7lb4 ЉJʊ5aR홨ԥuCx@?$~e7gyx`(AĻblHzP<JM _yk't.6ߠ iڐ :"S2EkD6`1TEǸi)!#F(~֐ ] S8:faPC_ .Y9-bk!%3(yNy7ލ1lj&bޢ7iixW]Ƶ6E%|˧\ ,Nn`DBr}Bf{ƜuJ-$L>+Khx:yD>5LY?#ΔL[PxiY٪HR[́[713o+ \[zY#I2S(<|<rE3yRJfX πeY AxW `t<ˇyl@s2/n[BY}qwc`k?Ԙ/,$KGwxJ=f7sVJ_YQ p8vY`4xS^@g3Ս. J6~j1ctךO-hIm<@9h PhJ,~;t닾>!BP2yU0V~fz#s.Tk/A;@1%7_0 5WF~#A#yOR-q\U9B>R~Ui#*x}P٨u 3TsAwt7jjHNu^)uV l\[^o>t- EunIO%2wh^iR[toTAۭЙ-xؾ(O'SN80 *<ů.){$rYk=sy[Ί+X@xw˽S+Ķ_.|L;FW*4C~IFNTɼt_dGE-z`fw`8fj\C:@ԣb9L|2Pni7q VmPj5oˆaeze}4Ť b[ha!)W߹QZx5gXH= 6**' G,DC.O2Uk2IefGV,(Ji8*}[tMZqL3Li5=IzVۣl =\[P;\!3!ɍ ͚L'oU2:p񑡑?A,fO={C]؀ɭ C҂`GN">=U1 }d[ Ծd-.W)/}Qhqh|>m=^qY Cu# ꡨYe 3_S o ccu^XQ" aإX{1apڊM0h>!Yv6v#7ӻ:srb`\: CWmYQdטCkT͙`oH3k*X!J9#`4M(` x>&pDPG ߖpS[G72NW7<oF$={di%QEjogBd~r@`yT-]3MıR-JaEiVHLFM'cIP(lV^qwI.~'o M.o} ɼJ Ksd!ȳ):qԗ $EQ[^]COcaeN?*BK6h[ʿ6Vȩ{q aXu3[ O>\Qx$ xp7bcRQTYeD>ݖR4YƖbڽ|sI[i5. PnRBrmN0ɋɰH/Cl (*v ^~;M uBɘUќwD01_Uwvpy7 Jw-e}kUR*\Ħf:Eܐei/ M4Kdb5ǕO= "p}"qm8j'bhT¸FyJ iQhi Z#я.I H(tsMYV DAq:4 FT] ,bk&$NڑG=K(H gPt7*3au'̷^MT6}k-5y[EST c]¥g"o|f):cu]1GgV4|ퟂK :|x?`CBW,4^̶ Pe IazzU9L_,ԓ'+HBmeXoamjis(^fZ ?tKMsCh!Hҙ#mbTV =%`ǔ)Pʚ?MBX&BDߔ`c10DL~\B-xO%eHseZBAC v[#Mx2c5f1:D٦iл18mrܝ7!$@co$bЪm_sayB$&=Qn*<%4b:+sëzlamoeq4PsE.!(0_?0p2 wq \+2Zc蛈a _ /2C̐Jtc&I\UhFW",?{JE;j"6UΆ|ӷ)pV0M잗g])u-YP8\gKZ 9k='xM1va2Q #6l񍑄}tK'|K7ك5H6MMw@):C8{(~mRqc#+Y+LÉ'&K/pկ̝t_%w;[ujF!P{ p8WƔ&;L (̕ƣD\C"ц.-/%>Z[/ZRCvڰ]%=ʨC@[[VLzyg‰i ceŶX Jk=٘0$}(A3ӡf Vkp4bX Cg ׳{HQdݑt^TZӺXI]ZM\7:udn :ngQے#1sT=C6c<Fhؠ׊{Eq)5GvTˢ=%b7Hls(|!h%Hx*;hX7n✛S- L h<HCKJ >8}e{.ިCYV"(%)ҥ[ScKq5:bXF^&j.iW8j]kzbq>W;aZx7%^~:@Ƞ&!t 'O G^rh ʅNP Al5E2atx5b^Hsm|ÉdJ4{ 5);זa?m_:ݧ%'c"vxK0>'yFL=)PϿ:tbaR9-vRKyw 1KWʌ5> 2cr uH99՝(^Ha)3CZ.'3ңC- +`Z=˜̲T.*k5p`W?"w9(y7 |c, u¾;(D+Wa`!i!N#`ҝR6B#Fi7⩼mj2Ioa@I9gu'B9W\ez.2ä\:S2 4 Zc*6%'r/7zѪ5J43R.1u8ܨs[KM*7o39uD+OؓߙK[I$,>޵F;>){Y r1rSnQMU:& dEv >-sThxaswH^uNRMSpgXU2ʢ8dk`<wHiɸa*Ƚ.C?ON>1F6}ADQe 7}gjGb-=~sGꕉDjٕBy7q^ҥp(A@~t~x0(Sel!^);mͦ;;mYc}εԜV`&BWnF"¬xMڵ =o1gMo?.`ٞ/;pBݥcIv& -;cJ,L!TU?WCغ~T:\CI^ -<ݪϊmofƏ0DߊOW*͇+D|N(+NY/:]:-48; \Շp}L$ᓰah89ucFf0|},^M2nk'3tdDNd]FYQ^^{9[ǙpX (`gVg6ҍ8A `C(%>H􉏂Sul Fb]|om*C)nOͨuJt:cDlQHU_o<ڌ8] FW\t.N9F|Zƶ&JAs |ڿھZ}(}(Ο>:֓\H,ьY:t-MMH25u ւݵ;n5M&,u lס3S[%0<o ZGEheD`) o_#Lڐ(]A&idT> t5jHbp1傪{l-d4)=(Tq٩Ⱦe_zكZǴV̓.DD`>׫:Tx,XMu!| j|_ЪiFbkէw6*x+Xw-ngpIh3Í̂L^#K)bk;ULkǎv:sU, C؆Ñ?;3`KVF:eBVAevƞ` ;4 &:q@hd 5jP? 0q5aNḳ38z쓧_B9'lԥ}%G 盤B>Y$D*<.|/[6Szmj%?,U<&%޵Bށݗa|e)K]YM_xt:4\\>bPmԳqQǴR%@oFDk'aOh|L[('T0oa'mZB+̣=/ [Wl.AqhU'+6E͓&QԤ?!,sb%TЮA@KU$4@"56dSOwc!=rC1Ql4{B?..TZ_ov`Yyk$SzXܕv3.&j@T'І+xQ(~'gtO! Dt6w+%dEEj(;9J7Y S4|}xO? 0mFMw?ͧ TU-:顠.,h:ce[v,6w.V9{0EbH\NmFD+?YUQ)yVQ;x&؇װd9 0o0n)cU@YM8 ??҃7V( ~nx:чTtb Ψr)VT9X늀/ߢE;gh`pST BvpO 5 &zz#weFGu29TCbn J-dz1Nq6%f{(4YT 2է|x* Z/{R R0R>U:CWOiPbcaZ@sVubԡ3ɜJBFow,3A?$~G-ARXHQpvEQkʩDzEp^n6`)Tg_1fs? y0~:#0ԅ SZt%AزٶTsj:<QpB#b$ K-|MbwIIw4oLs ,;:˥ Cl [Uxvm㟏ò̺bciaP[j"uzWܚ cmNQL=[0Y |[va8֤g1s/k8=1]p9/++0.p[=bZ^(FSb*LsE})z{6I[{6v2"cCiMf/u"F$Bs (HAIe+)LnXUαM+f<1ƨn`\.0:ÙKٿ D`ZR}IbO^$ ޺m[+;fp"&yt+?1I䭕eK#K|AKHT+.^j$Q!q%~0E/Ii2 4@!yǷ}2b;wp#%jYěՈW#w&L੣(nl0DF@z׉4] v`12*6"L}ٓ`j98ٺ8 `ZK^t;ECh=7jVGXskg>*4i04oۃ@HNgD)Xd<D^8a"`&>J4JO8J^'R($AzM0Q$M|vSJ,ƜoijJ;iٱ"䤥{LLv<,[,tk)SIŸg 8g},ߣGo.5J.jZ,l1B&>gr}O̯8&!b5:p2S+]F'D+;XO'C5dU  -0!QӬzGsi'J*B_T+'JXwxJ67'}:K3睉GewIu/$iϊ&RY4 #.NjiA~#*w T+6z9$tCls^dCII/աk+0<5 ΓȸLy?@7U =eAnh.P|m_ҁ "A]E޹EGy A6`JmYat5ot~wfF&3KxEQsRj*6ۈ< v'W"NFLu0)uD9b&t?0?qd&a! k+]a H1# eYo ||c̮8r bhk&Umzηem[KlLDxV|HO{hZn7/UTH %]5 u}5Db 6pH'!$,h*,h05ӹD'IXn^V?ToMC3~Gjhz}z%%0WY| aagHDØĭ6߶)qUn)(z#OXL6h翱)PDѼZyԴccHUwOG]]OEzxccǶ u ejLo1 0~_ثfmeZE0qNI/ jzj0w }CI(Ԋhg>r"ZltߊP &Ca[s'.Y`kThwY&{FcNfU&XD2"bɶ qe4b Ra`aZ7&ցuvQT$ *n r4̩ڠ5 e IkjHFT)l '5yb r<ӄA862%! w99_tܧl w(KȎYgHkT:3ZExFGI a[ Y@MpPЊP;dq`*J*ػ> P@NO?vXw Hg*_qS=sR"=mct(?Vԁi= ưI`Bl ~G;g*.bfiM,U7wc~6lv%vR+tAthHhOF3D]dž{sf4]BdJd[OA b Y*0Y%e=lזW4LR\Et3U%SBQM|u$/!JkCfiH}T2Aµ0m&~O*x˹}mK~,Ui iʌ=qVԼRm{m2_8QhYgeBMHzHis3/r_͞m"FPAWpF2ۏ/uMӓe co19D9QO q*dK(bq0W&Sl "} YO۠ ޵ɭTuI"}gJ\Ԑu |&Nb S=r1sբFĠdūi=cW,R-bJmUq aF\i!Ў`|~D1^w7o||%zBArd6!-(@ h^!Ynf޶f':mHorC%VYʱ8:VPGv~:A*A7iSza  4$òo==))=ًZ%3Inہ$*Vd<>݁>/>f}a7.Fˣj| J Pz CzL+\d,K߽$vY@}j↹pT'ff;a!3!LTqso<ܐլm!dc_UI@&5${Ǔ-kS]]M>]RGQ&js/ɗw/sy yAit֐fuɐ7nYO#/VQ5]_dtNrgt^MԵ7;E/ cNf60L*9YPUI1VKM l/uDL #b|N-}{uN3%_pB`2`^͞/^.l \WG r%b=JA{$kIeMfUtoå D¶Q3tH1ճ7vL~w dnF%8GaMMWaTۍEE6 Ҟ^H0j]-|XGia\jn6v-C\ӠF(erzpH'ݍ Fەqp[Ij@ w%sx趄G6qh2x&g"QޱAfZb3HVY_)8@&c*f) 'r9?gΥJl,iORT{e K竆Jỳ 6"mudt]tOԧ7c"گyDw,Ehh#p?MyL 0T0d|ڃ}VAeb9Ys#;ъd,:mBPPD_7_#`\ z%_;@tP}[S_K}y/WyzDLQ }D&Źfdsxx$*\\] 0-2yZՄ(=$PkU?OfX [q/vX݅>,'cۢ%C`))?ťrwK,ξzQFJ>c,m.N/jHIUj1jWdvL]ZlƁ;ITG5Iof֎V^^ \K|z҆]vrH&cǛR`NU=łքXRB5a|S^)y].%|dnxzd&(yD!Z|ln2.C{:VV ! o;aOqP:>8=ov?~*l)]Ɇ(k d1~~D1pb: yxDfuXܬ *VYtCu9. }Z++W{4<\VTCz6vsZlz5W2*e,ަüWm[Y(e\(i%/I C<;jOͿx+`pu܋oYBiyOIEIF !pR"µTtF_#DTm:KYj).= DyUIFk**vi,mfWe}?P2UK ǚ?2^@qbGPtۭHGdo\+vSG'hzPELIfaHR#ϥGqH?gWU<jؑNC-VrC0ih̟vwx[Awu),! ku;uXt%wxunfV>.r{ ZY zYꋐ߈ GEt4rIo*zbKʰZVf>(\`:qO/b MK-Dɭ'W|d.MAu s ճ1wpwouw̠ d mٌ+/=4u˜KvĐeí Dp'v20e9|>n!+łyW=Y6 =1 t|qAϤJH2IX;gidϹLlsձ{'d3G#ǀ+{JBTɠµ5cuܤsOF/s!Gi@ڕ;6iJ÷ å)`$zuo SdQ!3@Qftl.u>RgG3 μ3<>_B~cO ob5]X&^MMXU+V]O-9e;R& xǯJD/|M+>NFqFBHkۖ/_+=>" Ah=]d @g%&Fl3N'񞈒<4}zR[M]ЙHQfy!*l SW$KR/\FWDzlԇ;vK~ژSbjAVg2‡ǓHDk3j8o;IZ>x@ՠǸ6 y$4p{%j'.CQAKwVLfQa'd/|0KF<)f[@4{2FB\D;1{2)5B#}ms#/ 9>?3gDptU{=[;ԍɰb *(zـz`'"CS(ՇA#xb2@^O'K@lQ0gUu+la,c`ާ&@ʼnwAo~ XR[ ;AcxPG=C_/#K`hǒn7"»t߼ 4 8YLWO !H'jrk`jƗ/*Q;QDh] 3j즨cN$ǎ_fCR5jt:X!t+f^\tsDtZ&99u\41ig|iUzyLyP3<رH `ۯ=gOCA8 e^$+~RamH8hJpфki4:Y?Ղ7 n%fV,AAJ~=g't<$~~'h.]~2NLm&gӾܢlG>lWN(mLt{h7@m=M?@1 g#wn-¡y0Ps GRy%nwJyZ&.> 7r̉EڡA`!#{+NUmQwS U5Na'r@ʖ.W0[_DŽ.,j6q~h٧xƧ3u/lɀoONK|:M/[FQ.UֳF?Žmv@MdxJ2d(܀xwD^ ^)$pɼ@}@.IH&ED׌cnci2PۈuYFslz_@6_*AfrIVOوRg̟+wb O^I 'ͷĎM 3fPŲ H6p?iԃ>5\ %sQ((q~8F,-B xM jJ>YS<gmZ&5wt+>ޣ?-b;fZѼe{D:+,as 0SXazUH(4@hDH\)bV5+ &TX}@Ϋ?]e.$k*,: ` KhF(NiyLVyj3l)ù |`L߅[6Hx03E25>\ ̸O9pK@0&趓Ĺ8 {+Ɓ:hCzI:2 zVC[+Bk;9fDH(!QmT*9P\=(Rnd$EQSF3 S$z4сB4S}l=]NV_|'kc֩ ڻ1ОXݗ,_E xsEBe pDbBOM6)c^ x[S%4hmC* -;MM>:& %Ec5(-Ӊm 3Fp5g "-MzW;;d8=BIMQ$4qһZklՋ"c.,h4Zg Or=t) #fn8 ccPm -CSvYrXMu sP;"JFlUI&c"1=Ŷ4O!Ʊܝ`nbp0aZݷJU,ɒ 7;rԦY3j;Wr!}JP^YU+ч xJGX,%WغZsBxK [8 .e0?f98 ),RB\Ja)K5y{嚮H1!#waM} ,4C^. 21r;JDGU^nV|E贽d -ڹ~]BJXl ]})qwg-Ϙ'FoL+U^DԁHh!in?z*[֟Ug˪WFRf P%),(?xkU=j)ܞ׺ zʶl8뽵=fRLbd\Y *pV.p7x,e#ozNX-pAӒQ29 ,T,XEbJsnOcջ`\ OrCg@3-euW2!3sT`"9trz"v;zGˈw?XgrmlJӰ'|T7U:!Ҵ *ݓGv\ʲ_A2VHnsҍ;Jkו"h+{G1x>7ʱe]q2_E@5J,pJ $௛C겟?$gCoݖ4p-}YFEB>׷ 3SBFSɉ i L;OͯMBʹyߩLkV0nl*gKɥ%LtnOGwF/ul*B.O[$شm('"YNGG|QFȻGsN =xK?~ߗGDR/O٢L](VkI71nQ0f8aVZ|*"imn뇹fZ%5";0vx׹ jE<|/J4xzO<5wmFtCt{O@|Tzt ͮ5̟\}J:g*s=˻DR!Ѽ }.H– g cMh[٢{B6Fёq*Zo9%|~@"6J*u?x]>`wJUZ(';q: 1o ؓ?R2t<ՄQZ].ZOb\X.~jlyU_6!>T+W G)' Ym#H8*O7QGOvx6·2z>Q Ar dpd%tB ~+C򏳇M_όN,%flU]t\nojQ8NRA>f̑oKFZfvq7Ӳx"]ܚl=(>!EiFE @#bC] (?G@f2D[x"ӂڊncgWKJǫb)zW~Fb} k` uvp|Fܖ3F`M41+>Գq-oOD3fH>F3ׁ'OB0h1m9߀Pɓ$˾=֜6%fBn, RD/[9{uޔ9c0(w`,~x@-I/zΏ)9]zIKUڹe@ۡ5LR5RvCkR$R0 3R<ÄE }@O}C!pr?az lOnh_ NXl5 4BS~sBG߇8k&VuHR݋q/_oS _S1)caıc"3 sޔXMoW)K]i4k_L N3nij2R-0_}s BVa9*p2 Lmh/7Pɦ[uk}p#.AxI~(tVǩr4C;M$ 8_|ɿFkV&bRO.O"69x5ڻ&q1,kpX?5ʶT'߮Owcλj\*f5knUf+30T Cs| 7CHln )W, ?L߻*]B2@K15 AΝ_ߨYvmpӧVR_Vۑ699i╈Ϣ"A M}L "`NG^Ø?)M;%vZ"jx\&!fu tǸ}Q ,u]3cnhFwZPwxzܑoZ k?ƥNcsӈqFږ6r9T?sU=-j Pp P}v >;.sKc$g#h? 2 Zb^ I4YA#\FV9^[P6&We9"-i%Q&]N 8P_!!~a NDF> It\0l8qEH,%wEN F?K3Y q<.{qt؝+nWCJ;W%CνP/{r%^Gv1Xo*83Ek:6KN{*}!Vk[n7vBh|1d|>0Qb ћ1]2`ziQCʑ@86!xS;,) f_fSYOq-kֲ*pLI=0?\7ĢJq F=Za *I\*T;*Z1۲Y/ù9y12bOo-Hu^M0bxrMУQҗ'h:۽6d? ,ˆֳ2&ZY0V+lN2waŊډzJ7#2f1+<*:όaјIxyU|wᥴ7)S/BË:r |~mV-L^C fv^`J6z#Vg.U}t{(edz7Jxt A,#',2&ӄ!|2)Ϳ qYPGGxJhp'lȒ\X3e1̵@8hv)?516M*NO=$5Dh( e ~Lь5*}o, SE{Gx'W೴"Ti'w./zljɎ`643hM3 FU'/nО TwsS%j^2r Q gBFpW?B]z5|t%˲?8v^!?M:*>lDʓ9>g{亞 p6}VĨs'v.N~V:~@>?[S,EjDkbTdc&ym#Hpu$߰kI=) MմP{5^ar@rAte1!rM ہ\-: bfK\÷6{x `/$@S#]DМN&+ﱯi#(LRGz6|I@QUzMLJW[*K36(&@ dO9P*L}J~2TuQXl>5ćCjπ9 oHn󭕳*Si@qf]]z[e+C2J=d nVCBdOm*1*MzʠᗚT,JOi=$2+#v77loU1WL:^iP|:񖓆%hj<([>o>dCnfplz#(|:8YzLo,AkfJߛ;Z9et'{&{f:i .^0O `(5k 3]d'(e%e-wO%`uKHsd3nw ZA1d3>4QMU\V~_TYL Ų>X[/H~ x%a4B.ξ`ϡ"[="Uč✕`GYJ~%bg(|7H~9R6's #:S->jLez(frGe9[/ 0DKH,<бrXn_WoΎ?eC1Q=zY0jy&,QiY,GBk`_ ".ɼrGm%MւaB~|ޖS fYACC-t-ج(`dK¢k/.!f|_CE-V!ARg p0dg ǝl@ʇgSh溶'0gMVP 0eTֱK[!`0R$W&EMt6ʯ"B %oQF!,Rs]-/ <*2jΰjF=,Z&Aݫ1)NڨFz$hc2aI^ :IrHükɓ(0zkAM+e$PQ}u!f|zWȰ,n3ڰH .ɕJq9|A?oBD-I.j"@L<$Aq3-̽, Cjǻs~ e2WWzT_mN@71g=?Ɉa9Y .(HKav˗2N[GC;Y14BK !kMZc^(uY8 d >I_:+}eʘ&_+S5]`BBQM?kjTOc]=@1^Ey.ŞŒPtJ!fI4٪@*+ܦa$焑mlXpŶcw(dԁ)X k/%ޘ,7wN-X?C!?qM{SțcNFt1^bz{gX34@m=9TReaUTLJ77!Z,QN1XṼ c4Q` oju",Dˡ*0Nh?]psux,>Mm @?֝_ ڱ>x7  jLT?[+]GjbtRm2}wC{%0ț.wLd3å]YҔ5RP }抁}ؗ!>l:`\]x1ʰK/+U   Ge;y;iQvc_uv`qQԭW"w1 -#NSʙTz9>Yl݊t@;g3P?m=C{,#Ȟu1<6$7?P'7z*{mLuJcᬈ5s=[j7b\D ȏ:O}Oc44HdDsiҊ G;x&S =v>N0dTBs;Xzۑg;FhfD)9‚m4g,0 eʏ)YUQÐs*T|iXfx9yGP.?Nȸ.g-'XwB35 kmђHMB39(ˢMT )r`Jzq]y :|%D(Mha{ÕPg?p,HXmiew2c!s18_~Ϸ_l\吞IEyt_3Úk(el_8)&(N+)E;9Ե%|~*jS"zNlcy<|"E<[$o$71%jCX:U%ȏ#&)Gw (VGJh'_be306̢/ٴ#g iPM-Dsxd>/XkÉݻgKrW*iBR ;ASYJ .!@n6Llcz l/ߓA.@'/hq&C `h6`R6,4bH/&ql [!//&cDy8ԕ9qpҟ%q`& JPmAU/.#tl2ߛ72i g@Ԧ*i17B}1[/GU eE:L= Lg4FgB` c^ kMdsK_w-P Vsd7c Fjk^p.-Bx{6⣈.Jm z7{~`Tɛ[r7pRwC%ӗ7:YtStϟ*XdP2ݞ~hjPc0u݀ȇьfNF}4v'f]b$T]qFfTnPzuwX#`433[/h5̥ŽKAɸ@2psI &b̈́v2'}KIqF i*Pt*.$Y~yJղz![4y!4 SA(_>x`e@4ػq?P.J8wnb\qL;^x==Zc_R"Ț04yWz7}2?G  qL :Rn8%= @kޕi2e9RmjLM_n[ϸ emmOMX Əz&ks/{2Fҧ&DoI{c"!TXcW> DAݳRC0F_܏X$'kLu5L4QJ2Dz`bo\:28ZCR'~gn1j$Yn{ x &/^[.C< SB. _ VW Z(d.?l_}[}+͘l 30e ^uLv~lUwyx0wߏ4Z-D+DbPݳlI`ysGG)o09o]i|f&L $TPlݤ7,c1H<>/t$M}s2Ǹpom"C|Y1 L)6Cg *b9OohuDҦg;x#:mEYM&{=,(<I%CX,Ͱȧ#R!&#ns}i| =_pݜc ih%e@hkdB}q.F%$<$qD\i Y6H?7ܯŸmJ6(K9w'HQư# !9Ar}Caq`Gھ4",FaC&9/L`i7F\zMl?5SnB\sA{85,CDo|},*f$QzI[tVI^H??CN~#:|x9PE qqC@3#=[KbMI ;}-0-2̓Ħ:w+سW5die|_+QH#ŏ{V;s7P)sqHH~.M>:}_Hc:fE,Fڤ17q/Gw l&kg s&J֪z+ZϊG#cm'&lHS3>et=_68J2 KP6_\aLaM{I[g׋wIXU\=5+v.Dc롪 ;[}&FaN~(.(2ECP3xXDae&Bt~+A(D tmpt!^f3^X[)?:Vgz9%(eT]FeQ oTwѵD\|uhxk0]\w;Zhs(eb(r9VG\h& Vj棕,]Dwms} ~7]zK5Ou'qeD**$[ ۑ;ٜU:-JsW@sJRntFD}ɫhasvx6بYܜyn]=CTgՙA%ڔi^g_z|Im#_',iڤw$g] ߴe .Wq%J-40l|dߍ' Mڱ~Qߔ$2uzJrcߏ}aݭu/4ˉ@?nnٜ8z6(*ߚdh Q>U#c^]A= Ypp\wasOQ$ZWu Ho;wW r3'0 ԌY'{{9cf5r Jb^W,.ßC2(8)hvTؠ1-'v[H>eUBgtb~sF a1=/;ߦԪvB K)~5AĖ!zt6=c,c/9~K^fxt0_b[tV-_Apі=w֞ǼH7x]na8'7^e%|@yJPz;h0,S~k1vekzU=:}P12_R=(9:,Ɏꟽj Zu i7_֏:'nX][vTc/<,xajzjk֘3W $Ǩ!FAI>p p~kƲe>ٮC=r-ӡgv2lE6O;t(>zN5^Ha -ra1:LR0ͩ:&BMRq𹚊Dng)aS})pB> NOw pJBI)K3id[h" ˀp]jxʻGLsjZ 5[$vYGCC%8W2-:-=`8%XjeRF6=v&#aaTNv1Ve撚;qyG"ѻ7H'Q8aO1< 2E" i@'.S&)ˬCA#-;=19֧,>ןPª7Ĝ8 يoɐ={D0%u4xQ)r@gw[iT::B؂ݜ eqL#@8UBQaGX4 8EЗ{F P af 2Ai3m!PFS7*Lx(KF 3]A PD{ .|3ViJhUNGO&Bjr_$s'm_XʒWs_9DM9Gc;rW8ۡ Cݼq!`NuOeHcͮ-cܜ1ҞK7{.m"[HwrdHrGR],Q}Y {"jPU`4c*ҐLeO>|QpĺF0#k%þɜ;d85Pv7֋d @j ttgjWYG6F2{DleX#IAՄTnjd#[MP=>"suEvDž3LR~L:o.[:~1݈t6P&cy+`%Q%RsTt:kgEWmXAPEtUo%{A<]vsk`!fN v3⬣ḣ-!+ ӁR^xWN23m=BLW5D v *KiVHo5nzD)3-}Ic)tl~_|$yQFhTo B<%::wl8Ԥ( X/~JA 6T4\#43Ӆ|$~`('@'AӠ &HbܞLնHuP36[92/R2}Rpym懷2j['=yInFw^44ۥ̿_xpWQp&PI5w)B@9h6JBx(VCBT uB t2DRQA vEEKYȋ4ó'\xvɝ<QM0ՈuĐo 6.WwRdkoL׸Y&Xe3A["W!%y?̊.TQS$.n֧=٨W%7mIH)\yh,fW'G:VT_tΜAj {u%-ܼ\03IiWRD,#__2*briW|WɠVͭɅ>5K_vmundk`J舧an,Ǫhh9:QW ]5b9r7_S> Li\Q}X.2|gp6ù[R3h;%by(* j\@>iV[Ll%79ͧ +`#Ԕz|!ku=:$5sjZ/ر H]7v欚5853gg݉2bE-(ebh@c\7޼<2Uuqj`,`3mV4.͑ƃ0?@.Q,ڨf_#CZU(lm8_KW˫ҝ7L YƖd/˦Ä"S͐g@#CGJl㭲} hٱڈlL]`↟8`'1x,g`Zz5fqt΋:֞yiu؞:8=M]|VW70ȐP$;<4хr''"7-zqpD(%[֮WҬƻk8}Vd[\J XvQ9U[9`-2we <ҙk)ƦiqB s UQ%6?uH6usuoD,yɷ+mԸ?:\vyԣw3,ws=ַ= 7zIpguyyD])3DcuI.IWNGD* 6+!`F+atT_h?AH3;Y"eO:*=@S%}SUPXQ!KdG``udn"](d/ vj1YztrǀCU]5%ft9γ5@mFFlIhk:c2x+@FȨs{ .P$ͩuYF?-lEqx9^ 2̇ V¿uƯ? VoҶ# Ŭ@u!e{6u'>h`CW7:..qY+{^H*ة4d֛ne`ɌӣNlbV"hMgf_8M:詡4?scs]'?C֓_K䴵3[F A)<8{}QpPL΢Iu{bξgK%m7{iށKMtLyh ,H/7xXkky!{)\򽴗qn}C#_[^r ʹ|d@BƛA38u#6_-rW5 qa7DAg6G0S*2)e|bOTƗۙ2{wdas9{8 JqٷZ s= .Lk6 TaaWu`$mW{*1IߙwFګqB y _={#b oLij$)=EfH[Bѩ.s+8DzDf%> P/Rq]D+#~R0Gn:;wKP䳲4n!3} $ ]6QL/z \BMqku wCJmy-qɈ7c ^ӄkl]n3r ! eJ`1?Ff7 Ө6P@10ZV"Zw8 F 7WwK?e1BlldVzb {wfjĞA.L~">.M2$xK9tU-^FSd'BDKY~x9nÄ=08,'BۢT@zSF *,$džî ^;@ UK.`V0zjӗo נkvA '}[!~;( 燔/g15 w4uˈB\!F7 YIrm<#*s:Umb~4",& 0B<6k~B’,\--W؅bS;c}/l,xQZmg>P~vگ{amQU^f=?ug8YVv_W o$ㄹZ0Z FԚžĞ8G3&e3̵<xNAdWx7/@gloCGodUp6T}6D@gHH xqr@3w`dzʤ·,4s$:ZLDEKzz̑vt:O?RYsB$]ܲ~" !筷C?/]~yhiɮ|bvUKET\y&3{T-S:Y|+T  y YsN ײ' k"~6S)K;aMD݆Z.3! 3m 8[x>[?ɒޓ}O7[.|>z70hgn\V lck&z*Kޠ?CY7j~LN!e+mD089L~;Y.*),]I"_]i!Z|1a'eM#M*|ӵ"EۣhVqUV# #J CuamkЃml#ɼ!н{yqPJaDEJCI A7X9)2v6Jk۞ Z97|i4(|I~w"[=JgQ|U 6aǰ!-[og=`ilSu/_wJIP"L嫶6]IRsמ]mt n:sNunp0唒Hhꍊ"W=l'NIuXk>7%3Lɒ}؟n3w;p캘Z,߁ f=VrGy DQ( " F^f0n7Y\8c^ 9y_Ď>%\)x#D;N64WtXԵALVR Jܶ"+S}Btf$$ -&,H]L], fGY5fC!,l`UM]`>"nJh]`۩ܮoQʄqq Q=֒η,՝|m+kD0oBT8[fֱIط_ E_Sr! j0ά> Z;QO-j1"uOZĦ=\Mn$,@5-ctna.w5O a :)G~؉I喻\EgmwgKn~J6̧ØATɡ#y9bUuxKi5Ž =x9|&&BXKOer Xmc{1?wLRSQٮ]aIZ=UALB#KH7ˬJP@>{¡pώ&# O/ eC.qC:9ʳ&\n){?HblģP rU~ pQ&~y-cAdʹT 2zˁQQ 60{n }B.PiF@ $a}@`޴&]6I"8Z~L `A N滑 huS6wűޚTbZ c!" >~f7F? cC JU?X?bJt[H_PZa_cA< g6j6H?8(Y /)/yB.|S{0WIgw-UpO{^kYrf~g9PztVB0f`p.aj|1TiOGoY L FOd?u]$!_p'ұUloD&x5.6tHy|3]!Xd,RX1% E;3U_ec̿<6J{`#a+;c.S}SO+̴OFkG>%j臲G_Z̠\i8VTŰӞaPC{[KOâ_;6~4%m׾C#jtE/$F[Q:~%N"BB:UCy7y˓z]2q/'F:'3F|{PгaI9f8Dɏc" /"4#Kkfb)i}Pg9x @g҆_E`:lA^|0g7z65ڪ3Eu[<#;i Z#QÄ!uy (fVu7sFD[lD6EL!Uz}ֆˁm>e;k{Lxi*quR3HrЪj㿰>%r6&հ>=srR-On=$n2/A3쳴!‹="~ & "^AVWPoE${|Xnhrh=/EFأqk<&#3*t-E[ap? zey)exN ƬUUl(^x[r;'B!#4 +b53h\wPv ``詻/UV^~щAWMMda<($lfYݵ0v>c\jĀ]1Rx\ZzTRk-LVcj~ZD`Y䟻G٠^?ɜf`vA!7~^3D9R?ȣaG7Y\xkȃi*Fsn>!ˆ|nZr`7Yk- F{幆.!/Kڙx؇V3@|0u ĂoNj}FlkYȰ2u3cȡt_ GTK<`|@Պxhrx]B==ưmj*0LTv.! *f8|מ(wQ_A6݉aL(o(0Dx=dĄ tN;|1>wGylyGFU[;w}q?6tf MYs8ù8[@mMwhXĻ"Խ``",YzusB67EK;DzzLmWZ~;|/2W_{jCjo=?)@nSTVƜ\% }>F  4x&lV>h(QS*}uny]:n}zV AI{ 4ΜuSnG1WtX02uٰ^R.94 H ⴪n90͔u#%n?J?q>pQ튪0{Wp*nJv$6閧gE77.;-ŶR<9RθY 藰&Ē.'nPOF+WyQi 9{Tz ]LsB#]~X0LXn?pZ%Dm0x# C4Yj4a-|f^]M玢l| y2$JGQI$~ElE~ˇchZC4NECP2ѷ;-zYZ~^7hJ=iC&$D5X$_B6l9b.iVURHb*K>] @fRd EeLk^&ߝ>5{ /rHՆ4nS4a{ڏɠ0`.=H7/iq@n82RVU]ZmI1 P^_0e CcMO\W}8dQH7A YIR\e2kn/`QF/.ҁPp&!D[bTxPRKGUeNj`ax1EHWYy +˳7﷫a{~ip%htX\Gcin% ? #)󒚷KgdH}7ѡVBEtp<`" W؈@u+pvR75/G=)o㙴9',FxcePUYNJS5 #Lg^N;7.Vr)*A`"=/&_y0A)'a-]T^/eXތpdžC&6]D_@+h\81յDpzOM/H#1WZ 'a(4Q ǹoHDy"KLbDq;jN[xL%UGH]VR' =(&+3xCj:@D~v#|ڦEa3ƫ'="9,gG٦~ 6%%* h:b86ثv )yW9{K]z; h9;ÅFjFvB֜ѵV<sdXiY_*ibuc_A _}F)BӥBI^Gǥ;]XMDrʜT1c+3hK˾<6]t|DtH(E+ɤ Jc+eBq-XBa_m2yuE]ze{B,mɐ%j-Yn؄C7'gZV z  /%.DB:H^O0o,@ĴUE ?fxR0 ѩ Z*k[ٞ`YI|> z~I:ɘdf)V"ep6KڿCkUn.ݳFr;C}.a61_ Ep{I)XLe3xNYj,oY'ٟUٖd__%ɛ2$54P&Bav^PY\طJƩR:k{i-FQ]#c*LR2-)!xqQGhg u}qX d{g^iM̮^3LZWf[gduBST0nW&fZHmGWɈDөHg =pxTtaeDX?&HG cS`PaGG-&^!=~ِ&Vōu- */LG Q_΋Wr\&pK)DOpg,HَsFz$I_3R 80Gb4Ox=lv!{_1XgҡPcH$MZT" ?6ٍg}̀c U)5R!Ώm#iv8/LԌ@ }f>?yn%sqlA$$&7\h{d[44(P\2Af{3AXa Xk/$56Futݾ1prwr5?k,ND6YeM'u!cX~~tW$t: s5 U<ƝCJw~@rX<5+zW4FEsSl(Fdp-tO7 ۿb,41kĀ "FdOM; "'03 ͇ ̓ }c  {i, A_lNU:hP+7Q-w6q9nl劓OUe(˭@H}?Ul&~<?:RFw |Nm[(g8ܴ}4dԈ3>96VX0!c MAŬّj UI#Su3A˺E|VOG$x|ǃun}%̌x}ՂE.ŻnqdN `ww(| TX4нeifm =">X$4|EH;k *6uQHD 5zq[(k*P/ZF 1I#)Q'oL=kݑb!bNY| IMeejfDnByfCկ8*B§ls¾U MEghnQ A)"']f_$?8 @8|YP?* " *j晄& o(9ȴjq7(w!ؙe]X87AEAxRϓ}[ (%0Aw#9b}jE0E}!@U?>b;TO]X/tDPmɬ2 zafc׌Z7;􉱸-)NiM8Aj94*z,ǚr^OY%t ooq}9SpPHPq6f`9hX&+^fxb;xbmV!y.c"2<7csېcg'Lුlzٻy0N@ȓ.6;ʸLʃY$M}⮘'潖f2|}}]ߩ lk_9y41 ._Zˤ N 9+菉v! YDŽ/qT_۠%)Q}u']dAсͳY-EU}Ku6g \vUg D!zH(iB!v. .טUh g?{䫱'%nx;󓓞YO1戭`Ќwsyp9ViVcʭl#2FT_J*՚g rC~;/WQYv=>O  U q")q][/{Lgڔwը!JysU5lYӓ¼ >- z_Z0“/tU #9!zY (~5_@ îgшE6lG2V zz:ۘ1i o܍MvXNP,-;e~Τ=0-|f| f,J qӼzXzJ:4>y GjfXy"W;ۯl{ _?s^1ow\{9pխ?õj־mq"'wG|4zy9" <zϐ~CmӚ R \rٖ xެ]+m)|NN`49.M8]'| " 3#'޳ymNCzM畡I8XAcE,{E94>؍*e󩞺ˤ@Qk}J7:DoD5rbkCikYVj{t\ܤ2Cд I'3J~{?Z\,=pI@2Ԗ=Ґe77926Mb,xeT3L9.X %4B-8 潭c2뜆ʔp>1bt{nØYQVrP Wt6X,T}P7 #%3!hؒ<)(Yr˞Q_o BȍN*>ј۾hCJogq}9bB߮Qr8d^YG!P\f ti?=g6n5ޞep!!x/Jגξ5d U鑝&X2 r+v'<70-0Gﱏ(9 g5h|?5kyl]/ӹjqóǂ`7#D.N8x7xR5+w f)ol!>)B wO,=Ţ98xIܫ̒8׽) U!δk/v4b3(3(\=Y܁ͥnN-kn\-L"CzFKAb ?#V>/MY:0 z)IcF +\9[sO%¥ɥ;O),i'*v2';oGYOAkWF6VC$ohm~Nցj3EJH}:: cnC3nʵBp(Nfc!-S]+x6EIYd56+ ރZeS/Xb(P)DmR EŚYN U?*PW q4ǯWF#qٖO#`>&%"/B5o}rXL>_$ɟ,ݐp:Ty*Pa='ZbAJV\O&/6wI aIPGXsYP}u'%t5>}H{aH'5BJ=tDC Fq '-D1i^|ovIv/'*wloцH\2b-DQrk`Nɍ>Y;4(KϼIH>԰I2; qVBo5wٱDWZE-:v o;1g"@(o/o++8lLBvq;(؁ެ☽|"ЍCiiN!RfrQ%3sN-o^8*cfߓ7kK=I3j'Eړ4 E:b326-7o6K3Yq렛KO)xȄO}xq8:t:Q;U|mF-Ы8AhQ~X0ڕ{3,t?εütqOr- TI%MID;l˓ ;&8eIؤv!nN8氡רӤRfa7E,v?$TV 0Uֹ7Ti7*Ȼ%Lh͜mL(/b_Dz/gn5%!Πci]eњ7KBPCOAْM}yM,yJO21`K']mMD D~<_-rf]*@dUV7~;]38ɘgkA]haHSdi9 36&n2>nΔ <2GN1y0 E݈QVu k #zj%#7KB&rjH㛪VhU)EAbd%,VNSzZ{uQ^Wa`"U2T2)kӣAa-lVҋrxn攀>(+BRX$t/q cT{FN*`?9" iBVV>S7_rOFm].. }3@tܩ5mho6{e,1oҾ߉G'V%`NM\@UQʪ-Kĭ8Gt|kw25`pL} 9{>L 8s=i Gnd DPX c' EQy]XcP:훫d.xf8ayYj쟮Bc/H=EncaQ~T  'aF:nF(As'9C8ugX9#ݗN0\MAISp`y"V`p!SkNGCTaxAB_ň2=pZ],`SV,-eYimϚ m}af1 xhJ'`$L< 6jX:J 4cH#D$I -nN%)ʑ́Yxv₩_așmP9qG迮Eg`K0ϣ/l@A{UhwJ档փTx:;M܎Rf?H ;L3zոRݝ63 ԁ&)KwR)Pj4<6L҈ݔ ոu[/9 TxxӱfzÜ´&JF+KX>Rx[ް5j%:!o`ў7:MfhIT h5"N(9P"/M\ଭJSo:Vݰ%E;fUd-nkjP&v$,XU q+֑8tTQou6do#?f12EJLT8 :iXHEl=;.G S+Nzg:g.wH$t]0Gl\8jRlH̉Z6d[`?5 5ey6k-;-HS#m e?zhor#̤* PcG %=ܼ$bhd~z-H4xzgN)G-(c._xewzDD,M[ŴqA+cj6%Q}̓_'ƻ5ԚvLpjC.^жHDρFA."8FvN0SmW>[P/Y-1>,9'?i(E)w 6YfoL' x@]?%",.VRmK@tQ(+iU@Ȳ$c X!ucOZEb$RnxIl2~R)6`rw/)Š0Bm=Z#b¢ɬ p0^LXR&Bp־@B [ϳ~%W]"GanNN G'(2jռ fY5Pn} Jeг\~C>2g Ru\UHO/'?d׈VERGe*3Z'bMQe/$1IT˖Un*b`E~  y\#!#L]' *>B |*F?~_Ȫ~ɽV !s廓ȇFsJvCE)93?A[rT!o_ra6=JBѤ0o]$j%V[ڬq!2@>òB˄$$h1wO.91 98—|fjJS߯(zRۓ+,FI@;öƶ\ . vl+]pX͊:G+;Rͧm0cGh4Ɖ$@39+lQi=KUl}S˝Ҧ]^N$F0 `kEobT0\%#_n.)p/+Ibckzt|'H80L8­*tx ۬Ba'&$"no MSU=qK!\C憰5 Mo5֬<BczWfirgTp6Jx Q8$eLZ`@FeGU嚺5QY088]}){ Y)HB-:N_˫²S"^CǑVpK粬# fc s` M.W4_o_PR}F&wH_Њ6:>i8p lh!1}tvH?XBU|D-A = Q+>N/P|gB,A3^j@e9,S5m y)ۘ+a'm}$&5uσ)fNގ!0p`zҳA%yZ:z'4bs {Crv`yoR8<_n\o>fZC] _N Oc3u]xGfjtME$J2õaĖ@V'v+QR"ZA#VQkdIn { 9dSJ[HMe-Yx X-gQ7Ơ'&$TzDjtN(c4M3wswEO*Գ;.=hqݏrߜZ"bbg\oo Pw4+4'`;i iw!H@WX {T҉Hr Nw`y&Ь?Ҍ QbkӜcmJEWͭA i5lv;`d*-HBto}ޱLfm98Iw^%_h m zF/[GTcT8% uݥ( [*#WBj-glwnz{HitA@1C_'Â~]yaQA躽=7"O}-E/M(4pB"j'a/l.{^tV~-~vi>ǣ ul!Po.5M7,XӻR0cZgHܟQ{:xh۲!n}aͩWc?WY gIg4wZxF0S&}t 0i<6U l%,',Sq;p(Oh`JASlYYі)2h1#t@#yU,,4P8M_A|0j72+zaI9F:NR0Hu:g{rVL4(N,H4Q:>+U%E]5$0HutDg8 "=_= -I$c sA߉,[; g4(g${}S#+,wz+oeQm풀g]:B/d 8  BB?Yཥ/{;A7JQQeoD1}"DTm}Pn)ptg@1`G_va^ | "yɺJ^Ҁ;1{ N&˞UohMȹԳW$N.6VxPmJ花<EfoDCVޭ;Jp砐yP l?b0p4l~@Ǧ5.hh}Vo]3NXcʋeMQec6x^箛Ë53};4*( eGdJ_9z.,׍H׿?jPM_7Υ)=8)л77v$F5\̝І,%IG[JKo c3\[QUȍmL;"Ou R1]hӃ9"Eݫ8,_fJޢҿeÓ(޶|rujIXJ!־:pԌ#ڰ1ر P6x/Z"82UO9G2åh ]_#dBxK`^ 'Ȗӈ%B8f?f&M!alf+LmF&J-״JK@IzNgFM'ov*3 YlRW0 KO꿢;U &-]bǘ55GŸMҽ(Y=u:\ [x<}t7$&Ǒ`%kKS@^0n⨆x< &v2{¥$#Q8}s'*l5ġJ4luijV۾0 [Yw+5"C'0 &njbkη3A_f QYW<>Z=(ᆴqͺu0U=d\ ńTg!X% J. e J>\"X/p)`- ' _ӤC4.M(aT%5ӯ1Ŀ¥ m-wR//Ü/}MR?-6mTx&~ih]a鎏6ulC,3V`auTb@&A$ྠJ79]yDIX= "Ui5 y٩TcgIާK4Vi5ǒqEHE9x+иnH<Ŝj6 m]Eqz-4L-.W@HG$?`ϰq0C*-h^U)ئLuj &w>p8S%5Jo+89k"1E0@+I-LȈo%l+֔Zd"'Γdi0ΰ b`yoS󉳶 \"ULu/W~YEFeh\c#+Kvױg`6ci7XCõ+I"4/&O~}RE]l6*Mg٢ sfwf<)z{Ep^;(: Y\7.=D[<`4w]<=x3Q[-cd4..>x/;?Yjio)sߋAbv.Nu\ɞ6SM22In]H)= & 'Փ$J&PPލ_Qؿ0 Ij?.s?2v &< bLa`ך; _~yX;=;7$7'?288PpmZ^)`&bJI{OPDdl,=91$ $Dygn bJ猒Zy±ͫɄ,WKw6s>MF1Jr`y;R=?PK}z8YɂhwWIdstT]t>C 6@wykˊNN4by@1c΀u5/i7EBBՊxJըD+ Ge29za7Wŏ.JVl7Юfz!xr0}S#fw$_L5đײ5눞R4C[Cy̸ 3Nw (;n=(PwCH)+UGDQ/մRc6+#!1ZZ{]m3}3wR|26Dn WRآ0"JQ}{3W}&%+7 0'V:sxg)2̀s/t ۙxdF6fh@-y*D| <(3#9=;c;t=62Y5wbnqcܧh#+t%2~k`j"Wjfj~0hy\ kj;W)yvfyBp@P= ک#r".AFUR WUo9f&SC,}NZ Ly*G ant ^M)pWȟ-^r sH ƹFYՊ-f B煃*XsO/ԧސI@re9_~MO1<<hiޟ2yMy"! !yǔ4 } Y-vrKN傥6X׻Wwҫk$/2p5O&MϼҾ;Ad139Q2"nTAʟ-^ _@naؑ"*֛!r9/"F V (f[1AĞd?0e#IoCS;Ämq3] p4'EuE4 "垪*ћsf/m,`~tƒ+p(wJy#nYZHD&BI G /x9krD)ZTGюg]{$D҂U@ O4銘0N~uGƹ*g vUd)3:(]Oc2۴CyǶO͟|W՝\0F2ۋ4_|0J^9-Xoy9WX B_8$39'ST_V.nwYT1Yx{UO-fd<5/ ? H>a  %dmN#x!y=YbM [oɡng5e'1]7#tM-;cvDMKUaE̞sN9bdY៩3ʵZVvLY&iX ~?v"K!tRZ*ևO6!.B8r~G8;a=Ȯ%N~m*vx*V̰=[/$ʉ#U!9˃mEÈqх~n`8[-Cz+bcMUXY9q=Aic0Yi5T0= ׿ؘrlO3ZC}WAWNC29"$8zd}w3N? OܷaN WFG^sb}Ljt)&6c5%3B&ٹ[ ]gruiW\(<OM!i-thG-Ѽ4k U_D4hosǁ__#ɍ ~&a 'lzD52{g)v""Iزզ\ pUh*@к`!θR@'c~>/v?co?W,~#'nx:_\L!:dz#g_Q 8u󗈱1Z8]|Ȳ 2:vy2~Auh%{C>ꢬ,Q^_~<'7&~4Cau=e`]u,gd  ?7Cn:[vDO'F+,4X/+ztB*|U vHR9`FkQd&l C,USӭ SM}2"2۽_w*:/x`$=`}g"O/2s{_=J$#{J5=fĺ%ma+d1.+o[0J_6a*Fzf)-=M~iAV N6K4^b_@pW8ؽF_-k]&} ܓjE("7.L֙˦Hu)VUYU[h9yxV{6H0zcvWZ5~5<֊ LEP?[3[[`)ԾUcq0C@,gSuo)r T)`0 .m ndĺS)3!4=+#4 7pW&+̀75#x\*M^ߋl,逓Qs_e ZE(aq=VLPNw)wL2+$@n#26 %) 8RQW^[/^^$# 7Gټ7ĺi0b!u5d1A@昢':wOw͆8QZ1h=Ng Bؿ*N Rol݉/ Ya@ Ǽ2{ӕ"G:Etwr" oQ>?81 ws=Pz&;]f}aQj  ѓw&u7 \CÝaOe xr2 [iSgd i;3 xzQ|LhVQM]6cIO84MQg $ 7:Nj: vY=uᴔMk={"0\SsnG=(eQji鼯}ДBh.p+g͏!+'oa-( vhcOa+*(AS>F'v_Ӿ%7?j~Fq2g#' mbfY1vw DZރdO dE$}iwpҤhwL؅ c'zMcA2{dU[*OVRÚ, J"egOO/l_KDSiV3pK.|AbXƄƝK V9vnH=2VE"$Ώ(W~qtҸ5jGy{ΊW{ >cJA4Ё.Obah/fȏnE/ z2FmixEN .VT@d-U#!}ȭGp% I@8KHu 0q(k&8T39hRjV!Hb;QG&Ufxy 0U 3]X%Rf `Mp\x-^,~Q0;dx光 LlNku;}15_sp@$X+cepm[xUܗ ̭\  7w;v=Sy9-\3ea>0/D7Qxu+$M2ؤU`&*d)i/)"WK>2KtsUN%J'Q*W:Żh2!?#d3$gWDhγ>pYυ!KFPs[R(R;(&xGb `˭1&a]_m_fu<@sȌzS!kD(˗E"vPDs>P='I cN߈FJIG.+Fр`Fàr$ʤ?Î ,VS0YI<#7vC1.@*JCQqRTq̪Tk(8"iܩS=?иXp/hu41j)^MIgI*)MZ&v7 "enz{6^;s}wSd#=sAXX1tAPd-.+aa4a)B;ުG0/q-.5MDo/] 4k=#ǢliKb[6FA.C_:¥Wq)u>To&jq` lYht.uN^:]k=djCֈ}SAЦ~dG^ 1#KwySwLy`s./Mh vtj ȷXw/G*U;O5L?83n-n.Ĩ˾hŪf'o#eTӰA Suԩ t}'Gai7F﹵1ϙzW]N0 2X~:XtOf,aVM[o :jxH~ ԉK ٤%w-+@PI1׵GVHpXR=Jks'7iK&f#ET*Ǩ>6ĮZ+aJ /M5]hJ! IoSHwOqfSǧ&w` * >7VR ҅DwR:@yJ3L̒`-qR7* +!A =S0R.0%g׹7yFk&7$:B ٱFTm7%ܒ٫dԲؾ۬"=ȿeL *oNlaUqA3&%-$? Ifx2 չ5mxN4&FqBMeg?2g/ɫ)h% 5.9N[46Zz#+UV~*?^;)l@kB2슿 a ahtD)S9])S$w,A~:nfۃ<kϨZJ}&/#^Q?yQlbCzR&a֣}L,ļX)|%]q:aA-eM[u!L %0} )`jP׆:%#ùY68hs柝wʲg-:#p{҆Maz^?ZrY6PY! tX' ᔑC#o/AJٱ+VJ寮<5򔝕+Aҁ6em4_vQTL%h3%YvNη[x:a/}:ˑ4>8G_0)7d}<5L߱=P͈!dqXm+7TAGWW{760{9a.PWNJ%  u}X8wG9פ ,/D櫞F֖2 }\nP8M\/?ǔ8gZ՗IcרUi}՘C}FK{Vt"dٖu!B_1ackG7TM4&s5ԎcMYX0Wk-MBYO1a[lڿ؅ [yJme."7nXS`[LR0N AA,]^0 Ci)N8>r(pӛۄuTɉQIN|7ɑ53tvk_ ??z(oli`ccEC77)pAwY.Q"j!j3 D"`h<ñHz^9{Ͷ e{aY8Sׅ6Es]q9-/.fϏz ̀Rߝ $: Dl1J VYOm;& K%> D(IW05;{P5]P"uh;|l6}^M-9E!'5fk΃<]|ke4 k/WtB"-QO$uƓpc7'H[.Q 'HY m  IZee+; ҃q3'i"]H7^T_n ^PDzuZ~"KY稍GGhʪv˂`4O.Tja^hXUQ6 ([f 9Ŋ=Q0a{RQŞ"J鄴 򣙌TVS<_,*,?nܜwv]"߿*ߪh wRb֧2nV wE-@%R*u΋Z?vNnऄڷ-E1 |m"'ᴰtfv7cjW Qp$~D/ݔtrS *Y+n$(Bpc̜W"mΕmJW&E[ꅦEtGRɕ7|М#2NDUQCT{;d[;7&G,֖FJ;NWPba Ov03Y7ty6FYBm"Nh UO> iMXWr^T?,<l,b$ bB2pYN@ JK^8cV&>>H3E3ܴek:qU` x U>`0cd:G~~` L2T#ZNfۺJ-]VS1K8ߎ؏XS>G2Df)QA䙁rJ71kM!"&l HF4̽rʛ̸vT{=L|"v3k_C P錐dٮU,Cm]zG!Vh,nl!չ:x䔬g2;/.P7mRF< ܆ȴVh "B&X$YY6M U' m}wZ|z(ֆ)K)su˅]W֢|=;Vˆ/ɠ|K%9.Ωi\[L6M$Ǡ~GSO]tP0;/G$=CF8 !1_|A[BhqH:]쎉Tݲ1`iYn&BacJS[&$"@?=5 X;*SM_wJƀJ11=pb}jtM`9F6 XT{-k[kEE.W"ua"E :ZQoٟ"ZѺ)?p­·{~X(!ɱTih&Zqt)JlH]-pL';qּǐRCUȰd;w+fG7=]fIG$)́S4u!cɌz=pMtuYīTEsG!Πv?X4 ݾg}{%>J,@,Virύ?̥.7;"=,L &MPg%Z&=K4u8ě96f+Uܧ]4annx_rMl4f[[;={ ]_v}tEk7tQe59>\R؈zijuĤ2=7aitsШD,+^|S)Wk,?c" 淿FQx«0Jtj6`>~à tcƐU9MA9/ZY uk-d9m*¾Br/wYzwׂQ 5L̼aAhK)q;b%vخ/'uSS4(cA2}5Hlc֞9DWl8~噙]4%Tt3h/^Jvף+a'5Q:6]P/`^*ϛOᗨ;*V3L3mpt _[AF;W< *0R?TEv`lw/e.|yM|Znb$>!)w>sr2v3x]KXh1j&$ea;Zge̽ɐ*T# a={Qv^;"BUh5A>u劏Z837KANj䒣rq `4yTʺ#v֢ m\@@u=r#FcZ_Qi$s l_Uvr Ҩm ]oq-C,Ӎi1J %3z N͹J@w 2Gwm$-9["tZ#x)Wш.,8 _9#ȈAipVH u،-7-rA".VJnWZWQh{^ DyRtNobv:I-j,9TI: pJXp<|ADX"I:\6(RnݪZ(mT<2|]N=UXpfCƿK@GO^='{ 2O,4+5XWh[]b* ߇!\P)\-$Ƞ..eW%SYG}n2 Or>f<s5^PF(ONOi%&zo7Y$:]\*ƣoW*=Ċi:ؒmhq䵖̇1] 9 wJ)R]L<OKosWZ|_[/:%/VbP}.!BSTw4Bqq1\;u/+.^R7w;6WRz`q2҂vh]šEc1w4ԋy'sZ~rZ0K !@PۣKc @ MK&˕lV\َgTbTQCt5y@"]MDa@nX7JOS''#-[eǩ@6گa@t/}EE<#(jȑ,x'a0ZR.f G;V& _q1.L\n-笐MǒP$>]6QULϑ)~YդBeL\{ED$[￵ _d"3iX`e~rw}o͗fp4|q{-Go@oni}]"lŦ 0B]ǾP1 i"%ِTmeX&K}J}d[Rdɂ/5 e-*h z/l! ~굃۹+0.9yk8d1!r>r?ӑR[e{ΰP3jE߭'\:I)ƟTZa7#miyGu`CgJ_uy(uL HRAt`4 R/BZThW3TKtgz[ݪ豱`;KgRMDNprs=%3d\Wtx1] G0?D!";VP nmsʔ]}‰QnD[FeM1 ,{dTҷ[඼YsǛ8JPD8tQZG@Z4I7>U%뱉V<+q:65p&" DһQS˧.|n-GEp=~yT8TՍEv~}gȞV-(TI(Jt]lۇ9?٥3K#:Ik*qe&ףqam>taWQuW|փ-LQKCYU}#Qx O?bqumw#)GŅ4bsĪＮgQugQ7wTFV#Ap`55H0WQmQܻNa TǾG P`5MnqprTN[ rUܤrx#knD9o,o8mms^e8mk;ơ&ͻRqBJt,NlFbo5ڽyzxI;cTRow4^lZxbH7gy,0bD׈X*oJfzk#F.]895tue)m&C1%zGdkAlyytUS1xas#:rIQE(ҥNLeoAɑL_P `=dR8nhX!PX">V'9R&@npFL76T3۬0xr >nPp6GEڙՌ3f^ *'C= L+z9^X%wRk\~_]mDK!&݁f6:bm?_M4RJͼYZ.k/>IB]{pdݥn>U*@NGB2MjQfO `^I5^2{k F!E!ILֱ")6#x7xEdos78}]YtH|OtB$lg%pm':(bIV|ArCɈiYt JSAk0s_{x9}y+7y@~0PNo01ǖ /Z , ;OGW=hcf|ˣzk bA<~\N6Di<܁zbR*Zcy!#-|yPhz%L&9~P{.+@ Xp ` mɯ3 2fP&^ж|'Tpx.1r" 4\DTUr:G64R3?}Õ;%Zk%fqI !3` =/򶏤gU,~%UgRf3XK*tL/?%IvO̵/_R%W׮;r*,Z.34Q)P߻Րv}0ǀLjm*砕^UXs :xz_o5wE;}nT&)!O'ț4ZAմ K8Y^dj|rRrDt[ʵ5I˨rd1CΙۿ>uUWe A6-fw U3yhRcbPgu ,[+dDf#Y!Ub 8?("}<#yoiaVZ]BVUD:Zo9eyI4Ԡ7Dnd0 sKeS?e>trsNOn#"km7\m H3o>dHVbtYaκ`A;s6Y"_ 71k-):R:ZbPu^z]>:*s%{2vb5V /vzoHgӹSMJ! K=_w©`M +t22U&+xvwXx8FFi*Gbr\ՑKC/"2}ck3=Y3ϹΏvO^26k l}o,oE令e.eX;,8"<޷X (E !Bָ"" \hP z)t:IJ0шX䙒H)qiH~hDw/Dyrڤ*/ƿIt"ߋ{IYGOiICܯ K/S SF܄n޶{!wg J{f͵'<|?;Rdbo-}+g:tbqab'/Ļ_<@V_p.]:QC LJpGa<< ?VbWE A#QU+`B.&$4*Ӿqɫ#P:XϚ/`ʀ:0>3x<(](ʫ5^ =)|1+{gy\S<OxGV5_swΦ neW5GܴPKlږ\]kΕ)\B)Ci@yؔ@+O9F9˞w<VmvpB9={Ď_dThgc =Eݥbw֔5DX: #pJ -Ee>qyQ.1m@x_)OvMz:{ofex}@s 1ak% ƭ@96 x~эykQB'y 3['Aapw+"XB&ڔ%y4,>/:DY$ FuLfJD^,<6jesx}7rL_ڭYE> \ cE jOgD}ltϗ2S~ W.^]ljB3?rKͱۭtI03ݫ&f@h($uڽ׿mD+r[t'm(EfRݶsZ"ƆGmʡS324􏩫/ р0i&[N_i]x;tIfs]cޏ ]n8k0X{`"X;+Bao& WbZV!XV\"&5Y -3<K\7bQ4,'bC>7plM y&g0i 8RV |Ԧ 5'>=f;:bU:Gtˇ7/Eʱ Y1Q߲I%[_rdj^Idz<9W֙×u[X߻WM#Ec e mhqbYq(v 7! )>@lyxP >mo.u:b!dN(9ןHgy %!6RCh,qA~ Kye UU7xģYz\L?١<3S CV@:1~@ëRUW+R4 9ݺBp)teZ0auSRA)4[?xd A Se@&g{/\i> NZ0U StP+{!ML4x(}W\lmx8rU^ɞ)dI<?8" Sl9w+e&NؔJSy&olf–~#{I^|X Htwlu˳eT2}|cF[  p&ZfTMWٛZ[>D$h!m͓Xa@"ԡ8&ɼzhYy5cJ2 W7я}Ϫ?[V&Z7;|*,I$e AE 3AT::W ɂ,2Rt7aP0}*eK?#X>!o *>g|@(S>X/KqKLji}ef//r<+k1M aGiS¹ fa}gn&'nx` eF26~ qtdVL;5rgm +]Gpu#8mCə;1C[a#wx$7j׵5]zNyؓ!HΊ VմDXiWaF#yŧ)OlP=d_NO-zOǤf>>XUo@U@`'Ϭ&$G"_; ={eh u.Y(Aa ׇ[췝%t5gC?ϖ(aQ d8Qxzꅹ)E:V3j]AQC;V1TN2Q}HzU{Dn| ЍO_fkF7̺!MfF$ݲ6G#ص9O;<,t$sR,3MOʹ0P tP-Bj l|@C~h|Xv9n՟Xgc^2otCadO^;0'<>c '*iWG@[%U'UH9>j}O5³N#V3ٞ08`Vlh=Dz 3gjH:^cBs7)27vMim3;Sq :(RtKzIYʬۃoyL f8^eKe?h2HR,$%6d R$]bA6#* ׾hd Zm2fpZGR\-\ !M='x)u+h2f[t|L-R(,[eugl#IG/Dx?0w..QMߣ,S;oD 奰"܀Iih%|AQbJ"{ ]%gl79]eWIFrQI+VdDuCONfwK.uR<﵋q؈"]z;2YFo"*:2qH@ JԹ𭫶wKiwg.O+:3ctF!ۄ Ԅc P4-Uws]ѫCGtWR[EzτhD >2G.:64Ҟ ӀAݔv'!P;i1$:n{oc %"DNh7J! _h3aYtnBT"7 E{DC Jюݹ{mE>45KxZqD~;]H 9EnġT+Ltoi3%객d ==.&|ݫqp?Jf5F^6|GC<{t<;yvYS}q6m-s=j$3ѰrF23-bCt35%'܏)wG/N8Q#DKi^CcA'gIF>l)|YAGMF/?", L7A rbm m#V̥ΪҁE<#Liuv bsOz&%}ymQt<7Bt/}+;4i_"0D0-ӻtls60%+xdO QNN(k\ߧWMCm'<} 5QqsҦ-t95!K 0Tzeg :ξC<)+)u# XPX#t IIALOېFx;:f?N+Ģ9 ̢ N0Rs9 }}RlB=PQ*{EԔ"Ꝝ]pbuFt"(-لf#m?R57$D5ϔRT{S`yNzϟܫpsH7x'ōx޹ Nb^&d%rw鞿2,Zbd[t9N@ןUWSfz<\Lip[BxrSҢ+7C%z\ʉ&Xi@N)>>qlfvBo9nL\+~gC}}AY CŤ)*%:zA\˂Ye& +1GԦ{Իx !AUt\PYRNNEՓ8W{ۀOoh<ܾUo+ @ <[HYvp U^ۆr:-$c0E`"%!E`Q:FFK~eƠ0X;RVi.:5 ttN1]IеdT11hMitf׫JR<ńz3C'^0ܫOU~u*&$!zc}Kley8P4A< ~iwLr"@LpK1uTtV:+#W',yQ/NoHߡ6|C8?V9ŦhK=C@a5xbD } %xOa42_27xg?5r\*BhYo {+?QP ;w& Ǚ9@&JJӉW_"Q?kB!~ϯH ubflQo%*'낯L8 hq#{ijy9I3!v2fDh.5xy+^\pRT_m!R3:rKA}QRyqD0bA$@S\N Rܳēö@ŠXՖ]r{8sy۴ވ HN濊%lM"hzn;E`ߓ8Ur8{3%ۃbn00J~ξn)8b,ˉBfn3af1GvmCyMLo?m[Y("CNrg>\Z%XgAcMKl1S5`z% d#K 4 RdXޔmoN|1.q~^7"b1?N%,Q@A-O߀)-Z$b*&V)%+w!` @=LKa1 qoKѳel JjWW{_FUOS=DEHu ̜%p0 qpgu(|I\2F−-*܈Y?oí̙/Z:TK6Y%{ M c!e@^ȩtHNf7{l~vND `hʚh,c(uN-`S; lJfHg%,W^Mmeo Kӌ7Î6&I۶߱2ݺz͎Nʒ$gxX$ ]"!LG\{ F]7,A|$ .md<Բwhcи~״IILank Zj z|)TGSTV"@Ím)4AZx<<{t-(!C! +7ʧ.WNv\,+hs$Sa.,è#uHvA$Wja&>_ڹ#4XACB}w%p?djJ*BvM!g ɂw:LJc@5TYr2 [dbeS}k{؀p:\o=P!|˨fIҺxhmz-tbLF6$ȶGO^k~ݹMG;kwh3kY4Qqs ]qsk~8mҕ?h%ȾyuN㑕/q(1sǡ"eܪF);"nyy-ܹ:m|q2o^-w ?#nY< .L$ z"ljC2~0 uQF.7G-lu /qHS&:r*oe>1=$ ToB2 `t3 fz ( 8m,M"&lj ;GNW-[d*U7p /v$~嵲9sw_5nf;zf Ig 7͞[SQ9jyd!ĄLO~5ܽ7.reV*n O 7'IVE.Mifhbf#^idl }Y2VlZ#}E"|ٛ!%w=M,&}CQ? ݀D}(X>i" ;_k:W> t F>aI!޽|(pYNR5S!_Bdּ)B`|k ʨ|R 9'}=42% *@?H^AMURkdk_B2'%fGϘ> 撿xmF0w}L m$=i)`̴/籦ml ȧ \H_EE]f<#(`9ʳ-kHվ72::-$1WLzZr;^A>h]@ۙ\"#6vDr44>=Ԭ%SFhu,=_ۓV=7beEfiN2 /~Eʑrȶh Z/K%VtM4ˀVboakC' lQ4FX3gR$& pibؤm05WTz "r]-t5,TN=*҉ !Hz2bnhz՞CO 3}h Hhԝݠj&T:ѝOZ#Qc8W keU32iO'U‹m5@Y]ߖrkcPA,Hu ~:pӧWҽn֦md~)6J' 2VqZ#>X' K5>HTPXOK' <{(Ɍ{;.MmآZ,K83TL9-QV}aA(օ> !Uic}1yf/vSTNxU.-Jh FYWĽ/p+_<ΤCWؼn"oH`eDUS.ie_PU&+^j'dCk*C쀁c҈ ;8-rc:lLyDœd⁨I˫*>h#AEHnHeő ƼjX7%DiIR|'q #QׂQj1H;b΀ּ~q 5,j^Z;O(_zP^$MK&|NCogl2byuc)$ny؞)vs!< VcKi֢di_t{zBsiNK%K}9I.=Uh̆{d,];wp<&3ÚWo+Į=Ra,-Pr__{1?ϱCd7n-a5%0)m0'g%8G +&w1>1G U'Yu 9N=yNmxKF:|9-U3>KmMЀ5r4Z컀ᅙ̧d=0 Eu+V V:77C% 5ptXWB4 .fs9Cy-QU]@_hձlK>}ݪ3I0| "RV}$w߱ZډP7t^4mFxIh Z)u.}H/aB0-#ocǃZjΉ!7 uCH$Qn mQ8FG>&J"jk -zs48wbUBCX5QzLXJc""!OQu I;S޺}v4*_ (_ޜR#ŧ{ԟ8\|낕~9x[D O2HېLl^G; _B!&qFsotҢ1tt9R Bm} | DOE]4Tq\ \^"] ΃B'jgbQ_"}zН`BT72톧5 tkDhqo4D|DύFDb g0 vGGtp>&}l:םvDnޛJnގv KO Zt KC8r@2])Pe*IoLa.9WO +@ѹ}aDЦ xɞd6dGݲpBΰ_Pby? * {aO@#RKҦٳ0Gv|Dj*CqZC cRF1y}b >dH/kP%@ڣQ^3d˶EdLM|dbmSn)oޢO + OFwad2nԪi=-qفzxaG>JlzP1pΫj,%{ƖzE+$n(iY\ᶹ۴6;_ә<5 (Vp}<ӿ'O@uTe%ZeV?%({XK lzZ]lQ<8]4 Ym)_Qi`9 C7 frkau԰i\$L, ɥkF _/ާSnK[P:zu_x >/W7(4`Nk4{G:O|"RS IB)Qwh6&_B-߭HAupHȩ),l+&6 wxt%dRz֊2Ouؙ܅}]D(+Rc$^wo^w2s\Lznй(70F:@㳇E=P^]ۚ –?L]ME@R76fwb?<}$L 5 VɿU1;ޒYɩ^Qvntˠns0ەDiQpE Ygnbׇͥ3= byZ?c]$M?ѵ {&'x@V{F{zͅ[n2&?۞|"|Y=a֥G &dj SPxRJ`i\]|1?KMV){~֤R ĬS:h^`xލop(g'F^n4ʛL3b+G7+g/]> )3FR4G8oFdd|phe Jw5P~%ki/%ݡ6kC҂ і dC@ZC@=TrBV3G{tK0$L=L>Fc]C ڼ%Z=pt|v'7] Eaw<ƾ ͊er u4TL%$E؞K Msotd1R(>HE?ց;krn/^9.Yc7'Tl0MXK^Ͼw/5\a[qإ/brSm8YCO9i=j_{w̸^u]LQó6hI_5C-ɋuc+Q֪QkWCXa8 p$˿)zorvI~22rFiX6XѼW(T/ jK| q -0)cd' Na =?-3KR7t3C!D<)kDAZW"t,U lw |9jb{-q߮g&=߰]2v|(5Am!/-^Ɔ q$T䶽Gx'UCѼAW f2c:+@Xchֈ1g7ĉO[:1yj7Uk\v׆fVk7큱4V פu6舟 *Gy_+`^*&=ÔSWs6Jha;$i͸8Q3VOlˈ|t3[$%șJeF_w$6tk|Hdmqr̀"wCa6_|AXu :F}O|<{bIdC|r)mCM[ &^sug `qgt9[""N-y*&Qϊ IF;ǫӨaWFn|6F)>ឿT%FPUv7:u5A@'Q":L;DO;+f8]\7T (T^gs \ɍ=kX;yChSд${Ms>1t>E^Gds΢/ L;|uUsjum9qּWwy@(`t`Ba-[=*-Te,H3# $Y\{{' eƬp&SNyQ-/ؐFn4T2q1p &D@ &ײAE4s E Yt޶r9Z,#2 De147 [ZW^.bA~fÐ2@ir> V닽w$ f7ɣpt%-Hsx[wi=ױ_&N~S*4r#h6_K?jT(6ɴ߼8m9ism1BPw&h ͭ^*N)e8X+'UJE0#R:9TE\ u\ ,atp w!s5 ,]iMDBeR$%UݜŏuRIrصi`syPIYU^noTIeU1ZQ3񙃗}O~}^bϏ`ǜ7CymO}z:Ȃ10>x&u|W'Ô2: lB<8 3L}m\`K]Gs [iE1[]*Jj3ۦx}!vQR9%DSMiD](\wq >܂W.dR$$V[,}]>rjxD-pNظԘbY嚭+3'q|,T E0ѳl<ұlI'}mƹcR8u"^ծ}#92Дؘz|}c82n^v^c9`p5* g\owp٩ǜ6;,3F]eGE-~_+ԚF&YcVMn*@t:Ħ58մ$l>B)a3._pnE#AeFfIg1Oe>l>m:вXWUˣs͕gI=Jes=TWK5K. t'ugA*h -ͮtۖ5&/G>vuj>U@Rz (/\sff.竘6Gxn(i0 q2cPG0TjamJ?q9Ǡлb0H3DPPGX WGWnXI\Comw\:]$SI 0a{9uKTcA綔FqW39ʊ;'U=^ ~U씧FREHA*ozѼRxA4OTBvl-=-`Nr0`IGML)IK-l޳C!`,QKZtRdiZD"`rj*{7G(ʃ_q5/s9nR$J0gxuk2itWySpbac,l3]97i>0wg)}ڈGMpƳ)G>%!{ga5He7`j?CQڊ-Tz1#E,LPSdbP2Hʴz^,R:>^wvJ5v,XC{f٠B67.%jtHb4CbƜ=|0)UQmnm,x'P!jo绨:1yLIiW&Jt:sz֟=1&Y0\T0A9 Gz^(B.%$_9`#8UAR`Xw*!̻چ'컇! y~A0П* xF=s D'auO a\Z XAIEtsz沇b g@#đV"JfnV"+I?_6s XDA% z^HQjZZ^h`r+ǢP ud l^\Ż\TzKc=|ˬOfMXp%mnT-` i=8F'<~/N;=G ;U{0,> f*NϻFq2tlU#{(M"^h">e,UV+Ab:MrP r14n(jTI\|E|g݇:|proH5oNïy ( T7|VK'cBv׶Jo"k$eAoPA1T0k۽W=o_.GH3?6[ZTU.E7Kҡ|WP8FuSZ+oy`bnG?7( ; Lb}?kc @IĮܥ@uYZ6Jy&&ÜzP'n)ELyysLRy~HÕe_NefbQe2ffC ^~O4`4#Q`d\bv_vQ3DHՄeS1]vMd,b 4sXF:67bz 2Q:E)4EĽŦ}**7f !`ˌ&^ѳxBԷd`OǬK_i ; 8bXARޗJRN;~^&++8SѼpM^Zjbn{2!e.3P2{ Eoj0DX[MgsMY=n"LUD0MQข B% w LR٫NXS`?i)g,"I2^ W|!h]48+\7(Ĭ:I5BEA,TL /ˍӎҔ1D}(_Pǁ5lŸNo\e_ h')=.8_7F܀2K·%U?4Tr5Z_/0-S_)UV-Z@:c: p [{JvMeSCBQe!GSP#/lNS+⅛JKlۥibAD?떼ZYƑJ"Fo<}G@?V8|ja_i jv,?1IDM(x/5h~Y)H<ܹ[tjZ&=\֮Om k 6dO+^uI+|gc&5YqK ()k2!t͈i Ev ߄\}n7&HʧTo1IytfL)AGT\ioe1&ປc̶vijV(uUQ 3m/#鸇GGH)Ene JfhZmE((z<.:*;[4ۻ$LowsjU?fIS"dA~ĿAHmO(#Ϳ~@}BZ;0ˁ"9JKˍDX&|QygO؃9T ɭpH+i Rr*y.MUUt}v,q/gNgo l߫"x [l1Nթk$4W ~jksEjdf> Ϛ1=;QW0Đ ɓ x!n$x]xyNp \-.Eq!tH<,Oٝ4c ŔAԽeW%ؾ|6ˇ ~`A%gEjJ$pP-l]NF|oiX !q`>@tR}kb j rJ闥PK5_}4e~jm:C ~R 8aEr#9-0-kCw* kpз}*`'|Ȇ! ]mx[6ٺ6b#.S?y,Xw,+ ]%xJ%v/jOP,lgl-пȗ#FB]Bh,5C_uABnʾpKʘZB׷ lX =˞ kK O(z ra7>]Gly0aIqg@M8 !K6o4E-ɖ ݥP㮣 {g9\`%8E.Æ XfikSp y^0 : eHbRAFP'5P~yLCrlcNR?YC_Y殹Y|ĿCqG( SqO`>~D&o_/44`k~~ >ޢ[G~=}% Mh#pC` JkpT-X 9U2 al{) H(tw/a%wm~neXmv~1Wo/0Ga|/cuEm7O%P] >{ \j08|]RR~|+#T3]`rF|}2t{s*8?0+q~F%c9qç5ӭWo׃a1B܍Sl[k??]VH=7:22nu/{{__RxS*Xpnp'iG3=}x(zn _F(f!0Aeڐ\RJk/3ՏWU3`o úLAS?|񶼱y:ŷVR.axC]n8Ýgʘ "A=yTwA l+6P aKw kL4 dRK U#hp!F3lS]!"aο;HE2S!IM|hWHYIN\Mzbqp߼Ć^J]`{ 9ؐ"KU~#YԽw='EfMmz`.38 7B25@J;.f{43YbYwu+nfFGsM ׃'gڞƟ=&|a}:3Ko)Z x=Suj CQHNQ|lp]/b/U"_ũAui7,3(5GbVg %:H 1P|ߕB߼y!9J..`0FNۂ ܅8܃jn#6G6yF8 #P|($RgdAОbܮջ )j( vWG^[ QYcXgesߦKz9ņn9bi8! [3 pԱ+(T dU)׭%6# =ST"H_HQc 6p3IĆ`g+>R , oVlqоN{%Z%O+S+$$?~g&(e-'8ZSFTpT>xѓ΀,:( <6j02,DBo'kwƟQTr?jb<$'ِ:*C/ВY7s0N"F8 0+d<-Mr[.wv61%f g-~Wq,:h=龭 jOcGPz6ءVC#j,UvG|7iOrp+y4*MDZ@a4;>4bǚfgS@WGEcL޹e[{)'D[r[얚=dV:vY!t퐮KP==8ul{C Bz'ӭU| UPk* hsm& ]3Zg7Aԑzʁg(`{~®UkT v]dzQvtvc-_˸ڝKB:$d~Zx*צ#&zph.m̪|r&:Mhj'bz^N;lr_JȰAeV74pPA@`~k[WsQ:Z4]Ag5ZÇw=l]P!T* #n%ŏ([ t-2kQ8Č l^`Č<{34euj{S#)L -,שg.u) w>xkW+ xP?4x>7G䏥+m7 3XILL^9 ~8_Y' =^ i0`|4!̠PfɃF=QU-w孹$!),-:T1 \9#sZ~`JMZ$wl`Y >2jca}rڕϴt ^#bydM 2eڀq8]*ܶ澙wLb #2eAٽQ:,ßW3{k(ire-8D.)Wߴx:5xy`͗u1L#ÔiPsҝ|I@f F]pF1euq35!*BHxVM>ؕ00t;,.ѳ&.c>- NnhiWˊ&|*'|!O~ht}z06DPX60EG|ՕX/ BIz._(z Y>8':BVB]@ $i(]s:/U$XHNFPv63P[luv4k'sgAeSu H捝R5Tp=Pl[/ĩ(-IQ.py5 au}g@{¸^ETr).443-nuDt[_հ[o#Uq: al3d]5U؉Hj#(-*/Dsk} U+D%-hc]E-c [3ZPSa=ͭ 7hQod "P`AEȵN\M@2P`ˆaV:y rBHsk|A"6]n!(՜u |v򒫦1ZY_-KKǙu_QtOs˻NwY%/8U BLq z$vLkE_Lσ%@G ߲tm?@m* -V;D8L[;/% l~_Пb®:%\fW/H]-ISZucF&T  *v .:촞Jamukxme\.\p9d9,ɮCOG@v=~z93J~_0># >S!T4&aK~;"|b8L#z7qخ$w3] ՝66 [S'GX^ɅN^LEĤ1M4,ub#Id[ Z'=F1< ۜތ>&@ZU9ὢ>Ve~HtVn̽芭-.α'\YfRXvY[ڭR+tY=➡=֬77nָqc:<&Nˢ%0p҃([lJc?"cG/OrT E?]q~ orE<{]S M~p.?|Ѷ]4<7IYvg@-N+MJ-ʼn=.^r K%&-xqM/@Һs;dxd}FVQ{(lA_n5|Ⱥ}fzBP cK"TB|vo9>u):%EHgFG'Dznq;i _9 KaV%}yj7"vM m" "{gYUb⡬RtsœR"l֯f<6U-fWf޻, ["{9^*t >_w6kf9(393i=(nCSa_{cjٞEj㩛,Np۟# d@޿g&Ί“K̪ݬyR ߊd㉸ё+]4 Îodo1jfI 5%aP$&y.ejgZ0!S6*i7Cel"9onR}YRd@X'٠1t-ͯM b KV8].$r|UOxO xdSǙSYm͈z@ OKKgshN9}(&u^ݶoD0Vk':HpɄ;\`f:St:,'=J۠7SmB-A]h%ڂC@^OPAnI= FPQcM=zʫM0 ElsA鲈aC:xGu 3clQ9 ltf>'W!aƹ}KM |,.eԬ|ub 4 [˜>ЂEsHd[9a7ҐY,\onӿ*a:NiԤx}A;)gKDl>M8o.mPTU&D>8(𳒭䁊S]@bxhFPgD]Xn[+޽C'y-Se`U+rzFLm-ܳ:%$1u.µ0.䩹֮ʛˀ bAݗzfF4dk@k\h_I2e^|}B%#(`iG-pJ#&"nH>hO|I}U/!Tc5' f5 GQ&˻Gܿ΀.&$!;0;ORףe͢JI} ^f8_ 06kwKNA=.㗀,|QMp((Wy1pL4sBMnFxL|Hf{/1VGEi.R&4ynÈGS[Ag{ɧ+ݷl --IL292Hk\>s=ɵ:g:NC\DESyʗ9eM銞H CK^^yڅP{oopV ^8 l3-mQ$O d) 0eIdڴ#Px9K飷4 i$l&OT;䢃N;;aQijԺ3EO!25?wPl?]w**/zF'y&+_\G3dZ +# ml`8u}LBx 䩵[N|" }`>IhJ8aOuCY(t1 uه\*qQr(8)녋͖ 6%IĞ]@/i aIqzo!]rq^Ot`K]SqI?;eZ%'sEЅȓ|ԾY^HvY:®79m@(jX"o" (|sJ.KΪ4ƽ#1ѮWg6Hwb*Jd2˵ +m:#8Gm. EMyσ/J񽘖8䐃FѠI8],+\[n 3..B^WU%1cF Ś~r$n4T:(,{G?\ov%@S]zpN(cǜRvC,͓4b;Zژ%s>JK1H%=4-%_Qc~qhULǓeg`@hM̰n8GRJ2DХ`nu՝Yːew?y=Jri=z_Tv [Ȼ!5-ac0nz/;^W64ЯeȈZ=?ꥈB]=􄢠<l*v.N_5J@óO@yw"ʽWLtU=Էæ}<}C _Rr~S?!5Bڑv|aKwT~yT<1Obч|'XXYlz8kM8nx,'{ޫpy{l =FKCuNIkZ\TaRJAU4 lvgpaMT&XML%jdb+ ؆L^-`Ϣ(cUN@F o:]{ / Wh>Uc&OF  ,E$g|r\.|L4:~n 0QecurB_|it.=pׂ8v/\'pfI]|-H}δ@vNx ,ccx-=?-mCv倞EAtR-ۓʃ_P#oVdr1cV-rTu g.[6čhUe$杕n26߮ZVj#,!7kW2.l :d" *DԼ*6j x?ŶAϗ;4bgX9t ۞g1|SD4?|rh_=[z9Hc YD2YI{TXF;;دQcՄ(xtPGnºoW8:ٔ;}֏`z(xa:Iűasc)S\.py haØcPg5̒$q sZM:˜iBG&UBiS6FH4f;T1\"WP9O uk-rw<* Ep3\ /Mbܲfq2 >B}EL,H<\Rw6Zאݝ .ʃ^3B@G1eTI*~-$9Ŕ|w_t ~<[+3oA/s[";Li0gEȕE4FBQB==F).JMטyKĶQo0sS i)fݕ^O|)䨥fb!eT^kCLp uk ZP;ՀMt#wKʀebx;Ӟ.*+=4HrcYr>s;:~+}XBӳRg[K$/fB҅&(_kyℽD߁G؄EꗪmZh:QRP>Clȿ"jGEM/N8J!i"{&:Cp\KOl0E K}ǽ2Z냃,S(4߯Ɵ<{5H?S[Hw[L[b+(pooܾ$`hOzaH{"Xf@jc^zc c|( 4r[72yu.Zߜ3w7L<_E(۱9MCI~,ݺL( yI>JSu{&ɥ)䎄X5V3PtLzJ4 kG\<,+Pf+vdmH%~Z*,AKW951͛ƳDk03֏RĒnB&ӥKFW-nMrB3< wxT+.5b1 [0`'3u{ОJ2Ҽ RY!-yϾd}Ca{S-y ((5nM8uXp^9JjI,)ظ9f h6ÙҸ\k6y 7+=WiK%qKbĜzRXͥXIع )[,1omx'Y {tu\O,}ss`rf_ %pX–  =!>g` p[МkZA/K uGF=Y(t${0 uIU=6i2rho C%~.ko|r&nw%F wL7fV< 3\1ʼnɷaukuq72^j=ind'sܚ$ {jcW"0{᮸qm8?ͽDfZ3`  dНW$, =%"n]N/]Fgp3~++ Wsګ\=dlmUhx1oh+D@}Os|&^DX%Q #4oVC8GAw#:Iw?f&(PX1dZ?d|)zK s*h吇F;l +B8T/jeݮVkqdW^٠(r1ԟžZyk T$(21y:~"範Fqo'5@MSbfoT`/cs :!>lQOnAQnyL.U#]PE?$2v3,iؖbgN#a){]rp _t%뒊g` OkK :EԒ#{`if])bF;4[JwJlJiSL)\UG2&=}V-} B1e46n;QP _ef>cqDzGP{9љ}سU@J:~+aIY`;YxU6͠Q9m=P_> abm/*,a3rK8af+>[}H:fU țu(o N2Aj m*vc@њߕ=`z[YBBKWtxߩiebq0XK%-jdrEp&V7Εe4ܨ@ >/>qC5H7f&F@؎_tLs.`3im8鬗X͟;P-[_\a<ģkw-3Fw4f1'K8OADTFÞxu}p S/N'Bw˷hh kIV:h#t~o+L9elDlk:%_e@ޒ()ÿ*8'Andqd ZQ)8q`8~hѤ Ql ,Lg_=[7Mt k 󭳼 r,L 3x(jh6UWT  A?wt!5g {#$9XN 0vG~澘ZlU%ws2hKxβȠ@%7Z]n/l$*]l#|Ci虯^y@3_ܖԑn.{;eeʿuR<?seun+%C2ӼKm|m>:>*Gf=o`+!^IH~ZDu􄜍Ǥ%xbz+||OE;Eu$b|wΑCqrRB~sT\"G?$bolY95>Y{GW9N 澋Ƅٟ,ys&gUQNV+e0⑳.0S`hEe|j/:rfP](4pH]GI SlJn1{ xr~^~ E%] f 50b6LZhb}6#|-f_œafR0ahˇQ\Fq\Hu9hāT`B-ӰCh!ZGGAep]~bߤOSJ0)w+*te,M^eɔA:Z *6]eƉr %yi j:8M t1b#%6dxhvgڱk1\T BR@=k[N (Jg0rJf=a`Vܢ6yKT3_g/g]9۶Z( λɤy,&C `4?Q%<[L#}GIBhױgR2$}FЖm*5*ҴFwG"Acd^1‡15E>m#ȉte ОT' MI?;[h=:BD@j|YW/,:5P%6Das :汥qh=xpe_g%k3L g3_[B@?ʧ=v?3;]^Tլ1g!j[؈`"{C[kfxa~ Pe_f> ʱ#Zj-eOTNAHثgWc!י⨥hjS]̖<[HnSfzA0:Sxh0 +z _ ݷo/b oqNJg7n X:p0;tٔ’_ޢ~b)_Nw& ,wlTpV<%3#)m]$#G㼗JcF_C .:uFǼL#!1ʟsQWvJYT֫c"c `81iÕ0E=o*b[.wUq22sUN[sw\0 wJ!toJHDMnJц6wvjYqvB} Qo |@‘zze{ط5I˙f%2#Iv~9Pz K@odh丁Jʼb?yr*kfs~d-G2Cv(lȅQp_ Kt.Dj͚k)ڷ)z~ٹʙ`qNqU &?%|rb)~>5LkBSq_R [|_0g fS1΁{+HVt% r.]דa]7<Qsc%ǻEnsJ0%|MY( q Bd7je58° ljzL_V1m*e #@R^;4M+&@H妐 GdzlV.7lj@]9ds5{ Qn *}㥷u̿c054My܎幑h|,۵ʖO񓊐~M⪩ 8E,[ЄLmG0L[΀YYzCG 0PTk ߔ&X~^ftxf%X'K"V'55ZJ)d',{mpllzL&?!nׅ)։OnO( O,kx=^H$kqА}aIgw9D\Yu5.lQ0'ݲsrX< zȔ<5T6TE*z![ibݽ^ e0#\\Z4^wIH1$ӝ~avu386Wށj۹4D@ K-skQJ>T{YTcqبiOiwz'39M׳ɤkܪ1q2qo0_F|,IjscH湏j4i ܟD, Z-E|_IIag@\u8u`ޱ듯x|/JǏ2dZb* k6$v^y'V!ĽXLMP=bB Af@eV)B6ؙ_Fl4VuIIz!_,vƝfxsH-$Fe5{MTѮd: !1<1* 2bj--T>Դ\EA6nDW7{ONޕ&(Tn(zA>&a_5QOmL8zYhQ<xr] W95}aY+O}uOgu J专v!Wb-V@ jD8Em8ma*bi.; kCԍzŸ$ЕEk+h[ 2zfiE/G'˜0=*tm^'dyk;`M}k ĭnq<}AϪr_'{Rvڭ:((d)m2ԬeYMd/\.V~>u.Kp+ox[Vx{PN 7"/̅i,Rl?h:"t*;$9@iT2uIyh`#Lv97^x04?x#vXWwfbTtTf-4ZzaBjs c/y.lľ +äWHyn2uG׫ <6`8%֬"28"œܴ{cB0; Sх 7=UE1˼,OiNӄ-)5Z!1 Wg32pG&Jm@{o !*"1D!m9\9FQN *N™X*qI=t1 2jSe]FC RI`'{3}39BM<[]AJt$E4JeKîP j[HᒌMW{_PO㢓od3An>{Ss^7TW&\'Slm}zK2=aT]uA* oI--k~.ŭ3MM)9Њظ[_t%V{%=O0_nYfQl@i46eF^g'B D>xbDjh7ϸHo~ }t춤gꕗ2m=/Ϊ,ԑ7λ>W>ZӦ?0e"QҾÈ*,~~]Dl=I=Q͐yEx|R+sYxBT/be7i)8'֡_KY,zCMyCG R'ߘ p@i=:lSO[vX~tjYZSbz׵lwR:hJjCUANS=h.Yfl|h.OZb|u@7ί"cүݱf|@01}@Q΄a"ܠ"圁#V.9<2FN#8D"͂}=4O'j3`]P /LvX#2k ٘L1z:kr{%~9a[|LWΑ8 (rypz(|ܟ uk'okeE/bܤ2V,%2Ԧ3Vm66P6 P&&E\#ILQgi[!k\U=L/D{^i* o`$ (5G=뾢aȋjX` 90]mvab5n*:TY)XB6(_n'q`o2|/d'c[W)T%(oi.)ʙԇ, /H%FblmD&r~un&+(2I5h$'[(C.0JR1h:Lah'cHQ/5WUq$DZg[WѳҞc|Nvga!*=awˠ%4U %кΙ<KKGڴ` tPP45 N$ӹV CQ>87xsZJɼլwŠ6X<1jU&;GRnk]1yO^!`RC.DȡvWP(D< nZ׽ Zm>d8 ..l,4xgZSdōۡOe#TmK ~կ{W_t+SRFAs u.Rwsfnx#W]'5@(a7G U7[$W_HdNLWGՃ#1r{|.OVAݛAGp]䖶#YkDX{dQh=sELW}wB^+__}&1b}0ۚ8ŬͥtCw#ٍδ$8 +gh'WmbV.0ZnqpzT*0B]Ԋ4 6w Y'fi`Fʂڜ$mrّUgW!l3ru1"GKA{k6,/J6E4`u*P3&Lbh t:y_#сqpNnɠCؾ赖^s_PVaow~לKmA{RpgZvXYUظ rRA5׿)z:/J^!9M 2]wVi|ŀgHE"19渓AALj*8]uge!VH>؛ڔUME'D5Eh$M-Y纇dcG/RHNA{krx<%`S=9.IDڜjԵ/Fɐy T 0+NzSK`͋ Z,P$>Qj/i;CY?X) E (Ϙ3Qшee #^ 3TtIY 5x\**Iܔ:e廷gX.iM:g0p \b,,AbKeU8IRĻ@T7|('p8_gJh|9#WsF16j_şƥ$6f,lft^VBRbAM2;:(;d2bX%?XY~R}+:crVw:`:[`Y^鉱ϟq P[qí`nFb+LnUۙd_@@$xA_n(ESjmMWIpH@4#bejۿ#'tKq]$҈D0U9ȤH$Db`H-Z p4gGUwl6f.8eBn]CHOŵඡoTW==Q<8akk{|9wP]5[ 5A\4~"bx[Ѓ0CD?!>V!8K6j=S0`aȿstl->爻TP:,WL7E[|5ؓ| J- 2Gw}bL 5wZ(wxnO F(ȩ"4zks*yd 'Ď],0m`HˁлEBfj?+r$z͟ =dd'5L+prC`}sZǣW]a5LgOa¤d7(*:IÕӀP84۝?toP%t_jK}3ѰEĝP|q#RnKpzV?_]!lFףMF{ELZM,*GC <5d4 f ه/~cHT C>#ZǟVݱJJafY }u06 HQîd )7(,gp9{08g5BmRԶY-QDp7ʑ^8Rn0򕦾2*aTHGr[IE):w,N9Qӿj#3sR*1ă>L2-K*GLA7S3&v(k0Km&_O*@M$]RIzKk3Q;^ƴ@Jw$)/U+6w;yp6sOm}Q^'L,@ř/}F# cNXD8xm+V,eQ3݁S2X7)2%1f/@ Sk.2!O$Ls/cnÈ*;ʷ)ɥ{ih_(qe>>]LGG^u9<*8Ϩjշe8ښ΁+nk(TSFfIWݢyTq.R3 x?ЁkX~3gln7-`Ng*1>K@= AڇX/kvI>gz[uBѓt(N#E3&{nunY; OmцUQzDRn`q$'jeyφ&LqQs<Kec~H_|),p""S9(ȣONQuax.\С+.Ug527@މP9g} hz y]~.RʔE?˟>Aj[<9X }fdWJ3b4WPj_ɵ @{=ѓl.q+d”d3(]ǜș +j44;uA\&i,ak.5ʾ0k*^Կtd/2oEs:d ~!n8X:so16>*YVբWxIՉm`&PWr;zI֏0+0e10)] ;=Ƿ-!3yenLL`u,'[:AcŭLf!>KXtT912 <_h( `b ݪIMN(Aa\i͹R?,HOU*2 W&VSd>vv-+}7^!['v[M虽gԏ].,fja%[B/F „)I@?'?n[fsk0չi"?jU&egcD",;vbץ/!zNВ-.?|Kg]'+o9l1bd!joʗ2l w xIs`3!qJ~X gC@8'xJf4$X qu`u dOY>!)&-yնzW:H2;caH>m6-|[g M5 QSA~6E-TF6`t10ne\aیL`YQ y-fi ''p}r'!fMTtS%g2L)۪/H F[6X,sleAڴXgpl~ĝ4Dv.W =ƪ\\,wIJ` 8).Wd*~*ģHR\/_!&'a3u_JLo+Z"*yDy74 ǵ 反pPsyJo˪[->Tqt%R;؁uQ{EX<W.:2/4{d5.eD7۽5:<ǾfdME7s͢V\֙$mW%aS*PCj]M՟4^8!+9nu_*=GX'dn> È]uA; &B *1J`Er^)˭4񤶄Z``M\e:;:fkL%0}W>JI= AqW!%7$ˎ}K ? )̮8[H-(ie>gKt߫7@NL:Hw`7՛S̕w-D@ :wEtT|*YW[}6m.ν :~(Ԟ`˗|_Tl@ rvg֪yuS՚9*Z8ʐr1Nrc9G">RkFX ^-ݨn4$]$4)9^"F`_A"'r4i5)PIM#hεEɅ=Y$^ U<<"],U lpg`>,SUGv6u*;h2[ O֬^ U~40,y;39Ou)dkΝtV-!hC\!n'vk5rR9!. w-{_)eAs AH[P;M\m5^R6Flk& 9,R`$fG05e9waǵ?eiB%pf<*ĝX]`h T} aʤ^M(u0,FF~*{*9` ;PIRR j- |#\wn1;Jk,[ u!7|O{L*x۸k+ASj,l!E|_4_Zm/7rl+JYU0WT!K#a"< eclJ؏͹ 4 v: a䧸\R)3[W!X* H屨4m@[Q0ֳ8{O['uM#4bio% e fHFe#퓮6+f`8$O*-Dc!{LJp&K=R[&Y |;nTQa."g01 ŷ?f8/]ǜ;NJëA8F h#)/ZՂqJCvb17d'LxNM*΋8nodg7.a ^yE-EG͌ '6Jpn]^7G:}U -ط$y-Ղ!?Apc6izd0h"ҵ`0O<`RG/W l-0%DVMA&ld{46u[o92^I͔OȠ"P4QPUE]˕B쌿_= <ӆM\jԜ1Ѣ %6<ƕ,4ۋ?ecȼtV7WQX࿖"m|dw |~LZgdz_]'Nܜh%}ٮ೶/l ;ħ7D?FM-#ŝ? _(f}<G_=r&>^ٴ$h4Mhk6ES3lq;٢?PUdMT{hi?p]pcdm\UsӰklI]ӎ5D]yo@Y sl^$}ifT۳ @t¬#z̀XWA6= ت% z%k!KPhrDi:Hzb:y~5Zx:\yKh)(&=qz{kL,o= qr`+/pb0Ǔə .-̎ϾZ<L]Q]Ld5dRdlUYA:(rB~KUXl 2r^aQgaa}Nb-ixZ,o'($~1D۰ f* /1[`sG0~^<{n4e]žF,=W~-yYwLyLZv#o߄ ){>axiA ́}.1d#;39#~EA.߉{V~،Z{"?z[ڷyZ۰)թuy4^Bzb<Qu7R4z89zBm#e&wm{ 3e)9m QZX"]X{V5{L~i+|[PbpR@z⛙7s})Rtj+ > v9x`ܧvI#\VfAL*I'PE6ƿ GH {ɜPWy=9vF71@Kʌ֝O3|A~jIݠ2H@Pp @I,!@b"CEiu:O۴ԭ {خ)M iq9iy,(. m[\Þ[bzn8 !iJ7ZNCU./衬wW Ϯ_1a9ciʚ鉸E ַZs=HHaʲ3{jӢдb;,L#1Bhd>Wٛa+8&7۾בzuQbHWn"NA-yvED!ȍ1]BCGކ7XA _jZj>z4") Nv 2ҏi:e~71˷7P (r@U)} J|a H|499 Z4DyC R1'q?'LqD X/~[/eqJ8'")I\Fk筑4 H&{K3l?,7pR_.0X1Mw^9{D9!(fY٫i@BlFڅ/PuJN[YzA"rn ݉ܩ"cKc.0E^bKKd4f&5ڳZ҃#<NX~.Pp:}ja]eOF*=޵{'s>Fc)>] Ye Y`\h '{|D}m*I}{R41- (r_a]HT ]f-72H;({9/{8so$WPPoŜO0 $ r*@y1<>赴Ks?(̱+N[lhT[˕KtX"ℨ K"ؽtpHe)\;/;M\iJP۬P(p!)w#SЈXz>ũ/X2_1p$h]`AHfs 4,:Ź{)d):bT=H/i.;_#'eOK̏0FU$3 P8.7k”Y k3_x"в_ZxzG0Y /j[u S蘁[Z')n]5.Bb{h][+oCvIMSQ-g {b( l%.C/8P! dS qN5N9'!|Sp. @fP m./?Mp~#WzUFFKBQfIk2cth wSC;SgSo;,27<Uf':NQȫ 2!]7z\h^G\ kWV횔3"{3QC?uauOmRU$,vtd>(Yw4\ j3 |0,)%GGSZ8 (pi0=!A}xDZ IHhثi r$&Pl5!T?2D%B=ZMu ߩք[#bWV՝=_N(AE^=l,d&(L§:)sKQU_o8|(MH @b.LIat"~iDÓAUpլ5)972{Sm 8z3٦;hpUDvJg\QqX'uJRYPشt\GU贄"eGu)6כZ%sXtkgMJxC&Eݩ)U#*,}[u1$Ӭa֨P ^f'f_Wd ߮"^b=A 'ʖg*N{ls!W欰A&W /+'% XClirxu >8VZn!ʹ_%{.@mzBIh:Z\!yV~)lRB߱0z$ww(ߎjm-BWM+w1ˎ[@IM:/ ^_TG?ק#mxW4Ձ7WSpQlY7.r|VqýHcm_Y8auqB̛H0|{5홖>_g,߱yBy.Pl1G")t.{SAmU`jw(GsnOn\] sOC`@!Պ1ipC f73<)Ajs:~m]_s|TxN9$`c'C|[at;| qȕN_vYIR[t1?fј aWdZ%ET}HJdTQ=(A5в~XZ¸<_}`[  n/s!p+e\\%_"<Bc5U; \B3O\u:vvlkҟU Ԛ26Ч8DECBmA]^U*xfB氫~֌͠(*;ipe[=NEbBcLt==X1پ xdbTOu@<2Ŵ\%i1_tD=.oԙuކj 9lK1@1 Rh&~ Xx +\N_{ [Xsp`jo(hf/:QOK:˺*,^Ft U@a G0h.ă}?3e۱snȌpG#iYP.)a6s̀Œ)9oqfO.q e)}pxZjKhO̷Ω7u2a~Mgpԍ13jZ 5.7x bGZiDJ69H8R D&ͯ#M8:G*!^ݽDl`yn.3{TZkI̓鶈F10YV&}.Ѻ+J}FF9?#}&C^לʉlSKKOL l%΄<1]tr[zg5s"A~N1K`=~d`-myzr& a%ƼM1 ^WVHIE1ro#r 6 g\4z)a:bl&r, x1HO8 ic8N}LYAi6m0%#eey]cA֛߫ll=}eh3ȔE0!;$Z@;GU8|x:Ks>MKƶ%x:ie=1"=J>g~r2Y詑g␯7Y{{2V魷JF n?7Q"RCUc^J_ߠɜh\?ƅ)؅5@ 10}z!k:ckO| d8Ϸ:%r0,Y$*HV?Yf2.eBtCƒtz j%uy{g-5>}tW{ E'WP#?yȪ$gሑ2͘OnF=mRCW(tS]5]k"e*$8r =){WZ!HqC*Y(Tk /@{ǮG1o^RLIj׹pݔc}`U*,uQb v_qh:A-˝.XԪɾ@;ūάq&COр,{`I\X,F$DI8Th>\s=ȩiEIem phܓPJD@6@"8n>Lwjx#)_<2mr0Mr=;^ g4q2>eߤ/HsK 쨮hl p2Ec\p̷%[kJ]v=$*U?|w-кnZg:Ȓ;[t>u r^([>@_D-8f-޷,oP8 g/ $ۊ}(\E8?VApJfLPFLd{` C{w.Ut`ԧ訩wj_Vֺא&!&2Yo\b66;Y]m+Y7e|ս&-!Dۄ5!^[јQ@$GH~,3xEgE鳌[>o: `uy!S2S6F$0 hvA8X mD+4 Nu0y'C9#xd"?;2˶^)֧'J=pplݞ~xbg Cb :̋PJMQw%=^FZQl0*jw,4 #_Wf !C.lHtH\EiC 5;l}S;gts+[#?WPvň#3֌^ZÐΟlOmK\6[X蘽6}bv ^ʡҙaLԤeXAe;%W6a6 o.٣JN ī_,p=hB˅*)EcYK|1ag-IqK5I!Y&]zKҠS[vݢ''Z %iͦmfdzNlt`OvU% ֟ծڕB#8Fa!4<(zC/0z+Mmf|% J yF`SF=e*S/y@լO<3oZni/p2tB O<O3p;@Wmm 鸝<O S8ܷW}MAOBc ̷ǧ3ǭ 1G>(hT$z2q%+hZ_:T?b ԜW&r;۩'5Hj_!Sr,Ͳ;ҫ3S:|4T+KkPo@A[ۀ2"ULtITpˆ`/G%+ɦU$@FQya1 'TvuO ò1l W 1F`8*抃}y mi8ѥ/qjff%'~jx0σʶAqK 'ަȼ}԰cZ.EY=(-U@~]&GLVf!iy.kޢu5TX?XutB̙?bV/#șHV^l,(5kzs:joG{겷ybр5ah@X]IALu"6AVF2,&.Ƒ]C{Ra>%UVzPxepQAw> .ɐ/YD:+;Y)R5pda?GJ(DƇ1v*Q˥EŲ}>^Hdc'؟iբۙ]·-O6/v ӣ uT]2>PiQ9]4خbXKZٗ-[n%%םK)ώK%65 lZNJ+#M6P;8=MFf-a/eʁz.;Xsqp?yR5V%a% tG@Cܺ'O΅a/KO+>B_ amF=qg?^wn31W܈h?Kڤ` }w&i~%?e#[ug UU%5BX!]ЩBtWÉc?gL@!ۗEX<9-7J(G `E w%.}&ctCYFd.Ƹ .%U0g5s8lbl*_ڌ_D 70Ɣ9h`bAB:엦:bV}qNQm܌!fׅ(?>0sEw=vɖGƉ@"2LjfCcdapyŖ>j:[v[ąO;h1(䨅WzG['=1]R@-ֻ. Y#tu ?]`I@UḍH4hyYqP7-CɅ?%bȂ}Db*EF>x8H͘CT1}'A}DV\l;a24nGo,V*EukNSx4KQަsb0܉ w͍IK˵FBZ"_BN>'IY$Oϐ[ЮNmB7aâ LzâXn\N[gxuMA(*ײ."} R`?"`TX(84kZnS񃌆4%C]Mu-A`ȰN|QQPIGuQRތz-6s5)q|Mjq,ܔ2fA:Ac#/RvmDws5%%P"&A[UyUFX\^/Li,zߖ;r8+rl{h`p9YWtYK]qzA *R,@SnGI-&|a`Ҹ  B^Pձ Ի/M[b7f%~qkn;RyAB፮ahg>; [T\^7[wڀ\)OxJ1TX<ξ<C3bDٚF"@ֽE JM]Cf1-)Ā=A5\A,fBoªj;.mEM?nRB픽MI<S`Z޷PJ@ijOa%qe x/iӫKX8ල='#ӗ]ӥŏeN Tih{ @6!n[^J@e>6%FLJ#yRkZ1&TIn(4wg|jКdvoYO0}'ojcm O0qi+hCBŃ5o8{C*,p ƶHt4 "{#bg2r߁I}XO#-}*a$vRL͟pB.^CEʴ![Vv'\)dgҝZ(p t91Х.|3AgrE"Zbu$>;F, Lok\Sm0a_pvs"WE;WJgȤD)anX=o.jp88ֽLN; a3nE7vVx+Ϭj)B4㗍vB FI !Pޑm qEms2{7d USZ a}])EiqQTRŁZR#kǗS+܅I(!o^]o}%epΌPn({H6{% )6d-9FWY|GC#~IPRہ$9s{bwkEk_ DXXnyb]0b6i\}m4@Kh^kW1(&géeS]aFjgOq"l3I`fm8>?U /se.Br y*sۼo[+LibEzZ5:YZGm(J2m.bgz{J6(3Ews׋3yQ{cXRL+E$N1^@W܇dz,f5c< ~)O->H L'jZ 8M( ڠk!802`C1cѤPK@cG[;`\2:AW"&>(uڇ P%=ieB!T( gC,'jg^ɧo;rR %LX6_(:;jͯpiM"?HؘTޚi$G' {,Ÿd+|| Q8SLft!Tۿ)"l$#4PMJ[*))Dn@_-ji~(We-v0I>N|(hn#*%{w]7݅ ȩ􁏗O|GX ޯb_@~O-㏂m#b@Q^$[u.K2LMy*,, +M^(VI]Etyv< 1jFWP=x^eېq&)g^s-鉔U\%s$IXRX;OKઇ|w?v"Ԫ޷A3s5k@K㫢 ֵy{{YYNJQm!'g>g~( ̜]2w.}_hXďc5yb+Ds,կ@^7 |w- PRY+반ؚ9̻yuF.S3O*h7vsCј-DݦתjJż0!@^fMԳ躦/ا>K}-dB4ݤ%h}y0 #0g$ `cT@P|5rp(|P#5޺ق1r$5LZ:gz' i?ډ;)A|*_æm%GC"L~pRb+ ?Ʀxd&wr <&%R&jA?7 ~ҼɷqX^K 5y_ #y뛈"b6$U4 ;g 6kzÚFEi "YVZkݍ{je+-nc3?Q̈FV(VpgwBqZO+f`{'lstLd< E/6sJ#LJ;9 W(G҄%VU>DCK4de\ʋN;Zb0'%Wa^3!r t}:*m(pK[hPoьo! @?i:xSӽn yJ`E# cf_K&VHh1CyS&.2] pY!MN*J5v=D ?n4L;#v8*Gk[m)r@*Y؛ ԟҿx_Zr*و]bBRҺܠKbh#hU/xZ)R@_1)̒hKmAmOrC6hB"q3L׏۷hӔ7_qq=p3W33 .豪 ZJrgka7b9+N/A\徾!2Yp68Zvj;}hk%5L7V'4:X?3A4 }ZesB<ƼslQa CtEH=">9r1mG1;\;NPJُw݌~fۖ+cB*eJ!KVi J471 N{F/CqRB(]d %пJz̘9oj/ӐT5 Ą3b[ʯvl!JGֵ++4>EgC|y>#cîhN =+2K??zVMQםq?O$Bz E"tح4yb-~F|HHCد>YE!)hOdG>raqSSLgq(*z7* M59e]r- Nf 槫 -J@ ѥ ٥_#s S#f f>.!Yzno;._LJP,},W2jBD(`ſpOч:{ Қ7`!hzPDb=H9ksh=VaJWK]&a1] 7If菷w;2>#CǨm>|5bK=81OeD="N!-l{rjS`XP’\m/7tKZe; Ϡa8S TUCl|azr{>qkwB7?ag>/ +Y Ѽ54nU`s;k\vx g9[GP[{V59mکTw[)z'Rqu^/@Q|SquR>5 qKсZ3Y}M y,_B]$dG/m|;DY\B}ӄ>2(/D\4F~"pg׿7:PZEt@1jhf ⬝DZ+*|!.H?Uܦg?IoW%≠n.6'v-.qIRM "ahCWj`CY8w8m<Z6]{fܕd2{rLo ^|]Xc&eb6K%blK(@/P!$nS# 'SsuZ~/6gOR1.g$;8턡DI>L&YRp}@?cقQ^Wxz9r8gePr>Q%_ReKW̒$dx'9aK_ZCh^-^ ͡5oD?0k;|(j(G~0}[6>ңIBѢG:)MF>u; iS,f>g1h@ *!y*R.:/ ߈Xx$654d%#B2_3wluTNj b'@VʧLLM&d5f%LpQAB2d[}tbnv6fZz7`w(x R= pEN褈2rDI` IS,a}z3QŠ8ɜP8VWwozb%"X%`h2Pr L~\OidBTZDSUDYٺ:Dm/d>їU1;T?Tٽ"9݅y$ɺ4&ʹ^=L 2*ˡtrګP?9Pia|=@^»ݑF&Dχu?0f)m&U};1ݮRs  ]Ğ/P.n $]2.qg}ŬI/ aNB&MG%EKkC ;(m5`#Őb(f0 R䛜v a.a/wNb`qO>;PA% oᗥ22 j%LAҀ3͚ u<1/"'k`Y0- c F-Q70]A{-ݪ5e-lBXs%e"bQ~Kc) tեϞYzB/ՔI֕h;|bQz96汌I.3eW#,Oّ\X'1ֺwҭc7ø܁.!' ѿ7=$3Z+~q2 " X8$7.>s.dV7("\+]`OD~&Ǘx_w?RTM(tkB|Oya- S(X:BcqS1+ "'$%dwc A[9<(oG@.8`fee0i6^q-T=T^ QZ ;1u\cP^%젘XY)Gƌ;13269ݘ >EMԾ a*ٖtWyiN O_3 $ZM+DJ_UgS<x"E2iMVܛx-)m'e|wXl?g#)[+Wb/ Rf+hg}bP}?Ed"W֩ STaQd2yA؁+&0}XA"M6u>j  cAڅ1Uñuڙd^@ʼnPؒ"ͪD:X R{NJZx SZ %y^89VlϺf.ې1>jz= y@oh2sjň /^&QnVͮӵEƕViYZ]b!<.G=OK~Zy9I-"&qLcdm.5>81e>p(Ce ˊ Orw_Uc֣z)Z'Ӆg|G`ܠA-+QYyEvP!{oNvV.$J)6k_lՁ6P P;e;SwaPT%Nu=#v>*l+1)nS]3s]gnδK [d$1$~/"]$)qBu.Ƣ8 ș9ތnl^&]\~XbLq-5;ˆѺz"B'zmq \Gm%\(#ezBbF6Dw%[r|?8!2j;B V>3(\m~Wӛ]"g}p,D&+ܓH NIeؠdoXONx_i8 k(li\guRmCh1rGe7)ߩ&쩾jusS/mm>z 4[r57Xbc4P#E>N:u#ѐЕq+ +R ٙe'-{0[ F.fFR&hc B!N⢘!|\?}>w9Fp=z@y ki0=z#j?RVYXwy>WЗ{ibrmgam/3P&D̮`CoK︗k 4Ux/H, Tʺ!J/eת34&>!Nӂ݇Ȇ'ѵ{)5$NoHQѨNl㧙M@-5燈DŒ4-*PTc|^B9V H;r O `͟@2Xo0aዎ1í'S&;`=b1qZ@ *~UVw  B Ι@FΠe@\vViˮDa}ҠCDWr-R0npOPP+y%w p4#lW =G6Xxr굿IA8][GFGxQ-F 34qƆ C"*yH jA*m"c-{/͈kus7A>Ͼt 8*wIytc"PPaݟ_$q)B?bnA2&t`i8'X~5O7<Ӿ*ue,C&,Vׇ~c6\҅&湼NWXdu=+Fu :v:xF;BJTq%VTIRbf e~w @ccJP5e?۟;# mYsi9FhJ:+ES:·3F/SJvzR}@+8"<6+r,G#|N=+S)?V5tC|hJ!l R`Li_Xa?CK^uQKnHp[48KXIϱL0NY]kRІu%85CUek +GmBgnd0uQp:1-Gdv fTl*e ,6V&a5+;{K)Bva2_Ze9f ĸƲ6`KMD!H_ZAV``(8/ZK(E?MA2Q Uj*7 F|}ޕC" E{Lxz6:O*XGJc ^$?#C"$|׏MzzNZ>ÇS`ne=`DJmf3 Z55FTZ<Q$bsCUV WL8=6]=/npg:gIRKI/@N/vsk\̫oهGXK?H:+*^+#fV"4iB߱29t~bE>' _),5~Ny`6 ~蟺}A"?[pQK=9li?ƈgy<ݮ3qُ0 HB1WKCw;6JM%Y@`ALwZm.4brAp sycӦ\n7Y"<"u}Q Ss:F.J!hg[= @$>ă`(>[γn%E<כ<{!Y"z\aIͫ׹^>Ӌ9*՘Ɩ{Tgbƕ*! 'm}])#!ɯ>²iMR;gxV?R m'3^;MDY+jm3^E 3N;'h4*_0m: D V(*v0pّNgm+P$UI;]1ݐl\x^Nz*CC}%wB%YZ8{#)譒BF%= M]WꢋLuUD^q9^$|{.=Io:|R]74r*kW]jaxMK(ޔ:o&ep^V1?VT7S-ːFaR'SZKsii,ev]~M"SvdSDDsS-rG_!VLpVM -P/w~|EZJc/6|lF=ȏݝQmhu.ȭrnTr2n,2&R43GT6@Ӣq?=DVM;2$# B+V~׾ʅ ]`+p} ƒv"HKߚX]J۴ CԨlOk!ځ)fp\D{#F-6|0VuYLX{_DJ<`t*B}O:hjx cGjw)0T A,$}ce^i 7]Yݞj3>^gG C%kIb4o54Q/z\)E~{ktj,h<>R?qCý@U4=φ.#g*OL[Ξ828%?Fd=Kt/ާwXV<~Q*#X+]&}3w̤?ƺ1uy$l&p(&: >wò=G ;4j[6YKnhZIKItEJ N;Q5&aC poZͭU@݀"?{ݺ}CC!G9&g+ G=Ve!MXps7voTŸ}F.Ĵ=!uz, -s\oOAW  <# R%DI@g`Zw!Ll{xRu/M>aAN W{IO0Pv}ӱY :,r; '׀̚rjw{kyR,nf!"im:U,`ջ70ٌَpUwXZߦNXD BTys+F&hTa}p H}_6V ${ɱ'V9C.0/@7S Bۀz#4%%/x^h SOm9)AcRVP\We@18lT5TCVR9DGʃQcʖW?Mjd$s6|KGM$ѕ&x @iO͇%"Sx; %w"͂CqJ <ڌގ¦N'=M=9s&c{ 0f?:{<^w~G*S_!r}gH~"mC À&\oǁ(a{ ~Yɻ|ޗK^InPI3qݵF2\yrC^UtY_'ϿD6TWAYQ渪g<3E!͉1ZZGY H6olN3!EVPG(/7(Jތrc  Frc&u00ƍT7iYZd%އ>5cI~uhB7Uoo5HdzS]bR4 +q(ǟ:ۛz l=e~ 4 } ~<v$ixC0x5¿UP@SEBt1``UPW }UcJI׮8L,E>cҩtCueovgӯ7]Py#(ƊgHtr[3\ӫ^~MSE3sGtC Jcװ@x|lqTJ,Ù9\ %JcN.5?Pu/L=mCl˹f@VtUSО= O+dCK)mb ^fK(ISd$~=B>q!>!iU?[IRT?0`!6Yx#XV:gmEYԌ\}smrdfp_IQLy9}P8*Ӝ47!h?{RvVt-c\Oi%MiF5@R3B !3~DV|Xոg F |/a57aa޴ُV'l]̶Ǻɀ ⋨ sJkڃŵVa@Ƨ*>=,{ ~.e@T4V]&}wygh$?L1(߼Đl{YݟKYKFvr.ak m0WAYgs]=[?e5,C"Q]PCN{(zUN6]q|/fי^Symtcdvgq쀂Elˋ.2Ө=t+QWO54bO*4*fS#rg.+e?0LɋlNvvb9&k+e3^GREIfj[Jh+eJo]?>OOsYgQԮa² /*`#(L $d!f4 0³3Uʱ$I 4퉷 qC> NjEVlT_'~QX3lla Q\; u>U{9: 0b#TȐP8] wdW&쨏ec{Nhvޔ0X#Cg(W>iru:",3Z>VݔC8Q9؈LÐfQ%S#,Z (8 9 >2Iju:j "0DZ~Me] R),l* ceHW8c!3d+2Zk\[  9gAwάUK˜Pt,#\o`XPz>дmĈ,0{@U'ˀ69zڑU0ϐl~Pa373)@ݹ5믘R qqzb1 OmԾv!ijn _1D7<ה(eH@u]GPxwydfmJjh>e>4Xꙋ`X^L5lX7ń Hf~+8#J/+\GS-7]eL5gH2W0)1|QyUWI@; wV|C0΍A5n4>  R"ԟ;=7l&WOnf="|+=Wx>T,(74|Jx&?G Q"nzԈ1JbpV7a<}ǘmdulfיwIb[pڤ . :狎Q'H .D[#JO7[ƊҽBQr/kDZip2O+h}姺6i#ϞIk2cɺsuX h4h^Tq,sn[Mu#o5EY(ryļj5.+/_ ͽ=hqWߓwѨn>q~H@+T&v[b#yGg)u#H9BdU<'H؅i  (M?zxFTL𫥻Sb˻UtH=MsZ0^E;d=%x8+Xi]JM^ZHڛʸ\lf '9yE! /^m3x5C--iQ ^/( iԮ B,ѻ+}i2ZxdG3=XmE;jB8qo\L??7EZ[ytT4_NER!Pϻ/h%GIuQ)dv3-.kX{ x[OJnvM~aMX_"W"Jʀz{I $o2t6'igkє~+%.j^m,]()Ao*E[]'0/Tj"e*zC\ Mo|yspU\|ӧc =+8Ð ez_NV՛^;{-f/w"`p %Wv65"@'Uج.ƚo6#ǿcш͜ק܃jzGEyk fplؽ,?(pͣKr|*o{FRM2EH}jM|?ԝFsVbMB,)ugCy*hmtŗ<ך1ڴ0s$[H Ȟ+-.( V~Hgs,R5A. b|4q%XwB3E2n`;/0b-I*tn/r `b6&"6:frlԄ+.>G>=`jL:x-ƈϭ! d8[O.:mnȩ6H)HUe9VH@eV빬k{OAB p*?*M ϛeZ3 ?f q,: ._K"Rl9mAV;G8=g3R0qhHj9km)]nim@bSV_u1ݏ,mn6cO 67}2TQkM\c(r]…^},A*^a篰 gSϺ{&9b =<1Er 9YR0m1WۻS; U1o:B6VAb8aMՊưZ7Dy?ϕ7"BƵ.p!l?=t4 =S֯*>W4I|F4 ҼI0%H>AŤ̥1'Cې#8x\0YU-}C-;4U/L9UuH: f;)aCxIMj)r(ơz&(imK keE+kAExaL$BH˜& :D7GZ=+z(svV)VHw7Oc;26k-wgu=o:aCces%Z޷hQq!ctܵ] ٨S}PZq<8 |:Vd\`DW|@󃒡m4XiYC1XJ_CU& nKE¼LbzDL].An4b08L 3Ig˧.ɥ椢Rl I獈"#AfVj d G@ߪ T=n2jlէWr@_NrKk&.-[ C/V1#6ㄡ ^6({>uYgN@?jys{ꦐgr; ~`{bYwK/JOקK-L!Rq*tp,by8YZP퐵6Vfz *vs+RB;BrӶ6o\ 󇚑 cߩ3:/ Ϩ.Vi,E~貊ycūn H?:yV!jIs %~g{ic(-B/fe9%a= =Dnњ+ahyix#FD}h@]*%M3= 82SbQ?rDdN6ޓ| -#^/dߋڐ*P~Ԫ$&pAnyUY"qF%&V-Gm2Vf3+]ASMH6Q%Sm)T/54rmz˷ ר$޻x }n<|I>L󆥱:FSnɓ\6(|mϔ1U{ri[z*Lsޅv2*B #b U UM9/!e6u#J%7=e)e9\Rzs $8cB+ QKJ%0KKm[qvٮ´ =*wZ tͲ6;CYMnj).s9+ɒ6?pоi.Oөe_2Ij6ѐ =BD*GC_uݑCıESV6kJ"=߰H* I\+S?/6"R˅(hB^_yl 5~g`0!kA NAzQ٠w?ώejy6ޮ6J%1υ쫘RxJ`4i_3TsR #?nEL_4&@-@ w+YEo1ECׇF]¢c($=T|2 r CM0{70L.PEDsE!ةdxܢ(Z)^Y2GCy\Ddp)QP@̏-ͺIglP ;:R'QPqtT6*ۮy0Ά̊sR˷IE1;үm1f,y'AH"Ef|H2s.c+] +IZe^QfٛH)bvQF[SNW{![&!{gjJ= ŰR5JijYB /dDR*e9gQ=!COP)Z1Z'.L ۵oZo2|r|< ǯ%c-8V-t vPVI y9F e p5@/قer:[ɲ !ݮcӬ{Lo)ob ; 9Vߐo-guXӰ5הŸR1iHHY_;1=G?l#ЊΔjc_%-csOԳ+I ЬF; ptN ϒw2S֕N<RIRxQibW@(ϼ y̨S;.7~+a?t)Tx˽ o̚䈿2^2Θ{4 bg ǟv~@q6v/d3K{r HҰ VdOᾄh |7pEMluO$ŝ$j!NV̫?їu}sI'zr#3/r䧉7Csog[aw)T8԰}Ivp'$Y - UԮlw% ,{I`-mo/Ѵťd:+ n'͚uM9C{=xΘqB0-CeK]ї^XFF#v0p{Nv97+) Svd /Ȑib oՃRL{]dVN1 qd ]M*2CxfAVMP"sGBLHO$Wěz+uKmb8(!-/]KK]AQiw7~zKoYSV8&cjѷt ͻMlMx"c.l:qLz{[d$71[5_k@c}4" Fi,t! ˛ug:HGY.2tO]%3u,Z$?LĔy;݇8[I ū{cM@YR3"qT]暽dJܶvlF=u :C^4ŵttg $A@Iѕ<7˫ZG\,$jYZĄۣ$r;- b"ck&Sk7|hjz_­$ɽYGL"WWQiP#+lŨvSU||Pdm$D7CM((@K GX.)Yh?-{>3m]~)Eq=,3"YbN-IlF5L'-2\֥ 'ٶ1E޳ռs{z9#`4l<d2y)WYGkP#SeJh:SWˮ b# ,a:'FCK!3{i(1wD]6o/]41Z(MUgV-lX<0xmIoʝoo̸5Zy]'^d?'D ;VRDKPjR7 ]CFGcl dNYAQZq E5i2U,zBT^sys[`U֏oM}aMm ۘm_v {]%HO<S"uG`C@R5uODoWpEL׺RI">ߓ[؆D=]E`m$xb'vbFBP@L;n0I6;͉0K- ?˾idOs0eƎ. :ڐyZÖDeLt}cPNMYV`kSǔ[Gʟ1"b5ܦRʷzJ^+lݠ|rr?ն.5By|2S]qo؏AY8nz^Hx7F0LAMzJZmC_tЍNQDnC1kLҿ̨4qIC=ݗAX֑XM}+uΪ _:)'(r]tQۤn3ƲS_eC.\_"Z6O+TU8__Gޤ' Edˡ Gj{ay\oq>MTOzH:E3H)I\7k 7I#:tHi<΅tVBY7#m(M>+K@:̩0tU Nܛ*)yQbP>*f~,[4‰Q^N:}ƢUi;6]aϑTw27MOD\SO7g; SY2bpoܺ k%մIt7^]R4nQc-[qOvUT%*'#@tvbgDA25=nr4W`6Ȕ"ʹɨؘXj؇e , 圠5T:Жkuߺk3nfc-j X-;M*gdƐOژ^OPBW}. (=g>G}㙻uv Zٵ;Z"C,^SLǁE-`gNvSUK I%Ǖ8iD wm?qnl镜9QƁ0o+5F.A2O3؝ьjuEGp4 &Ld,p%KvU`J g w]`& B6$)W.P0je\ɔ@zs )m. BDV~2WcJomևe%ꗐ[oݩ%"J@~܆M +CC>Y-}6|Jz"CVHLLJtnT q mcakj?e,'Mx 0+o% E+X-*&zo^z| `տ.ܦ CbwӱJ\.P'dm0엡CεS5 ģs^n 'Tcx/W{wo5OhuE6(m$[m2HT+Lg+9G7ƿ0'$R{{&(GU|Qv>@.+e5To@oSZr+~,]x( O]3fcEc=j.s-=)a]A2.) RH'JǏr#1gnzOOɴ3]{(!OxkGd:AloRae(=Y'zyH&ǂ5x>y4GRꃘ޼p[' 8-.8CE?NzOCmvG *5 hydzOXď4j4au Է9%rn@JB*bG]UF*ZoGf]BI% ,v[ OA4TMCgƋi:U Tk`"yMKpbc3g) N{> " 6ڳ;Z ̄WSМ:m0ls|9.f&g牤h ^l'ϯ2dh^vv/ Y:=(fce¹"]q|Si`p¿/PRt-*_HhobU6VW9Phu9iq )ݾCax|5Xڅ>]`*Z}R%""gȏCԠ_> $o^I^$\I.^GŞwA }d݃'UM|T}[pttʕwh.O"l+}WkInrＪHnX&?7EdsJH{)־z* 0< u/vk4i)LVaǬe2 KEvLe3T*v3:ij˄Lhٗ?0_bF2F.(o Sa L;V?(@rb1͙47N&9.JB<1J' 5V㝤+k dx`^2JrpK$DȃHҼݞa*%VEA6UsbθUa:f5j/WaZOKKMx>:@">A}B8[#1C2s"Dt7̱J+!u￉gt 55SMPnռ+ƖrPb}bXD\ T׍-hIP)ZSԜb:1 ;mTz稠د0A ?.&+46+QTy"LcΧ4{u:"2 V_郙Wm]vss c0Q1MVSf`M[ p6B ͺſXmM`N|[TvqmaxcD(NȀ &m}>jN(qyjo]񘄔zЛnlwVԮh^4ܱhm'ٕz}0D$'/!`}Ϫ/M~HT?먠e)>ZFͭ7əyt`8f;IT! :"'= r>{ B מac=3czH+cFcIƁn\Iqb:V%x e$eS[p4q N8+ ƪĔun}a?Y_{o;%T̸?Ӟ3U Hp}".-9h vu' %hFO"IZS#ZS{:8_O#A \/ۇu.Pj74#ŏěNh-E!ϖ;7w*d -fTmEL6)MŠN+VTqjo䱅(!%tQGT`7lrkcF9yqN6ɕ -"18$$11EӔ O=4o-ai`adj0FSX4/z'>b8!pLyzKQ`)ۮB0sWZ'Xl̲)?w¹P f E8 `Y-AgH&QXaa_z\t#wmcZl1'$('FY)EyUUQ¿ʚKF~7L<ۏH!clX3FpJmM}T>`ufY^S'w[0@36෺Y㇙qde:9sJU/\M З~"su:d'H8ӈlƅI~Q((jobv{"}' ǻ:oS$Fyp$[e#󔭰_Xfu@1R߆`ƛ^fh~%VK^_%j1ii.(RRm)#E7or)*& Oy2&l6:eőAk>f*5,FѳSxC j]{`ՈiجzFEb~Q_N!~Fk/gJbm{ܐ{7\%4]IqAX!yd`ф 19'j 𒞧A/m޻ eJGP!:Gu~#ߊ~DŽ6,'gҖ ?1 Yʬ>q;&*CgGa+]%P')ƈؾ~\es8ȉO[BOUVUmS+dbX ݯd_ܨ1)~*F)u}rƂx+HQJ-z cA(RbXo -09D /(AZNdiwLɻ "X} 3/p5# .wA +VW?!UrLyRʖ򥍜꘸ctTMy-W 4IJc=Sȉ.|NMm6dJ}%5oVanґPWLw)ihƓ1oSگt6J0N~j+a,pH:gk`\u>~.B&l~.[Q -ux6> XEeS_8EK. 呿]%-!w$n@\ĉɾ䒁i%O+boØx_+F5 UCc*7qsHJgG2@)__եU9ek$,^\ W#az$PZHGYO6R1^[HS ~-Dz*uVM }FmvBpm~.NF ]?E=HI$ }*z="XA ~`{yD/юwӯEvY!Gå%?Ȇfml,vA`t7!leEbj~6a8oEU]2bBy"r>zL 1DR"[^l줦Lp~YNpj˓&?1GU l/yRZfe3l^a֕7 2atoodw5׋+ՅNϢ1b4cnd> U:6E땪|Pp[+0YvZ]Ʌ/w3+RE*PTy{!&$gY*?9WXxLky oiD. "2G/N071!w0Ȍ/4=YÈP*[@w(=<oFs\#d~2 yCkf2MTᝒĬLQ$l,,]_=Nt: Z5fŸ JBY/x %4e$.߾pEH_IA`'c* 3 ^B;$[_덳WW h$WM}v cRxϣ<4PN?ѥR{4WʳXGvlpO7I;R>{\'aCY: >'){_c.]!\)<V:xсa<q ~hV /b1V)z)4g~dvD?wӝQKuKJ.a\Lx x| ?mcp [TI -*As) y*+sEEe튺о9-j<ƺu-#~y Ru ߌ;viԓ(@-EZ>{bjo٠[\rku3ҪGI9i]d c)tc %AMc3!STsY6T2ޠmhv M i~4:+OPx`OyXܖ6Ec/cQLIi՛];@%wa^}c4JH_a}e;'"-@nGS4c{T}-`ym-\ts:%20$Xa`F&G`NuP =rj'EAp`_PA롺n/Q7E2uO G.=:317(HܛŃgK8OSj5DȻZW-FNʴ'[VԝM*r6)xPLYF%ՀDPeS W;~4.MUݮ)f;~,k9o\ҩG  %q<dGT!RPEeppv_x)AnlGnnowZ˼#|=}`̍C„z[!>/<)1M#5ܞѰ*47.;xC ރk:,l!&d8Dޓ|Lq{VŻ%G8Ά뷇@~:{jb5 q?KʁoW$/ɷ(b1\F]yTŧ{J߅32(>?!XrWTƓ28j$)ք9&8:օ͠o ]diOg}hU8x m`.&VAT/>+a80&+n6&H-C-;]>iˎ02R%N ?s?SALg *g)?ᛥ3|_|Wҹ%HA^vFe`1gUuERO' OYUI&4'b6 C&2?Fmƞ/lN4.z$WLs`LSrdc 8|_i5$XM|Sܝl+(<+TP3*v,ڣ@2ac@XF ߻\|)xҭ.hAgK0 @/%Ϩxn72ONêxJY\(zJ0߭Rֻ{U;?}d'{ʺ1jQb)<7\r%9 RN5UV6AG0A%EE 6L7j!` B6`;ɱV6L$Y{ Cv @F{SK93B Q~C\5F9SV}ԕـ%b6V^F))U%1‚z2+Uܹ\r(THB2V  ?fQoECNC*ϼV"2c)_4*:y<5M,6_jIe~߬73NHEK{+d>|(cI}];6҈hOn!k}lv!mozF$;`ͰU cֵl|չ\r9PսcBXp}25axu6!38+eC}ðC\|Lv10pyNCJ{}) EHgFkQaر 1%}#fpTj@_YB؆n8Zfkgd&!\J7ٴ85x{}ȈMT?p ŭ9N T8Ed k%J )xIK6C1ES'İVAzhN*,m1r-L??B%զa.w&ܽi犕%ݟ2b^6p3~to8t@^CFwzh~:O;zBװߤBm>E!B&O{k ǞRD2C 7((7EܤN%#C/$LQbHy%Br.vע~3'ϿUcs*uy,4|2}smc/ꤜ&Gr}M CpMKH~ DK4YU}[ 例-d[dI㒿 =]A ۥ鱕I +QYI PW^vᢪ/Ts,g!!?YD꯬юBGNÖ [3@LcrC0/d|𸼳1ye HI/#r1ө8FAe1i$-PȭL*jBQ pAJdSpfjG8 aaDG %9))/A1OFm6-%'@D)JCɉ bSF4> ̿T! dEe5+}FkE5@BQP6F]=m}3u<XK@C]=#1G,YF?[׫2'kŒhHƆr7 HD4EIǁe֊MK?@>[ZPܧ?ך\ATʆө-8%'xs,n,z6=! zi%++fF]q l)]w2'63}3 66Yc9c}ޔD~&F % ܵFVg"Mg,D-ҽ@PVcB\h<5ZDՅlVQh>սŖw^Eba>A%cF6ُZי$WAY9<ϓx0bq\Z +eJ [?OZ~5>43VzI(SB ?oY VWVNi_@-վRߍtwėAiRdGWپH(vGggEꁧY-h$n> ֥ 4:kahkp*[L6 @SU &.I"Oʱt]p76^G3q :)@sx?TI{&_+ NONSm9plJ!3L3M2-Vg3A3ݳ ݿ:ɟ4f!F'Kzw*ΟcG1^Z,z`cZ ʖKMl 6# )x}Lz@2_d,#Diw"XsR^ۜM+##WzE6}f6Z+bGr %6R%_k!9ljK*|)9ugTm쩼4ҿ<\ivƯc]O~oU:}Mw16Ԏ}7Nqk]3  |xizA[A+9[:.(&MX y`~\l E*)KggKI@ }S]^SIxZ'(;$}ić*9>q\Y#3_{ÞFQL-NS%r_osՎA֤Rm;=yS[q}ݗ펵ɛUZf\W,9o>_&= p 05+,9vI<ՂRkx hq\Y m@CvbLɛvM*$ZrO#Fa;6;o5*@^.CjأE=|mSD74Kz<͖ҽP {ǐv^t&=RG>ڽ[5iSԨ ;R6bYl8%f\= 3n3kPȐC/ZbyL|X\Ʊۥuq#\Ӭ*œ6{'f=xtjѾ9,Hz6ͬogf( v U*<>#UFklA>ZBI7)M(mxBʯ.- b#*0waTP!5r3ގ>=h _UXmNRB&,[ ϯjOg>qLq؜vg;u~~exI㚊2l"7^)+Wߥ[nkҋm5KI1v*Ql [2)$Wrs21vRwlzް~3!J]ځ6_B)>҈|a..Q+,5cсQrU*D2Ww^?qt%@b;r@[F"7(}؏n]ocQT&wГR11r\h)u ꮝ[Ί,; )cd@ C4QڮGƇ)LE.3Bue' ~|Laa f7[; FDћ4,=͆9b=n7h  K0̤s?G<ѤXw4J"*zp5l(4>~J_+%ߋwu聗sH$w8ꉐA\e><@S]WnN86fkATB:<ӡ(f2ٚs ƱW^vƋ kA&x|!nk$S789*17MI/(r"vnEwxgޒ~ $!TS2O7%?!Ob|\[xAg^@b͌ aatD/ߦ|3LGL%y=\9xFPGmV|[8vL'k-%}- Pu)85tտjO'P+s0Tu~77EQma*rSq}]|RoHOWHpj&u\g^U"stf~(ZNtJۅAA޹VK'0Yց0 7WXᙀ(X )3I>ՕjP$A,Wrr0Zc@ ΨAof3J5rki'Od'܄Lawkwe1qfWˮ0? e0 y:W/c5Z-fO#`,G rb,iPDٛULJ1l k%#?.nˌ8Y-{3O.`"PB11 騨 e9$tu(4-n OUNEna%lBUF;|,Ma"T4="擜. sbPAanQzN Y0$V69ύVbнtk Ȅ}M4eH\`/o۠gPFrĬE]J'ISI3Td\Rݗ K^}36 V|WɈ\Dл[?7fʟ(ÛΘ=?K:g)Gu5X>8%'h11IְSz!Δ} qvg&ڮ mt,]ٳE<ܪЀ3aoo/}@y=tn2z~|&[r%kFm BR6{xb"22*FfqQ#QA%wO@v)x6شNZ_#Ry!}XE6;بiȱͲfkB "r7@f;W8=ix,'i;5ֹ:x!.EWg,(- ƯQQr7 (a]I"~*Zݲ>iqۡG'5C@JGe V(^]PPAʡۘk@˺0Ц ٟр-~[N)"ߋ;Ii}SV!p}X=Ng[?`̀{Q̪:3p k]P{ h}Tr`k ڱfMw ?-5#ih olelnx]z%kZ^@3 Vw:'oOI:f$-6ߐۓq<.좦uǢKZ/N:R1ԛ+Jnk^;_J&?JVc 4:Qh3Osj'-© =IuQcSI0p731.Oi+Tw S}3@R`H>Ƹ +It`a <0"K%޽A.Jv/ApYs B\P-b.p4Qfݧn"'Eb @x!d03{q N3l}w:aַ3煇h3ިm8ݑ?PfY2:L㘿JH[o'DcZOt1,%Z&;䍪!c(EP- ԡ3|6_MnV\5Tng ɇvk0{zdw&}=qUoe]@-š(&i=F5بle45}ϻG-7)5pnDڍKè~R9\"/: pE'n[<:'dkC8rlă&W)C5!"`>jl®d_@ E@_I[>gM)&(`oH%"M{Lx:mctMqTs QB"^t}J ~rH@(X@ &SbE%0@U_@Sp"8Hw/ T3$PBQcVk5f֐7Tw xBF}Ȼn %$NoGov~vPm?ٜagg9! S/mČUR3IH@faa`e<XbdL$5i@}A8@ g߫Xk=26y[g? :7fT9 vc: 3c"I xQmW\M oB|  У&PsT~SKQ[ lw;mMcZbt `\A[EtX^ ՍutJPP4 mDY0D\H+kVnSmJιq~V8}JCJ )M9<#ǖKY7FMbG;bc5 ?ޫ# 2J$WDRk3"ץ/Va;:`*L#8\l֕_(cCմ\y21g&t?0ړF{(sNж ʄ⌻5Y؇am02/ƷlҪ%Kc#kgIaKM0u`iR@Ͷ %h Γ#6?LcFɆd/Ev.ʷrSjIAD)Q?r!RlDl/00v$ Lc~V0o |=% o94eD!}/w_SN "-OJ`΂@yu41L 0z$2:YEw7=* 3KW0ݎAqaZ~,72xNLP7,R$|o1$r PV9U=(ŗ_> H^‚l#>$"kLeM _A|d3xޮmHқ(qkwh{&MTٸ97ik764=A&M_/`t+h~a~U-.^,%PUH\.;C/c)ҿ Q?N˴Ƹf|[C)XFbO Š Tzpj!M v\ v3bNa~k(>Jk_Z3gDSV7‹p=" snl;MJS9v MD]hU~~~WՓ* ԏ2=qx3(MEݶH۫ʹ[ w8ܖxXӜiJ}'18. +x#EhlppDzCM{|ѧM%?Q~ATnj>**D})_q2 o>DR$1!1h+NOm\ho|,62Y-ZW9ҡ#o'tejOC#hD%4d5i"#gl'yX[Z'\| oGf >cLO䎅 vƎ)HrX,!efJ)}=zցE#Q';H96ڪ籋=l>7op(6bI{v >jlٽ|gHQ8q> J, ׎[/s_!r/4|xpO8/T=tH+NWȏioL]8O6@gp3Al&뚖"q៩7#Jn] ]( b2$RV $j[?|Ry6ŴtS$`?ceg5-@  K"֒oX#-Mv!yJe88>5Y uwr&mw픖!6ldXܞt 1[fkd4]Y4_0-Jp'dW;}U&6Fl9&JT[s9ÿ/kv)NPؕisIC8\>7GWz|?\kp{F.Eۢ#+}EOw&}1ֲ:n/hwXAVgTvITq<)w{v"ĤK>~9LĿctܢVP-}7悞R}gCOD@-,yx_dڧPiFk. M0<ؕ(-zB3UVXlsװ,ȮYH+*קGp% &a/8$oa}^:;&hZt/ eA¿qvyU !Gb`EWKfeYPo\k訥vvo>52_҃UTZ&G>ow&Cb\l9Yܔ؟c8wSTK<#A?_e)^<Sw;<_Or;i-^jT^ڝEn7kDrqU!%Qo OѮ2vIJAuj7խR#~XxwVg@| g_3G;1$>*)mcȤE4/Z<`%8bd ,bP}6U=O} nfE>NCAy" 0崑{{a}Dv`OhF (q+f)ؐ '[ S ،V ꓝN0a'6EB-r#d uFU@ze}O zUzYSs'z6`SYy}Cr' HI[`N_Hz`si8\M4 xD4-gѤqBaႥ!O^ ζSc޸LMeW*@?+1^G$le@8_:2^6ԃvǺhH)!lMϜ*O;t`{uN5@.Nwyb4勾o2Crer6wY%e0v;0.h=dSIzTnjd'9cǝ@;[]DݢF`m!fc(@A۶:%dkp?Q4 Ж~cb-n:d%;H؃QW]G8/KYWvC)\iWŚ? Ajqzj0YC㾁'.0 scC箋7pꤋJ5UE$LSm.֡nBə8J!'ʜ~ДTh<:Ђb{D:E<ֺ_M2a^%sriQ:Z4s!b1bq@-JR!NI?_l+P(;\\ǘ _2Rؗ}S-~YuLtΔ<KZk9i7>U]MxUtb^,<*~t\U = J " ڟ&q^ o>/KmMfMCSu>$ѰV/NÎ`R+JN#}=A^P6N _AUӪϯ8%ܢ-(?0.:;IJDOE_/V܊H.IwC(>NwQȃ ]<aE)EFΉ$O.~Ź6_P;ʜa\M)YwPp;Jgqa,MIQqRji,+\Pɓ`yUu'dnIO 9q>,f~,.8.o0{t =U단{)P\4B2j7/pd6/'GvߋpA>iNLDy]pu+oXnB8Sh@ qYܕvו`V`Kz>n4ʫ dLdHgܙGMH818.EWjK%sP|;-$s*P+9\}2bpzEƑz)DՋNBO);dWcu5zĤN5>8!۫:lbJЀW;M dY+pЖJ_ 4/`;vew@]9"XCgxx '}'{*. dh;h pWAH 09𥩘9'5 lFPjXf/hr-a7VԞS+ %.`%Rv6h?O%a?qp A W0 p?|4`.*]nR ʾmW,v=hpFQ6%H,gnߛ`6v]E c8}k{(S;-yMNddqM諮]isYL$@Z&𘟿j:9&]Xzb{y9b&[~ߵm{jaW&Kka,W7siRcLaRg=BWp bAKAfZZ?uz gᮟC/v){Ϲ!)$9ktʬSe@bFRDM0HtBh^Xeh8Ve d{wdRXnZE0ˆҤ {^W^9z-~z"qrq8ЧDJ} g((vu -.'@bt0P͌GֵNtA0QHA\ :cF˵Y+[HSp quԫ8n+E-3ҕIS?[i#P7zǩuQEtcJUO|`44K3iƝ?>UT$@Ny$#d󸁄 ͟>nUU^ћ |g#, t>W`{pLl״fx&JPd+' \;a1UL#apL6(dnjg q^EB¹XŨו qoj@V*&m`{$!/t1( B=? 0ko@-^#"<̃<Ucԫ'XbԺ@(s\T(W'~l7.CFUQ=p] 8of{ar*U5yZ~4-Jy$ߦw ${U*A[ r Kk|>)LspZP=AA1@VuBge$t~>=r@\bR ivrRѫW̐{;rڌ]Z)B ͠eQq`8RC1$R}/G~?9llL\dm6)'jK+oEOxM=Z9-2V(<ˀBa3) /ԣZM8onmhwd{ɔE=!z*;*|zMۛfե3|?duB.'F5:d6X[f<+cI^thü! |{r$~ˬ$@)2 IJR=6V F9`3op.HCMcŬ^͢aD&Y: G,[NN_tI귃PJukT7-A%"/JfyHgG8\AZ{+]=rÚt[OԇVDg]s y$i|dži?;UN4AOi[N_u3t"fjTA yg²fiQtNJئXִ,$iNQC\3L ~v2\&=? ̥l%Ts~ N0Cԉ>vnrW^z)x> @Bd8v:WfhKq*%Dwe^dGT]ᷦc޳|^V>TiL8sino{"G\ j/G^f,lVlDRXk/@ǒAtD*1Ȃ8$%! Õ`8>ЎfXA" RS/l,Y+I=v:#@aC3*wV|#l)ۍT2[A> ~855D'G@\ys^Hȵ=5h1X" xazXWrdأԼ41`к1fc+5o?B0xpIn [AYnoN&ǥ/xik:DrjAaÛ(% }9NRiGiA9,KOeS|MPTS7_({@iSxXQt))m m%8sqk:Ga.@Y5#wAlT2݉ʛt6"[<~ p|\]eg*?OD&~0n3 @`# &41p%Ӿ̔^2pp*޲Dg`ɮtnޤ_<츔G n6r/?x|\v.LZ RRo^aӗneL3h5)f*n,w-BƏ Ƌ|%τAT _n+,`a,2?\?Bs';.d`đU'g_tX,nԫ9MM+ BVW͔RAѯAh'ϗ3{GB=K4(c@*iTG|述'\'>ovtӼQ&40misS Xqv%:2L ֓ 퓮 z0٦v'oDGwF|40žc.J Q/mzOLnjKʾI;8aG Sif( *X d,08&?Rbr-3bP}+\eI<\`fj~„hC C& 7vbzotCgݘRS.P^תX:Qn~9#lT1AXtV`7`y?Sewv<4b-Mҡ(/>%Wy&]1RfDϧc3b~:vcCrxTkeR=n6mYJxAYD3*-2ӹrFC +_c Mg-8|h#ܗ(dMxB=%O_> FҤe$B>Yxy_C6gBOTCݱqF`4ծ[E6<7{|4/Z]m){=ՀytҶXPӭV+p鲪|;5=[Ijot>>g$|R+Z%z4 $MA"G3>|]HMyt7lܵ s: XXV@TƟߙf67{Hϑl JD:o` %Q{>B|f:9^ؾv95&U_1ԕO<@gIjcgɂR C ~oqh4T?>BH-c9Ck>!i`f@bS}" 5.&{HP,eڒhq*x[dfg[ )ކ!u<)Vm)S#{##nԖL26m5PdDPћO S}~DogNGf Lj|iPrX9 0fÂ=oT[^ |=3A萮"y #"_9;joIi$55nEpwW>+eO7WoZ\7`JE|Ty٥>sjf_$vX:!8t+cA$(|H3/L1=ջ]yYL;=GaI p/?%gKjn#]%vA<`9vvW-Ѡ,e%[,P87G:M Qf`Z x9KAdf;/ 'nMߞߨ>~. 1_S6 <eJ.WMlwWſz@,gqG0</'}+/iF=‡z;*)c?/2k6 AHZ靠pFP}٢ću]_S('Nb[?CVPNhDv%g&Xl f|dRrl~>m1 (BkdqJr)&JHqj1T+${S摃Pv8khChY?(dr s>jfJ$jZun_b盋$[YG앚(<^e4`O Vqvfw)*!9aг#ˊKKBh,RrySdۙ~4rϓrTT'eSf^p#jECv&t.88;g>q=HHi.hCX/"j9лTY>yUvn39mS[1JAʚ?kӮ&ww %E|=9ǮT(qesY/* NL9zڭL || 8B>h-va槌w/'C{f0l47ݗ77db|OܖqT$xm!`*gCL'7g  ٬tү]PH R#L|N5:A97+ԓSbO$f&CLa^.J 6i wov<,$e^$!dp.Cϻ2,svq"[5ŅPo-4gi>zB`q1[.GǗX =+=<7dV)Y;-ɵ}{f>hezdEI &:O ƙjSU޲>Un0E \Ti#ƩK :W-8YJe0z&s5|qjdKi/a+Df {M3JuK&Z3, 8, UD#u\qF<@̎2,Eֵb[ θv$gh W4,5agg@Oo36=*[%\l<wGh*LY3Y݇V?|$a\)5b6J?"@ԺBM[ z0~aK^‹$g˩`Z}#'DK}t<ƣ[>*a ]7!e*TL&G΢sDʷ-v N,47L.΂#9OOPFkN=|s?mZ$.q[%} 9AV` 6ТrxZRd(4RB8}=rߖ5Q ( 4abZ8,Nw5u|ok=|03͸.! A6'qjzb0؂zNJD% a31^/ڏD)~CHaI'42%USIzL7ܘY^=@F:IR ZM^! W9%NOA%qg\\qʯ1[))"M8#swmVRm$I1ƙ>hW~E P%/:]e¯l|#e/)OGr嘵M\b'o`ֈ(ضjix!XGzv-7S RَujԳ A6 I)ԠCOüSSj7A r}uR퐎D Ѫi\pJu e޻/&n\J{,CM:V5] %1֎F2E0ܘù)Jp_Xlgz? (13D̟(4fyN+A9&q@>T Iqy7Y޿d{>G* @%R3#N`$_ .{;Zg5Ǟc H 6R"f2x5gP:lЇj%!b猉eeRoʺr+8.C\csI5S}j@JhՔ-]ƔM '5]m0S{ȴ݌zԋ4wtwH^aFo$+ؓ,Z KE(a s+|~;dwDI!M" %IxgL*TW?ZygVFn\0,+6ȓVׯxV4Q+sQꏜz<&W%iPx%Oe&~ hҲz(xG$GZ?8Wo5joJ75M'O@;!^N΢0usURNa9LI,="I,<55o :䢩LƩL?<۶?}XPKhqn&â߉VE+Vس?OZl= kk/MiM{>sIc0r3$zEc ~;emvҽq|O07`pⷂ!wo#j F9R:4x },_xz _Wg>\^qmvUlwˆ.pN袪p ͫ8_gWtj]S?묙I>WwК6͎ACݐxŊID!0A +Ǧ Q$_רZv]O~"U܊8E2Gd0hf$6U (܅*8{gژkSٍZܞF7oI٘Y:䣠I3LdRTQbӄ 1cRaͻ#GrQ%3>cF])rMx=(xDDGϤjY?yR.ɟߵu?C ̅@C y.>DIWVκ1Y?Qey װn@HE[iHLJ;ӆ\A10>=np2ὙN&FZ[4IC6O]߯@Y2|kT!^1pk'\҆ U)(hFLIR GxhD⾭քԓMO}PB:x+~!f<7vt>t+Ap4ޮϦ*9Di }εR:}I\e{~y?0 u--)z{tGp5(E0ҏn3`*9E`t:~d¾ A\ vda@hVtk)n\{4vV9iUkhq*A/S3ncɮOWˉgv*ue50͌\eUXUTRӴH?YY='y71z3r2ܯKOl ܵUWN܆@dJ EGOjȓ@d7.E"fh)砱# *y> Լ`hbG)RW}pd , ɑLfkԎ ShEmlf);rNϫe} E-O|kd٘LD4dʴG~_x #'F? PN*\spJG,om⽫ծi7y^ᮦBl9Ab&]egs6FCE pt~ɧ"zn?ݺgmmyz ԦreKJ%(e#ۣQ!}ɧՕc1WvLA8/Z%_.wP{d5RW`D !qÓk:jjr`%W!x\ɤstUhwXAY͗bjf,t;G .(gzw\( MEz"T7x3;=&w/r8x̓j2߳Yǖr:In}hnd (Z+:!q캂 ־cߍLc_Lkz]0+K,k8J<Н:LE{u&?oi HQV~YrN^L.)s |P \<]d,r'r|nѿ@mZgŋMqER*uWvn!Wi"l=$nA ֶ"@Î}c1m˚)6Qξ)rn,Zy$=-+ Hw fJjLkJ d{PMMiw13GeƀP2χNE `d6v[VP\̭Vw4 颃 0FF#L:E36GЏrr(|Y;}na~rg%<5?j=R!tcTRJ2U8MiQ;YF8wݣ#Ylk6c|B8FX|0z:Cx|ఀ=}IhRҏlsB<ؚ,xQU4EMsM9u7j;=걙Z>J>Vq (-)();DDyKHw~w^L%L757Kue? BpU{ȏ߸wX1%wfqXq\ #3xrΏNZ~^I]\\qqӟ_Іp?IG2U0֫4d]2n-NNُ)ٯ Bğ^7}m"e ^y@%jtgU!Aڱb5!PT؀rqDKZzh:ut? 掵6㮳l%-tPR@ X]lekm gH|8oJq( ȇU^$.mŲRDlM?JX?Dkn_Y県Y*Jm_WmV9{O3Gv =CCؔSF$!ݣD R12MҮ#e)Z&$(Q,!Ź?> yVy@̏3^Q(Qmc܊ {wc\0~DҌ2~]=OkWY&c [.U*$J7m#T^67?N-J7Mk (o낅yDl|Bhd-*TtJrL" 芆mV $G{M[GMii̪ȏo;OnjPve-m "Ae &+E1P;BU]7YD5)G'p7XP?E*zM~}~(Nn ݃1:Pn6;}5#Jw>X.z͟))mY2=y팅뜹=j="=6]B&cG0GWsq=6;ϮI7 .PK7=M W/˩M^D$0\AgkXv?nV[})c4_;WۗYYSC0TALQaVKrKư`TOB4(v-+B<ִR[' ڌB^Jb6A j?]/,$HeO &f\,&s&w-eKdvnEz)+;>vN[n)|]LCqJhHPEG柭͏mhf*G=$%a yގ90&FXm8}2\ַב[9K[ -,{JU9~b#\ 9Quad<>Wx9J/Sit0<:b.Kn6(,$Q: 5ZtҳWɹ .H-?|dUD!ɓ-WAmRcg(M m_VaPp<:GVp@~Uq#9Y%ZNvǒK;:99##ԑQ|!җ:~Om6̄o[WK2${{l䣖pV9vc_^&mrZΟ MZD9JqyiRK+hZdڗ(b"S$hA23g"d>F=J~ )C~dy`b4QO\U+R|sנNzspa &^۪ߘl!iֺjԳ'_ g?pu!WHQExw/O{(5N7 |L)*k IL@hA@SB `-4ԻaܢU|.e,"(TzRt9 R1u{K}yk3{#sJ+蠇&Ib7wn`GK1;0+d6PݗغONB08/ s61 @O`g%.ny [) zw*\FBf 2۹EL%33'!w %T qe5,Fw459(8}mPQ JvsZ"5̐ŸrE#isfip|yaL^-=ely_ y|#zi_:C"r47H^<3ˤ+:Z ޏ7/n0*. q2ieMX|+̓Q2e5Q1խ&˖[XS3txD;>I,XF #fWd:T0^ 䗗 1g$? 0K&ޙQG3.p=)M`Y)BdyN-)뒨Pe2)itQ0d6@˫bx*,1GBhP ]O&?AdMAv B4Iې9t1b㌚3ß%u{eU/9DKDm2D7;~8;ųכs-]>Tb-?j-fЪz7^f"!a1\ ă0+B \)Fv<A  ÙȚ iykփH@a@K&SnS٢60+q)1 ka0@an\]p!6G#51R2Lyd϶2Pyyr-YQnߖ:*9G Ke4eqI65#S/܅۰õbN3CKܚ y@'i%[ajN8=St3@#s+@7yj%<AʆO]HN[fLc%^+2ÂRA;Z3R#>[&_ һLJ" TO`d:~ʅ|ޗdJ.'M0,*h!3! ߏ}Z|x;IC>{ESQvd7B)?ko.{/vr|:vhoxǪ >g{V( [Rڷo-ac*lqSmug1v|ѓw΁#tXԢ1`r hn ~c*DsqH/ۈ `P s6|u`bp^d,yLkLu!KD"m7L|i.,Eg $Y'WD]kWSx LV""Hl:M#J|B\4T(}YaJ8p_9 I1x}T^腐t QsTX T2=7syOXw|e4CJWN 8!ȇS[F(ĺ uM_xaV蟇zNAdi~WP{v g|#u#FD€9ݞ×/n6`83]ƛnVzL[9ka x9Y=O詞G%p?;!- &(tqnI+ت]ݡ!zӾ&Xp簾"y֮=!!0]5 AP. A?-{ !EԈ#,%'W`͍*?&|P1F/ FaQih:_RR+ISPko'^3Tqlp\RS1l0@}cֆ3#ÑtƼnԾ1a"ҚhӾ?Tm} ol(9"~a1ǝkhq\l (H. Hf|T Y[XjV6,>݈~ܨmRĄb(0obwGocn*9s;o-Ow^rd8P}􇸕W띚ŪOP$Aؑ[ŽgF*0ys;?W(UhkKG蓢5ccHߑA!Pkyrcs;`5%YP,7P.CZwTFjϩ8aa1)D}?CpZqF(N%w7mb"MU I~޳t^*ڱ5ƽ|x 8B(iƇx Xr@hV)B)?:uػ/]1m쏢Vء@O{(u@m OM[rnd6Ѹg:z dmiO\P` ?0Bw!& F|ތ9jυwdG3lp=+>辵|>!ݻmNTL&f@7'q L#STHbo,6' MkswRgN|6/x w/3P;ZNL8x:l8"dU@KBpꄛqa+W_2SxI_@1+fq޺CxC(xzzue]į R #͇#]?Rп byZ3&x$!C:uSĘ]KOG9)}&Sg~)&/p΄;GOZ]Eu^y חUDHlVda"yjz3QU[9Dtl*|h u׷Nalza!P"s.257 %3M6ݥxmӥơXT}DF0mrKg;Ic #!9aaqEx/][0bЃߩ륶]=B)j[Zd[S1|>fQS#feTTF$DW7@JWU青JKI%8B O?^mUESԖ|2P%-Pwt~;KCg# eg?VCJ#275ܤ5lNP}U'\Vf(tPU҇FSqFV: QGή]ٶ"V(=쁯 2?dKj{MBj_Z5gEZѶtElo zs3h|Rw1aSBL[vBi_X;1%Q7RG7kuh>n"D.y Ǯs^ǐJG &[lۭ}3-f5l%I24cqɠٺu5sZrrVG_BlX0'qV/DU OyP тP'O,v74db Q i9{Y`ԫZ M5usc0r2XQdB .` 0v įȟA!>ʃts ׅX`.WۆyK'+ﺭ2R +a'H9{4~}>gdq,+mɢm$MkHxGꂗoW/ H؍~35`a?^ \nd͈!\Eŗ9[z5(\ow|O.zre!p~1Eϳeɂ?PՊ%MSRf2=Z67ע-wi\;Л+SN.;~E 'r(~fH~qcMou<n(Fr Y[qh-ȴiҥ؈O D1i n:,,榈)n@S,I.؀f 8xghyIYۺ a,$8/Cyд^uyjJJ8viHH`U'4rw"磍3$6^gWDn@FHG܊!ꍭ4& wn2kQAH{Ւ[#r _R* z v}QQZ9i8;}Rk5Pے׌j*}1LtDM& if=F{.adH5į Uى3F;E&kOVUE\ط/c/kP3hʉZ\#́Dc94iO~205kuTK\Q[3Z3\Eq+B XD6"Zg;~i%ČP1;ΏdhM;zð64xDgaZfqK#8CtFQ#QAʚ&] O?Lk0)1^9,{\jքvKFHjc3 q9Z  63j(w>J}J.mJwCⱃe#K0H(-^hvAY< 6Wu /ưde HX5#KJWX Isem}6rl{zhI殿3'{:k oH7;lad>6|;NؐZU<<\6uߝ@c1(9®,]t꼂%i&d0hIu }v>[4DsdAY]T>?cMZ Su5^-z9PooE#rp67k]Z6o*$)NـV?2 HR"HPLЖV۪_#<xvM1z-HҐ(X>Txl&@%#O{$#i%; ga?;9okpe t1d@U!*{1^ K}5Cv!Vubǻ1IJ=ڽɉBP%GE%rxf70 [ZJ0? #9ED!Ȍ]ɳ+tHTčMm,:[C $M!Is 0SD؅XNdѱ-#>g,:fKcvtȀ ,t"Յl>'깪#x)o(! NM+m'܂0N6E߶0ўI(023gfC "Y K2Q9zMÀ:H Fbc;P8YoFu^[ol`"s mƼA)0*yF9yB急5)1 EDF:=AL3 0؃3 c|,[Qz>8c> ]!oTH {SR 1)`FkNzFэ53(N# \(o?pt rOQ̐*&m*nXn1XLͲ뿏 3:ڻq`Jb;xO wm0w⌳rU`Ja88Zo=';dV/;{NQ2 > _@iaU5/+Ո$H==jmwk\ӁAvS$p#-2B1sɨO}BU#UKyz/# JjWlNUiݥ @+˕nN5zRLOF`zڭLP6$-.'"ń:`ku89vC B@^_Rz8 EF"IC4iC5۶>v>R8(Cgad _shǓ0,ÿYVYq5#n0bNU<ͭapD#kC8@&:K#4E6770ZcP=p~0\+Զ맏GPm?6b9 v/'Jܔr@m8˺?dq*03D\dk i-4`8r)Ǹ] }ؚ|K9/'q} S'g&"S.&&t 5,Mfn!?V=6`o 1(H Ȁw*%caΏa%[faXB!-w1MfJg~m q[b@fp`ZKx9 wkQl[i}/Ȩx$<8AfS͢@hz6iPJ𝣜#_ڹxY`x&vɀUVFÌ=En)^ g>ו-0m`qn5u/ۃ^ʉn'4'NXV R|+ft5?m|KqZpha7 Ț{r4l|V?‰M|#?e==Q*5}!|h'`dм#dFX3P8ｰS3F:ӄZG=RoOT>w{XثǴ)~ZN!-&RQEzpñ;tzv s| ;~o*͆N6ϝePhLtkd=v)hmFJCwlކ 5AD" GN F檚ܕ90]U.oj`@ XG-,ZS~ }}d;ijwy-(ٷ0.wӘFAjFB}ǁ0^T/0eMć؏H͛la-r6{{ݿKx:4Z*IqEəGDcGXMWU=ژ"Y 0(GPG :ߖ>&OS>a@HRdn5j0ܸYR5v4@Y+ɛ~h"u†#8СJ6nX@ѝ#g{p-<_;73A~--젤 u)LmpvVd5{xpd|u,o>*^t=d]ˣ̞̃N7Xz3?Фsnj2kg6ɢəǺ~ɳW0fp}1ǥeҌ_&2~oըPYK_fdϣ4ĉP;ʫ21xXN k/4 c.yM-0_NUHՋ9,d! \rO6%) A>,;ޞqC_6s2Miij'YGǴ.T@+&¥BAvS:)KK6Y-W:h4嚰Qp.`RI<#6z4 u~K#F݊#dIJ-pu:#v[BqO pByG/T:oxr3Nj@_yp%׶?JjʎH!ԤqÎÄN37BLi:ns"ҟ7wc9nWZ~g 2XEBcy薵qQ!~07o] QMtb~.f:)8Fm srpUgWpM))`7љ9f %v,`{z?T*X~07_nܝ;d߳n ̀)ٖYsbGI릝Xl>CnSQ댠 x뗬6NWUԚtwb1=Y"X}EX87R> Zald/:"Š&@&=*1JOZ - AEKm~#{D%!nEg;nC3Qpj-býCTnIx]*eIYg>j(ߜ'GIMŀ|mLU?A u|S>d}7c8H8v]'_}+ğZބ[CpI>a2_=l\Ih8s=v)'S-smI[ u X,%L昪Ђw \hWb)Oc]l dR& fuˈzl?Vgb?P>[uC??ba-w7cJ'Df$p>fsXSZEqmKW(rV~;y0WEfgs_v?rvi&:p}H"% Fie4sd&;p~yY Py >M0JN,\j`>;Sd˳'dD2vGEȑ%Q_<I5LLNcO\^O& vTL-32em󮩰C*k4Iё=e 2M]%yYOT>y#N1hKwԼ6r;\: OIL=ct,ltQ<r{qn _Vws>jh60g;.~Mldn/#kU7_!c4:7:nM`9{BS}!3Y1,2ۼ&倿21־F0SiaNFmIX94WE?S(sDA2!1Ug΄"Em!V4W!V OHDfEg jל!P/}Z<[xSܷAT'ye$j7xބ("uvs2tp!:%ШƋ2 Hx M 8OVGz].!P_ j}1)$ M Izr):1BV? ψ˲4vN_!w00W9m boS=iB*SZ+(#=3.U>U`qƘ&;Z '1]^qj:ҺE*!F._b (r fލQlK31$gۂ|F&( 569 `\iᑙHW׾N꓏4 Y1 X%25ou>z4G߻P4Ad0X&+0 ev@P NHFƊW dc7;6vs8O3>|:)Gw]3bFbpH4}DwW 2sE ]QN֩ڮ /LVCQqdݽ%=,h 4i79%IecA3JƯ(Z.j|M Y~WIy:p M4Cva/lxe)!Ҵ̈3ڔ9HthK¥AB 3uJlڲAOF1T\㸽‚  dhs]E-f$[ߥgwhR[9gcJ9_jGH͊N002:Isre{\0#IYyO50z r|MK>Bu6:ɚ"A)lC 4WB%zuGl~,,mH~>3$FYlHYV.b=wMW0H_ayWNtCKavMpA<'X@^} ~hHpkkf;6ASK|' 1=VvFDV'O2= fjzHy[q4eާ`?z14U0 c2f ̉ Z~0V{A("M6Z2OQ8Ov>Dd,!vt5zLrr_/sU2.R x$6s3<"c4sv`,gh|cϷ_h@&pFE1p[8dm m4)9`}m9vl8yyb`d,0u=A !@q|c?RJFZNvT $4\R:H]R0N);? 'Idۉ qTS?3g?G<Ҥ,+ٟ":L"n?Gg(Uk]\phʁ~$,U%ϑ*Q5bTE%` hG?B/[ qv˺8CDw1EcTɧ\7/0Ol_LTSW|Dp U-(vz&*%<bLp _k[JP!f;Ӕ)."QVu$^75BUFNZ-a@ªN .ՆXN(Sv.n%9Abj.!Iw5x+b59#z:ڼDʮ{vfqhhkX4O;/S+OMAk{qw,jQp "CO/VAWW}-yd}恆&xW+ioIk "7n K}[akfLe!o~6 ō93s6G?\_GTE%'YXr'ů*8n(7zo(\3M@b_D%Sh2SkU2%=ˬIʵ`9xgߞbtHM*Uy6)}1Q"b+/:_UEw,$=L0Ƙi~*;F^@w28xs ^GpsW.B8kʹ(>>$;x/\ɢq .G2=@Ӹb9P@-E Eu۲x@0E1VNi T";e|0yT1<edg)t㟳^}L*ǡJUw7!yc9*ᑀ(V7@D[XnGIQLf?N-Y}Z*Bs Cњ  Lv?hs`#C ' odݚn(")(7h>_VT T_S9g,.`hYk3>` $Y"V\NL.l|ވO 8d6ρ!;:q⬒JG8N%1K V&_sJؼeȘiO릒$Z vR2 zcBk7&^FzZ6iOf $rtf{gX gU'n"W缐R0TPz7>ʙX+Ux:@a5 '"&B?63_-<\t_-C/kvZZơBkXMp3M͝/'ox|h]NMwI|3}ӺVGNBC $<CRXmV2.] R@>,lGKSYq`lͩoP[u}0#,[1H"+ >:u$l~ ]Vo`[D3}˚2t` &pK3 {ߜ1g7\5LU޴˚Sh71ěv@pXLn7  +&e˝iGM Gꢟ餻^Xl {1gC{ETL3ZڬHA4oآ~mfM ڼm!AA>Uphrd8Uvhv]5.aWLjTࠇK!kGc9eGHYҁVK-Čw˯ۓ(YY.P# #sؚ}(ԙa>Nk>B{41Ùhh\,{xl\xq ~ӓ^NPE_Ս8biܒB,˟s&d7?H&-JVs*4wǝwAL3O"q`,s>q7/DOv砧<mZ6C譊k 2+$Vƃ.O}Jo;#YkQ\ DE4C'ǹA'InX ] 格fFV xq=I-<XXHa B>+0y1.2p6 SL wjJ KX }\TDw]z(j{Ʋf ưOE%&]i[ܚWր?^*C7ޭy >URߡ!j\>}WjZӲ ?P瘾PCyT(&5[BEwVD3o/m[T٭|715g0L|z(su!*WRuV%rqӧ>+< Faػ/<>cMƈ4ˋ+Z;il0_bIE&$1*"[٠~ң;b29|ھBN{glI,NWvWS4Yk]'^:m V"LqGqyR,% Lib6h/}LFS87I kR/iO:v$65[k[,=ZVo.|&(| Ne@q>4ISWiFiѤ"5@Ģ; Q*R1*nW5F{TzȷIIMX*i>5z1cbRb/DF#ߤcчg%qG`J^ ,c@iuxA^`2Z*kz+Kg{oy*3Hے/M9::,A_'_5fڜ#RsD1T O9(S흾;yC!]$S3݂@]7 g( = (M^N秛̠{>IAAQM¹a}L;e,ZPZ5aGoTQ?_- AdYmIR x&7x}+ʷW--fW̻(zDŽXw[~r/ F_/Rmbp:>WOۡ`J?PTYo5dK;<] jڨոޞl`_aXNu!BfQfb9kD",a%@ي8ͮcdw{[†;DʑSTLz$udJpFjKNHl U6÷QmZɶq쾖!3!H\In,7{a2X?^;nb'⡳!|y(Q)Z'!hx}[`]f@h 5<(pHpۯYEF&IF )yY9^0[=c(ݯe&ݿby}4%Q5~jw+2xݍRs<]1+\e!Fph7.!o;mX]O4OA^M.^š-m67}JrI)-.u9jP̜Ihij8rht 8hhՎ.}n!ˢMjqy}IN_Pkn4 x_P;V>HI`ryԤHz%/,Y[c;١\0M6puK1svz=6dlL7;6U_: W5DՂ`~ g%ڇrŧ`59'MDF)/QtNۺӇɂsYz +4ܩN-u/\,yoK0Ad?`m,+3W0׹tǗ]T @|l! 2mbN?wr2?L&|J >SjKPJs-"O fӘ-ρE]u*:? (oPETٯGF Oj+? /ca!TCuvBRLM)vRcIykg ]@@1 ?{`#'1lE{e1`"pl>հ[Wvq!mGPAw]e)Bj؋| ?g56`ӖߴGM}:p֓_z%[Mp R ( 3e0@͌Ci~e2(B^~{m8k렗2Or`{U*%`_Ma>e>QViMI!q%Xe$Mb|7!{rW4L6"pqyGG3DwBM*؀X䷙o͏7Vc vہ\d^A#wZ,רvB> Zf0CUkWƏ, Sɴ:VfCşz1--78Ȟhz s&5uj֗(lbԟ>EP> VgjGu86!~ʇ6.3|z"qtju*(sl7=>l_bL fom e3?ץ۴mxEE*< _vƫx7y0hf yX- X8t_ƢPߴhGp  Pȱ#Vr˕ezI1y]$GL9JO O2{{۳-kGRڏ VB>KTJvm-GUl\ЯafO>γ5u9@$?8zSJՋWV*>Aoշ:gH94t#%Cokg*K$Ӑ3=kMj\!ؾ)!^O-S?Nf S?mĖBR[H}rmǭ;qFH$:x3if @z/|F qfX`^&}~F8zX ';sļCkLU|_V߹0rRބ۽>qWN=;2 h}]?v-ß\Lʱv!1"Me= R1g92g&d#u`ƃtS)k܄ |cA)y4̫8a[w8oΒ4h&{e-V]c'reE)u,VM IML0q8te_66g TB 3JJЌ$B4[ 2A27&[\זD~ԕ󡔯؊5>:o@NP*{$[<`7N#m%c[.ؙY6'<ϑ,H,vV'{xץBtsX=H]9sեw.n և[ ]a+,,A"6ab/de*:=FnuXD3D.^l݆}F2g+ SSʕ_'ݿqVkAWV-'ޡы7D^/kh%+nu4 B 4Iz'ΌޙW OH.@7ߏ7`qK]BM2Q~IϒܫVg3@4{9 lA3ٞ?Ґ(U&VnaRYna[.r8PkU\!p=B!o_RѿVfQ2`ǘR;Qt'*tk0 4PٙJaW/qty7{y5G82O  >%!VOR$-1e7u]lGJQ'pA"5ݜיDXڥ"3]SPk{.,mߵǂ:Mb7Y lhQJVvgPӃe~qR:uKS*Jiwuw7Tvflo qH@$,E6DBVG.zf1v-gR 5$h/P}9n @0!*usdPVm3tץmJO'^$jb 9 3Aj;5L%K m{8NmEs~SO[7`f6~ HԂ9 q:l/!57gNRq朒2v,IBrk4UMBᆬ +- k}G`f?Ưp(3qB'솣dF^6$OU) 5B*tqy$ޏS/kasLm \1&0ّ} ok`uPwG`ߌOSr(i(\}g<πRP|Ù.ɝ{ٙʚ%@{V͢a}xSzoeEE2ZELgyd]F^Ta#b~5pRADJg9/,pqZDag)6\yT\\i@੕ͅ!Am~dC5N\90ߓɄ(oNyIuD"nҴR]^H~:N |r| KlPmڣPFM&d#P3`IPB I@?dK6QUܽ` -m6y' 0&aAӌޖc(9"RgW􆺧PH\ F,v0DnD>񶎔@l\AOCMkdbkWjiNXYd*j9w8ka ܠ7k* et|QTdPOTxuFc7Xm]mS#{h,_.4EG \B]@xI>C~ ~XLE\a[C~v`b;GPSC(;AqJt7^;#V<~O- y91Avݰ} 7"sd25rSu&@֭d]ӪK +,9u8-!z9#]~ßa~]t#1\@U%}b3x7 @XЫB!$14Pwb$ݽ|*Y} 7|E!Dn%~ٙ8y yގSԎ{߄~Y^si~ө%q@-ݛlFKF{$2JĻ_W%N č+")x`oAXkCIMB|[pݭ h _׳w` t h ps;x9xh2#@j5GK^5/К`7)v}1ZpnOOw;s]o/NT EUCԌo[ϒb^}oޙZIb()RK7Ydp|rPꚻA,mYJqs@ QykW[7V[g=#]f ;+wy24~s=&R}^TvJI>iMlU+:T^`1yumI`DY,2F^6/̸|ps:@v X|`pu4U8w74uv~;s6{keSRzJ:y(o̼5੮؅'gG{Uch#/pہusmESya|@{N(\ĐobFdD0`9)DZ.l%9|JcE?`8Jlfcj'3R +%@ug^aΗ%S] vVլ-SY Q{KTGm뱃Ee9FK[@X %m `ɼK3Z۴OShbcUy=>7OuYT)=4~l|rq^/J/>k3a|~[&QN\-.X1&p}}40{zbHj|!|6ݞ_q^}FNuRմ3,c~'6A&օ[4H͏/PTa| xCnJvÓa`dE8sn*;y3̤ Dav;|NNUۗMF(8&%9.|!nf>&Gn< 9do 1[٤0F~^%a_WԔY> >XO<0LuE4t S'^"L)P$g#ry4`'@3̹VQryDQ|nu*!,ͨj$2A{=_[н}|XP߼Dm= ǿS8/F\[sx,Bmsawu}+tm(-Ձs^T8~]d7f:M+|%F t pam`%O`/hg ]8Wg3o'jٴܚJ’PnovOi* g"RҨBf;4'$tRɚ _Fz9$bpD-B,xI# &FM>;Mzdi1Dvc0S sQUEXh0Kҧ`I˅V"2'GÆD>~OL^{oqBg}% ]_5ÇUmsF.. C?!0rfWfV_?"J;"jU22!GK$hk6㓉Rʱ}kd=RD7\ {PRgsYj^b%7=iDƧK_H&-&mXv5{K+O%I̗R#"!FB4d3]:~⁒naT8Jp5@fzuv^3eG6wڹC>d/Gx"P;DrΟ"J먙Xt@+wuh(UH#׋r#9Çv¯K^iQwqsxo <q\IşIOPj{o)C2CA)K ePt͘/Y1` ؜yn9|A";#ywn >C,nGTO>M:U3A0ݠrZur3.lZԫ(~Tygbib.ii f&D~"p<7x"K~v$zGB #yv| C3A @>BMbʱca5C*J\WJ0` Ljt" E+O'T=ן3|,*  J`٥I`W&r*~Dw&0]9>Hj/X@K#]*Z 0l z~ Ft98fdMe>:+؉ )t4!gp.Ì݄729'rvQ9»s @* K`hny<qEL'͝iИλ8}fD`HH0#2K[B61?(8<Ⱥ0%ʹ[h~2VmsDxp:7;n_.MTL(ѷA*3>HiWZT􎦊[w y}cBi-e5njvkZg%*4E^_$%Zu K|@"8Ha!0R[8O.#VPG|o9%A XC(}JmlBx`/g:qhy4.@|WJ`x\/<(iB)sW*(s1("%(,")ɤ-wok!` \Yr z'xĘω.N-ZȦVJ-:cg}C)y*M$٬l#-NDx% B/`9O8|<B!NZC]nY43x:kEVـiB w1̴6'V%hh:xb9fUXfM`ZNIؑ#Mr/ی]])WbB뿀zfeM ;{NF&"}Q^5 oXa>MTF,!VjAݱ0۟e 5.ܰܥ''E/T:5J:Ŏ ̸fXrFa˔H(9`Cdm;H4eLpdWhY,d.ؓ˭C7YF۴An4pns>QEꎽǤZ&4m[8-+E{.? ~p mgC&F XBrӤY]O![åH,t:pJR ^{'(nq~M y  ?;j.I eué̜="kӄ|A*z V΄S+ DOV)P6aZ10qU0]GTQ_D;Gzv-^|w_8co2t xRcfju19 GZɫm쒫OV c[~sl`Ld2 y`P; 0ýC:_{&rvWlv-; H4H+±p:V/LB[6plDK)*`G![1fBHtch.Ze,psȀԛ4mbYJנ4&f/2ϭק@ABi#yq!Jcm*qr9+&$F~/M.[`QԬ{Xre$劫Εs۴-& \rh=]t-(7nSyUPイ!odGo?d>1AÑL8 pg;%<DnP 8J6]'x8twtSK/T^:'ZŻ_Mw AhlF\]!tM+q{>~8+{|*iSo*tv;[xnBRğP-9/..M`2bghG+*ޞ$;!]قJV+bō! Ca^Ɵǟi ԃ]z]F;od\6.{{;mnOv( 坚汖RYgUVnih1fʇ:W酐8f7 Hs]h}RRI<='D ڤ|xJ-ZJ9(h5:aj_(o(2J$5G 4X*j2-NuwF >kl_0pXΥrϮs%.%Zswp- :ARȓ[ö\>"WCD& rwơSf>qs' bdqq.ME7@s<# I6!U5}-UK*Qks1nvYi.! )֡ƻ"XoImjg`:B |;bǵY )="÷n*sR*KhEVF^,ر>4&ixʏ*qk#0(eGjiATPt."Пx =*jG@8)?<])Kr)O>-upHA#о*n|RnctFD8WͪүWp$;Q:MD1U)a.r_^ޒh;6$DaxB1Ζz,6cK3:P Ѽ-~"14߃9+B>UDyJGf(,&?֙ita]y>e6=792>< ABO\S X;%E5M7c;ԩENԬ]**l Ԫ>ΙasY8Ė!چ'q _oT(nw2P( iVCپ y%{PחIQїu %­\ z¨i7PݛGu##y6%4׬~8N rj,@Lv@N׈96Gt@5}d+o^t_^^/<Yn,ĭ{y쒱) fl@n !ċ-9e0(d""!TPGm;Y|`T>&^r|Dt1Hp,hTP"~O0Lo|x(0#Ù4$!'miFrYމr%?C,̙$b-~U%,WW[)/5c#u 6D<YBE$6)vyeig;^ ErS:4xSH|͹ FKuLNqvH"F^uŞD ߨԭpfxkZ5/n@8e3|G!L@Ƹ;n ʻ,@I\Y|~ a$=̊xkv: ,1Vo0z"l>=./ L^х2~+AB5V&p nosy qB/:lkzj45{1-(06"Nʸ9Qss.w _gyc: m:(VeP_׷n{Rj$F:ҽ0Nl^4uW$NjϮ:vs>Th^3#3K̨fR3"1^ g=cds JnOoXV1jK rEf&3-A;{srnŎ<ᕇ#.H:|O>dNQTd2Nf1 n3s,媑,,>SOI]։9d}ΛL?=">osv987%axv~\;p& =G1T\DKuᵟv=5FάQlXg[lf#K DFGM;.O``PĀ]Wfqai ĮJI9d[c :0VϠjrVtl,O1E Pˈ\D!9]W};n5Û7DOR=[S2bo:li^ލ?=dEzѪB7^rtz6h.H9Ⱦ;ևUT4F Ϊ<$88O7Y YE]dbeWq: H쉔(t>8<>7kZqf /uV S:LVy ڙYNR)ƀXx7iewژg1e|'ΰ9]$ʕ‘#mɈq_ב]Oݹ=Xz\2`X,@~$R2VWYgPh]HMD+|&/lґ#}d e\,G>Or=,  vJ=:&VFI~-(ϮIJl;ÇO 2L=KrSO+/Eq'-8odڛ×"-RQpj95f֛Q1P:>Pav73pO$i?nɈȇH_HFd*A6 ޤ2|-<xѢ-t;G4RYSyFI@1HU_9, |sG"=gK@ [ӸOF9 |YOi|9^wyVzQ׾D@QRX eӆQS{,OO 6V<3>?UtKk(ƿd4-JG[OfܔBlsŗ;6Ev_[˦L<-O]GwCE<Ć nwJ"!wT3Ә<:XT){.ӠfoU( A@GKDϽ3^Z"mXQ,z=_ S9lpdNL0R` cuh녂${{I{0TCh]fGU߹O|9wz^NN8TdzC:iOP$&2w/X[#Vn">u-Wl}KˣDmW{8_-ڧcN6ߑQn㠡r10,9,x bݗNK,I^Șm[Pž̯(R'ء/gKԘFSMQWrvIS7ρudqJ b|@Y*x)/|̕p{ۏJ2UmЃuox˺xLGr%M`W& \ rʳ[!>˲dnЂUd>gJT5B#Bz2?yn!z4ZjzFԡ\X9U"t.669r=?c]ŹSh䏹<.B4pȲ'z*KSG*Tݏ<,B06tǫ1^ȹ+9/bUsY&PucVRO:v{x!n(ÏQon%GÊu+ըӣD=-sY~k M\ZMDm(PoJoMk5֚Rs0X zj+dO?ZG\h\M^uU` BoSqG#:x{ȢJ/[n\)TST*2FWo/x\_ܾ_|IL@$oG[=jqȁFa5R҆HBaMYۜ4eBIlڠrcvt {L{sR?sR+xa9Ò sZmMċ\.[yuB\p fn P2ShW>qZB95,įa]b&>:k2,S':lt,W(oa}=C%~@ys#]CώR 5 _NJE[ :K׎$#Ƥ :/Ӈaoٶzṹ|u=0 Y02XMK 3\4%ԧMqK̄&0VL!i|{2}Lk kF3²id}2Yw/TT"W:(ߍ͛FxG43,?bxq[7lOY]?p5zmV8>BBD।T3o2e#Fl@6 :3}A nMqlr"QqxKaByDݨkH1R}pΨ^f $4!1FRkTUsL9)`gCY-jrL|c1ofLV -%I6.уj>sJ50(wh2 *=y̒x`ܰ;uZyDZX%2V Ģ [==Y^Jp1x7Wbtol4$P1ț'`جɗGCHX73 '3SE<~닏lVT[cy rScB,*EfO!5SG k& ʤ RO~{Kcq>]b AP9$꒎f~0y+%`)~s"܈} u7[^ũ@T9jr]}|ĉ\~G>[=MXlݿH{%7Mx M*@ȯV>1XM?rc ID# D+Uh#/}^svkў18^>K;&Y^q3@ PMƃ).:2@R];Oȥ!/($CJR0goR~iGs8#XH⍕SNjab[O?vؒ`=ŋF1ִޚO5MIH}֬Nb&C"$%00 YV)eiٰ3s@R9;qntV]%D*t A~1ʋsYߓe/Js!ep6 {sWi`ITWaH{ a3wmɆ3O# $E+ U9>#l߂$6|(zso/U =D:Bq$}LВ3봐Sj܍Kmqܗ ȴ=/3X_b‹Z|``Q⌈=,R`urehwulGD|Ghpn<` iΛR?d] %ߌ,vdL(7T@ ՙnm;JsQf!bV^ `UxJuR6Rjǔ_lp1V>TQ0|I\Kts{ߔH!&m/ Na\FPT؏4T9ɺK~@0n YD^  Y9.s.ס>ǺU87YDIvf')):PY䥲=ǡ{D]^lUc)rf۾E Ê#)L }T@7 a~6QU$K.N\ly5+Oˉ3zQ"lse|Q.nQ+SeAgƝ%іElPZNNMP¢Zl6:G^aP@}Dm[יݬ䪘N*N%5ף =tG/y^FLw1=DGfz6ҍl*[^Qb.Z]\>7`d< ?mE&-V~@5$|*Ed)({Ixr\ȟB#5+Nd,ʋ^u M8}*1"XUK|R* VFϘa:D=Kj,j]C8\tV=2A<ag7܏JP@hnp<У83ϦT}<^Ghlc{DԠ*LU-\&H uaH$Z`F!\_7UiEFQ \<;M̠' WZnk# BNï @Pp4SpҤs{m;-s{*+9ؑˆh[׿= "BDtgҞ!5ESY95;=0KOa@C矫pfBpq)Ubq'bG|㉖)uS7X)McSrbl&<i_qHV4D55.܁PҐIdznP{]fwu,t[ut@# ~lm}*J~8Q]ls3_{RzX `hYĉ  L,SL=AI6_ B/]MԂ'~nZ^Ap:$S72$U$F/ߡf2֎ pPbMZ/Uk88j^MYj]Ĩo$gv+ɛWمJ(^ n>@0O;Dr6RR.dĕ,'[*n  ΃<=UC%~novXWǘĠ1-'=ɼJ4-&Ħ@ j!V sP۽nmb[e7E`$ۧF#8 X lF^׏-6l[.KZ_U wM'9HV[ MrBɃyDz0 CbE$O2ne1DGRnykMV˖L^]'~qew[臭S|L!EbgJF>fN0-$ZZ'B;]tȏjǴ2hB"6m]C> R.~tWn:( bcDz= ݔ1C\sf[~]AG g"A:l:t=ŸK\]ާV͎ob^N:L^A$|ilvUD3as6cxYe_oM=rл uLT&0a=p e~^mE{e&R`j:1iId$*ւyS̮I:UX2,(Uqv}q_Rye$N,xI·Yx(=E A~wIY\2|HrA5|$ԶPd ԭ|!2YYK93R0MӏVo,wʱ4g!`ZWlsX&@̼}c뎱(9L:kB7-E7Dky4f{bX0wIHi-D>y&%tiȀ}bHbŜZj0q[>)bn^+7.6o9C3<^Q{c=֯'QIG_?0%htWb{\" 2ㇳ:T  ` #{B\@,gNxx& \Ƣ`pK+HpP8Hl^ua蛌 ?jB!Dk*s8g߂xBO skI;0/NĀenz5[~$%VP /s Jm疴38aq T-CB' 'o+ ĸ!|u_JϠōɓ*RE=qV'y:db,3ɪ"xcz1 C5֣Y$0cpK=M9ɝŊ՜(ԆPo(/>2CTj} imqO/8ǽ`+W%(#P~IYף1i@vҶ-x;H-Kv yDZk!\tk5m~  ]!7UdIx©-DA%St@r*-Tbc~׺* sE?R)oD~.R/YjLwCqDHNvf)&ƒVb]y>ُwHgxT<w@*)nb_linxir*j^XHpa`屸g%t ?~H{9Y%UC p=|uhu yZ3 AjZ>VT/BK"Kއ^9SUD~I8finn] >Avj/(&CaKU;ju@c_C(tI>ILT\,US"]M>!oN-d5 hAM$C$Z@imp[x "6fqr=9⢙[En9nT8o{񚉫vv&Ia:)fLȍ^X$ygI~riW΃5]ȪՀF&ÕE&T?uwȇN#HR5g^eSuo5G$+^HF qfz#9F?k0PT16m Nuol=NUɣ 2kHԫd~]aY>gY/Mb37TFQ9us^슬  (jpDb1&ڌfjr(2(Plo<_CyOm?a:/2 8.@;!%F\ܘ(.{rDn^1Pn¤W 4D%t=l"PKU Jj%@FplAy}7ƁI%1s*UpU)%#r#7WtՊJ4G^"h22Tٹ? <-Z:*V➍Y}~O'83AO.%gzbtM`U>wdۦi9f~Rĕi%؛0RE8A[>۲TBَ3E! 2)Q,+X8ųi!FӖCVM=Ly{uY[ yg,0.Jْc?覩 ́ՠM` bV[Q?(!b3DZftY%F.e!Cշ^б;ws{$"Wη1E,geKvmЕ*gc \syBMB +qx &_͙/?3&AKDޜxvEq>g%䞨/.N(X%4ɫvؒ|~vw_Ok(P(pī0G{p"* l>l BAc4N/ S H _YOz/@a</i*M> YNoo3Z߽n. 54oVUZg+Nn4p&K9nj>>AySJBܶj;M_Qb7 ԅmVAI pGwI ʩJc B%vp,ϱW:2wNNpA{KMlpr) d@,:<6 ~ŁzV̚, كI(&1y6}Ye]{,;a_t\ۼ͒RjZ^^05QͬH=z uXe"G3ق. ~6hqRE͒t / hl4/W"M 9|D|O>W #-> \sĆ7C}[T`ä3֕F ݓ+=Uཬv0% g1FL0xHۭ9J_O֡d ʇs)R"f.:4q:C3O+8eH('HPxRw֝8 X:>G@ +;]uƉ9s+"y ZF(N'j-ϾtjXMw#ѱd1sjh}) y4ͯ&b9J"@fi›#T`cMeEv>;r*Z#a< gfhޭM} @lq*LL_}Я Ow\̔% 9SrQ"<D[]D$vvT"e;uI+ ,{h#uaY16|C; (дE ry|vcuxE 9<]ZOTDZ+y>zD0R;i3E mQ򢆞jon=ꏾ#TV3c7~ T&8>-:{8SOu嗩\о{vMm&KP(=DwdHV-,Of(~V˃~򛈟ō=ba3^}/䓲zYl[p[&4*rN{B,9O}Mm )<{v@;ĨAB(]A4JPApq c&C i) %U!tB 7SZ%=_R aǡqʄq؊Ej:(6SAaw`RO2XĎ)wyI*"+ V~S8p'SyY,-C ;P]\eϱ~ijٵr+hi=; ./̙vfP@.tRHbЏ F Ic+)},(z66ϡʄ:J);SD'2 {"f|fн!w:p4SCya;<q̂`<&~ԋ D( |-8 D4c]qsKƏH̊bٰ\lEtzI dH"#M`O*H܆׃FلxБ#֞ yjk(URjhNwih;R(N f߻mMݸS[m?3#\% Q,hnCJ1([MnI?>\R^zD05ic/8>ƈ0a5*Wja~<@ݣ_j˷x Ox#hOfr[c~мjȀQb7^磊N#~ZM{QPkFRO܈436FrwȢ0W)12Z(k.G|?!VJBv f/fg_b7tKד:ڷz$,!0}qPY(sۯo@W}ڟs{&>?DpÓmfQ['cCegAش'{>Vd^''^bБЗ`2YPqIW%f0n0SMfHFsM.H 򱲶P'>lE[PWga|! K&( L.e NOC.cIv*Php)M p7/c;$o,qH7)i`g7b`x 2!b|R<gnm7PrDz,|.pyj* psh{:Ba7|^F+F `sJS8; 93., y7SMzb08pn64 {'!0F>#K \F,dqK>)%HPoz g cO -54]6Bs-|j!c" 5ΉD4>Wb9{QO&rYFR.U9!& ` 2ԏԟ>Qun{42r CHBuHVtS7:j z+]:sC°LjOhZ1VWGnlP]2?sv%طO0}Su䕐7fhV.MQ[#S:iU4vCݛD/M@fI$}!rIDtpw'?2EWDV7ƹT>`&$>@ItH١Glhɫ,sc /nǴrΟF>ʨX'Dv~UD2A: ND[R{Kf1!҅_e0p Ym]@FQrR9W%KOHRUIo k7ؔJin4|t9EVKE> cK #sfm fPqFYCO^dٌ\]J}Ǿ`+Q3BY}*}v#+lف6LթTT.gldx<2ag-zG5<.~_5}'- <"i1+GsqnՔ5OpϺ4-y.5_#[1 䯢gMŏ P.^PQ*:)B_ -% @>"t2m*aQUX"1-GF\i}q%!1 xdʄY̩Gh:IH8}vx9͠8^@fcDf)+lz A_㞳/ {=1i2EHlŜJRŌ!pTH8}2e %o/ 5=AW2t=O<)5vߠ~>]4W*ytP4Ăjcr ]>ݷYRVTdLي‹WvT"+ɞ?X!K5", ~S6T̏/pE9kE&^``2l K?+6?wcQFL'u!bv1O1 ,. wzP: xA1{]6vuS_1~kG딷7S fXp>[r-Kc-,K MvIeY"GC0 N-Ѱ7?|v).#t_/o?6.?t,BG{k慼L_TܾY/1o'``u8{<|uv.9AIn ` 3hZVlКXZ&x!XY9)oʛd+§+&-"inK26.z71 |NI$=aBHoie 0x ni!s ?!~LHp!8dhXU= =Xξ6Ыzz◘!9`tl0Umu/'#uoP ãlݎZ +%Z jvhD#(JGDgۼpuSK/DBJې#{a-yEQ6͋p!F`,:}>7_hTחak䷷wgefa{<*-6\I6,OƴԠdQv*:*uHڐ9 o152 G@ :l89 Bm`ll@2-PIo@\5aY2b%_tݳJ .r4VJ;iǷ;O;O`I3 PIY̕A%)]Ph+ d(p\b1lǤKmDWS+v`4v3;"X2'6ӧ6A2 H =uF|<5, {c:Xm)2#7.VƄ NZgi~.>⩯abW&b Jn΋ayvPWXX{[ .Ebi>gg(ڨ;V.rb@ qJhH!q{Ƚ4g/Va)Pʅޡ;"{+F2B=CyYI%{S[8}')*ĆF,^ {XayF^h ʘ~SIDNC _/Ua|s#NtOɆfȷZwF"R*z4w$:K.Tdf,W)tԃH]Yثx1Hqvpr#uWxި@G8$(YةݞMTOׁ9?j4U?mL!yP7L]ڟ趉Y* aq>a8,oFLS Yvo@+?5@feg&FS..VD' ^Cnck-J=sGU{o`6Le.QNTF#< nǔ7ݧ"It jj:5 o fpmm^a,prd =$SJW+PZ? E7RY6D<&_({%$J NĠo E[P> H,hlr9ў 8闄ީBZ< .o(f([۩.J AdR.^yv{q;\:MnXݪ`ޤtKKQ4SP4.u75//Y|UXΰ,oy=ِ~#T{BgO7êlժ4L[fw qq :vWNT66 `ַM]L'Rh\\QUr 6g;h阸>=FjIMMTeWңvóu.r߃ l$BNh$AzreZAv5 %> mj%" }eMN.N0M¥!PV<{BkAߕ4wf86H Ӓ\$K 0N)'`fVd>i!.4=ȃL5gw߶lOMN oh;?-rj7RM0׼n`[Lϛ!xcDSAd"Uhf'lH8l+,H}* {sf7v$`QNKkWIټDƜӽ*ST4!и[ Gcwo_(a;&*tg'=BT, gi0UlN.W[JBސhczFMބd6R9=y.P*rWDNh$hCD9vu8%p _:`_wȌ-5eDЄ O82)6PWݝu<1A7Z4bCDfF%(ožg8na 㓌p*eBvN{H.PWϺmUu6Ӭ~sO4()`!㯣!6?)תL$A t@:iu\c[QM!Sa1^=Β@_PKYLQ eT;ɗf< wI3\H``w* {sWuӁAv˹W$p!BYY>';20!͐zg{-lΦo?6% @&U˽zRn1{X( ڔ9=8}̀2_Y΅uC3:_7,wn!Ē>me։uM cko S 6AO;WUQ)"z*q^ ?,,Iu-_iPG{x vc]<I#z"w!A8B܄ܟ,Hlzii*įKD=)(Čp:UN= =i`qv("Atş+۾Dvk=9Aw_S$oh 73`f?)G`N3|K `Z?!4u@j|5> hDz"do-Ue4V((ڬ‡wK7m0>I^QG~w,`6TX|a5쬫7ҚMST ,Msr/\u XKgY] j[T w {I B& V;TuʷӖ=mFE6f)/7QO {iHq;D>d򾤪Jj:ab_/A*d=z+oH%3}E/L6'M!9HpBn@V"9H$!:_dgG*_m*v!Vh&144mɟG$SZfi1faVP~kCsfEYi@07g$Y *RY#åo{A.*T{;4W34 /Mhvс{ז?ؠ9udŵԠ,ӽ[A7/PK =IEBO[x)1Y$Z$棆-Q>cj>~uƚ3J"h.g積֣\k_OMFZi֧W y=Y0tmZ8@0y"cjf4) dgD5L!+xIl:`$'8PPv?,.O Yj בBJhk0\x);\a/2g -p3ĊN閉L&husÃMbnrv 9ʹmƯfh$7&Yk[Q7?ړj~갌w&OoOt#;UABσXC| xwkSGCwˌ;)WI=ylG!JM `ax #5}=C*Nj23hÄwrHL4Q'5*X)^}FKP4ft})DߕUwFW[!tN!ey,YKkP6yq F{?kGH|,Ĕ IXΐ jn\R%Or3 ǗA^qb=jk:ߞKg]|Ն󧝒"t-5x ?U5; F*& |z [vê1IVZ\ gJd )h%MܼQcهvfZ !Fg&2BD,0ֲ%p>(ο6 "^= DM8*= St7[1}Pc;B$rԉʭ^iV^U1d]JWҜP\$u:ţ\.lZ#o8dS)0hn&Ғ"WxWS!2{o jx Fd}l D(,3ĩ :9<w; ϹSNAQ n!\y־D#Vv,,yՒcgbTF$; +R+_P٨˭%qz"QNyVC2-G jqx-@sm5F2}eC} 6UAŬ?[ޘ[w<ףm y}4Et!`ݓ`YGLg;XO0_] &>g}!G:5#~v%*Pi5,]PCח|p䀄E)!\Zr4Կ6&JBk*JPɕkn^+(嗸޵ovI`MtO%$Zڀ#}k2x:)\o #k)Rrˋ)T(@(np6F4>Gw!"wMsKݩ5l{tv697PBCb2*&)4M7]"e+h F'\@/@MƐu#'$d̀\70#4fh}1c#(pII)ksGAsqiu1L'$|쀵}V8r}NNI{rbY]T5b1/Qq \vȃ0c{qK>ϯ4CO/ZshJ4#,FAĵςq2 o\ET|j/=)5pV< P#lGdMV1mG5|]a")^`5sm\=.PF9aDXa߯LXŬoX Vțeqޓr\[1ۮ79=5RUR˔#tٶURu8kl-E{I)o*bKgjj?1H, ogNXaEYJcڦ:Psil* G!z}fX _=l-1C {m"HQeɚVq-Z%gm?(bSc%,Wy=m}qߔcfӉ &U)O^33p0~5DUS=]sKA,u !b>\.P̉$xN\o϶9_kF^c C |\`r L`dݠeu@[0u5ӂ>coi 8m@4u8[XY F,9 4_Z ٽD甬-DbHؤ,6v.h~^R`h4#(s?)UMeL90'EOd<=8jK<}!*33#3B9Jh?Ʉz!)+.MmEgtƼٛf wB>r^G9fnAwyK"u^Z{#Ȝ`rq2O_LlKE}!e/C4b>*)gUV(*jBVvl'Se^ I:6QF{"*Ʌ٧e0=O?<," {Zz 1")A^ydgnTP*\xAft#p}L3$Oa/rO:l}!HFU})Ė* W&6ҮMr3mfy?7΢b } 2S[?p*u.eD S%$.24yq)c;.IX U;}oWE=.u*eXE4S^w(>0{=1U# RīK$D!.u2v#ū{Z0)UNL.P,ku֛ylW)-e$g4NHjZ~/K IÑKcɥLnyыX\nEc^Rfz͘T]s)1Q5z|i| J?!]nx^P F/⁔oK"a9c0Q?[jK^Б]+f"vjNa ]#h24ϞQ\@|D~NBי'$'48֍G4y.̂.N)!C6|dBz!l7`t6J\pUA5!fҮdj24n`CԌ^PT-;ćUPM@Lg~țǠr ީ L1wx^Eaʾҁ1ѭ<&O{md w+Xzt`'^ @`܈!?  )FTy]6h}mޗ- uVW;Ihz,˗8 $5Hv8exxi@vfT8z=Dsx׶G k#OBϓ&832)i8V-ق)!-W85Y IroOj}?擪=GI͟GJeT淾{-W*H jSXwG(s|a*Lwq4GKk*Jց!{L) S#腯oND6܋L;%-$\s0[=/(QߴM:y2FTjBkX]y0 4c'\F9H֯.ͻ aa9 Fɼst@>~qT)( [T`^1"zWO]?s)/3*{Z- N]Z.|CqפP< 8oUYs$ y;aGEa.g DTkUXC>w.sgl@܄+ 輿Wo`p]-jԲ(+'YL7'2CtJE!ҶF{&A^qId~S.n!,J ijɺl@q-sFX^M'-j66gZ_'4biG"n}d}`1:fV( (Cbm݆5ϑ9:KHfl' "[46Cp@fQ΃ hDLj3}gsχRH|"ay(V`mn ڒf#qke 3A3_|%!5 ;󅪽Qޝ(1trOj. ) %4%3 lgg]<ks EqރވtMUt靧I9aElgE6rR[^ho=} ')4cyJAY\=rB|a=o'՗ w!U>N#^j]?0ZTD eҮ⑚ BtD*]j1u&d>l5*W,nt%;4oS74 MkwlyB6rt#l9,7(;_Ѝ ?bAxym 9cD ;A^i Xt{Hm.]0\OoKfS\W5>8y0L$64W>|l-ʃ0t~b^IPM9zh'P.@f,t z|楧Pt.mauZVc(YķlPo0^Ico)}ɁA=9]=R؞\NDtM,EgHWͲSe:p9=T<ކUD͙G.'BIHtV3[\zCUNޙtK;rXv"izA;v^t587s? h^&nJxmTd9ǂ".)_o !gaHq붨` V鈽x @G?Db>,~69EEl)8=ϲNMa,}$ϔ_d(]l})[4?I=^ ʶQP[[,l*d!\h#l¿Nsi{]Ac}E.z%_6=3X 'C}stT7 ^Bk'j 󚛸@瑞54AɽJ FWH8#jiT"u*jgh%ݓQ]WfL߭ZpW+YLڔ"m esyBgכdotR܎t"X!ũr=3mrB"[݂C[i$ӪȻ7&^EuN@=,=e@Vn""ǣC CH:! Z FռJ 0`4C8HL 6hFD5}ҙz q ġzQ3{T8c9L 8 kj Br>HWH{duXCׁ㭸>q o]:Rt|w*Pc\*2^H4⌃}J ӢZPdyX5[yw߷ n-l&PZ~r_0MbT{GԲۮrW e;9\~Y;j G3`][ͼY!`\΍(̲dK%UnI䴊1oEъ"w;uk.E]' (`"Ô͑wN>@LdHuow 'W#+\r*m@3ECюU\-S2c$3"0Bn%u#m~?)cm irt~(k%6Ksx(h[#2jaKĺ6{/DpnCi?5͍# xaib=`|5ࡰlԔk%='>:iWo.9&DGȱ?Lax: @+3UkP{j> ٴT%GO5R]h>s0/@Nyz v}u-\,W8jazm*;?3~fGDi}Y9Uȫ}g%}B&y"`ZN(9pbd)*b0!ŀ{u]3wd IHѱhdMfB:jLgy۶@ƄX4GBKURJ({Fq&Ld$upSM@tko:~1u浶*jDH :˔qsT`yE/8Ge?/&PL`i\"z_X_ 56%tVUrz`0[v(}Y D̞=MaI^Ap^4rP&P#NB>sY5 S~L4EEl0l+XohZizGN~Xҏ$<05D3hɕ*X䆭\y[}"I`Q7!;k냄cwn ?s+13,J{-vB`@+{){f?[3w%Qxe?]{NIYI&$Xy몐) ~bL,UNamNl4ivW ^:6~Ig9C#{ ir"mxKӧXn0VnimױJ]Pgq^t˃F_jU-Lw-0Y&}bRGn)1DDH\3f`nd3khhͷ;XNAܝsFTA'&/8׽ Y:XJy>6X}}\*m^[ηŠ,y}E43A"5&ջ)֎4k #f%DhЦ}usJBȯ| 2Ql@*iYυ=gG lCjK'm4f,ϋZdJʩ\]*R^嶍 -9S6ni/p_;]Zt-ӑ :6tZqo Uc&}ݓZB)Z;t`ֿIbvC0 _V @4n},˲rwֆUYɇ`4&$lT,zcO:5[Ϝt"B{&*E/gf;)_^)ބ^]hˏ[!vrxBBUZ6!3!~_EdKJTۤ&Agi*a3t=hIн°'`R;yg:$pj,C{aۖGA>"D`چlWXF+tc- =tWxp~k3$2vtf3Iir-mqŴ#Vh zT+`xw+bp DQ? n/b'OϞ0 t%"gIV̑|cnZ7˼QY 쒲 ]: >=KJ)RZg/u~NbXk'yjC j߰@٢"f$]nWlN=d;!-bbI2F Onτa-PG;vA ojT*S^[qŭ",lFbְ.vBL쿺H y-CӟclJb*y=ͼrPuZB2Y ۑ ?*$k B01bFeL1)&nI?4:۔=;RBӲ^,:o=ɽ7rFVlV阕 3J Pif= 2mrl&Q~}r4: n딚.){~dRי\?T%keט_A¸qQP.OĽFV=G +$Q\@\ptW@ wu-G7Itj(h_͉^PNEk3zon,{l6uěi#EBNP 7@ŨqoSELm잯w #ۻۤsBnKmHqʑ~,Wqlz/6'OL.vI`xWvrly V@F[H]wu?9EMU-f'F+ER*#M/km_yInfGnH=@UQ M8b/:թT,2c.>-+) |<,\|19dۿ"{n`chNaf=ٟFH-($z2YOwMO{ei̐n8]r,ƴʂZSaaӷK4T=2 qMƨI%0׶gX#FpFz\rA*s2v]"qV:OMJn޸%ͣډqgF)^þ4t\}QRW:9> eU#"i$)?s]CAMdT9 s|c6jNq=ߓ6.ѧy_i @EDZ0 ;'g g)6}Z(03PZI>$ *gg,jIO@_P環zzDɁ.DuHi ^4C. r1а h|&Ҥd,śE[Sn0IQ PfɄ9 eJ"0<'w2v &_&g޲|oac/*Af|8c$ݑ gg89# Vy WZo(dGŘ1yAg]\ZV RPoGDzx>̉ ((m8^ LY'j{x,.y N~z:N=t RCnTo?y|^W8R9]I=> ]=287̠Q[ǂ'I߮buku3ߨʏӉ%dU19^P3bbGE/-4i{Х,4:v32-0p!u[sNS?`U2(^ ?s ӻ?9_5lm|q9D.T\/`shSs7_*il5:TgNAfE|Y.Ad,n6 2jyHE?󹣺I蠟_,{#??e Cq$s,]|S"1e(=>[>֌`dG 9Y5G .a DF>x}1ER8g1N$<^^v%uiaW N u!yϺʹi4HR|@ފੀʲFPM_aV=vou w`~^p hEDa*Bz93yjPCu婛3D..@Q|-'kZor%_ϕӚf9yR+evWQX< dni>GLƩFT)2я):Nq 16b'́B^۴?tqcQF-nq@N!ĥG" "2yީ"\->L]D)A"ؔ=2=2a3ue,5ȇ\MI?t (`0ɠW c]gz7&qz صj}4 U亂vOGM$ax=`qQ3=Rg|}N` HMQ1?:ݳgq`:'+ۥ_11,NT+R§P&L0AK.d"C;/#hAR%[E)4Yqae!2k&Do4>~BR/c3 _j%‹dB&t-ͦ# >s0r4!tJt+!C(Y@#&"[%K?CI>ԐǼ>t\ k̝ 39h͌BgV?Ac&sy3.RMAVOiŽeCmنqM eN $X ogNz,[::w+2sj"ԑ7k`0 zhv0Tn' o 3@@+oVև,pʽK}9n([Ӷ0pAp( K)x2= 8{ҖThC֥ )tu{0~?guzH /ƼF]B ~'h\*]'Ea<bB-M%PT@[3|̛A_߬ԡ?/bJڗjafYu~C<47ǿܟ+aWea}D;X9twBA->$^z rU{9K}8EL%zΊzZ'Ƃ3aTE!ϒh=ӌ ׽$K`t!mAt6B;eCD{Un ̀+ hg̗d.p90Gsn1􈬾Qyg6i&Hȗb;].Lo&Cz iAj9u y5& _ L880Em@cVrV@& ʇ4kh(ڦYqQ7Y|T?-$-*x!me*/F~{?#crVPE$RYl5͋*b7h蛙6D}V9_rśl^S' @tNj/MHatԏJ`g*,1U@b  e(kژXG԰@ya .CqwM e*TqLMۮサj0m5YsI^ښZXĵw"8؎oiJjva m@r.~n%dKػQ/DF]2b|/Svllz֞6@l^Vt`V|dc-T ,PZɩO4%Gw9+D&K'Lq1 2`(M35hpGtJHVP#i6X7m0'G2 K7fɠqF];gbaX"z@//;D-m[Y2nV4B> *f:z_[rouc(cC{j5ŹՂYDu.3&= t=mfaI0>7*2Kd|eN%bݴY׭+ "r+Q1%rW2 %KYk2Vo_Dkk=تb$_;E@q-E> x3 V`4/"$s86B4`AǀHQk> *lX[4Iܒ8|фL4lًܼaD$>l|>Qlul"ߡz9 d9.LBغԄJ\w7D%,Mڦ˪>ieuth= z?p[6%]&4 T,O[{<$ sz^,:!n~ع6FOQ7u̾wT|eXb@jʺ[%D]s iu{4bUESQ0l5Es: w.AC 2r,T 8eEFH:7YLAw C,tKq\.D_Js~&2'Jz2KTwZ4N#jGT[aڀC|\qɁ^5]RS:4}5 ~ǦML)[L|l:ɲTs(adif{@g¬`,1pf3FIa 𧰫}(?-k>ZK5a:w ;ى2F{L(2ASi3#{}3QʉM)UG5JS&mٍ" ?|6PәREO r000Vڽ2QտZiJĊmҌ> QFۙdPUFzeQGnD4@N!J<2.adkyЗa!xK{ٹ@34K->6 9>\)Prt`yD.ޥjt"1M>(PdJj0X( Yd׀Cu !v_t$FbB*ӿ&[/ڢK ͱ !eaƉ/ 2pÜPv(?Kz lgx;|u@> &WbV o<e+FcBp}Ϡ*肬h |MfN{.j4POq Yx,}2S h'3#b^3mHC|4T0ߠ5=/h '/GW6a [Ge1v< zPne6Lo̪1w4mC箩?'z#$RLek+2鐆)A7$nB* %@6-MYz@XY"rC񏁴ĝ7!;|“:Da)@&˱wZojHp#+!) #M#f @{ywO}!n8$[*6/g-]Vk3Xg(3^r7Nyb?T򒆗4׌_t%'F 1p ؜$vN2Y nļkȿnϓ-aa1 R^gs{cM) 4c=qG,;F(x*X~4t18TϳFr=U8:GEPO -&.qK3޶,AM̐blפZb;r Uk5C\ d2 vAyk= l˾`5inpIΊ9jz@~L%wsO[@^]LD1z`tSzTXI T>KLjf/}f5ҌwY2<®ժ#3yn>MA& sPLjo5wǓe %h&BHC v^ N:q_SU![*YRT=רipC{ ̎DX,J4ݚ([W)>Bc轆a/u'QqNL L3<;Y h0i@1 ţ\vX9]׵)6d3DT'bI2ch> f2 >xIE?$!XAsK[Wo2bKjR2l4o3\0}Ql.?" RU0Bb6nZmȲPBnOQtź4i8{AG0:خ Qx`\q)nvarK@g]^ mI7XիQ@G.ZG͑zB5WVaosq5' pQ+!Mw/ vs=H,;Qot|iAY(ʬ#yUi#:n&N8A|XvH#4ʑg=lj6`epnWӹ˜uc+D;` #Zy^c'\<8"1͡ &USSyC¤Z|f+jQh9a✱<"bk 5&q$C.Q* 4ϗ8jkî 0 #!P򀄚Q;7*kK1|lq{ҍkμ~ٌf;/V9pzU\ Uօْ̬T2`#``C4+Ϲ-Y 0+0CnQҸOPK#QIň(ݯ|ByR>3\v(L\띜`E.QQJJbc#m=} 49ӌ Zȗ}^Eޮԥo{ZBYWT0)I$Fzy( 'E!ۆhޖVTm4Jh[SWGerv6ۈ!WB.8Mbk_IB$QS9P\U`Mts6J):m>}l֥fD._p(Qcl6*c~:1owΠ8e:mnǷ#2#󠔿jt ^ m =) ΄qmX|VIVGO`|끶D ?d$]t%?s):g \N8D׉С!xY1[Q,hXtbGݩfu]x0X݇`XĿA=`eBָ.N6[%. 'b HRKGES|p/Zgߊ6=t3ߎ@ԭWLLVSNL_-2㪹ett=W)EmV NR7?u5O~ [1fl>fſt[ԲsX%\CkEmTkfV4|,(g\o۫#ǰܜս`90 uv'Pa^CgC:arg97Y?Ql w-Q:ɲ > lB$,혭d3ynz;ۜND1= Rtq#xUHB{g 6Ė)O1`syoiS9*躜1kh\v:pn 4LȑJ q`s)+>B@mʆ{-@ s+g[FI'_>qѷ~zr!=]:;&AF4eɟx7's6%Iwo+tfK@C:re1z lpF Z0 vU]H Z?a")'C#SL0$awɡv>0G6u#U[cf#Zr4뚥_96=^ 1XZ wڽLǍ*]jA`b3$6\XEV׼qch=Σp*_kM'Ahf|"~ym͆ `{lkzJ-Dլ@)$T\ɀPq*=3@XKmOH^u;'!Jnf9J1K2SR`*J 0ހ a- ./`ѹ#=ƙcsGb%vK-7wL!,L& &jj y+k#FNJ&nR }DS=xK!Q>C9[r4R&Ufo(,t9C8؄X=! {0ãPԳԆ**jf j.g+}TP`xaSU<dW5&P3'USȶphq+Td|Q vQ֭&IO|ˁYꁸ&B vm!4~Xm9;H=>eM!&1mD.sO%5wLp_1U)࿙m`ѭzMc?I(RO1mV$-P`WrZnAXkG'! v] P뎞4ި .VQبūȟX?=4:ay & KM658eW~xG6Ͼw$ЍۻXѶH}Bv;ߝ$4%^ q_ʜM PCEC ~9(!D5t*lj°ȧ4G FsΟs*)6~c\nxHqDGφSꇾ!k|03$8SMcS`<W}őʇLEr^A^1JQy yE3>.~I$ǎ51Md9FWNcm+|qAnLq 0pBusQ6zrp"! *Mu5+5S64׌pLV1JيW)bG]7Fo4ua2\o!4 q[fS=wJ1g1^HEvx tF7Ÿ?LRJRv^[ bYOS՗d}NF d {(}1Y>iS*@J[v ?>g0)TG꿚ND09A(O2 d8"Uښ[þް Y@jug 88Ԭ7IhTGX30jb%խkE]y ozQ1&|E#/09PPˀ%m׌r,y8oUӒ0=p=1쁖߽ I`&.]:f8u p8_?1.6DnJy4-pM:bi5_0YLMEo^wz/⫯ Лf9<$&G hLB1/WA[RX5#H[țiu4js!6f 3k)0n^ُ~2_̶4$!4wfblIZn.Syco ӛgZZ*.~j z'x'Y9wqrJ*D¯ .Vc޷0nuZN5x[4·L2/'k i+/m^\H"7XFu7RuA.!]?{?\5pLk2eFVVƫ'9-&}_ݳu4a닲L 4݌m)bJxwxs`npT/_D_eۆvj~5{:+3UJ̊MiI49RĘ|׼W-S(u fT__i2 Y %xUGWQnuMyfچw O<bT(FR1:?Fua(h⿛UT R7s?woJU'Zq2RpgCHTPr"#vއj1Co 6")Wk-Jh.U"je,Eāά;o3RZe ︵2`tZNo,]P;9jRy~=7GYߒQ{_?[[#&uKț/4!s"9Q*k1FA&Af ܭV~|U0~4cۺ݈[[{C氙a*#_77b_ Pv\6mr!ri-C@q|aBv?b;o=]لrtG$=&Q.{/CfrtkGKmNVb nTAY!;a(>ϙyeUv=4;(aT/1$eObO kQC*XgbwOK繵SKZ[݁Z[p z~>tVd#8Q<7tkG_%N߆S1cmRdZz P)4 o(O>ɺzьW&oGY4-tkn`j"M]kQ `[2 XԽ}͂ȵ)~) YΗ}4_5M0A|r[].p4Oa}?4JvPv8Ynkzٙsv`L𬩌!+V|"Al's7hR7> ̈́nZ4-,7q`CbTU]_,Qo>WnLrnޞ'/ƥ!Dž%oyLx*Bu;=0QQUjDsѰG+Agj[Hρ&F'%n1&:5i3~K!>WVL_} IO(b5͙#\ꅏhFh@ҩ -Kblt#/)̥?6o@Z xHDrI8k> i8Y.W6l@Қ]y1$>D'b]US2ۖzJ =][OL;SZ#;UgFui A }h:Ў"]mp3l3;-(&vϬQqb&Mr"4aF_s/KOcVNZYezY/&8*%_ͧ)3b"F-6ثjhtb*%X7#8d*iy5C)L{)YJ8Gw%o&x5{4o1~#VskT_;:X -@537q+#Xu0+0)K}|8d7"8~%UΫBG ɓΉ=}IU$<n^Cf34y\Ha6"I$jح.2 5٠_ۉIörƣh~Id7~Zokc3d2%.!K̐L8ũ5tگ{ED!f4OJ W"? ӎHx_t(̓ؓIRw7nxSv.K=S0%+Y?Y gsoJ]h~`. ,Y4St'K%[Da4XW¹2۾ޫ|mg_V\;D4xֶ 5$}˹da&]Z{H+"x)VBKPZtuc4 >i?@'XrI5Z-{~ GB53(pp{9^j^,H-ע?AAB'zJ 5F|"[A*$Yk=?Lܧ@BÂ,߱@f_ArrgYv;),p4jU 0YX?XPw-1c,*z#OmʘI K]CϠLAn/q1^JYtJ6K>mkPA~=9fV~q~*oqp2AY;k"{3s˖a ɘPP扑B r]YQxvo5UM/f+֋5(рfKsH;ɇnͧEV~27bs-63֯@\'0Qe:)mhbeѓ wܬnCfe4hK/]VQ|_YȎw1r65y?'>/Kre_պ!f7 GHT׷2 u6ds>zlC?RݐM,C esbi^OU}s&ò@kr 2rϱQI\\_.=7`s: cߍ"` `-{q_Fϑ3d)-iה1x|oI7bPA#rQqh!@ikqHa}À Awm5.;=ҫm #* "*g1.tRn[?!DPByd ^7iO{Cn}a:ER8A_nYf1 _Wܐ3+ry;}]_H )VҭA4 #Y {̔eȭJRh;7\j^BKGK{CiTmQ1?S.2g܈1!\.2Gh*>&ѹ\ @*kKȸ'G<6xj3@'jGO뿯xY@-*zutV̉ƋvʣmQ\RZr5y$mխRԏ9b0I$_cƓzoL!G"޸2ȕ*Kzʎ^Q^dʐۻ 埞uoV>cco\ԟz`v iES/DV'՜frS.pFa=vMvu<5zH)x;04-cS:jND=h'I@g4D6TKSr1[pÎ#[A{8@ _\-lC,-jՌtPDg|W{yu_-?a-@hkTwCDv.i(WP+9|uKmi QQDGMMCqܺ:k2 v6EsMl]2$ߝj+?}f<PE=@ r݇/}g7>Љd'C} x(a F 5xW?+6㮭LjX{-tBeA 0 w8 EC@j@t;+ 85P$t3[hYIb)]&%I*! <=du4wM:2VUj}Ӟ.G&oNbLWdI]}^{P 7%٪EsĎWW{p]$EGNT@ \rMg+Q$qnƯND {&{,sESE| gQ\۶qɑBr%ID49V2,g cCJGҞ3PV[NHLXD5IB:!(ks> 彜3S>$ b*jaaoLI$ {i* CЯB=oZ\isǂB=LHW჋@U&^zFPO'|I:PA8!=H>6LbGY11eyjJ&Z{&z%pk}[PgKL 5BP@[yǶ+&r(.gBdqb^^_wmiCBc3}JŅsòP-L=*Qԕo4bЁ'xHMuS(DD"DlpTJjs-elO^1m}4Eϔpj[ۮ}7V  ^8S-m_s,Պ̟T{`(^5I%ҡu[`RDm2buZ/l1PshSt0'-McQknH$ynȰ9̐e'0DB¬a\bڊ Vɬ9!Nu[Y(%ɑgsd406T'5헰XB|=Yr‡#T1Wr$j7*BcSҟrP/{N(ހrLz갴7zf*/jYB (Ocfpe2V[qgG~yN;ƖӗO:~{ TrH -)I!'U`:12ٷI!?Fc >|cϩ( !JG@jMӐ}Z]\ ^[vqaN?j! wQ,Gc3ך9d>< @0jc1u|!X >i0#[ nSRqyD8mj㩪r-zPY#vtllc ,Ĺ뷠@^ڇS5 yryFtdP=9\`hi4?,s) BŸd'/l'nzU;hd `ـ^ل5*jL:Yw#,߼?*գ"HS `y$;=هEF%ûڨKR˅z|5E4 `J(.0g*P-bƸxBi$՗Y>_7~()bFM8)d-V\ XXaxa|2-qëcZ5W430w[svTӦM}n|#A:]\67')8ޕTd<`zF:=%[z;1Ы+ LF5}pc Dq ңwM 4v/U䩖Ƨgwuv{G95Ff40wZ|m L_'\ƂQm_Yr,Rt55?;E~AzH0s9*k]"ŃD/d-܅Q55&zzgӱDJx YW6RN%Z#F-h+8y2BCCʼ}%Ws3Gzd֡ct d a8da?OU|3 W$מ̤ocA'(b|#$0YS`Ư/ F ei  ؏n-))܇zbeAR@htAd#+XoF@1@R ă]C˰~1iN|s/ %r˜H$QO޹lNϑQVڻ DK!*ب{y`F'27/37+3prF#י|ٗDhǤY-l1RvY8]Q&1+t%*gQcː$ymcD@R=jfp[G+d炍d y!N8վl +Cc/o#oj 3mQ{CRcޡ{4Kԗ+ +㴈ەn9h\?: xm~*ؿ [@[&ՆB1X<mT?Sy_M}c`o}d\Bud&*d2biت,MԜzT|8G+zO_7u ~1/@x%OwK4p|Tv˫AȴL3&&6M4Mc"%2_0C3i 2g$BwCKzT6%'P(4icU1r6-{"8bNyTYϭD7ف> eǸֽsnCn<\Up0?SWzitQgo|0*Eo\*ó2K[*OzwM1 fYAP|ׁLqj%l+QC !aWPEC<3eB_q{ofd'v8ҧnP9ȏYlW{U̔\v;DhM_sW3`Neo44y/+?)-GMhu2dJnl(J7*2:)2tx(Q z[j4^gUO.۱>A~ͅPF$agTnr%,0;G߿;5 Qu)ݞ.KƩM>duU(ohrnB#kD3ab/RtykdIz]- ?^ǦE۞Qf[>4Yt*x\& jv{!C#wnIiV%aH#~> ߌRxZ^ԅ-> I/Kp6xoI( 1H`6ۤk= ,rdHAISo:SgĔHzLAuۏ{#9qP[/77`s|8DBe(׵g%{\eP+' rYK)rQa]杝1a~6oϗ!sg 6 U{Ad0a\9NZpVcSvS #D`$ WA[k@-L)r`|A21o]lIx̢3es":40QYccw#F/W)V.YXY"B):%@,ŝ\@."]LWcSsonV BXZ`t!YDk C~|DMٛm`9ELMx`QqŒ"=z;xW Xʊҙe˻JB 䓟yZ[i$ j7e2Iw^11xwg# 2 _hRsa~H &x|}Иw3ˆ r7w}5۳~C"d5EegT|0=Y rI]pQiw0X-U K3 C<hq^Wњ֪T`DFE,ö͋}tM{Ke&eXV.#!Zɓm{DcvϞdN;'HΧ7|vq3.h+JG%s2 G{Tpk#*yJ3D9ɪv; |3 ,1߀MWp#Rے<Ǭ%gdn]lz4j=7$665B}=zU{8heV[Zѽ^[QoܓE(_~E2(u{6"ޥšZc4gRkHeQ|CNJyzW23M' =B L @ #ao'O(:%@H(.*it t MƩ?l"B7`W'3AT\{o 4aC G*Y1&%̐ sPºɺ1Uy] ^n> aٛmRj N:!JljκKgnQRA/Km(>=/޿Grh@*Lk7!/>6ٻH=z"b"3*azXRAKoQA<'o^ -z3 zb*,I:5SOOD5s66 wi(j_~y!5;*Z:Fb!"?hXe3Yƫ׀yjc 6Sxi<.L]IR^( jG< %rU2:Iw-=&6R؇Y*WF=D4/yysGkpɺnFPr"ir ֬gɃn=L.쁕ŷ9:2KXdvC%I}:Pv.".87M#sq=CGbAq3@]4r͙K}>?$z Вzv/yL8k E&/7`o-߀7GJNuJ0"&f~kQjӔL3(vcl_N@_%KW k9{92PsMAn\dL/_+G09oWk-Fo%?)Y;t fx7 %= 4> $eȸYOcM\qWolj,u@t*c;aob;@_jAApStoː~Go2DvijM֧Ss/ƪEU!˻<]8m e$3 &qCOBnҟ<<1!Mv@fed_լuVc=>5V26nw+ݹԗT^gp=B`(8BPbGsڷ w`HܮQ|(^%Y M*ILIgǹPt#ydp\E*н/̫ՉVڤXӐ@M}U墩X ;V ǭ~>zO:|?1Up8VȰ8 v9ctMR%sxU p̷ vRVDwpvM!M}JʈtB+i%4$]zz7Ԟz;N(z6|sR4uAJ)$p7^ C".lg^`4}"$_k-Ϟ0um\yF6;6ڑ@0J0oqCECh/(7Ն=Gx9Xo]̈́Z#2qUԶk5^#wa4 #S$b}P2_E RQr+bf@c7R {,L#XGno/ H2kn@-՚ V 2GK IE,eT1jGZs* a9c߂HQu} X}rl=CU yEI,NVEKVwObqH[h+d5D 4aܙ)n<yA,yZLy53R&Z3uS+o =rz0&vH4z6ߥڊ؃h)?<А΀[~!PϖZz:%k fyV׉Nc S6K!@dz3a *Ѝ~s.f1{P-LgU0X}1y$gA rU f!a>Ё]HWt}GhFKs 71Ֆ Õ5t>a@yಈ:-Y ُy\(猆ըl5d"G*}ܲ0T0Z65tG#WZ]8^.i;uE&S4.wX &̇ǎllIUmHS[5DKwBqC;ٯ2ʁ>`R&unjݫ8_SKկK;aSwQv5BE 3\4jZTcQm( |SLGࡴ4l 2HLd=PmM] Xm42sLu젲ZQOܺKuVSYT!z[0X*FK21N:KqZOTf"rꢓ^nWZh ~R˫;;%-1nn^oFzX[(k-)n2 B?ӮNC(UY0r¬J~w< pp4{'-ZiA5r&iyL?~}JkB pMMZ`!HL8$P\bx?fm7Z$ Df?e_[A4yC95>.q}OybcO$EDFu}B$+Ur@zyl7#7" u$2Ή?7ːyJ4w]>mS-lg'ݥBPm͈uoP$6cDZB4+{f 3BǹIjsBqn}${2(ClTPcYs]X0]\\]1>~?*ؐ@huGhh(@WيG?J|Y? _$:[&95[BD]tfW46hנތR}`?9]K`M\7Yʸk3+.;^ z8==D|т!C_VH+fVdDܧ&hB„9mguQGˆ݇gZSAֻ>MI٣ٕZOmUO*2^'U;uY8F 7_8yݩw] O$J}}a&ܦ%>$xgڷ_đش YNT}8u@Q^I2jf,X9zBQ nqH.Frcn)@iP&Eքt6ck0dMSvfb#͎H^߄*{,xB Lr2o/k1qA̝_T);IJfɇAӌ@VJ8.boa-AЌn1XbۅӿFύи8򒃪!QL_dA30kݒü,t+VG3^yWMY{Is"mM=ň͒>qWnϤs0j:ڹ&`MZ6vDp/ ^-(/4bagX]^bbycPQDvMOrqWYOu%Zhz$B%6>P(;:nnӴX-!?ug@sK#ş[dH)@V'FV2;aԖ!?eY z"=௸1?0fHb>NP=…Q=B,q J&W= |tRx?%gcP8ӨX<" v!EnNؽmV,ŵquotБoGdZr{jWD ZԳԙU;VYB֫-}<鹂n`K"ß_k3K)GI7]"̔M}=Kijsfמ=oAFt AR˅DT@6󼟲HvHc|[RRGHEgzR˰ז|k<ܱ+^1z\$=~]R)dLuz ,g$Г, &< 9vl,-?`h %N h`51M%oyi]&8ckѬE"%fM`]/%׽-_>`a&No|j1a+? Y]?*6=DG5zS܅C9#ԼSOEQݍg9ȪFXn6cV+&>׷w֢k߶} ϯ4.adQSVn[ +J%C츂PH=v>;Xv4/5B)<0L.dg={T&c!ѵ$YⳌb=ږxaʲ,a~(ږ61 >:g508vjx6ЙV+oǦ[ I2([˒qY=&BD7h <9bvtvXGf{h:)O6n`_C"g0- 28$npyuF d1kU Koa*@։dXi;fv!Vj'it$-~2b+s~Uު  b!n/Pt~$ךn%*?D6>M rcfgwЂ5@1dt =nL88nQZ0E5g^*B_} ~"k'Ay@k=5t9 ?8``4UY savϊV<"E(')A {9 ީ0G)PpMI It8 ]yϵM !ĐC.yWi< K 49{Q%yMFlWƚ:5Ħ>)Htm'x>6Շ|(a)}jCOJϙSES,sCs,=10/2aD7愩"B̿"G0(-|C[%y3졗fږ'εcv:* o6ms,z=$%j yKȋJ}gB E!`^UpR'^?&ѽ5b5X˅Q ߨ$#mNMA͆}>62PQW&?@%eX{H,z*G;ëŤF9fiԓ 9~֔#$ Wg}gI%Ӻ`zVV+.d1 \xϤJ\,Bih2H }qb*4$Tz &KOzH\WSIEO(M8BF+Xn*O^lmߚK)g74ΉQ7 p0cĞA }Gƶ-9wNQ#I*53k88sPXaMa𩄯dNe]zh Z l*Qt]Q>/͡^ֱi*]x%&h2ٟ_Zp3pئ/.Q=C%.'%BCsWx(??y<eQZ:X"^@>1t+IRԀ;Ds`[7͗%DE`qmVUxia0B5 8iMi򓒂?@0AR#(K:e\8)\mu`&݌3t^KC +"ϨVg/a.銠Mf `0i_7N6gn`ﺄ4,ªH% @KуLhhz QRA[e0ikn]Z+޴C$!D&3t,:5VO0b SrXV*V#T@T.FMI!EJ4$siEb+B(iX{x (Kx]L(P W@MmFkd}b;xa_( _vTv=^F[0u~֤v!'m82U'1H'/;Lc-:i)WO[Z+>;s++@%rժoZ*@>e^uM7! d$Z^w._b 7mj>YeVї@L $oy)-w[$ϙ.&]tZExk%}G 9 eJQYWW^z`ETB K.ǖ5YQ࿽M&Jf.㥞kż\HANdZdwW%?s-NBc%QHːsDgW M_vtreZo(Q_t-ϵUxAN4'90M֔pk#27LKM$nD4@í; N`p ̅M_ -NsQQ1Y&ziB|Inc80ƀpS&}eB>*8rM{.?:ԫqU+SֺPZ54#ʻx|Z<ʸ!?jB]/6*Gwβ2iWA: VIR\c>֭d`ד@*B;;ڪy @tUP{a;ͼǧbo&p[g}(E3 I JقB '_(fEj-HN2Ymk5z0/<ȩ00&ٳ^yt 4GDx2Pq6BG6(dX5(3Ӭ+beCR`-.2C!0x(~ε<# r-S|pHmgH!AyGRAOf,룬0͏|yQ`1N1f $l@H 1kJZO*U\n]!ƇM>tcfɅ>:W]Lg,Wxyci/Y hA #hBd͒cn,ep.{NVh!B?nӁ? %'xJzƻ#޴hח&8Yb3mB<ը+!c/F(:bY6wOwҧnZ}[}ة66#"7FK+IQm4v:2ȋ=4m B0\DZE1Mbf3gk^Y<}i!>&;e)xpUK+i5bD<=rf"@٣\^;뛸= G!5dkn*َ)-cLDžPb/^&Vɰ);oEu@Tr[Lz c`TO {ջ!toMjvn"wڮ? u0U9Lt@+T?O݆hs!m<\rjf 4 ^VcFƚTw/jE:2Ep^kxYY{3(& +; xw'6QÚ WL#Aaqhq4%ۉ&*rm{᾽Bi%8}]AwkH %8l[N;~O&9\ey<˞^lx,-6UV7%;U]bE7=v}\~] 9s/Ƅa,% 14oĪ~̰ۇRev2*.V8j4yW {B:kQ Z (^u$SҴmVa-ދTЪV֖#O2~ҎW7@XyP\3ם#0:헀0&bNB[GԻCd˚̘WGo;!TQh;d&cߪ&HN?垣a ^rE=I|2Q!EEk~)5Pn%#YآټceqW?/~";\ڿ%5?KDp!SLA{߽XusT]!3l3} &# =[_ŕRFIA94Z%_ZȕJhR{3,ilAS6:G4K|H0c;q %,ȩġUgCWxW E\*AW &wbi6H-rå׽iow{ _̗>, Pm\H!YTmN=+a n&C C_VJkMŸ|y^2(=U4]-a*)D$F)sFkW+ T ߣ`q=1뺳`r~DEHz;);mҋ--oͧh<;l+M}ke&:ogIhQ#芧Uev]J W#(-Fw BSH -ܧ^ݖL7WkyW!6J+l/KN[q8EFܟ{M)jwg)%d,atm%=[ND..aƵsthHHK(KJe~D]u6ڱMyj,Ա Ydz UI3]tz2)TXs +Uke:b#NA47@ o"2z+ft)8=쪡Kw DRҋrL蹌S~4(0 ЩL.nyI/Jk LDf to ~^ZUkF; 6}4$BN"7(@'4݌>|c ۼW Ѻ^ tOK :pyaPCz0䎘wҜnz1|(nwt kpJWtVBIzE0ǰA W+0mYv;r^5މR B(lBo<$^?M`;AO9D=z]5 z~jݣF]r|gѿ*_B|X-G$S۩%%yиf6u,;R6w$Jyv.[ Nj/[/38dhYlpqSÙѬ:> !4>`M'A=HO4A>}*Mf6i9p{fY`d6./9'B|Ӄ/O݊"ƛ|tT&9ߦݥ s ׆iBU.h>)$x-z;R—YъWc- SUwEk[0&|1:V6.'1ԟ A'BAףz{&K vK@<_+߹R3Z'?B 3ˢE/Qz,ɡl1񋃆"JL4s} .RM2 R;`|3! CoHV{JoB H\wcj@e`ҍ&JgRgq*r`D]MG mRە|(v6bk"`F a!T#/Z8$aj7Z b7{Ot0 UqlT6Upmr@8&MH:?"@[COCZN?tC[SO(*g,WKQ_p/8I1k:2n&zƑ?1IT*r& G^EdGt9N񓪡C'ٷB:Kxz:O@x. 4\&h7}>_7_e}tt5h5~(Ө usu|UDRS3tػ2^4VYjP$; 'ͶzVkR'BњNLvc6e@Xt)l ZZh||yVi^mVM{xv绻zcg_(BcC}mvGډQĽ7rÌ#'OnjC$Mvݵs"ڳWE\Je~ˑ{r G~y@YD3NFv2׆y-Wa_E`==@t1 >޵*υ8_3WDLy𱝼 !HL_،YfL./!d7Uӥ cza񘬡nc@SS!ځ=e '(MmWڈ_I@M`rK%D +nU~Ի7p!%6Nt}/szP{l"\"j[ƑOU"%)Ś2/냉a *rMR$ =p8#5Q!ҥiNHBW u, mfs^`F.UxY<9ew]+NX&r tGsNf+X,-{G ߥ'q3J͌`; *x8IKV3T $(ۊҹ,kz#ue,SV_/L1#[E4"?ɿ^*4Wj¦٢g[weU]U v;\VknbU()GQ(%hƙKX:MnFyF ̀1^:ČmRm Aa8b9iG'\h`i>xqKMjj(#$ :;ٴfTr4w߶)dZ.UݙӨBk栢g/DOG.}2RO진R\ g:.N/ÈuՅ:o;"eZ?XIU @AcT!Ikb?h.fZUh* $Cp5kYK-пF_"OL >NR4q !֞Wb6R,ks[7 ިte#2^q&[NeCpy2XPj|fq*RBGC8 ܼ\<0PPKGBJq(4J`xe1p=eKȡlOG+m"<):rvR/b>W KO6E@55^T0pdo7?/ Y7AǼw#~÷ #j8APe}TGA0=V#tL6@iw%,k%[+b#D˽ <=tO58dutmkŜ*P+$2. &W1a _3֠s8Fo^,nu@y#PJSֽ@+4hKSIdz/,XHˆ \‰fn0z q]GɬFH ::7=$(kT OaT̖yR]s-UXw+F+ΎK `١C>;Eqa eYUb 2:pAdj<|'lUyL2H;fT)ftOBaE)~8طGR)0?QtZ_$N8FBއ`HeEb~ז3#W?˗o;O~uoMX_ !2SfhmB7y `}x`ZĆ5$VV"MKnf}tCy,Œ~+%bZz!*[ζ1(K_djS}y l6BHį[GU:)W,СYqd$grFA)`Zhe f G/YW,Zʯ+o. 7tAUi1*rJt)#HY ߙ|>r"a~dUU&HLK<߹|HRE{MBrfm<QNJ@0ԩcdP#L8x凡^T aIXrZ׵WDόέW(sVCe19=^vq/ ԝ΄ۤfcKN]LѸOP7uoHRgI*6bձճMm7 CB{AzA{FI! GyJ+E>lj+سy$˰PO~w2 4=g_l`X dF/ AXSǻA1NY9q_ p<Xm)d?e-ܿiw"ypZ<_쏽˖hH'hOo~%$DuF^.7բ[j 3GSRc. fT7GA&-2AɳUР"rcQzxia:aV){`0ĠehW1oD8/ȖGN0i+wJ4-xWMҠ2y. G +RY1nW쪸b^=jZO*ڃg=aOCm[ 0;󩳔C)KL:C?76H*sNr]:* Tpk‚UїGlKQ`3#BpKϵq fȢc~v#&ye :r-紋l3bx=\j ~>AFjQ˜fUk@,&jFRr4\myF:AK$1v kt#+[>ImMr4}b8y#ol;Ћz/>1ʓ7HZ1>*bCbMDY&MfSkdS \U^2j97>gLmvAX5ɍNq-ť's˃3^^ʨ:Ԙ$hN$FR(9DJAEM F>UA|gx\쨍VMREDBź^֕v|CS]-clg<@`jj ɳF߾AgiJHxW q?e[~iFj!ts'K]_neF JR򡯄[s]P l,`o @.+z45/a_uUU= B8A߷`=;)D?v9}o ?KOCDN eN1k]^GV]s6 o< `A?xw!0MGUIE,1 ĺNKK//DlATpihĐoQ}{G~{Y]d{ =}5CzE(~ȼ"oQ<@ OA]KN[:8i7;n G%/ZCI6~7W0~J֨e-ڼr9דݴ}QPoi rL>$ |^N?oGe̫D63Ʉ%y HD}v"4k@HS CS'f.=S 1:7{ o9q{Wہ$\1)ܫ_8?u,Jȇ^?[,_1EWz+L\`wM%3.-4 $MQ\[*?t:h u9 {3T`gM8H ]"ѓ(^4I0V;*Ab-4}3`%VB;A|y\}e8ҐX;o_ e,vb3d)mR0x0^4L~ 40ǜ,Qp- OSg3l4b v~C_̷ uhjqkvS4@C^a)n@z!"G?ODemغ28pGܠ^$'O:T^V)9F|FoeQe>.۰l2Z>, cNKM,MOXSR>%v3#\.LМ WW'V(PGx1: %-}\pѽ7hf \+w+P8zM\L|Dڲ$V^>\AO$MmM&;cy3Ab8ccb^VxOp1ʜADs=\NCUsΊ~b2ڗ:Wwb~ݨNovckjQ x8g{KK7)yVs0q Ē2|QKz6:!}V9޹1 ά>.%V^c9Gc\o &LC&_>):}.fq60o;N'e #K:U؁m]' [7vRB d˙á?;+lKu !sî7Z?X1#Ғp$;>r62qqC/4,8c)q#uyJƛuZ9 ,tgGR`[ʧsW9J0P{'%I9{x9:JU:2aKKTY=~#we0tQ^3 31:# ?",n6L0/k EńU2 &@P4 9!cJNˡYW eO?G2Ud6Ƞq$VnJ|/Tl7DSh7]_\l⺠~Z1֪**f7X1rd'Ou;rt}vmUmcͺhgS&rc;9 #bݶزfz$gBz&xz%v91XR#Du1kI->A֑tBha7]P.)Ѓs ԡ;Y@ӳ Ûv*KJ;R[OFA9긿D3T "kP;e[{Ƕy]?)R#vq?Å1X+?1PdA*[f^\ns;z;߶-֡.ޯ2W A^d*#B+/|8@V Vs &%ǒyh 862{N^Tu2 8.-"e)iwq"f2dz )4_ 1O =jj;@{n'[Kd8N=C WA~sTj߯o'ݻ0[=Si?LjSڛ$+BԾ%"!P n5>:/L+VJߟ?N;*ӑvr>!{"/ہA*nQty9DRDFʶQ ;4o. Kme Kvq>T~|r"kI}WN5$,d2.#)9pA|O:bm`wiZRkwǟªF0 HM-B`)Ic&Se'$یm= r]ϻhAk>+"!1,Ě4.m0Y橵BiͷOg= Hqx0I*yx<Av2^SI⠉ A[$bz 6M(?)ú(e b)$D2!HѼk/*Z#b% Ȓe,HW(I%U놉~uRbV,m}(1( $aT[~X8 5sCfBHt sVNAoN5/|1fBBpǍ[46LJlas_kysK"+A3:`,!5~c\k[v7೶0_AU*AUTi(dꆭ:HȎ}@>?UUhYVA=B#y}紈q`YErȈ&H#Yz|Zs7sƀ-4T=-yjrQG7xg @fm1P JQ}t*c3Ļ"^jy6pR̞6G9d: ՊۣuGL3Mn Ŏn&^vYp ߚ5(Q@zD"3QJoeơ#G {`G^ >=ЀfgW5TkUلaһYPgݖŹ$|k0B_E,M13M8gFk%aQ$Gޓ#3xR=- mC_<-6CZS[""KZ 2Υ5%i )7edxJ1O@ ߅@ alJVI>+9(Lsx;,>|XfpӫU+İkD9LG냎gXk=I.wx`CwhEc~/E}pjZth{}X\8V@.)Ļƫ9ت@M7һIGYZ?95iCp=5?5n%tnIEmm dĺ[ MW.Vz3K2ELupi|曆f4t;820@twWw¸,gHo+). 0~ 3H|z#F^,-@(%(JB+$}PO>zwdU7D٭3 lM5&ωkk.^hɏ~uW:Y?=qZ"/l\fAdߍNUZWlCgOd|xMBudZ53AT: ֧ky==%0wi!1{zjbaϮz8:W>TsgB u|$N>9-y>7dUꉶbA;BId  ;#է),>Jv$% Jd:Gk~8#Z{gg^uCۈ|(K,uNyZFoݟsJ? -8/̭˸Uh6,)ǽyד1!WYL^r٘xޘj7VLɚaq{P_ A, Ro̞7SOEђƔ9ͰAiG^j{0 n*RD#o;`ivDgQwa69X^7h>=j6mz/s a#<3H l_fXqfRʙQF]ǜspXކzB7y&?n\(s#=φ3?7Ԕ0͖6[DYvh`H!k׻jU*0IvL}zTjgawiC[h*[ ̧x\nΑ1}vFg)Aآ22T`@KIfVA Ɣ}GաZ,%5aS:5,?S:榦ZH! X:cU՞9*E)1/{DdbwJĴ!X?}PKTfDxp&@i PUr{9$SJ~QPūEPl%Ss̍ŷE{;)mg_IAH5Xl}_ESIE0Wzsܑ_*\ӧv`jt}{&#VzCzSW^^_eLdK1n]SYG % zKE 7ԍ]Q3>.Gz;:(B j8} ÆqV~I/МlNCW6+~Rtg0&*rfga nSWRѪTA)hqLPlo/\,0м[?3R R:Rl:K&Թ[Am^Ǻ,b[}NGci?%49G+<}{ h17Phfcޓbn D.PSw/ M)S ~"ڙF z9 -V[heeU6=rԀm6mY&i o KWo*_f@Y:ՎӔ0Af=k΁&3~U?׺U֟8|>ً= x) H[sC֗p@CVarHuERO>ӥ%(\.Y j|2bCKzhg  cn!CNαS}ymI3P%^vCpTk"3c7QaK$Vu{eǙ IӧKӶUޢ1bj>\>~V^\Iw[e\ΒY}kSSɫy~f1DŪ:|4͕mnA[4/ʠdhEISKMZ#j[?KKtgH"Ad8}ƍFLvqVxJn~]X|( CGxJ(#@CjiK|\~HX}whv`;eY\}osA ptFzщ L}lTn0ep- ̕ aKQvb_ TDX^Q|>MYTuG?0(4{f;AֿH7Ϊe^ NEZfWmlQIBȈiJKfi`OȸJn𐪟 PT ״~,)4?1%N9Csx3|{J8W =Mn}tA;|Sy9# y.5&iO,gDShv!ܭFlƒ 8r<!_wSG-|q\%ix7kOВAj4:d{P|s8vV ?!ԐϠ7~TN;UskpW!yB&??(VFǑAۏMuͰ\j˕xtdv>Vp\_vaAbJF0go8~N'(i!'/O@Cܢc\>7X ݰp߸)>^7afg'"F)xuqH? MFsmWdX z(}Y|` O76Ph"(#w#6]+Q'oDbs$#h]p } _i7)3NNՐr&j] ƲG40g3&@8$ TJq4-+0y6;-SyrHy)H?96zq-*$ivBl9IlSG ùy*OϵWQ,嫙e?.g'&+9# U֢$+A3>Y7ܸwFIW>p^+5xR_9:o>C'in[(z7Z-u}-YwZ' o!e9Po-POFe[4/ZRb&ko2F^&n:96r(L_~`z:§ݳR=b܂|iS]ZFV]VhP@Ht7z fHIwfprN~ p7KF9V`~u c"6wgDWdR 꽅;v}BRA8jjA`rZS7翹Iv̛ 8+ERK~KxqoZBx9- R/=ؤ|p~+uguNwk&=Rm 9jUQR޼z|Ml I.$ "Ơ}U?q PsbQQaRzDyt=$"^l5qJr N!ٻDUm7Ƹ➩l??H}fSnXh,;e4հ9Y6UbIQQTL^ab@Mv§ݶ 4 dξZ`cRc@*ѠN:pWVLH06cFlAcu/_#k8Z_'8/`nGvnwLߺ]afۚc^۶P e]o S`DRURbmblEKvtsv2Y:m$*L9EGPJy&-z|#dUay+k'['oq5uXJShZerpCH":^@Tі>A/`Y-r}v``KὌ[) "6fLN6Ol4)[TFqb괭Ä}IŽPƴ]4CY9M?6t?k0YL2_Jji]\q ɪJ69kpCӔw~2`p(4c0AoGhMivl;kEMF[!hJw IRYx!JNgo} cn7Яt7KYӑL8̮a\RX8xOO0йX'oɒMOܩ ֢_\5IqrZ@9B̢TI=-~?['\aYL2O~;+n -`V!$G80x)H-M LԥVAu%+:ì{^` :|WBcL-0Bv6ncf+{{kʿ,%o+,"[gG6Nā%Ϙ.lݚg3CrqGǾ4jտ}V`tx zwM9)'8 Oi!?T& /@o+s@IX:2=ޖzNT+[?T1 (2K=|R/" &0vJn% f[VM=G:@=>}6pL+y6~-ұ0l]hgCYޓ YAy)qKf8%kMS~+H KYe]UΤ@jBFI'z >KvN cvPbwSOr2l n&_HHxg9biT䒌̐[eZwFҦ{{`q_erֿ&+=NLE4.Nx6?i} 4컺쬣,cQ|IE[|湙L%|0I*E,ǂz%-؜ۛ2YX2PdS7~p,fLm n:@2o32͝+'CO tw! l]yR!5R`z}Ϧ ;" lly >[;:t)jJw'!{Y+vJBn+wz(0!wb$vmap$ I/ c8M ihO)u[weBWO׌){F,JL'W53y)J4T?hV,kz7Ww yG@ʎ':vm9O|F3z˲=DjQR/bNsTk'( 2]=2PjIIOE6n*;&FH9\|TPуuͲ^<[χIb]T5h?'&%k\UM^l)e߬+u@awLݐwZvdn)Jͨ6 xOm,=`7]曑b1,!R:9 ѬQÐG|5lf߷DEhzNQzyˢSBVas'h.T)+0HpPr{9]#f&~[qDJ*J_@ni@ПâO+1yq]vqTNݒp>Į*Ga /.lEGj.G$Io2O*g5B 赦/$1Y싾/QZr*EW1^{͎<m`/*}A{}\)zxC]-RRivѫҪRW4Ew|HZL9p^uGJӬ yPq /Ae)xchZrќi0EcD%B/9w!wpg3փɄ=DFrRhEH=)`EHTc`Ŕ|ߑ{z/D_)#IAuYخ8z+( x )$>*&:y7kg58MFJ0u7w 08$5mDΜXX=0>"/4AT!,ݧΣT%==#t 6+o响1)ne/)\}O  р!/nK⎽Y91y fp(RODY$lIuz~hҽ6dİ.Δ2P-2Y7ed| l/mvxf sw+ ܋ /TC;jDm#I 4ခշ ?CPSvZ34GԖȤTyI>"PY<1 n']:Ǐy)PP6zWsjRo}jʱW5F琉񩏥ͭ=9ľԇIK G~I_{2]U hM Pk*Kq`5*]ф.zتCD |;ጠ!Wsd-L 1:ܬLab{-V+)efFo?th v.phe5_W2 Mtqq*N::`] CߐQ ,9bfΩkOߌcҤu~_w?`:@ίX]VvErG 6R=٘Iш$ƬmjdCo'ކ@p9%`:]n6",>xO৏ t~'n~{NC=ʮdX7B}M+N߻hD-Tκ]4࡝]ǣ /`9^OުrikZ$Z(lPwgMG7Iʞh.PA;ub?55Q $nXfdZAyUMΣ#,h nV8'Z*mHIט]:?Tsk=Sť">"YD@n\߁IÓ U[8y@7rĜeZ)/C  :?H!Cո Q?'i#KKgAL2=! &F:b쮄(xvb$?UR#m&%NG$eq|&kǝ$m6)nf^͔Myڐ! jj9b/ bDS{ȿLȂA9V8{g9#]jrֶĐ߽]n1Q=0߁N_kCR{.UL EtE9q>.[t &D]R] '*$!0/Oj/XNs0 PTXM'm|-ycl>,Fb?09hhhӑ_#v9eq?ԯÔZ=@Z׉-L vow}ƺB^B* :LQޟ6kDIRĄ(, 1j$9{&o`"FrD Z %3XTKƨiycf;d0jgtsQlff蒄r&ܮCƳs, n5&: ;v㟞ek>#S(eq-ӕe-}B[gK::`pRf¿8}bdmˏXA\Wj-\{lܧlc7|֑'%+wBk4ӵ!9,-Sk}5`iU k6Xjȳ=aIՅ+ A '->5|1'q|- m,^a?P㿢jU: U`]D4չkˬKlisQ< -hc[.!D^绷^ǐ3l6t_IpPh=y.5Qrh'y*&Y'U +%PZ`+'gZ4@o a>>T 5MNT h=Bji)"RI{t>ްl(.d(|h.>SQ9_G8 baN1^SBjގi o)=_Dd%jWH&_w+DIMDrɳpxM_ ~F<':X[ٛ[XXXBDwo! kQ+SdG{뙃AJLW0a4EEug%bޢ3;5zú<Нl3Dgu( wZyN %CH+𫿣pj=` k[XF|#3dFrOu,y:WddaKn^v3J%l:Ȅ9cH{>j grdL{i:}cM*:q #GDsy" |Xt$5&[B[m(& iN2CRW^eQsvEiASLKhKjՊ;P:Ŝ%湹<"+-H$ ISdo+V1n`5 D^_@:!ġ&qd }kP`:";-!y1H0pu<^x5ɞ$pI\ߢC"zeuQ!Os3|86ʒnPӤn;(k.Xbo}ɞMo&ګ,]>bx ]{d񦈘dyOZ+蘈X>딅/yH;_,qaɦ):T6+ W~ƢgzDEL3jZ?H۾ ٟ!e?ԋ a"=O@iFqT]QYi5HhG>s>vd SvPaLH,Y '1ˍz0_v04дħ]@g=\_ qK" D:wU`Ѥ FG(7~yZErpVo!Zhd;9 ?A$`jq؉#wH$ׁZR[Dn<1wgR䅗K DCw:8TQra(LcO c%ɖ. wՕ aGoڱ{ ~(+]ơk*SI~xtRgX}"`Q9FŘs]4(7ʋ}V6YCZ$Ĺ!iZÞk%?YS`o >]'D9|^<3Uj"IJԍh2^ >$0?(9dyS ńx+ǝDlGY)* Qh¯1|axW|[2@-K ^픊udU-eBjgy@B;U_IU|z(r9)H2q5D<وvGnHc_$[0"""Кg{2k&\hujޔOM7+Æ`!(D\ [_j|uTPzJ}37% 1ڠ>Uu;qTm?R&w6Fbs|38y?3,d&#>Wہ7ڳU! M$wUQ"HbUҹ%Dc)>'\/ĴETO/:(ڇP ף^)wH=N6Bkd?=?sOq ˚1h=aG4Gg|3!,΢1C狡~B5qRpڽB1iM9 E) K-\2Ĝx5cU Q ۺPE>fܷySڛo'lj;ߞɩd)M\hgS7â^iov. ΓQ0^Mxk6I6B,uԌ6jNt(޵Dq {fXpl+;%tj=91{k ;>62@q3m%;qHY#.FQ ӗ|Fat0e@B,+e~c#(/7'py'&d!^^W2XJXG9=j*HTv˖%O}}BqM"_  <]-GУuBb:?3k`ۦ3rw#ƃWK~0z)WLj #*M.U4w均F+q 9 _ҸZ_9[X'Q@Z+Vql?{C<ϻy+0W[N{, 8B),]xLu6J"cLwO^ BQ(/bHfqyCXik*dww>5'6 [Uk~4mQ"f 8PMK yS chO]dб MޔGF8j *pK@C$DPO ;g o8MZWQ6& n-JO2RN7B\܊P!{o0i)e8gutz4ub-[H?ҋo-W}̍Ġ̿@stm]UPGlߋyik)W*u Cd\hc *QƗ6O5 p]CJڦz>t.%!M*GG9HM. &6᳦l[pv{*:ocX~NE9xMlk̑mBz>bTOϋ ~Xi'UؽT-v$Q)E߽vSTs X"on1*ϘA^MG.2is)Zhۀjf$%vC/.c2rP-VfV $'6J"bXQw2di1n*|)a:LW'Ն/exYv*3t:!|,/YN!8<=B.s 3\w8JTg'T^EHyqU Ҳ"uaHGۭ"٤| <vJӋkePVɱ\(Hu<Z7UĉL%N,N"J Un y|:伒Dp7j('l;-2zR,3.Hq1XM(VFVKZhP 8:{i%gފ%u :! a׾ G"VeVaϋ1ND`(Wv8X6fM|~:)x!Я0v&a:͈ͰMNLrxNj#ɴM-=RȔM#4фzJTGg8fÀke}~- tC|H)a((҃5srQ-JnQ#Eb{1X^Expmᗩa?VAA - S+v7p~Bl#I턢NTA{F)YsfUԥほlXC=A#w2Y# "шYxӿ<ݴH5I/d)%60?3U6 B?%A❓OEO.RI{i];Rh(%_Jy9LԄJ-SM]KNk ADezD_{>Q7.8D0HAq5 MB/~ҌiW?U"!_ctMF='ss_a>v*wĮWm2&kBLWT>ےQGlSFJ(F1Ĩl/JQXF2v:~$MKrԆ9[pJRyTu|--B]wB+(o礄bN٥YYzZ@oe:9K8R%;uN{Ɓjp,2`۔!P9.A<'m‰sҪr!&>| ؆>7?MsfN03->!3,ҥN,Z}76iݯJSt B Ȇ=r:ˊjT{; F#8ZQ@Bb7~į#Rɓ=$Jq 3K}9rl@{ B> 2kH asfO,$BWQ/+q1;Shp(.EWALyCv5v1 A*ic*%U]QCYTsN)y@C:()S'S@ʯ8‡4vǩ[*>&@z7gڈf! C둃6 o T6x+f#PGW&{=1vp`?Cb݆͢&kJW"Մ[qL4޿k\ 4I[#l>T8` 2wҢk*LoC,Qm~ILI.07r |߰,aeTsǁ-[,ۼtZ?$3&/ 6 y/ԻNYe}n%K &oOG+Q:uL{R[Zy>eUnhARg>?'Ukt!&it y%ǪT2Qcs6=ɧF 16S2 ^S$;~a'JLձ _Ӈ'awhZFIeŵy[lSzI/R'ɢ)W&~:%Ӄ=@U5 ng6=W$W)5sLL xsNseAgrXiVKS_Iף.&CTh2RZ_Rsֻ 0۶3p )!!eE"CZ/X3-Dv,81?OU_22^&`Wmma84H嗉r1|=(azz+Jh]`c@+l"Tx,{5g9jZ^Ҫ.#uy  6 ^ o]-\_g z=R-yɱT&oEY%bwl^oɼ&}Ϣt÷\/&} O Iا"(>\VKI3 R$`EK oVX&t\OMIk"t"YviAAs]sۛ̊58T%4l%@ed 8م9Sx԰G nT?p>.cWو̮R5r#}15 Q 0duQx1/dT5[mcW>15!Ԭhd/~E-]W6U%m~k^wfl 9T zگ~kS!<ـCȋfa u|D2)-R:oe#9čTz ZP .'+՚105f |ks'kIt' {j?ΆhYfVb4rUE2p(,3E| H(WDUeGb p_Ă{\1Z4 0 "?y%o=jwݧqhƭ ^p(a.rH&9re%X"g` )L} eXQMl^* |c6-0RcW!W ]sw!0"TU##w,uhm0UDcW@fo܀Әa0c d@тR8gbUy%VꤒXE;t}ɩl"wY ж*8s -m%>57v@0_c1g.J8#a|U:7$ svp|)ooEx۷^/ _g\o 5=,rkB*GN0r^OԁZ|=ߊ~OQtLI:Hް< lYk#I[7*3|̐gbn"J‚Vh dRl5 ~}5Wp~@htTWxm-oaL#$ fU\HbVI f ]Y >'~%سq8?m& sz[xM3Y:;nM{Dl*CtSqӹ/ucpyL1kqP7Ь14B%I#1C"ܮ0]ˑܬ@T4Q.zvsRnn1RDUbs"'A0!9QpRWuj>A,LJ,&cd٩KD P j4[{v<]_ 70c*Vs* hǦew:%2c&.G0!9%כEyOl 0Ƚ-3 (jgh} NCg$Rp .gLo9'qޙuݙ[HFv;K-iFoSU’lQ]k7ęF@}f,31{6KuE(/D{C}V!d^{=4LJ񹯭UuӱeP9g L|x8R$/A_u[@XaOHrx]$4Y1,1_ezLlw-KS98Itv_Jы;37W:=¿J+{r*'{v<Ztmi`0x]8xyzQ]N.3Xٛm1?i`$ou=ǐ/b* 8m6G*SGIr")SXČԗNaKІVT?#f=ܒvvy; hUjd\eF s)V8 JW)GIZ* HDhzkg-OhNuk rCp]/SS;Fu39VIcաD`?5-,y+tZfBlT6dM>䚁H4k~oK'nxljX)8TnF}]KA'T2uF};fb@PTm3 m݂$j\okq : hTR?D-APX؞f9k^ 9ݿ'*0~\1!/+dL+'YN*oO-i!;6f8H-_?ol[M!6מh.ɇz"۸ChŹ6^Z YKАˡQkBF@w};‹HĔv=Țf3lO͸Jـ3rw=炾W 77g}32$x:ڶGbyZ-Ωv@nlfil;/pA{&H9:'}(%c:HյhQ`ڶr M[3XTAȭ˧e$T<-dv8꒞nJnb%Xx8"$G1Δ0wÐ&v֔9(̋b.wץnO-SBLn|aarmiN'/7HIP"Xb%H *qmS|Sx7!N5HSot\C%*ѓTR"вX5yxv'bkPrX͊*.Fr)i'#Fs%k/U}R Y}l3I"]03B$ȡ4'=0{_1m𢖻Rp;gQ$݋Ϫɚ̒>QN\WRf1_%<8㲀rNhzF?a*Z'V-SB`A撇V$Fw_ĩTX[  xSg\ 郞U PSU3HL [ੱ?W!эi\! $F,Rי&H?F/9yG*{̙'<42blHNZFw> at]QO7,Pd9I^HOI~e%CWs~3Wm`;bbPcݩ'Fǹ,.sn1jk,vdLKcvտˢbOT翵A&at;-K RunPpDA8gm^Ӿ: MkˌQDpp}b f%WB+K=WJ 0!mi Xk;~"tP cLF^ OqveP?6yNʒ2e a+QT*34m c[+aaeZ۱{KMHKt[L I-B/m8-^n2>O[i˪x;1k˟% )!q&eG ]vO,`q {-m(>r|h, !ǖG \B'A@pRwp-{O|pѢH/ǒ窳 h_N$^bƚQF=sDAdG*p5֐EW@׊4qf"QF`e-i*̊mMSBF?tUo1ñe#9}aI.+f\ Gͮse^铕{ZP^e{+\OaOg4 Uyt:Qk~P~EYomJXm[io-uW BQɣPdKE+ It k3z߳P_x! $mZ ?큏ez$1" `Qǣ+o,sFh%HHL2v3MmK޲u!&Wd͕!."ɴ0KM 8(@5< SȡLʇ۬ ? {SӅ M/MA96Bϑ!5b-2t預e?|5[]t!ߦ݌-M='@Xx!z <7;m8B FYbkRra-p, :_QMvbHN%{RQ6dGϭms`7ORriߦ5a>SπSlb,)N޿2Ӿ|%~dg1}nK8Ƃｚ&8T;~o,|ųmȀE)4O翈# |Io::9ُd*:)R<1! U=JH%FW%1ϲ^jipp96%&('@L>ٔ*:*G9r·Š_e+ h z XxD_X TX#~RCոchST6Teŵ3k|9c,/ck`!:]B4;䑽i ^S$V@Ή*(Y\ȭX_܌D&{+?@;=LePc,8t L*`kYi\ ɹ Xv MTZ H5cq@[,ui¨'d_zHw3?n}IWs,:nsUGBW9X@G]О_A9CռiGUi}{M083bʀ|2GS2`!z5tp>xڟ<dȃSձnREжv%DT%цh7uU c}&S}q+`9yo@(P+%%aVx١fS= AVPkeΖ?»Ĉǥfb@SǗ{?A 0sGc#ױ$ɵKȳ0&owj%Nm`v9ˠ&FIļ7ulhD36@zkr+,͎7 !CsH nGu'HUau;ES f CCTn$CriR|NVdUZ>" z@d$׼k A'{hcWG[VO"[k:, m\!!`ɑҜ3= gǒt<ș$1B@n̥mr^q +ޓض7^$5^߲,:=2oxnq#.ݻ53U7*;-K}&6eJ֩;zmUw[ J몹R~p1-R.D$v +-g~b'[B34,#R(PVNJM.9ێ. Ԋ~K/dQiGɀ7d~}Fս 7(2{i6ӷ#HߎH})\KZ jAvFrstdҹةEg[7 ?(XD]j=rFPI85;/+}H$Pd &66* x"ݕ۷V&qȆ O8|L/Ω&b9" rwhl6@ިڝH,CIĤGo6Fs'RQI2>nHu0K(J az] G1w:( m9JҚBS_3j]]t4cEu70Z\mĻa1 2%2u-AoR1@^KP<={aEF 0d[p$_hE(1gEE26ufiΦ{3)4lCS]C!w3;}Yd:p|褲7#8"þ. +\jJGn If%!F ͷ#-a̱쇬K_fp-pY T Jڗ'ޣԅ[MS an !j$39 n vE{R9VDd1Ԃ:0 S%9ݖ 4<`L`-{|K X6U`9}ČCD xTHx4jR=@m8iV<wN򽸿=3:-NLֶ0G$oͳF$ fSwʡI;v6qmaȧ(i7?"#-y7%;2)皻[*Z /E"kF3rcވ(is.{vRMl}b}YƷT!@Kh@ň7;,}K.[u?ayz;9u0ԯk ࣑ ) <fUµ/`hQ2y0KfEHod7sbcy\= N*4װvx}dyJ"=z',eRg<:zNcũy>iB|f.3pאP05WwC闰hi'?f ' (Qn}O=^5S{ l5nUBm`CUN6A ~lV҈e(ᙶz^ؚ"+MU[ΰ|d|'|){ww5:S$bq{H*32#=دG͢()aAWR"[%vqAn #0Y`1FGYZtMz+Gq84 XQ$ϟ,9WsĬVTKutpg¤ Pl: 0޵٣YWb~ n'/^,p3"͞lM~ew뇮 ^cA:*K\dbС6大*cmJo7fb8yв<_D)12pYFjp1Sc*v@{3tlvQqwݕ*]1y/cϕL7 \ C*^v.WRVvxۄβBYD6g3U.+ph-,*v_ْgLK6nk mP#I qW"a"j~I, c=u.'>#>`NYPɀz{IΎuMJQ)jkk-IxhHN~$dP g3C<i r%x6ߣ uLɾKf :XP& (jh!GoF3LԬБr'?͎oE0IF@+8: GIG)3xL4BG@ٻK,F˵($DlD^' jDE[ z y.sn원aF&zug*;HO6'g܌Ŭ8dbB":q͂lV<@L)4ysbI@׬>bЖ_"õVP Fqkּxt łrSs(wRy+֣h\C餩rfH~洑5rA-2ߠ78O#E]'ȸ\C|js} w^"U}d~fDUԒI\WZˁRaNr)WQLKtu++SvHADj;B!f=,;йxTm {liOun@ʢ #dĻtw7Q$6:\.quOԤs6x~z>`xu9PO!3#k(b~v1W  3&{ڱ% "}BeeHwmGH~eUOQ2Qy>kZ,gE;+Y oQpoVe|o vffIN-j&ɝ0`d`2$;Q_.taB>{< B]v!Et/kDjTiΆzGzER5ʻ52<6'TQfAbX0bK> ޕ}.rvt6ס3o$Q [ki,_MT3?ʯ*@XAI][pxZ Cl P]P|]3~zRNbj I䒾:>'Wwt0m;sFnPF:mD?'^ K?}A)-?BʛP (+OtI7>|H1i(429kGyxܣR}9 b8-|cVjC\>ִn+%EA(s{"?1Uլ<~ܹ~m!00W5s;ds›:$F<=W-fF\v4f &+=jbీMP#&ep:ȆwQUGv, 3J`u33+:}r&$t6\ #j gYr$BûpLP3֣E)uAdQtiIԓ`Kڵ RW62'*8v¯;yG֊z52|ׯ' }tTr#ɯIɏSҙ~ i7ڻ8R4F{h֊\juBG{{\[2 jFpSj?3ɂ럍 .5-@l.L~,gk׍e,pS8y?s R!BhUF4m'>syYYa~y|\nMU+ DIB_>]l\ڍ05IrJ'Puet_-ق?᧸nZ9e%_|6'oفͩtfT-J"ˑYIS pb9'4-73yG%ȯmeWz[362(/[TYCh5xDlk&)̮}/tM쁬>>9yߚȸ X(ho,Vk'eO7I_@H e5Ě~rN9pM]{`@OOvq`B#*j2^NC[ j8Ex/Kʹ POjZLkpXzJ$grPq$%a c"v"dEt4qsUY7ht8|`u(73vX f$ʅ?inG݊}c+͕N!HMZ~zf[jN=(t`Z[62$Q5ఊ>4r<+YX{c_'H=qV_c-$};?BA=IY5"^x0`yc<3ýa?ſ8k]`CV1K]&3 VWHPFl#'N~)˯<:ۍ5ʬsqS[#dd /\o1 ( 5п"iR8C40Q(Mlx4/un'("`:ZM3],G!s/t8Ƞ1Bk,-26/!w kF`|quWN)E`VmAлP ^ o7uXؽi)Qh f-L?vU-9F+c_&>1_< F )v0ge ܟjB4Bf-/y򧇧Hy{AJrƘ̝ ^&*ӝc1[]:ZANѿ!%,ҘE>0ZJo!.9r3(ctKLsk;Hh@tx ',(\5DOvZ(ƉcUcQT8 R3)FRw4{v88"טj~UVП>4f Lx?-[$90wLgԿ{lÞc4li4|! ř2L1GSoaVN wǷ >ۚ/ydZsT"Ldܴwl+ar;F1.g475<@F81V]2LhjS8d6[&z\XL ywe@ )nc_M Ϝ\O=Y fhSPWpɤ(.MX }\Gs";RI9wQuqxM&Cj.nfEڏX-a2+[d!Oe#^՜+ty FSuH(R`*=} Yc wrڵ}Z{C3,oϯ6)ݯ+<+oO9H<UV'1kuVa@/x|N,)QxrA8g,SuF9lkv.ԴLxk.v&c{D7I[4kj=X|}@YWH"uDVB&=&Ms T~-gDOۤj;peBgkXy@ZI%%C`p,E[@nk \2t8;^P'`_8{f{#7+zo"bvIxѬA49&Sb(YJSo8yC5+s=;\G훊³5ר;0 N8phBg3mp FY{lao{%^d " Ƣkv63kzY1ʧO~?y$zqͼX U<bmyq^iTSRr全ضCU Z{:/h7!蝍-=pkLm@)#ͱ91brdR{ qY+_ Z5\Ff2`UIHٹx>Z5=ghBn'ݽ14^:& 7P|h‚Ky@ [L&mֱ+᪨6]FyQ:\Z$,$ j~]E,C j,U sJ0ßԤYu/o"~mnZ|hA3GvY!Wж 9;y; 3ڀ˝rφ0NK(󱰤%7yD:(I70Yև7ϳ&ޞx, c;# 1 kɔ =nWذٵ|E| YTz轫x)sW(gI)rzSDҮ#TxDwlauycZQ vE筋(h< Yp.]V$qoϸ-Dao6ÚXE7-67!T~Tg+tx# Is:Ժm%D38~?ÿ8Wwν|6Ik$;S,A;PD~Z6"˚ TثqмGN/Y*'<!fDIJ5Svz((S YQ:#;\QZ/082^XhB$V($@o;J =) RGaQB #iv|#ꈼ2ie_%HS:㳀rUm~dw'$`TG xd[%귯%nWof#TtF=FGj^E:>u*qßbyKj혯L.|ǧDQ {;R/<5-b2u4nEja&<_Q!Ck-j<%NoB B/kR3ӿUv{$CFD31xD qn&Rg/JѩCg;߷9S$i _(c}! WmW{~KBif!FK; b"Cx빝Q0NP}skAg 7|x;0z2m |4<  ~\ .MeR?qB-ȵaf䛣0CAspEqsW-&ywsobcog]*k6j~'c/av0r"%BCW#C Z[yiHE-:} * ?.{ $]17wfx5a9 GbTv?{A `H& Lb-B侹WC]aY=Jֺ#!#%u4e%5FYa^̸Y@v{Zyk4#}$Qc B1oF`D{V;1_ R'`f|.==ΨTO߲?iV`|Ir9 P |'Z}C^oj:8yJ$WAsA傽[a>dUk*I}ES*L"^i>b]> Ia9_ W_"Vex|egPrpyרXa08'n[dI5Ve>{/2LGgq*=TŘCZAx,o7.H1.Y)!Kvh=!';x`fj0U))bCT0fJ63m'A,b7tlgځs-5K:znrCAPB L5KE<,K|v%sv 90~l E$U7MoZVu )[IJ( 7y⥧S Sppi`4+y n֥ I(<| F7`W sxW1k=-d46Ph@@s*!~RzuI.:^l5 \熪Jwa[([F-ёn `_$E;\+54\ZM p*9Y3}6%\{!0 bsO<#LA(OC ϳͣih>s}R3AgS$vbxFHy!1V0F V 3M;CJyלiCq*y2 >qH#Ra/VYddv` "U5 AaPΌme=Z iM~s(2oS|uyyi"4{BaZ{W̢I^[a ⷅoAݸ]H*pd!h=֋{1⿨Z^JvB=ٞȨ(@2Gf4]~1$u 7rAOxqVuKps1lp8Ņdj$o,iRs$%~{lLu9mB{gYhbi@n oލA4)E@'%|%QITש@kUٳ!b! `U!LUT"L⸻mOdspC{BUZ^%Qd}6jf}@wS[z)k}<yo`TPe5HrqR ^b(Yu˵Z&}N>i/mܓ*Wy%x u(鴜0~穌t+xi2ܥkwB?u@oK`eW6vsSiyH|x@:it`Wޣ,Ҧl:=P>N`G;hHL#%'ט2G]I'W>[ZZ3ĪXLtQTbeԉ6gHKE(S{sx:}v3ddlG+6l>uv#Ƅ.6jLyIꦎM"%V5GN%gDyCL g>x>9EjɏHojde5skTGTEVe֙CN3fJg0{ ܞo& X=+|5;_!;-zh;)(*1GEhL =-8ܛOwpJj*|au[EmAeA Qu&fuO'l)+C3 ޸ݦ@Bp(Nޟ꽱v? bK(ZZA$^7.̫]X8m]")EY$*i^}YQ^ >4}Dv8 srL{NAskT]A5Ud]a,tr)7`RANFpMLP|~8cQQ`1p o\{T?9H’:t\'vHY-[iiVlbO"f'~NVf[+!S{Vvm?]0^#xD~C;47c#/0"5H̾h)ϒ.μvf$J}k,4B; l`>9#kzuܤT{1WCwM#\O> vFVX'D NI rLPr ,;: C ϦaRScɺ<+#uqb>+k`Sd̯RV t8] 4=Tpzm(|$Al:$߫2lXv7}D 2 >?f![2`wJ]7BF+n̋~ζxSȅegbPSKn:. hjQkЧRv2]cTgB& Dגl b dN>,hVՄ HVD'7cm$>WAo5lbOm^ "坞KA%tG2(yBN8+JKhJ˔Ţ.A劜~&R M&YuyDlM'FVJojz行&]7؝?b(`v턃$3.`jlx cDN뽛*p. 3v3گ;0Y}>ĜxrVA #q3U۲㥹 SΗ=|;] ڍ^`\O951}mhĄ }Ǹ5?[D.9q$A@\‌XNz$ |ApȈbo)|ˮ(J2"vcVoYM 7^[~u6-'= :Ƭl>T)9AR#vE!'6>TXg G^f Y1}f. çmĚ[P>fXY^,{NܬRuBYf'4U3g'zGt7cNMgRjM :[z=U@wӬ;l7HG^&q1[> ֹm%- e)X-Kj~yn fv8H2y^Nu'J+ɾ +H~fc+ikXʈ*RRѣ(΢؛qXXV0Cl1/yh0eIs+}޺ѕEaU|i!S@Kd{9].K<;*% j h>Op1+4liъ8Z?V=49E!1>E Jb`4a9>^|k6.N|Τv|o0p#gTLpP+(4pe/I\(@-K=+HX!5i|& Nj&s ܍vZMɥ3OƹU$O.z!dH?d"k17?mg%iŷ{+쵖0Żb@lb4 'zq*EuJ`D)! ! țGs]rj88?s| C1Z1Tnb8`>f;^d-6.b!ƆYz\:T28^ЗdIm[D߄,1Z)k'AQeν14Ȣ0K0^F(J=zDSCccsjɣ'Q|Au[ywTk;^`ɛxkT=b=4HUP+hjn"  ,m:8ts58=zlgPׄ4p5'l((ݚ*seATpi* n2ჰ"@ښKY_Γj^ooY+vjJ֡#W~z>[Be۳; 里̳Y15 Q*,iNc~ _DG` È;?Xpt~@J$!M/@V^:GXn 9B*+0µJ\|}]V{,5O%v+rɘ F}߶#EbenR>Da _B2 HGO5eFkX9s+U.T!G9VR5> i4 mȴK('E˘ \|=r#5 čHPc[p@H-.Q9PAN=myI7/LM}5TɛNۊ6V2=LRFivESp3{ar8 H~8H4/ɤI^KI?Ntil!7.8+AXׯ\8Τ4HJ]R7v> , bmv-ތ#*px-B8髐8x6+_,AɍcȢn2{m`cj0ـqʼ+ p&AݬKk7xpcWt``P̗Yjd2(oO/&O͡*'g(T 9."q[16+ T@yⲪ/́t?T hw[Gv4MUp(CWa[jJeРV[Sdlˆw/~9F u2gpG"{4B$ju6%h}S.251[9\fVY69rl7cd9[u.B"E z0&g&{pIh-X U=_.]]MU{0ɺ7Pi;\Toxb*YZ-pqdٮ[eU-4geg6WuCBwߣddqT|}pAL0v+ls8O{q3忎[[;}i_Ϲ(ՁG^`Iaeb0ڟVٽ%Mf2'r Gwtz`ŵ$uzi 97W+,]QN=>DdRwwsP(Z8u0jj.g4VB')6CN4jc ^ XsM;%ϖUy|=<[}G-nϩ KicrwuFiYMXxAw0E{|*+VY8I 8Oˑs,i#b֣PY[V.aى kW͡PL|A7)N\B33*N$r;睕&jx Xsv7t69 $N]ooǖBwR@;,Luoh2gx,&'<>@ߚPh ;VdQ} 5S޹RJҨr (j2>A nq3]h^&Ҵ#V,4vxvhP%M{ong^CQ)yjQvlR $kq1tUCf4V:#.:c:l:'eyf%\ riZqq0`&;Iuܸ.AA%r>e,Qw&9tkc!~>Pb q)# һ&[& V?%6 oyIE.Mˁrew@06WTv;_Yഌ IYc"z/ Ňctd; =o=q$1!>}jQ=DUaqXcvԄkU, _Σl5.[Z cE359clԔpF>9tsIWOHc0N*OF>h4|D<{FOE}57ഫVbzk.nwQD Ǩ4~u\UdIk"|.,- * LD]^ߙOHK0Bxو ~,1ք/:t63TUu",EnLjV_}0D#5im^uh4%N>iU7 ?2됛4- ":1og7,JH4&' >prjrR%wNˎ0V$\<تe;mzѯ+4PF y?m\;C/ߔ@#i-ъO8!%*H K\<6߀v'3E*%f_|7n;a XD!Sa F.(979zn4JBq2k/z IUl6:C]|a~yiMD3E*]:l%)t\P8='_xA {%E2I@YZmv Y7)%Shl2H GO9JeuL "gpR^e>tCRr9# :-(1@2 _Ui6# 4 Y4 WGma'hr-L.쌼&זRvR*'hX9F1O345ٶX;Q '|I+`Lپ՛Jy2?3M+HwV)BpkV.BaEV&HZ&˯CEF:GA!)@#AZ 𭝻752T>D7lVĻV/X"]B=@BZb0QKDbCX9'qBpA.5JWYb1lv6]B@萦@Fmw~, r;9`x4v|8Δ۲`i f =MϜٶp~U&ӢܚpcзAGF^ql絔l7IxxU٢}?Ld/+6fU7I̕N۵7bP[z^XHE(w:N3i^VHN'%}SJLƎm#ȨmmzQhb-Yє*\EMr(N!:2Azc?LύG}8G-\0@N{Agܜ )ZDj]au>9_)Jq eisqBNHڬhcEJfZ||y t\ P@lW{s!00i/$_8?Vo%"籐Ԥvfඃ3E ?XZ3[%t; X' [;-/:s9qoQ!ɥۓTf xOek}?ɦYWa`r#@Qa@t*Ob*aHFw%U׫s ƈbNA}Urq#olz{k%w|,њ& x[A$(eo|zi }L=w͌V&ud MbK0QWX9S‚jrW,DvޤpFfжsiП*F-ɐ:rܙJn)=Gn|'1/Vdzќ| kX ;[}I91;ؠ%={є}v0EGAfB 5S g]Vz>UD)9R-ĈyICGEBBkW䁑T:okd^엢Q}]7퉡N(|2nZzac Z@LzɜGKa[ I?d'ot<_5Ol,j#BWrΰۿ-<ÒY<ڼm$Y:|)F<ţ 1 izac}m֍7vɐF\VYGo`p/kjJ'epr|ѭ؊-@ʌY7{"ڜvog|x 2!`?&F[m9|ǀINj)rzz_>+h:?n3JW-(탃0l!&~.<( 8$nmNoHdn9UT?ZSS^69EnH97:6̔X 2jfuwAAx\ m5oD<"PR-3Tq{1!ʓ̮y UN?[sfN'LNamdUc4Na^عUiK 5;ؐN}y5Ё϶^vp# | v-a!}@A]!;f&?c8c` Li½W=[wf 롼nAx(*$m5dC$]o1cāa)ajg(*b/E쬦+0cK FՕ܌jjmnJ8L$IgOr`UAo\LdV V6 DeXX#1f4Ax:fa/#f~>;N~6|\P F,(Sιx4l j09_K+J?t S.M՗-$auf'ޏNV9~,%c?mUPkux. ıJ^X^ɕ1i8g{.ʉbt/gjFEpn$͔}$XO:66ဗm1f<<[p9r|Ӆ?"m1)Z S^c]7m[نk"HkYLo7-#-d&*ַV~+F?637 㩉Mf43K,Ԅn( h&)Tްnҍ6qbYނM֓ c«DQac*ӔؿG3[SJ봈50y&h&F(] 2-&vHa@e[es4^@77n(yP:0_N@42آ"h/5sH['pU0͈%8X8 И- } @T V**RPҶ*.7f vIY5civD # O!,L`>` YEM(*ug6F$ gT"ӗJ`.d?sw6ci>p(5y7~ont JO2}[#O[}(,|+ 9A϶̅X;җlׁ H0Q*8oTI_UJ!LW̛P) J;th.nuXFZ3(b浒u駖Z|gևyvd_jEO&ߖ)Y\BƆLo T~Uc@AHfke"uUo|{ 2) (A$#d[.&ˆt.{ +Ǎ34,J>aI4Wve߾?l`)Byܲ?hlp:Ř{׋dAJ+؃v(U+PjFOJv0k ?˄7 gZ_s |BE`1m;Ʋ33EST(s@qNܠAz5$ǖlMwhϽZ+(n'[0X[nkSQ *MH0Lk6%$Z f`zTlh9"@60 wA!\tVU]]zs=Mj2#X3z 11/zeye#!5\IJ?^g,OL`c% 1NBk)2oz^ `~Y3:+byOuyn]P4—XsUtz4ʤO^ Uw~܆[95R,t)V0XEZb5 z kLL1Y<[`AoC'C^~?tt06wfH֕:X$DQqvW2"-4$a/{+oSQp[٘F\d ޲,*'<9źz-wK|&]jS$R%o BBڮrZbWޝN,D~dl_&(ITHp*|?l>7r\LJlt wX^1 P4 ~" ⮑Np)€rmغXRnK9K j w^ -٨b:.|ߒo”+9,ԩT1692}xn[>M}| m4h=;hh*l|)[=Vt1SL*  膶n5Ff6&[~C Nn*4`1uQYӤ V^Ơ01)#79](/6L|JCvv?*ɭI8ޒ \`;~N#@o9A"&ܼ#S"%pz%!I*~УO8r?I}=67\FT;j9%**,1 o˪o췱vH 5T oԣe {H&9,z\fd}g*L%)%-8lR\!֨Q@CZ+}0/".CSQZ.DQOF24//#_.a]- |)JY IPIFihlȰxRX ų1'vyx=!/L!ͣa8 75قx([ p @cWU:dlrNjJ 5\HJld4i9  *6M(=eEslBBtA"dkRVmmٮ'1o6AzI|O=d3D;S.L|š qo OF3 DZ^4OqQGcݛb2}S_PJ}XTH伖(`01Lң&jR~xƧcO'|>IKI:Ƅ#Yֆ/F-wFPA.uD_yf2d)*D&xm9~ >bGVY8$2?ŖG|j4dT6`zq&q~xέ]q>Pg:vtSp5%e\3_!+B2 {ǎz ESf t ߘqXU"lb\7 Nt"ڸ*g R6혭'"v,`g]S C'*KP r]_ԛv̂X/ [=?e'oۇچ A)1_ݿ 1!|,i]8Hs->-)8AkH} ]~ !aIOV sw K=sRij&w2@c 0 n R ]\]H-id 3>E nM~S|2[¢vK4mfog:؝Woa{;!9GYҘ3Qܕ]ITG"*Viw 6J|}Kk1|B^P5T~ϯ!V2L>ϫ(X} |/r_A1[TUW\ReCB%4f%g76xX#dMF. 8b[?Vm^ŵo#`P;qۼS^V/}CyYϧO Fh ->g#H5kFϱaUso&E iC02jޯa6VY9P?OONnSf@|/;o3Ռ_js|G01 7Uht6+ 6S7ԱhKF@$3vG<% /Gu=sڮ-);}b!Dr'OKك- ك-آ~G}-榋z&vvixn:%{"UIB2f|!#O8%yXE}kFPڄ PԇrqKE 1M S94X U~Q"pxOUW<Ӏ1 q"6C?*:EӃośn`ri>N(M6\ 4ḩQ$iiUOckO8|f nJ`PS4ԫ+xhk8ibUG.,?mm/"=/cR,.>VoM@vА׌PV߭C8D?b B2Ρbkȿcw˱hdqepIt!{tj'UnKմp0p.=M+pd^1t//O/1䄞vD~Kqsㅴ\[Ks^;%p,i~Q,LsF(zg,Jok& pIޑkk|.KcE9բ;.~Ξ5kaSx@_ pPW ܆n8^,#XZc+gd Ų7 GlFAβG\m[U, 9#mÅ|-"k?I.G(CJfgAP_y5UۙFҀM .½^9Jp4}Zeuoȸ';$z~ˀxM go5߽rSJ"SXSq01:>ouC "YaMAXCvY nmzENfW1uKnXx&~Mj^1a{W pZ=VGC on*"@Y" :s~>6wѾ;q=)t> $1ac8Cnzg } Bt\=Liy^IԽy8aOQ.ܮ衂>bu &NG֨Κ{A *xx w_=-qp-ٵɱ*X( <)-v*{žec:N#hpH't˦UO+S'1"?G6i;j똯lt(,`rHw@{`ewY#9u' ѣ⧫K۞+ZԺb!Ut^ w%'H^6ˋE氬ܜo0Γ/bu!ѕ=w1sINxe/ hh ̹bm>ڗѵ VmJʭ`Ǡ#0UhONWs{^ҧ=ѫiP\$8&QbiGO?ȲgL%.rYhy?bZQM45-y\ Y ̝z)uWx<'tfnO30 p&6a\g&g٬nT_MT}Q5僮 |yېDmcނ}Rٙ 冠6VnK|YHz1 KiuWPEVxRc`LH+mcmXlp,Ur$ E9_ 7(_PBL8v`DYKAh퉤NRjeb&~rz^z<ۀۗ`9!ifb uQRyȥ؄)S.a@J0GLﴕ`[>{@IĨ7S9ibsqWa+Yqh"t :lBƯJ8".q%hR`F76w% }`0f" lr&Vƞ 3:vcO9ka܁Re+,πeecjB'uHެ}ƢQ' ] z%$Y8| [ 8)yܰdLI kھ"F{P]`഻2md~sRSo _4r h=t_oc9'G17o|Q@8"R W<_Q;.$b1t\Ӓ'mEVD3=uk :~­[GJAѺ oa0 b3%Ht0_x^]+^+Y `o/D:2|3K'mPDR|rHp^zP/l! `mfIC1$&O5oP<Ӎ#CT4 4T}Ct!Lz9R> jrH;B68'f0uL<im?& qbSW0 Da=K Cn9D⋽o=V<˟R#ZYu<~oV&"DZ`<|+L*#a*PfTuKda2l !aYOJ^"\\!J%܊hGxKK;a\g) WeWI6/tMqlwAqcSһu?,~X%8Lqr*ݞWfl6$g)ey>h;݆#i49TяnI L/NCG,:Tʧ)L7W4_pH_ɩ.=yye:@Ny-"H<ܥ_7Dy^}˨$Tj #u:idujcߧ\8N#)A|\+^;Z0.;\s_{߸w0kx$(#k;o+`W }jv9ص [7ߝ;W] e+Bè_D獼uA5?C2v ctwDK{,ϚS0#Y~8v$rs`!;pTqgp,{h*As`,]ɸ:^8y䡺wlg@݂Ћ|;WE' ˲8'y-LgpYہ~R,Vw@ZOd}{;`-UEvɨ93" $yhUhyS03 jӿy&E;aٙOA ,WӽĴj:~ʌ>Sn o26~.#>T 1&R1yeX9 e[fSDs9Zs=Ԏ3Ht˘T9}#]3* MGhh U7xoO \fa0{үe!|*J~Uz JT ͎\bikifOANXe ̞M&dc|B=}].A||>`x.yp9ft\\{hѰCbh*wڲ@{Yez#LK6ܤd\- K(B[6,̨Vĭ}]Rx<IQxqX X'!ǭb( Qc2I2 6u7ucCxm- =Dg.{>Ja7tzvpCh~pEpk3ypU DOӕT2>T"2ߪr[3h$%S0 =CJ-؋̴=Gal+ FV'`@6${8i-ě/6o@b]=H7C?O. 7k 70nAvْLh5iSc1`i̖;)bt("J0c#$H:.fsz& j'R惁OXL[rq:.9W3I*AT2sCQYJV'rAx ЃtS3IHhQT4PrcI/C[C!9uϑ?ҍ1~>Â7nû5\֢5H+ AuOoM<^l#d*|(~6d+XnuP.D\ֈ8Ac^71Gf߅z+wǓ+5X1N5/%i?mrc $b WPFU&+9uU}5-\܃kɷ6NfXkV`Tq/6၌,ݕ㻊R&Qǭ 3Dj؁2lͲ.ƴ 9'hG YC2)HM>ͤSgk.S'D}3i2[TP稱*42\E$5SpyuP鹻tTQ'9ϹvHQڠm ƒ]8h/S/'y+țI6 Ogz6g_l'`k9 !JeJD8UQA7]V9_ƱBrW0c7?h"M5l4(kmo@Ϧk/XZvuܸ1 B'!98&o7Qvx !ȧE#)ǿ*tMŜI4\aR덊=Ŀ<DZ.yߢ 89 A=@#eV{rcm >,ثA- (={wUm?f0ͯ+ 1]2ʎPԖU Nj:#<=.YԒv/U2O+y+1XheNX߃\+yM$^4ϺWvǿ8٫ Ȁk)2hc`)o߱)V:NE 鬋5@(hʶRnB-L?cEC%8G~9bUE/Vn4|l-F{}[qw|(`$o3=ڳX ty 3٨궷yPػ$?6kjZKH;,n^C.&lo7=$AFbH>ʟǣl*u WK @GWU a)TO[ t~㔍Y;@a>M$ZFBi> __C6o_"w:ێM=k67 Opֽb (-DVV 7_@jwE ri'D9س ZGt_.˗b<ĸtPv3XO踌~Wu+w#L y*}m#d[*|?>]@G Ôu}?MmFO>|h\r ᯉe<NK q7.&iw' RJZVnBh**qt&uvb;#?FfНn3ǖU'ǮgrnV=(w!SP%ڠc(.6~oņ"д1h I7|[==1S~dSz~hquG OPt }K Wa[42i49orć.'ԤZ]ia݋.x>c.NhNZvY|(2'%,Iz0)8'ۀ" OEj/%@ѫ-rjY11ndm^'gyU]N8pUtvШnyZòdzڂE;H3`Iˏ)hW ;FFlYPSi\Ct© e-~S}珞}V~B:E2a [UFU9$m;!= (xB1.k/jb#kW 5bn,yt%:(߈Oki0&u4 P-bdS?H_A .8*GTwE`A(qI|Hj$Rg^e5H_]r-d}zυ)+B }kfIix3K<+ 33`t4Ѹqhۿu};{Z[ffTlkA@MBvbl!f`ȕ\FS/1b*|C$OYƸzlUMWړq|('EU+48.a֖Bzռ7/wT|汯 lgPc;)>D&WOHZݪ5ɂ5@դ_-MPt_ސ{t;!rTY{ɖm£üsOxE /w90pp7Ă%3V]hs2+cMpЋGҖ1*1?ƋIxZjC!H.;o fxWE{87EB3fS^3N_䈺pzJ]M/Vƣ.Ri{O{LgU /w[T2r7YLEj^v;0[W 6vT_7Eyo 4m$!/Pd9iuvt}_SZcs)Vj#Z=KF~9EN ch*m &S_c(BǓdiYm5㧭fHCVzĠy3Cb: zx{%\o@ 2 [Y8֢uu-К"1;~BzD9{nJJjX2?|f֥_u~\>/ B?VM, D)қ?A!~& j͚^6S SM.AX!W )F@0R:w@*Upýzx%NRpCܢX^Hm PlǎBя'\vpsbw2\d}|2)%n)!U!Xi[$gf1F  VVLpݚp0n듒fBד!W2 +󡧞^ziyn3(LRv0nŐjLQz <ܨ4{>}OU xPꍬEHzHV#hc} 4mid%%#cҠ9Ѐh~&d:CT;G)qZFsHܧp`BOYVWȲ꾏a ›=OzDvDkIՋx쓄mV˂z^42c8n]c|irpcg r0<0oElvtT&5k3ϽTU֜|&W;n9s)uv2cdڠ\`S9N7|ԭn=p*xpL/}VgL|B*i+Ec \AZ9M%퉧uh뀅k\Sa7p໒461A"9qK<~&[vS3bP"2|)M>;/aXT ! !%̒`k9Ƥ]ŴtAz/X:+*X~"O EJN|W>Ǩ9́:`_r*M^ej-0"&9U/7U|B8?8+Z u.zx?h:Yd Bb'2<'5pOU6~pSRΆMo/h;Mg0 B0 RFCuZ>o%wlr(\Q쪸6_Ɔ$RqlWa%N$eBXSkEm=e9ps qiP M05`cP!/Yi=r4rkaP(=v+o qJ; ]uA-%?`-Wۨ9 aǬ^&ȧMυ:c x2bW-꺕w?AagSG64-ب}7@{^){uya4SDA  #$Mq"O+fAmʓ&D}BߔLcL{kQ5[DG1?CHI5FMtTRL'K Flw)z=Uo%j^9!=v[Sao0rOCe|z@UG&1/Q(S!)~le]gީ_QV/2(k2[萠oKNhmoY'y$R!8Z"LM`\m .2.|~ io&կ,9=wxBO@bT=x)]y3:.ű[\H=L S֡P#X؏!Qdl7EtN337<Re%IHˌCXF}`?▏}Lݳ:HrKrޅ JeU )F~ 01jA&imߔj#cjɦ峎;6Nlbu&Ɲ^%{&f?>FG^xs|/iw8f'iw?1z KqEss2C_Sn呂aE6ZI* ]zw@~wgSOFx~KǷW:0MQ̆NX^L G>0cG#Lj/҃1?긐/~~hc`Xe3]{3>ex|櫶$ߙ#C6kdS1B"&/ ϪEٖsTU/T c`hKRbw6!0I[=5"ΏǪ vIKZw:oWp{r\9vW0=qCLSFr(ٯuI;]=Π;eȫ=/E:.CtwLR'm9nwY.PiiZv"zt1AȡIu Bh)suJ9.3~j(n%/#Bu- 3u:s3D>GH' u1b6n{NN.!qV^O-JH ea֬: x9$7R/fkG{ /eV9Neye~/ЛʕLQ9o&LX{"T^ŀJCl 4*Ҩk_H9|蝩'G?BaȯB`Ss+. 0o4_8d>'"q"4!֫KI^2tb6^=wꕼ%I/{lAO{$Z\QESez^E 25wKTly =# ɺ mǘ'[pkqͽ9n;&$풶MO :ӾNfȇW7*Iwjڤ-sO= ؉EBʧI0@SbD]Cb)4."`Hk]Qes}lw.Px Itd`UY̒=hVV| qalkcwܞ$QP8ևlByiogfDʳص 98qxEMLl]4Og00qE9ч]=ktv Єzj܉ Vy6\!B!^\Aɕ&xp#dk|~ֆle$Yh=s%J($<=*-DW#)ɕ}^1gpy9#${@P:O~- ?YY14r1M {C .%۩<-ois}C ^䪋T| $Ւ%6Q GU.&t+8mg >}41c pW!jSbP3ҝvwm?hi(| .G+4(܈r=c62$I~'K'?sHV*VHzy.3,cב/Ř @tiwq8˒ݻVhǍ#]XG=#k\ACj WNDBW3H:9{ (Ŧ31͛s>^Lܹzl>*4;d_ռOq>P#oc Gp'gX"SZKmm"=D#C F*rco&7f:`}K"0CWKIY9 314(^4RɈ6sA;>Q?&qH²bTAN9Tj9h'kآ%CڽZyqbZ:(WM 5q{юH~GP!P9B,fϷl/\F?^f+Y,V,rgъ`thb~ i%p 7 # [ |zia&}琲l˅jv-N)I@aeHhQ;cfZr?YySv[-sCK f8!?i8C 9v)7:E&MDOR¸~b9p I jNtdM!N^@{:Z#3SQ%DI#TPkZHD;X FUJQV߷8 ƀ"@%?^[nq &K8'pY@䫨CuYYW4;RJѤQ-AZ_;k˼b<񞧦jV9;*kN9N{32r(xDz j} W8E-bo J#yNCiӢob5>@PA~M>+$(/5;E8@) 0O][sdMV~PD t<-4r,a#h]{Ў[lyT~mqO_ NKQ/.RXMyok"_@=Q3l8~bK|gĈ2 J ncv>3KuVR1N^ٵ]% <دzz98D-HLiu(hŬ GRl>H[DI!VzMyJS)64UT&X .n(Pb# X i7KAu j .K.)Z6pWʛz]6-gEڛ\yoYV8P,+$qKb{x^7uG ijLݫS fJ\n#xd3&E`5 d35gb1h@3)ؿ)P>Z:;U&WLwl@ֲ^56ꍑ_%={8 Q]*&PKaFuGn(Jj[DM*p}G'iBG}JAX-Zgڎ7[Hʞ3>o2jtax&h<#ԝIm|۹Za}&J<7_Ţ#ͷY`wUI`@g]BڙwR'\V/AVP)i1דSnitU Lግ?E5X?Ax9vI_C,e%, ֥ܷ!owNhӊ4L14ed?G?SI:Dr 䀶I׌{~*->DųQƅ#qOwHn5؍N$Qerg}Arje WM@-u7ڋHE`v:Y=R3uwqxCx;fQ!oEF5+2p6qƍwK1}6`B'm+B/r]/]Cz"مhMr}yՙd⩘-";u`{'^)74#gdկQT.8̗˧f0^iQTϜHה9, &1,bѪ ue#„*wS0}Ƈvvl%MtIz|BW*8U Zdi[鈏@zء+)i;&ރKT7(M7l)/TQbw1.ȰIs5)KQͣZG}ϓ@mJ",iN8貳F3WhB%MՃkMDA̠U6RYmR8"֡} ^)gNt{V}F}h,mt Mܸ34+U'Inb`ر&Hn=d]}qϦEafh\d-@`Jhܠ*F؉D5wW[1 l;Bo%٣#= L@Oy>|l3Ajչ,5 RӒzMܡ}t#BɄ4'_+P3{mJRv=GtMF/1o.hkR6*^\pKIe=30KB^W[gMbMpӍAZTMh -+i2`|\6P{n΢"p@sK"5S@K RLթ|a}ɘUxMcv4jLg$7ݒD,f#M@N2b!GPa@_,"h WqMY˗ p@7ihyAi=pkfba/Wݽfבo-'9_K֣ '6`;7;ca)@LfD -?]i.鏐_.ǘ ynrkt,+i ^T\4jC&xPK.smllz?Ӭ~u IӢnTok_,0Nz%!&;JO|fv0rmlj % ++z'IHVUpV0SA{xz'10l 1ya B"9k;l-%wj+~Xy cd_A>f:- =vX&’(8Ũ8@5RJJʱ<ȧT+Er; "V*Gs}SU2ҀcΝ!kZੴ.RCYGatUC͘##WGʢMVdmbo4i O KZ >4/ᚢx~ E88א^;Έ f˦X- S1]uOD2qTHy?AG*vfl5=U~TՎ@xZcӛ!| i"RLT iNZi!<~.t챮p$4y/z,>+ W3,i*J\ 'Lzi?+"ZJ '#3EcČc;C,$ V,ekyƷr1N-žmL]QPvLK@@,^Xt` aTC*&^gb/ .4Vԃn!2iHVaM-٥83F)zT;5mMxn,)J){&ƩxȁhqȍB{׳g" +LXvg.QRCw洅 sQiC J^(|EdyTiۤ pё?eg.\x7-~ƺdG:;,&ytu!sj"NO">~$à"]i.Q }w zQ$#񎓸W{S7wP7TTH o9AJ  cAir =.ɏH6'vZ{jl^AtƷߖ#Q6D*y Fj̭(NUX2e.f{F@Uq$$80E^):u%?:޾Y!~nQ+۰9Kij\ɿ|_6sG5)F?f:O]Lj n$=bHY܃ hVfd%y~˒/"IpN騕XqE&6r2b-DG=JeCE`w4؂o  mefg{1ÏPin(ipWn}SP~,R'S8cq!gfdwxʵE5r4\ue'4' 8U!:SMg'eyziAXKmLƸG \9Vc8d9h'6QsIzA*P\uEY6Ԛd9k * 1^n:O\dKT)0hbp]@诰dC>FZ$623 Ÿ8g^b6=PA 7f\*4AL`[K?EAerH(DNIVv?JT 2uLK''JGĥ-k2Ceb!yAqAUzF}QށpY%:. (Ӣ4GZaj t|Y:MK.cek<@vW:wPqKnK,M'q/0(iO0{טX' Pl & :I} #\P}*5*(!\vA?^9 ۢ2އ lBD[`_іhyEc@''Q1~E2r'}4jTjKe=_a7J]TyዶDVaaKʊ޷*!ۇy룑,v1Bӗ ),^8tv=ifW<cK8ƬG$rm4]FoUWg:DW=mA'A"hT +%. ~uJ|M yEXCzNߖx- "V\s%%Ym9 "3}5ObR{P~/-8O?5VxU*P:\}!ARF?xwng~:3n?7:`$>?` `t@Uq\ӏkrRѳQLA :>& K (^\UڇsĐБFiʢY9C-K=tFЅ;EP6%>}4iF:S_9 0uB2i?i״wM[cy& fvf 'W)SQ]^ݠ%h\aoJ_$MwdKF;Md̵]`<~W "ةT 8Sb95H ?,Ʈ1KThRfRJ:a+3r5+Fb/$$mA"8>B:&uy%'Jj cM^aQ! qm]wᤥv}>9S- [d|'<(GT#61ha5ba6k$wɋ ˬϹE0=5QRi5gtҲQOW+Hso8ˈ%WE%_o(H,l󂿴SG_ Nr o9VRqK i3J`M|m'-g@bbmsc^fٓ_u[Z}4Z0D]V'[u 5s"ʧQgǴ; J$>}ȟ$?n}j5|訓738w(T3V/V֨w9 g옯aMia:p8>2b(:.3ņs=?2P<gqV'8#U,bRD5MYp6Y/4!5U9_.B7dFVq<B%e$6`''}۵ Wu ui6/; ͈>OX΍,@$sJsX'vy5ҍj@D{-2̓J?S֐GI!ꦑw":UX΢AjK,Mx eSrl ڟ 甽zZO2"Z d|,,bKq!gEaq<Ojn~i'V"]3#[M<`w,Ņ{Đhe1m#ܼQ \D!ٶM\zYzVys[!=$NWDnDJ#Ifs/d6HC>23,聡 DCR9o&NķLs%uyxJo~~JR%;A0ˍ'aY?!Psg<|yZľH6:Ac-]ee"2Jb T9{pnno:5[ rz.Itihw4<Հᄤ`t6l/ &hr=BD 4a_ \i!Dx$p!~uQ !-\q{Z>γAiBr H?̈́]fNXV٫t.ݚ#Ƶ͎.21b:|@r)u FF f lO~~Y ׯ$c#{QS죘 wS`Wgz.+@GC*?5-2K(_3ltS6ZBoiϼZ> hG+iV+!/aL-۬۠]HP-^N qbT*]t~h/?%|GtLǞAsMMȳ\'{յUzрon*i_4e/B롋1<ɸm'FJPǂ[7 ispMHld_2"p8mO=/DeqH mMD: WȌPSޙwgK9BCAq]y6_MŃtxi=}cbئi=Gu:dJR. >jAݩ~H[-5䭵oompvA6 o2T(#hp,q]SA.:BA$* ?|038Cl>$M]XQJ9;k0#>6Ⱥ]ʌ=1O7vνtbUՕY]Ӿ+GeGJL>O1rFvo"ʂϕwQ`gJ\O˃mf'F'[B߯p bp15e'|QeFk~S- Vn/QwAb$p,Х?9f0H#O&IXJѤus(pV%c mo|7 <(ڶh7Qg=YQb:4un?M*@~3eHrA|Ԇ`pV/LV+"a7 oCLYNGDt])"~[E3p:pK+YƐvO@W 0?Z\M[iS&SFR FkNZ5ӇOs2~d!!=IV6Hh ^dBEs@ktE! .+nć~դ7e@F\MWXi''~{\6"8Vӧ, 6pL~5J~]ّA~ݘUEqn4Kx?(`_r W', WV؝fwCJ5l:1{,o`D̺@'~.{ '}ο>MayxHÁM($ρj͊J ޘ& C6ƴ9 : qEV?)ODeOFvBSO? !mُGW5Z$"l6Rm/ϕ@ AL.]QttзٶURLς^}"Sݺn%! #+k}t>s׊1#Zۧ)tmj؇-/8FԵ#L5k>2`Q3•VX̳b݃:*3-iaN?Jp< qLErYRx}n(Z ,Me J32 d\(TYȳ)խ)e0|7R߂;-m4Uݞ 9PlTyR=h@g/1v-bI,.ԲbBVą ]J3ddo=eN`pELl]4`YUFmE/4Ox5w[꽝 E4*[AUvRӚ1(:T'kNi;.7VuFj 7,;o_]r?|R?::E] L=IřA:<'N=.ڕFk?%-py/Za׀f5L%@?\_l'Î#enl+;K~/, a[|Hz:B1C1韫2#w JePHS-bڼļ @v)l)`fZL,T@m}b-܅ՠ5` 2vx>s/8I> j琛"Zu1{6R0}➡/Gp]gLKLi+t&j}W 3"7EQE d' 3?c*h*%li˼W1ȹDÆM<@A]yУ>'.5.d:= i H^ ᛶ?a ;')K%5NQ&rmU&]7-A$/?YߔTThedѰ ʫ[ eDC虵^(Ll,~i 4oiaa Ȯiz<(Ȑ br;MBYK"M&7A4JOV4{QnVS Hf`&NMӽ vH9a)Rߩ"Ԏ,7vboK֙*Mb+4S*G|Gu [i/k5v}ՙV_8H8ߣ _i]sd=dB1IȣaS?GL ɚR_z/:\;ZA#+\d N#dVV x s-45"uԤ7BЊô'"џN C<5%EIFˋM]Q_IBpTW8M0rMU٣ D`yurA^.XFVSA641g,+pV_7z(.RfC;+tgM F4YR7"&#Z#r5X lMEp]j{ŻF~sf4Ve"94y:w{̟@9/uqs[yc+h`0+ NuV+hoa\:̀ǡ)-qHzOJV{(LO &r𡿚n:}Lw{}t?Hrf >cNzSD%7j`K98_*Ɓa+VW#裺!+BF[OĶਵEޅ"ï=B%R{OshwzzF2sk5I8Wi4Gy7HGROH݋Fa 5 De=E@7fZ,6>\Mm 5obCP$j:(¸?0Qšɉו2Wr6&a5 ?VFY.B RseǬ$Eӷe.)߁!nH7)Y, '׽UeK:UV%f*D:9&eЁ@SګQ`5DgTqya M>\ 8 D]V!6:y-s:/M\0lSnKbpwlTYn|EIayCTZ%7ˑj ٻ/F.ny7}A'zgلt .*)^ 3'&kmGOHSG(k8)#H#͋4_ 4Bq0,67ӲmYnd؝87@:qN9IkN:F'D3{gn>gh:'f͊d%t$?.8 ;|I)2=`C'ifL7eI.!aLt^gLqKbD46e Ik+lhf;$ SؼդG*-qˀd۩saFKCߤu%OJ6!O&zģ`5~7 9dzD{mJrAs{`r0isՔj8%.‹c鳚 # $5YtJθX @WxA6L4W}+ǎo> |)7АM4@N[}%Qf.%\n c.@!wyEwk~xQBßh5-YYgƑ"(pw0}xqE5{{Mϫ OVuT#yZr)=38;jg C#89p|-QRGma:毂4ICnwbC[ ";o<z]S!-9Ua>2OiˊrY]jwoς-&5K0vl7|3(`uZCj܆bт:6,2n!uM7bq幚IfYN׎I #p  nɠǞOC K<`eHE?$ R9.LVeMrVO!A](py6K867rNx𔁩 a4e]RX5H$QL.=/k&uB*)bЩB6 N .@AudzHA};8;EaFOt ,$ (L? _ÏyI^M*aep/ٛX"ءh9wad}sBVP=l<"]W,\Ԡ⒅0^`s6j}+Mײ(p8rۤ2Kzw]V2ˤX&+nO"!$Y8y^|fI)Th_"" LV"0oi?=q-T >,~7somGh kjjBo _9/"MF0JL <8x茭RGL{mHiow*O}WkN&z*[ tLk|QDYb|) DA'l+0V@!CW|8YVы^>2Dvq؋u+^-Θ"\wj)~iVGp ~/6v`j:%"i4^5tr;qTG$>݀G-fj~5t3CɀZ7DxwϘBW F;Ot)~/DC͘q.Q`u]T 5ش요1 *_S>N@\T>62Rn/NTE6kSFvltGo G1Li֏U< YՑۚfVqKlOkq 7P 뚍~Px!0)$(<H.1sOCϾOb5W:13xSJ_[m#ym8B|a~$Ug_~ټ+Bhdnh1F&ۡ_Vp>2qҺZ=Ķ'X\j rri+{I! b9iξ`'7%~ףW #T. AܹY3QSHW. xc@een" 6;Γwj f+aq(/K2i:V MЕ!qy:]+KnP(Pu5Ҏ& N~ f@mNw7m )lX!?rL:'+={/wZ WQctX~hτP RSb; XSN U8 ip2<\ ;A/ň]GFxLKe վ~ɶ`Q_ Lt:R͑v@T2рIG܄(**G^2ϓqi 5 '. ᕙr "kuJ|"ļJj8]h=D)q6Pk=g{˯ES:O@d\ܬXt0Dn7ʵbv p͌U5i|#TLd!l!v1a?~8ÃMh@Wje&Ml$ČЗ u+[gq9h"Z jf;2s浒Q1bNM\t&EC5u*BiKD+rLj ]UZ]z Ck`==Tqm$-?qk ٣PnAY`R2Y WŮ1ru-52FD%""`Z_&`$kǑq EB-h1!yah Iޠ3)+wesNt>@Cdv2<>MuJH" T:Vp飑*&ǶTHt}h1JwTW#$HO9c=;¥ktޓ{E*J!VG 8 Bsj<\V͵LZ iɼԮ=+tJ(l[m 3= |f bowgϺ- , 9mc:qP>CP="Cǽu(ؙf7&ҊR<&IgQkA&}0luQQPMm )1y1Ns8.̅7)xp"jt9d)"x"̍մAS"k7kbҫ#) T9IrD6;\Ԇ'A[iMXB)^;(!2&'-[;uV6iKhtjݳ6o|_zxZWG 5l%ir]{` -` l-{Gi* _}Ps&7P]x=Xd~js.\@lk{vF upVBlG@Oa{554v~(B{8LXiUdGkǁ$iѮ{0`2` 41pSE1=zy#E1O#kq Oj`'0M'C?sL.-P!* R~ҐU FZ& ֹ~d*'Kb1c2)j#|{J-->z=Y|)=VbpDlje^QV  GUt ##͹]R@*+Z):޵X Ƚ d@35] 5/S :{)sd _cFJp"3@'~yt9\ _7pՂBلx3^ BP;D.ڞ`ǨC⥛Ƥ240jڶ:Q%tW@ы@fGPF] 1I)A(jVi5[+:@):nn,5 gB N&2. ;vYᝥ+Q#Gc!\/<)\|֊kQWkr4mQP\tL+i4J$nK6I*Ԛw# 4BwP0jHa`QYK -c}y0$PyyI *$C@e/5yՁwQSsǒ#qMR#+/GTty1"ƽ<@n7dY@,%YjF;Bn.rLbac`I{@к3A#N3p:n)/, e7 XZI Mv+_W5=X7g YC?<_hՠGijq zcg?@l>d4%M%۾ }7\(aq}0l6ڨZ4)бso _3vP ƃn&DjM?VCazAz9Ehp_+ j::,4IYTj5ExʴHdԐe)>]US2 S" ՚FgA  W LoBڞZeºΞ%0Jy; ED{I!x{hG ppS6nHh6:N'w: #k,~&B4 5r -^s֨ 6+83ٗ* 8bKq4ުh@lGu&k>qÑNYtmxYh%Bxb̋Bfwڊ;\8Mu>گ.*E u0O.F| AlAmc|;d>agW6ұE ,QmSrϩ9:8k )s=+,ȮuckʯS&;q2Wj8l.J#dma$JGOܵgEj" YCs6s+qUM߷o 0 }̥W6>:|Sׇ1EUM} Ffc2˞)Ո-GvłX=g b&x/g=0 ԣu`{{Ӣ*3l,#e'(fAn5U,ߥDֆÿI<Is!8f`8)p7:A eD'C;a95Sy#M ,$B$sgؑA5P{Zӽe< ,^8h+{'}U5/{E8B@s0T݉+.AL(fI@QB|{w޾Mۏhʕ| ;@$+!``돐_n[ j~j}d{ԃ'jEJ=񵲠BDf8<Dk8s{₸aEi@7m`(ܮu+_s0iڼOln sh]|qm٘cT0s̯tzrۍ3qNx>g]5e9gcXbEf$P0uwX-D .,* K}wi%6Ցpi=.W/J#1*=+i#@j{SzC$*nZ{܋ߡ1;) 6OԐ1ϴ֢?ƌ̄]N^k;6qhKI(`,%q#,p Rs=d)#Xxoa~w@xa_ͯe|Bej^ӼMoH2EJ~4<2Y::eI^X"Nkv>ĒEeƍz7{}9x`8%rhr"'8RdHkSdyUj'tUB "6p<K^Dr|#TRGPD V>{$+:g:%P5rI=.z_]0r0u,9WFYpqɸn8Bc%c˄X8L'k%=pJ`lJ ξcwhаh"'Z KKٽآMS; @h%70H\*hJYE䵥J.Iscs)~&@&۠zaζ{493$劄 szJvba%s(8oN"c^0rէ̲R">Kk\_J:$cnJpޞi @GoqsP@˶ei5^,QpHH |q tH$XT2/G^PWN&}[1An/#Jd<6ߛh .C7)(ŕ5okßf$TL`1U(`t"@ HA.Ʌ$Z'^Zw~tEK"1}ߍfd![čNB@ qyC2 |hlP#|8w;4KuxZf.ATX1Wſő);y3'lBl ߻FýdsC|#zB`duee Z+fPn-κGYЗISɬAĶC;zurcdw9 #rnQ5DS9cS]s~GAˉXw^0.Cx'*e1 S:zOC0 =ggDL"*$dz¦D90.@_NW0woVp'uR᪶T2UNJuDZH*I/ch%OM@HzHu_hk4˅p`IΞm6VH@E6KaAhBSO/BI1Q41n7"rM"ځթIY{  |$LՄ&;\^,#%~U_ړN]G T4ܑL}֕or#jOy@~fƧ/= )moFW{toB?SY%d~jXnqF>vj7fH)feL[1X})79 nÛi<3uF%?pO8dPelvKwO&'J;] /Yr^,4쫕O,_vGQ[=Wl(!7Z.D0]NTJiÊÁV  Ilat]魔C :J ^8GXlX1{p*X`GMR:F9W ֐ǫаK>F& !p7s V0([mȂuTt>+ u@)-NRG Jf[޺ȴ+cU5Jf\-sk9e;ǤܔҮ} G +@I1Aeg9" 6Z0DZ~C+0F.̺Pw?]]Ck~I9PiD9뜬һC5ꃠ†OtFfi## CN.si$Gb:\GmN n_j'+#GΚx_oob }/#g汥`Ean>ܩ+?VܐnU\ܐ&dA*oڀ6+#4MU<`6=phbrF^D 25U]0qK Jj{Nvj1 ihpm'uTaB][$dᡋ2ߩM@`fC HjUFS dw+ToLMU[}Hi4SH =ECjFa"ƻ0Vyyّ[ %wA4։hq]k@0E9u w%S[P%1 cgu9 OY.tʃ;|ATN^|n/V$. :2.fR sQ@u*[>e5[{Q k[D@۔:0FplzM=pu(L5%18uv/ ۳SvDB^ 펭XKm>FM:j6s8Ӌ{V=e)nn9ի o8ຊS[RZLB!c g(;JfvMS6wHVvpŒ;ubsj-`RDNY!Y;Jz~6v:Da?*SҔfƼokSt{J^ 5* OϯhQLT&񚙮LCkiPT,yFjJFp*0-rQ!#azdU=84yifz>z@'pL+rPTdMW 85s{Hd4u9}_qR7@+Ls'+`*.Q2fѕc{ďoeIĽ铽zj9}weUx gMq$찬 rB1.\*2V`Q׶;zTRŐAoT9n~KD%R띩.hIGn ^>Af SDz璷 ),i=&q- =͹)7۱FPjG5Pݟp̩5qq6TɛxW; 0$C%;D1x,,?LaI^m/freb;VcW7I  -'UE~( lpwĔ_w-6 P=$=,T_m8 )Qۣǽ՟\_P桯T75yKaΈv1.zuć$ G՚|v=j$H-v)Telݵe& "@޺m ,ܠ:1|KSsC芵Ҳ^7+3 \ D`r{y;66֮X[ufRA!A1ˈq9ѿ2As `ƥ^Me 05ՙ1w}؝h lrr_MrwqfkQĭGVBbx&+YAunr>-Fl]uO 0i[8bdb%m~r!!QʴB'xɆ"BX+u"22rbPet@>N &"1Sy&Oe3ۡ+|)e5xQJƲ-%>"aǪ3|EF*7"16 fIS ؀-JϹ_YmݸxoIl$6%YcAi/gC0q~xD"̈́&Dmp)1)4bk]tkuz]q\w(?ZS)> S]Wf^#W?AM8wL9tJL]0=[#5FOKCϖY9X4$uߕ|MGHK~Cr+7 $sԶ91JGqCxzЗL՛+vhڟvF;y$-b4TBIB3eNSjNUsooV9ײZJ@uFTk8U|=ݔgG+: ( 0K΃[ nk%&Yx4<~P tzDCN?22'ڞ'<ƒ"'W4}AleJAY%$^xOB;]A!t:&uM,W N*E6@C 5kX7] hl bbK%LGz_[=c6bmx}s(3B[q=NhOy1&3DZm^RtVXSU}ʥHK e5>MY~HQ9iD+5)`k%HB|Fo`H+15 zvZԸԘr4I+utr9>ښ(ɏt,XasД(W_~䠊4vsvy@8i׿,$3jaV 6ira x;յ6Ezģ~^f8gK- J_; ;m$iO #@tێGSs1^3)Nx Ř.±/ZץG8,KASS+"K5\nax@"!_j]QT(bS JT1tYv0w4Q9| ' 7 zzl=rcq̘*5bi= fx;%ȭ)'ܐ(uy<1 [{Ce0h`M;叙dEYk^XƠ(y 혍LHp%;VEߠOv!2`'G(QÇ)6j&:Y-Eoi2?$*bn36nxf;`7D̉5;qf'GσWr>Qc6"EZJ(S3qG1nH+ 3WzP7_j\ҧ)48vYLb(\& ѹ-ۅq!FKTF% `qvDWnt9ҳ{gXcå`UH;>>If+/1Zq%"DN¹2gھ"&&[RQՅ`[@o:Gb-u~sonT48p&ŢLkk2dS@|C >WȧA3uw{y;\%RO'Wg(7Ot [-wK.جvP/{UWOO>[>踺7,&~-ldTMXr[W < <kfJEoPwOݜ,_%1\GF^>RhלJ'`q.kc8.m9݁`o/3\ceśŸꬾDĞa,"?ђUl KmGOaQ#tRxs ^Z1ho>7لr ok<[Gܿ| i{*-!1H"$ĦȡթT`֍ JJ2V$Z0sؕk*~HdL[Xy 9H254 J#aC8rx*}Gȟ/G۞q9:1ּ3 %4aOvF>>A*ԚYjf50B* uarsޮđ)L-$+Uv/<ɢ/$4a;q[ /wHͺx;TElCnD.8L8/ɡ*?ޞf\=cw4[<ŋы 56 HQ1z*DpGky> H}ڢkP!)Zߨ6o[y}}=an%BEbټS3=4s(<1XyJҍGz{||ygҤDkQm*F#R]0YߥɑI4:,2Ӡ%{-2sm!e qx'r&,L%4l[I%2# 'e8~#2g- .0^*j+@˒XcPm\WN&ӆ(D:? "^S"S(o%z1Ǯ=3x3Qf8e e Zb̶ K`-gUU/-M uAI Y#1s)GQ\{IJ!='1Ue:7邸ke~HExwæE||a)$Ϋ+^m534mFY H.I{0( ̀䈬ښap5 jtAһZ um[Sɢӯۇm@j4Do$A?#J\}qU}X 3S"Amr<^쌶zH49Qllz:{bH^NNfg1!gjSe. xz7ꤏW^4D_shkIouвi@؈S}3U ^M60f:(QY͗o_u`2#,/r .F +ٞ|s!ȅ %SW#ji[sR~}.&A븆bxhѤeހ*MYU:ޑO!QkuNAyl\Ɯ_|^ ]?QC DĆqf W3&o첦5Ɲ׳y:&Hs\st"K*bNGxq2n?R}k0LV m3I-|,_5Yќ_h=~T<ӯ'zZt\&i2u?J '3ٮ#v{ ==ra*/ DdTLυrG#GQ(p%v2`8l6Lσί%c }Ӕ90Z:buÿI'|GW]K 0]ET4AysCtE?XTWbNkĽs5=ߗJ|/HT=p{m~@fi$:! b\\ <і\ aK:gvSd^|f XSxm&m8|iqN,2CTzU'w8rY=X#S(aE4G {ߎwֹL=)+#ck-T޾ӌd%)_ YgQMk@UD8a[qRIa'TOye6$u)å(@Q &i/8uϰUضKr4ڡ N?s׎sWk_Ǫ*cY?RUq=d08-} ѯiht5м-M.?߮T\ `䀝Mv7@`? q9*oPb+ЁO.pGYz"Af\>fñ248ǏcYcz^1j(T2+R.G= \L갯e<Yb$eLh*d,3UqU7kDH ^+0o!Nhڞ]5IgGukfd"%- Gg#Tj*Y64xnNRRx>)̼}!j>Dp(`lbV{d5)< )J+5T%"`H'`E4n_ĺ%k͊|?Vf!cEGL $ö`Yx6􀘪8Oj1B4̓ 1s"p~M˅=d./T1dɪrc6TvhjrvUsեcبX\|,oDHkD1iMٹ#Hw?ۑ5FIlDʒx&4\Z $|_ԝ,BfwiW3,\ ɜ>2h-e'`;KVFeY*7o?ivj txq`wZMC tK^MKIˈ}tzDZJYF|%nI;B g k}UWXyfYWwf`,X"Ď;8 :j8Z V8sT) H?A#|qPU@6Y=~~ޖlMqDŽ̠N>Ίk@Hye:B& @Qanws[?8M-sOww^٠t%0,ˮY<{[g2 $}{( d(gdpQrY Wf/B3>6F1+Q45߂R/;؏gi65uvCd\ԉJF{̏h9Iј3.ޘG~.fJ|&ف.#Qۨ\ ⨛u޺{Yb\&n-,/FʑX@^s쮪\!O}.A?d]j-'O)2oūQb>@Έ@$Ц7ڎi^C:XT^?;ZKn*pY| !ᢲA 8=0qv1+0]0ʟ9wux r[2 +cV]G> :clvZɬک =Sw4s9׉-ـb>1GrVKJ )붑\}kd 'N`ɑ3a)ACX 0J%ztʾCOj8)HJn:FX<Yl'O.E3e|;ȑ3״]I_^3s "N4-hV7tFs#mL5 #eG~w}53eD.dg. Uqe u Xԡ8>GՆ{ɔR9oГ m @|沼?bOtAX\V(nIs]O xAK<~~egVRs H2U6nrU# [S4hQ^v7,`Ib9׌粴BV g 뛕YU^JK'`%zBxU7 . Lz+iNΠf& M~jj{g-9EmXirC=)y¥e(1V6]2r%fh&D\(J8%QLj؆U: m#|Tce$yC(Q]НS@ԠxcjfȌ`2ȵ`C9*]w:.ī%{d/J3.f# -Evָ_m;&Hf\5^Uls)4);#?QEcDQfN ]*hM7 %~akxRA9[OTVS58+aP˞ bg0oʊ >)ZFP5XgBĪ5Tc.,Tc$fc |ɍ J0PADXIdHN(ի"T/G& ںJg<xϛMq}1Y^C8>]0v7p&,@Kio7ao\iyISϼ]|k"+OP_] 3d#qoG.? =ruY]sϵ<^yI/*6"X%saj?%qWjL֣UG r5Enmd^;%T{"/ t9#mEZ{:1<ډ1?jkB/۞20r-'-$%p(7k:F^fNzJ ˳8l ùFs|t# +0Y{vN+b&zy:;ct) P[zQ1fheTPc *nȚ, a950+Toxr4bf2)2la؊4 ɖ}pCw1({g䀓ْzu{lwC(aݫ[64 65.fYuqf Os6\)ޠK>ZahH~,&3"*s Β0/ߙ\myFj9O+X,d$XQJs|yN ]ʴ\nFX6v\hyg{NQF1eo>dTSh8by &Li p>ωBVZzR) $|'~v~[R|:_8$'!3 iԌI+ 0b+[("NUO+j|AJ (|)p4ilX3NI$7*S+bв!7 #lZG}!WRf!\Uv-B_UkD͖q%%&R$c8wp~>g]&})ˢ6Uv;iك8mF| q-p'Tq?nMW7++0o:0kX,soBɃj6 T3dϑ|-ʼ$LÅS]+;=}7w*f(qrțРn h$%qgG_uOHuRN?#%q'ڬ>[JٽdW|?~ EOw٫AU 4؃Z1`G#Y]|?<;p_! ?5Ie Fp₻D}w7u?!1r-. qV n~I Vc==0i0`cʠa/b(+>z|Xs6un"15gfY` ?= JMY&xaq GzHE[ wHD'7/JPdl<Gsi/pIZe)aϲK4/zIM[x`YA)4%burP4֋8'χAGE|tZ){*W)گA`y󊊸 #?ذM dH7/SW/Ӝp45u{K.0{mѠ|~(%;m7fJ0E:n:+Omu>?ڲVT*.#HdQE+ _NXHA{C+4w7T؎nH? R@37I'E[f:LDXo7 ;ԓd4OtsٕE&RuO3bٳ# *.5O.y0̩eb t3bf89 >0t"m<3Od+F^nL@{]kޘ=iӮ bQ;ڈ#r .b؄V=å,@ΐUש\SX\З&$;i?\Co:SrѧZ 6!/"mS1G2Hdx^ܣX ;lqT;ϵUf|p*`L /^bhA{ +A8DPۀl7nbI=6%u)*Q^ %N^ '߼LD+@$z  a32g\2FD7 jF/{rf !8Te@Z\'NEsB%-< in'r413 pf(6ӯ-n 27J>5\3<Ըq mwauĉ8{ϰ?FgB*@U-N}'|6j/;.=P(}Eg{eE׻VۈH k#<_VE}-T8TiX   8t_a=4ЗLewG+43FIR)cqcw#TJ86BTrVk̶c@2vNOꁝ_KyIb\U҆!+0Sd0J+Wڙgv܉dۚt'Ec$kPPX# t{njb{7F gn؈ ۲0 *#F\"qp)O<;HB Wvlձ:sYrEڬנ EP^U:+' (!+Ldge}~inaN<1wJ31 -a^/Cڪ0o[M=GԀ,̍IrێP#\'No[W:FfbIsZD6aLGXOJ/ ]-˕c=oxZRjܘ8 V޻H""ˇW])kzVꃯʂR>2~r#*7M+.`_iNNO0 *? 4°?7jg> J0 9,>U9J|(=Q+w8\cgoY; DxECT곢0ǾJM#jXӐ\m,ݷOƞӉSͪT12sҢ+`͌jg=%>:ӀT #ίGCV(df}];>Yx58<$whHN ^9n&XNn֠|${yݠǻ!đ*m}Ђ7A7.jUg-ԁR?Xmۢg47l0ze zݹ@(ڤOW_O6ݼ@H*лRmNZ[hQHIaGY@ħ l&d䗏r:B PKCE˵MH 6Lk| CmDQMRSENr?{CF vInyFr$b=3\6|yG/B]=(/ ɊT I = >#K,HCRNҎD]4^SwPh5+Iwh*v zP'T.OXNzY mkg>xsT tM d,]PY\Q޹_l"*Vz*L /+8>st7b2wېUbNռBmd}=+*ŐMCnR<]; [z)>p6ĺBS×Y%\HXp6!njU  :va zk{iFe1P8vCS F=yXh ײ_SB=M "c}Gu)F %O ݄0nUA  y.n-4쏉|:CB+;6zHg%ߛ8{c/]*6lrpLp=jdgf9E![ʰJ~ޙ _Ω{gPRِD&G4. =Z0DY|o Yx`&UU(}ys֮LhL\Su.NģǼU'mTUA9-?Y'YY-lG@ۨ! 9cjb؂7m? Df~+m^1SSC3꫿S5`\#2 ] e`\*/bϜN*t7\ #;'.=s4j_D/h̰vJ4c8SuWBp$2%:6^iw X=.Y `D7TVb/^OH2T6>,'B^~j~'zuC{&a}~f>ȈzmK?n8輋~Y7D>KTݑ {2dV;mNQu]gdB2o'#"ވ^~c?DX&Njtc:huטP~ }5گחt'ފD3aN(0 pNyG8lDO,`0w-*/e*w8=/(5nbC ,Y þݐܽ |{DclqR[oZ r[ݯ 7Ήhǿ^߷5+EPL r#94kȞ --g/[w<ܨ<ᢜ& 'F/qU]ۨ2e$4Ac& 7A" *I44mi` XԵb/kPH&Lo~ǫ-^".-m=o?d-!!\0e:QzVreoR9hŰA ž3A340λ OGޞٺ"jK*Q#a$cv?xeH#,6#phl1Q"F݉s*-&سIktʴkDbA\b3o1cF}jKqmi'%+\&)BL2/6kLX_|~X_Rѝ3۟لw;ƒ/n:[p,0G;PmQs]D~X{>C<.X$Olk+!`_vݼ(G371[ᛣuz|wܾ%zEn/+K3:.h =XOß '7wBJb[.Dk-Ðpukk꧀5=Nx^AieVR +)|t/Zh<ݯhtEbr؀7ug._۰"$\{l~盚e3v #f2v`z ۅ4f"\Dn^ņRe%B#0X#dvcoqaN˨qZAť99E${7c+I֢TI-&f鐇NzL:s6$^AQGt 0dÎM5{eMm -o^7GڹK y,fuX (z>ayˇ78! o3qwߵ4ʛ]Ϸ"$k L3I Qh;;BY[{(`QL!<<-@;0|\k|9G/cw( ٌ ΡD4= 挴, 6 ŌMj8bdZ4W&VQa jʌw# 'eNu)=[J:Xn5(u9_2¤r󴡏M^$Kh`S[((jQC>?R+3ek> U6%R8ذgBP?ӽ_R~4WM&yACa P=Zzo8]VR- '}.6) 2`QCe iYXXm‚ v055'ӪtvJa[vYwz|M|R0NΩP|Tm^B5 6 DGp&Nh. CR2^z5A~H<(eӺr`0Lg d,\_ [#wE]t~C!C'`ex|mn\u- Ae Z%}.Y ovdX\a\u<ւp5Y9߰8mjZ"=E<̿e,)Lf<)= 1Z2JɘWt 1r L V?3τd|ɐQ/g*{Alx|}^*B>A~2!ggED.ClC/ p-U6EgP,#>Ǫ'Qe˱[-6һ6wS :1@`$dUf3sdmSiBkȩj)AX7g"xV2%JrpN∺#,?"/DYi/uS, K /q(5(ԼuzÞٷugU4߱#'KW{PV\cn¨8#%ׁZNUy3UB\r%hg8:}!@6oH `bć[/pRa@(jLJl|-*xL1.}С*Q2Rib % PD9!, 1Zp&>{bܻ wI4*@g=Ƨ) %we'lk!Wc]o̝/'_ZMv #رL4MT%$J}H7{sYsQhɺrdwAI2`\2VvMo}Oy 1vK;2+)|+BWo~NB-]= ^Ew)ﰑ: 2$8~oS+g hB #szw1f+@;E(i\ڐ աJLkMi=ڜ31wk+`R[SȞU xIP9lr;ɰmJ+)RѡP?ٝ͛  xAPU'ީԚN2ZС T]5@ >=7 $Pda({@F%)pwׄoOs Ri0 G_.eKn߇݂ Vf|{U%eY1C*<pYְYFa%8zvvW+ٴoH>6l\> y;a8#G2uW ZTԢ!:nUBEfVn '7kK= Yw]JKtwtnr=|kiC&y I75RuM#wFT(ylFjun2qȹeRE `)3FB^{/kq$jգC< )  x2fOnEX%??Gޫ($M;Pvz\BS3ا;v $ԃ,E\ JS^hy539hwh0_C1)6јȘcalFJ H;⒬RSpԧV-,1) :1MFx!/t+V'+iE$_cn4LLTQjhx45 66J7k8IEh"3/YvdW9ʩ-)7HC Dib?9;W$qipcd03:̞'l(<ꕽP5b?Uv}FHy:duh87q?ah`* a& _E^ Nk;P#b#.E-*\IEG.M Byĵy!+8Ei/5PzBPFBBcL_ gmJ'gk+}2w>Yz˸+uw9 qohE}ˈ}d%$$<CXuj}goC1sKe.j3sЯa)^_Xśjs5:LqoDf@1r|䗖 !`!Kk)LY7%]C@)jQ9ꞟ.F6\M Di,"~7^26l"ȧ(oC<\q;n&dI@lo?|8)aɁ]m큪<fs>SdP` 7/) vPt1)p'1I 0W4NO-DC%@ZQAe\|m@|Yvkx7oBi v=~qdMW'z<˕qn]".\ϳe!x_L91ʬWjz8IfJwL:|5;P[ GCu@, Xv G2xS$Vk^wj#)CVN*M(Eq MZ]c\)еgx?ң8JEc@ }W{Zq N2?vڑenZ"ʿ2K`X\r^zk^F% &w5߉Ɲ׾R 4!Rֈ7m vW"g[HZ/jDyȝ6${`0L9(q~ ?`MzPE ?k9腼wveK`n]QJb-݂ WfԩرPt5guyirzaēϲZY3[\#f]gInpxtM}34x` , x?5o)GQ}E>?"rQ]}r5A4epO{l9^VvYLAHml;n:r*GئJe\?W=@.FAhZ[0hgB"{6zRManb|Va=k^c;`/{̦QF'w!~:hRXBcv^#\og'/2DhtjI x3ܼ;#}7:ޏړ> DÍd=U1zH.{K+9j[t^txٹYKFBFn2F?oQ޽0?J^G tՇ?J3])!Nrrf5<%Eepqqw0`/Q*D1_ї&7yuvܷjf- &L X팛 G ?6] I-h-'OFZ$|G"뗥Phbu8zжc뗋+dg`+w\2_)zMw>[4^U<?W6Pvov]C8B/q:/L??2H#9Vk#n==3^yA4RsQ!a^׶ؖPv`D|ͽƻ5 _-w& @hkbQ [.uGb^ i(H7 '(J,pwU/hp1; 5x;sqrk\`U< <yM򮷃+?&!ƴ$*9q:esF8/kaxHtyNQwɎ,Q!)IR9oU`%vrR7\) 8z§R{+#Ti;Kդ/a\U/KI^ hD/Ef YF %_,Ώl >. *y5Vh~x" Φ4(5M '(۲w9H|ZI_y̴.z a:Bܿs鶼] /cV-3H,RԹƱgtp*O A%~VA3 #~MJ/z(m9V aڸLr{ y1S0<XMbK%:YqmR,b VB*Z8h& _jr0ou!xa%T5CQyD~at~B[oDߪq\fpYXN3kI@#xMkMNHoD6fvsx +?itK!-3Mq|*?TסPQJ[(97 vZ̄܉I.5\$4@"7H/N U d!D<>Ac$W+{v*J7H1fN:pyeOv|eU8=T"c+A(ȡ؇tR\ *Rnۆ|js鸚4YPx=5Fd1wN\5,s^;G;q߲-1%tͲDp=X1OIKq_$su9!n⚡h`V+%gt'rKK=5S;0\IEZq \1ld]O<sH6sXP@cwg抣{a| Q.y]Jwu"qu9lkY#-YjUINԠx4'x [<Ȗrd,:94BbF3#^U73T f|Rէ瘽{p1CIrb^-n7Z~}pY`h*3/B 1\@ba8?SIj0׈*bGGB\ ;`&&#bINa|`wc0g+vW@U8;ڪO|>ס˞ELmOXEx}ó(Iyv[Q8V|=%9hD?O kנ _pT{R b{2 '*vT_d+<¿{L &.Z.^s$E# ΟVU%GZt>oـ9@{!lis8te4IDF3R@w*t; )g)40gMrֈy7!:W@0nmю'Nt1ASbWThNCR4VY'"jg^,mԱu: vK~H.)pB× sZ9?*!'&-)K}l1j˃ ]AQ:wi̕/[2*OkF\Yt%۱N bP+GIH V;l0glJ/BP B+@b?L:l6>e'0+(JN|8.:Yu.KRB{ϛ_֤7[.$iO%<}Q! t0ݯmFN/:im_9p H51hGvt"_=N~1SףFR @sd+_g,@'/"C.x$PwQy 4HH h< BkBrv7:~HgM^q ]i1/oAG;l)q Kl -G͉Fs8NJ-\6&a!7d/P>۲>(Մj0ɜVe4P0w CuUc15 (dLn3GA#wj4^[`Rj 8MUOYXf(EdD[C-#w4P!YO̍Jcв3]ީ#"H(8 aγln0KZ#lZURi0o.9dm8H~أڔӬsjܻDv ! WZ+ӆ"/9ib*LOI'֭.sm2(3pLJݏ4ezKǙ}!k|n)T˝dP,dCOoO;iwyQuoo:=x'Ɲ $VZےHԏ6l_x_DRlR*'7jM`kz GQB8m0p Q±!aWAhbQ!m`lmȟ*RѴ>O"}4Abt5xZxtW&\aZ1k/+YU"We*C4x_q +/% Ӥ?ь9wD!V $OGsܛ,6oWgMΈ   )XSodz[2l{ힶ:-:X8?D ?+%r}/_Z# 'zKV*Y)$zv~@b u%7%tQ' ٺJ'UB]FfcȚү5r5 7,fO6K:\3X=fHO+HS74nkwZ}M {?]G817̅Smwjd~&aG #uS`GCd9o6es q}XuH胱 eK|ɣp kD%L^a'`%+-. ṇ(-"췕%bƓ%{ˆg~?}K V݆r&}ZT%p@o;`'R|w8wdg-+,tMxcruIPa|͒n Nu s{TdU=-`c)n}89ӈZ{L[5 %`P} [QU@m}^09|d]ڜ+OE{(L;[wJF!DtȦwl5 >rSA4i‚HmM=} p%p SIub2k+ ^]~H :(VRleK@xپ P˜>1괖Z/z 4 1U W]wεCK>il`Pdbz^ybXwڬb'(==3aA768Zh` \[N"^@Y ױxʷKT I6e$Xdm;ߵߤ }$lZͯ(ʽemx;vDwِyN6 ûF7"mٔ`GݸWQ{i+o1|^YI. oSKʁ)qCѲ {I}t$POmo 2W$Su)Ԙ"xkt@9|'cQy`@~-#P\Fq\ϗ[GUZ"u|Y[*8Tf/7\"1iF~G:HG,e]dpǞiDH@ >=l [Ȳ7N*&Bl¦⒞gWe/9Ba>1켍}--DK?Mk2 Ьl{vZLAVYk'Mg fO H]jJ"%.ͫ0(p(֮BV!Qp 'ħ F5妙]D\;_lP^Z>%P̜SC|l՝ NU$vAhf]v?eR_aC9uNK;ڬҘt׆*IE!(P3>9 ^vzxю79hGj!.j; <# yNtQ`an-*Tc"٭a}JνqT鎇OZfvEK[wT@6.-4\DLIhbO(N^AK4D0ŸWW ё\c)61Rߧs~1^k@D!0+1Ĥj԰~"'Ä~[jZؖnK:U༷"ˢ*:ad|I,i!R^(I8e|>ϯMӽ& NL$0sǛL" Y/+I-!P627.Yta>C[Pcc<vҹáhgMpO :*N/&+犧,BY&[l /&]8'Y7^ c 0vbV0Zh ԁUF$QdgVVF%\_Tj ݬБaxllG _{t2Bc"c%CPt6ZTm5z ]zEy_LS.>;g8N\ҁ%Ihdq )J a^3pXq2cLNǵf`|;g@?x zS{e~ܝan9EARnQ̄[&{AP`)ګNڃ'odtrՀ OģVEv/k+#U$ &o8Jj`rb8mBU{umj\[EٖBc`ږqL'G}ǀK􅢝V2R'|}blt7werT\2z\kB`A11F%Yu~a>QJvRB][t}xиU_N5y)?E\z x&S#wP 2-Y@=*_p -زhg|>E -HIrwԨXMW._~ FǶ?&),X Wa)<-XϦ"Ƶr2qz Ϭ~X|5q{=Ưۺ_1) qlݧUKł 7=Pj\K7y[j{vݺʵ1b?0~FiGZa=dBDf^/8Y5|?tLf eD]㼤J]KK[n焪߫ˍ`w9.-׾r9&Ey GΗȓ-PuZz̦HT-XYaRxi%FrqזcVS٦0b:ͦA]d)VW焯9{p ^{ks#$oz;ZM0-7z^vV˩@f MZeu/IȂPqK#S]TŞ3s:Vr5˱ۍ,J];LPX\JDu6)F`&-ES}ٳfl ՝B4{2>ȹY潎My1@KE}68-ʥ/;D-xG'qjd H(MѡxWB.pE k A~BG e=8Zz :|bl] aQRMpEWԻHv)5*wtTq\wOlJl>SO`?VmtYbTA:W+$ZղCW̠X$؆Rd$hxXS7*ztjVw!LH=r{N3?qS6l2[,%" }Dj-'@d!vT!⬣ٞAGq||柽7+&bR&*,>m57N"a&6ԙ&(~ 7,eSm _={RV]7nb⛢jk&3ǏyFzT08/(ib9ta'$ #o&{,WU椃' 4#1]xF}!Ea/~0X+=OYLƋ+r+ nKQLtV\YA|Px\p[@ 22߁ &4`)1-0\0T=5Zh(G >*TFLYZ;}lZNU߇. 5CY2%΂Wf ./L´Ml|;$B Jn2T;*G):.MR'}]-O/-9-=%f  7p}$nrtetܶHrЙ7=fl+X[^ "(8(֖Rޗ@s 8CÑK[Yv :?.ˠ"N:&xnv 9Ci~JHnHE:Hʧ>vUIR3ADv;"ž;$͘?.CUqCq?wg/lS߈Kn:eDSI0"Yfizfs{[-ܮRZd X*G$"A+߸W݇ͫ$V(a[pcӿ.`_>~Ԃ$WUJtɑfqR\ {17gW|/Mڽc̱b>r?V5[>Sz1,AOJF2a(LMNR)Amt+b6 ɢ8Bqa(vEtCOq"L:\ H-游nh6Õt]*,SZǷS`r2h1KMҕӆv)!q~}l:v[c[bH_@|X9$Z@A.1 (msf¹ /KGAqwVHieҰmՁ qER6krj(V:ZS-ia/@>T(eD&L vF+<).haC-!C|r$VC͕D& DXI),^lGIn+qpO#P5˿14y&fG52;$oSUfy0i~P`lC쐈ItvNgԠguF353NcW4:ls vDf F{cHE}9_2o=q4[dWcgR*]eׯ̮tq5љȚ/@ծ6$fA 7]3}5 8l]aP6LI]{E kYRu(47#$`b*,/w4xK#5+;^dQ r q=Ty1:PG"^6h-O=ѸuBt%ih4^Nk(Um"rx sf-(H$UXQ3S˷8jdj FF}Pb{N0J_AᰜYw)V3Mz"^S` 0>5!zy˻ C J M|cWn7?;^]7 {~H8L ){N"z\\VDR>vs*%lJn^rSђ %ZXֲ{!*~[l{ #Bp:+D ]+2 }J`QMh)iLfgXgD1:8 X,PY-4#]|JnT U k!nxJ4)vz&[ yCrG;CZc\x}kaG9ɶ&^$/wZG=Bl*MPDn *hPߌ|GVlrb]nW~z7%d%@UIq(6wlX ;e͓Tt873Uǫ9OBp$y|_O(AX(0a|\<Oz ,qaSߡil( :u:xm$Fʷ{'2^6BGU W'9S.%)һ/<Rqk|5J\?ߑdGMikmj syS2/4Y0Ž'~R Lc˫c‹FYCݻ,e20?8G0PR:9}V_ߡ \Ae ,r5ߠ4f_O"Zo:+cr% (5`96gjhQ@")r3[bGB$9j.Em؞OVzfyy?Q{`x|9Qz:@_,R=eYlHO4 U<α'g<}[ɉ}2o4?"ŏ=4%klk0ڂk_%A@+7H=ȊFծ=sk. Bvzj|]&l"?'?XOFUI']&'ڍvŜuqo%FˇPL * &QT5$2}ЛMe(hz7q@\Q[nπc1A:PZ8;JN ݿ~]X39.ZLn0rL OF>҄k*i[TeI!=L7_DzrNyά͹N l& ˖5OłNۀ>@pt֕u(=ni `UK 4we\ɽ %8u9X#B-Q `/i+ȇXҷ-ԶczTBW'/C_<@Yvz7{>=~dR XGC?[æW("u@8~ش=\\7;_\tl c1JhE*tP&'6Dk]l YGSTUyɂ?`:wO|),U*)SE>~2KŹ1ju__;bew*f}Ko5d|zxB)uIB픋,_\o8Iʫ\FY|͈OC期hЖpIPM 0fV>њDHZ:3 gL!HH\8XG8<;+`Oi(yv/!fluG498Il_n7si/>qF#(b~0un[L=їXB$"F2YvJmriѥPғ_UQ5 (msm會ώp<qS(#X%OiƇ :]@fGghqaZ\H1'_ k*"~¤_AUQb~Yݾ 9 dEa[=禰Y?7ǡ̺U;%; Ec!=ݻ>*uQ 2m1Fy $YwTs I˧{OnLW>ً 0o(xsbRr9U'ԡ- j@UW,؛ut[<̉Aa`). [W.7]3 IY_HܲjϨ,Qq/:V q~5DLl\9Ԝ2W|qI%5]l r";?jrλZx:BAٮ&Aj_ rl IK࿽j7 ZWcM] T8Bi-V6lQ=@Qq6T0w݇hq[còOEe* FWh኶Z{ x7IW8e>0-]tPKQbk;1BJ%a9{ AZ3}u΃/OޙP̠~BCUŕs{-10e2c/GkҔ0㰠{ %l,&vGQ77y.uK:dbDP褎۔H?0r|}چMRӵF4I|b ʻ 88`#3weى` +ij.{h#L|PCO5tt ׸CluJ7ߛu֬"I(5?I7a48x$$m.ɧ$:fF0OÉAP"B1.K3/Kr,TK88PZ`@Aem깥=BzOOk +_zp6 XVC˺R榾}ƄȮiq[ rbZ1$x.Q%ҋr⋌>uUVI<zNvB24 9-*ư)Qy1'8>.EwF2'I9\ᲃm9IJd1ke^Y6PTŤUՄ:r "' uER[Ye7A$mrƬ&Hxu3&$+@#W Ua!g`Oe.<U'%!,UѲz^Alx!aASJAs)vُmgǺe#-&z#/̉ǐR5 ՆŴ30\">O9Aap0+;8]