kernel-module-8821au-6.6-desktop-6.6.148-1> )lp 92e2167665909bfd6e904a317514267699164e7620b0baf74e1203c9f16623149384ffd994289c7d6f776752d938de734f799871pY<(pElG@=`Y>Bq?ad#+ - Y     9 <@EJpt~(89:G@HDIHXLY\\]^bcdefltuvw`xdyhx Ckernel-module-8821au-6.6-desktop6.6.1481Binary module 8821au for kernel-6.6-desktopBinary module 8821au for kernel-6.6-desktopjlocalhost`X_ROSAROSAGPLv2System/Kernel and hardwarehttps://www.kernel.orglinuxx86_64`X_j#58e17202d2a5a092162ca52b8d2f39c32035fa45f64d726a4ca352e41e56de113rootrootkernel-6.6-desktop-6.6.148-1.src.rpminstallonlypkg(kernel-module)kernel-module-8821au-6.6-desktopkernel-module-8821au-6.6-desktop(x86-64)kmod(8821au)    kernel-6.6-desktop(x86-64)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)6.6.148-13.0.4-14.6.0-14.0-15.2-14.17.0jtw@jgH@jL@jL@jj9j Pj Pj Pj Pi@iD@iii@h/Mikhail Novosyolov BiteDasher BiteDasher 6.6.144-1BiteDasher BiteDasher 6.6.126-8BiteDasher 6.6.126-7Mikhail Novosyolov 6.6.126-6Mikhail Novosyolov 6.6.126-5Mikhail Novosyolov Mikhail Novosyolov Mikhail Novosyolov 6.6.126-3Mikhail Novosyolov 6.6.126-2Mikhail Novosyolov 6.6.126-1Mikhail Novosyolov Mikhail Novosyolov 6.6.106-3Mikhail Novosyolov - [bot] upd: 6.6.145 -> 6.6.148 - Changelog: - accel/ivpu: Reject firmware log with size smaller than header - afs: Annotate struct afs_addr_list with __counted_by - afs: Turn the afs_addr_list address array into an array of structs - ALSA: hda: conexant: Remove mic bias threshold override - ALSA: hda: Fix cached processing coefficient verbs - ALSA: seq: close a re-opened queue timer in the destructor - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: cs35l56: Don't use devres to unregister component - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: tas2781: bound firmware description string parsing - ata: libata-core: Reject an invalid concurrent positioning ranges count - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: use platform_get_irq() - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - binfmt_elf_fdpic: only honour the first PT_INTERP - binfmt_misc: set have_execfd only once the interpreter is opened - Bluetooth: btusb: validate Realtek vendor event length - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: hci_sync: Protect UUID list traversal - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: qca: fix NVM tag length underflow in TLV parser - Bluetooth: RFCOMM: Fix session UAF in set_termios - bonding: fix devconf_all NULL dereference when IPv6 is disabled - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bpf: drop bpf_lsm_getselfattr from hook list - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: free mapping node on duplicate reloc root insert - btrfs: reject free space cache with more entries than pages - can: bcm: add locking when updating filter and timer values - can: bcm: add missing device refcount for CAN filter removal - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: isotp: serialize TX state transitions under so->rx_lock - can: j1939: fix lockless local-destination check - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - comedi: comedi_parport: deal with premature interrupt - coredump: fix pidfs file refcount leak in umh_coredump_setup - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - dm-verity: avoid double increment of &use_bh_wq_enabled - dm-verity: make error counter atomic - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amd/display: set new_stream to NULL after release - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amd/pm: make pp_features read-only when scpm is enabled - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gt: use correct selftest config symbol - drm/i915: Return NULL on error in active_instance - drm/i915/selftests: Fix GT PM sort comparators - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/nouveau: fix reversed error cleanup order in ucopy functions - drm/radeon: fix r100_copy_blit for large BOs - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - drm/vc4: Prevent shader BO mappings from becoming writable - drm/virtio: bound EDID block reads to the response buffer - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - drm/vmwgfx: Validate vmw_surface_metadata::array_size - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - exfat: validate cluster allocation bits of the allocation bitmap - fbcon: Rename struct fbcon_ops to struct fbcon_par - fbcon: Use correct type for vc_resize() return value - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - firewire: net: Fix fragmented datagram reassembly - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - firmware_loader: introduce __free() cleanup hanler - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list - ftrace: Add global mutex to serialize trace_parser access - geneve: require CAP_NET_ADMIN in the device netns for changelink - gpio: mt7621: avoid corruption of shared interrupt trigger state - gpio: tegra: do not call pinctrl for GPIO direction - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - hinic: remove unused ethtool RSS user configuration buffers - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: occ: validate poll response sensor blocks - i2c: davinci: Unregister cpufreq notifier on probe failure - i2c: i801: fix hardware state machine corruption in error path - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - i40e: remove read access to debugfs files - IB/mad: Drop unmatched RMPP responses before reassembly - ice: fix LAG recipe to profile association - ice: use READ_ONCE() to access cached PHC time - ila: reload IPv6 header after pskb_may_pull in checksum adjust - Input: ims-pcu - fix firmware leak in async update - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - Input: ims-pcu - fix logic error in packet reset - intel_th: fix MSC output device reference leak - iomap: correct the range of a partial dirty clear - iommu/amd: Bound the early ACPI HID map - iommu/amd: Don't split flush for amd_iommu_domain_flush_all() - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/vt-d: Disallow SVA if page walk is not coherent - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - ipmi: fix refcount leak in i_ipmi_request() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - ipv6: ndisc: fix NULL deref in accept_untracked_na() - ksmbd: bound DACL dedup walk to copied ACEs - ksmbd: defer destroy_previous_session() until after NTLM authentication - ksmbd: pin conn during async oplock break notification - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate ACE size against SID sub-authorities - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - KVM: Introduce vcpu->wants_to_run - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - KVM: x86/mmu: Fix use-after-free on vendor module reload - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN - libceph: bound get_version reply decode to front len - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: guard missing CRUSH type name lookup - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: Reject monmaps advertising zero monitors - libceph: reject zero bucket types in crush_decode - libceph: remove debugfs files before client teardown - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - LoongArch: Fix oops during single-step debugging - lsm: infrastructure management of the sock security - mac802154: hold an interface reference across the scan worker - mac802154: llsec: reject frames shorter than the authentication tag - mctp: serial: handle zero-length frames to prevent rx buffer overflow - media: airspy: Return queued buffers on start_streaming() failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: cedrus: clean up media device on probe failure - media: cedrus: Fix missing cleanup in error path - media: cedrus: skip invalid H.264 reference list entries - media: cx231xx: fix devres lifetime - media: cx23885: add ioremap return check and cleanup - media: marvell-cam: fix missing pci_disable_device() on remove - media: meson: vdec: Fix memory leak in error path of vdec_open - media: msi2500: Return queued buffers on start_streaming() failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: pci: dm1105: Free allocated workqueue - media: pwc: Drain fill_buf on start_streaming() failure - media: pwc: Return queued buffers on start_streaming() failure - media: radio-si476x: Unregister v4l2_device on probe failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: stm32: dcmi: unregister notifier on probe failure - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: ti: vpe: unwind v4l2 device registration on probe error - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: v4l2-ctrls: validate HEVC active reference counts - media: vb2: use ssize_t for vb2_read/vb2_write - media: vidtv: fix reference leak on failed device registration - media: vimc: fix reference leak on failed device registration - media: vivid: add vivid_update_reduced_fps() - media: vivid: check for vb2_is_busy() when toggling caps - media: vpif_capture: fix OF node reference imbalance - mei: bus: access mei_device under device_lock on cleanup - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - mm: refactor mm_access() to not return NULL - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - mptcp: decrement subflows counter on failed passive join - mptcp: only set DATA_FIN when a mapping is present - mtd: fix double free and WARN_ON in add_mtd_device() error paths - mtd: mtdswap: remove debugfs stats file on teardown - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: rawnand: Add a helper for calculating a page index - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Pause continuous reads at block boundaries - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - net: bridge: vlan: fix vlan range dumps starting with pvid - net: dpaa: fix mode setting - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - net: hip04: fix RX buffer leak on build_skb failure - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: ipa: fix SMEM state handle leaks in SMP2P init - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/iucv: fix use-after-free of a severed iucv_path - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - net: macb: drop in-flight Tx SKBs on close - net: mana: Validate the packet length reported by the NIC - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net/packet: avoid fanout hook re-registration after unregister - net: pcs: xpcs: fix SGMII state reading - net: qrtr: ns: Raise node count limit to 512 - net: qrtr: restrict socket creation to the initial network namespace - net/sched: act_tunnel_key: Defer dst_release to RCU callback - net: slip: serialize receive against buffer reallocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - net: stmmac: reset residual action in L3L4 filters on delete - net/x25: fix use-after-free in x25_kill_by_neigh() - nexthop: initialize extack in nh_res_bucket_migrate() - nfp: Check resource mutex allocation - NFS: Charge unstable writes by request size, not folio size - NFSD: pass nfsd_file to nfsd_iter_read() - nfs: remove dead code for the old swap over NFS implementation - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: fix SQB pointer leak on init failure - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-vf: set TC flower flag on MCAM entry allocation - openvswitch: fix GSO userspace truncation underflow - ovl: use linked upper dentry in copy-up tmpfile - pds_core: check for workqueue allocation failure - pds_core: fix auxiliary device add/del races - pds_core: order completion reads after the ownership check - pds_core: reject component parameter in legacy firmware update - pds_core: yield the CPU while waiting for the adminq to drain - phonet: pep: fix use-after-free in pep_get_sb() - pinctrl: remove pinctrl_gpio_direction_output() - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - platform/x86/amd/pmc: Avoid logging "(null)" for DMI values - platform/x86/amd/pmc: Don't log during intermediate wakeups - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - powerpc/time: Prepare to stop elapsing in dynticks-idle - powerpc/vtime: Initialize starttime at boot for native accounting - ppp: annotate data races in ppp_generic - ppp: convert to percpu netstats - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - ppp: enable TX scatter-gather - pppoe: reload header pointer after dev_hard_header() - ppp: use IFF_NO_QUEUE in virtual interfaces - proc: Fix broken error paths for namespace links - rbd: Reset positive result codes to zero in object map update path - RDMA/cma: Fix hardware address comparison length in netevent callback - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/irdma: Prevent overflows in memory contiguity checks - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/siw: publish QP after initialization - RDMA/umem: Add helpers for umem dmabuf revoke lock - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add pinned revocable dmabuf import interface - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/umem: Introduce an option to revoke DMABUF umem - RDMA/umem: Move umem dmabuf revoke logic into helper function - rds: drop incoming messages that cross network namespace boundaries - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - RISC-V: KVM: Serialize virtual interrupt pending state updates - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Fix socket notification race - rxrpc: Pull out certain app callback funcs into an ops table - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Use irq-disabling spinlocks between app and I/O thread - sched/vtime: Get rid of generic vtime_task_switch() implementation - sctp: auth: verify auth requirement when auth_chunk is NULL - sctp: don't free the ASCONF's own transport in DEL-IP processing - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - sctp: fix auth_hmacs array size in struct sctp_cookie - sctp: validate stream count in sctp_process_strreset_inreq() - selftest: af_unix: Add Kconfig file. - selftests: af_unix: add USER_NS config - selftests/alsa: Fix memory leak in find_controls error path - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - selftests: openvswitch: add config file - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - seqlock: Allow KASAN to fail optimizing - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: sc16is7xx: implement gpio get_direction() callback - smb/client: handle overlapping allocated ranges in fallocate - smb: client: validate DFS referral PathConsumed - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - tipc: fix infinite loop in __tipc_nl_compat_dumpit - tipc: fix u16 MTU truncation in media and bearer MTU validation - tipc: restrict socket queue dumps in enqueue tracepoints - tls: device: push pending open record on splice EOF - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - udmabuf: Do not create malformed scatterlists - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - USB: serial: ftdi_sio: add support for E+H FXA291 - USB: serial: io_edgeport: cap received transmit credits - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: option: add TDTECH MT5710-CN - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - VDUSE: avoid leaking information to userspace - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - VFS/audit: introduce kern_path_parent() for audit - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - vxlan: mdb: Fix source list corruption on a failed replace - vxlan: require CAP_NET_ADMIN in the device netns for changelink - wan: wanxl: Only reset hardware after BAR mapping - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath6kl: fix OOB access from firmware ADDBA window size - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: cfg80211: cancel sched scan results work on unregister - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: mac80211: recalculate TIM when a station enters power save - wifi: mac80211: tear down new links on vif update error path - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7915: guard HE capability lookups - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mwifiex: bound uAP association event IEs to the event buffer - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: nl80211: validate nested MBSSID IE blobs - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: wilc1000: validate assoc response length before subtracting header - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - x86/boot/compressed: Disable jump tables - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xprtrdma: Clear receive-side ownership pointers on release - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- [bot] upd: 6.6.144 -> 6.6.145 - Changelog: - 6lowpan: fix NHC entry use-after-free on error path - 9p: skip nlink update in cacheless mode to fix WARN_ON - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: IPMI: Fix message kref handling on dead device - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: resource: Amend kernel-doc style - afs: Fix callback service message parsers to pass through -EAGAIN - afs: Fix error code in afs_extract_vl_addrs() - afs: Fix further netns teardown to cancel the preallocation charger - afs: Fix netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix unchecked-length string display in debug statement - afs: Fix vllist leak - afs: use kvfree() to free memory allocated by kvcalloc() - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - ALSA: aoa: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - ALSA: es1938: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: gus: check snd_ctl_new1() return value - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: seq: Clear variable event pointer on read - ALSA: seq: Fix partial userptr event expansion - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: seq: midi: Serialize output teardown with event_input - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: virtio: Add missing 384 kHz PCM rate mapping - ALSA: ymfpci: check snd_ctl_new1() return value - amt: fix size calculation in amt_get_size() - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: advertise the tcp fast open fix is applied - apparmor: check label build before no_new_privs test - apparmor: fix label can not be immediately before a declaration - apparmor: fix potential UAF in aa_replace_profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: put secmark label after secid lookup - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - arm64: dts: qcom: sm8450: Fix ICE reg size - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - arm64: Fix early handling of FEAT_E2H0 not being implemented - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - arm64/mm: convert ptep_clear() to ptep_get_and_clear() - arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) - arm64/mm: convert set_pte_at() to set_ptes(..., 1) - arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() - arm64: Revamp HCR_EL2.E2H RES1 detection - arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 - arm64: sysreg: Correct sign definitions for EIESB and DoubleLock - arm64: tegra: Fix Tegra234 MGBE PTP clock - arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - ARM: imx31: Fix IIM mapping leak in revision check - ARM: imx3: Fix CCM node reference leak - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - ASoC: codecs: aw88261: fix incorrect masks for boost regs - ASoC: codecs: hdac_hdmi: Validate written enum value - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - ata: libata: Fix ata_exec_internal() - ata: pata_pxa: Fix DMA channel leak on probe error - ata: sata_gemini: unwind clocks on IDE pinctrl errors - audit: add audit_log_nf_skb helper function - audit: Fix data races of skb_queue_len() readers on audit_queue - audit: fix potential integer overflow in audit_log_n_hex() - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: dat: fix tie-break for candidate selection - batman-adv: ensure minimal ethernet header on TX - batman-adv: fix VLAN priority offset - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: gw: acquire ethernet header only after skb realloc - batman-adv: retrieve ethhdr after potential skb realloc on RX - batman-adv: tt: avoid request storms during pending request - batman-adv: tt: prevent TVLV OOB check overflow - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - bitops: make BYTES_TO_BITS() treewide-available - bitops: use common function parameter names - block: Avoid mounting the bdev pseudo-filesystem in userspace - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - Bluetooth: btmtk: Fix btmtk.c undefined reference build error - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices. - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown - Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c - Bluetooth: btmtk: remove #ifdef around declarations - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: btrtl: validate firmware patch bounds - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - Bluetooth: hci_sync: annotate data-races around hdev->req_status - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci: validate codec capability element length - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: separate CIS_LINK and BIS_LINK link types - Bluetooth: vhci: validate devcoredump state before side effects - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - bonding: 3ad: fix mux port state on oper down - bonding: add ESP offload features when slaves support - bonding: Correctly support GSO ESP offload - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - bonding: fix type confusion in bond_setup_by_slave() - bonding: fix xfrm offload feature setup on active-backup mode - bonding: prevent potential infinite loop in bond_header_parse() - bonding: use common function to compute the features - bpf: Add missing access_ok call to copy_user_syms - bpf: Allow LPM map access from sleepable BPF programs - bpf, arm64: Reject out-of-range B.cond targets - bpf: Check tail zero of bpf_prog_info - bpf: Consistently use bpf_rcu_lock_held() everywhere - bpf: Disable xfrm_decode_session hook attachment - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - bpf: Fix effective prog array index with BPF_F_PREORDER - bpf: Fix stack slot index in nospec checks - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - bpf,fork: wipe ->bpf_storage before bailouts that access it - bpf, lsm: Add disabled BPF LSM hook list - bpf: Prefer dirty packs for eBPF allocations - bpf: Prefer packs that won't trigger an IBPB flush on allocation - bpf: Reject fragmented frames in devmap - bpf: Restore sysctl new-value from 1 to 0 - bpf: Restrict JIT predictor flush to cBPF - bpf: Run generic devmap egress prog on private skb - bpf: Skip redundant IBPB in pack allocator - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Support for hardening against JIT spraying - bpf: Tighten cgroup storage cookie checks for prog arrays - bpftool: Use libbpf error code for flow dissector query - bpf: Update transport_header when encapsulating UDP tunnel in lwt - bpf: zero-initialize the fib lookup flow struct - bridge: cfm: reject invalid CCM interval at configuration time - bridge: stp: Fix a potential use-after-free when deleting a bridge - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - btrfs: do not trim a device which is not writeable - btrfs: fix false IO failure after falling back to buffered write - btrfs: fix incorrect buffered IO fallback for append direct writes - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - btrfs: zoned: don't account data relocation space-info in statfs free space - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - bus: sunxi-rsb: Always check register address validity - can: bcm: add missing rcu list annotations and operations - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: esd_usb: kill anchored URBs before freeing netdevs - can: isotp: use unconditional synchronize_rcu() in isotp_release() - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - char: tlclk: fix use-after-free in tlclk_cleanup() - cifs: invalidate cfid on unlink/rename/rmdir - cifs: remove all cifs files before kill super - cifs: validate DFS referral string offsets - clk: at91: keep securam node alive while mapping it - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - clk: scmi: Fix clock rate rounding - clk: scpi: Unregister child clock providers on remove - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - configfs: fix lockless traversals of ->s_children - configfs_lookup(): don't leave ->s_dentry dangling on failure - coresight: cti: Fix DT filter signals silently ignored - coresight: etb10: restore atomic_t for shared reading state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Documentation: fix conservative governor freq_step description - cpufreq: Documentation: fix sampling_down_factor range - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - crypto: af_alg - Remove zero-copy support from skcipher and aead - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: ccp - Treat zero-length cert chain as query for blob lengths - crypto: crypto4xx - Remove ahash-related code - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: drbg - Fix the fips_enabled priority boost - crypto: ecc - Fix carry overflow in vli multiplication - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: hisilicon/qm - disable error report before flr - crypto: hisi-trng - Remove crypto_rng interface - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - crypto: pcrypt - restore callback for non-parallel fallback - crypto: qat - fix restarting state leak on allocation failure - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - crypto: qat - validate RSA CRT component lengths - crypto: rng - Free default RNG on module exit - crypto: sun4i-ss - Remove insecure and unused rng_alg - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - stop using crypto_ahash::init - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - cxgb4: Fix decode strings dump for T6 adapters - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - cxl/test: Fix integer overflow in mock LSA bounds checks - cxl/test: Zero out LSA backing memory to avoid leaking to user - dax/kmem: account for partial discontiguous resource upon removal - debugobjects: Plug race against a concurrent OOM disable - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - devlink: Fix parent ref leak in devl_rate_node_create() - dlm: fix add msg handle in send_queue ordered - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: Fix possible use after free - dmaengine: imx-sdma: Refine spba bus searching in probe - dmaengine: qcom: gpi: set DMA_PRIVATE capability - dmaengine: tegra: Fix burst size calculation - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm_early_create: fix freeing used table on dm_resume failure - dm era: fix NULL pointer dereference in metadata_open() - dm era: fix out-of-bounds memory access for non-zero start sector - dm-integrity: don't increment hash_offset twice - dm-ioctl: fix a possible overflow in list_version_get_info - dm-ioctl: report an error if a device has no table - dm-log: fix a bitset_size overflow on 32bit machines - dm-stats: fix dm_jiffies_to_msec64 - dm-stats: fix merge accounting - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - dm-verity: fix a possible NULL pointer dereference - dm-verity: increase sprintf buffer size - Documentation: proc: fix section numbering in table of contents - dpaa2-switch: fix VLAN upper check not rejecting bridge join - drbd: reject data replies with an out-of-range payload size - driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() - driver core: Guard deferred probe timeout extension with delayed_work_pending() - driver core: Use mod_delayed_work to prevent lost deferred probe work - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amd/display: Add missing kdoc for ALLM parameters - drm/amd: Fix set but not used warnings - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/amdgpu: initialize irq.lock spinlock earlier - drm/amdgpu: set sub_block_index for mca ras sub-blocks - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - drm/edid: fix OOB read in drm_parse_tiled_block() - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/msm/dp: fix HPD state status bit shift value - drm/msm/dp: Fix the ISR_* enum values - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - drm/tegra: Fix iommu_map_sgtable() return value check - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - drm/tidss: Drop extra drm_mode_config_reset() call - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - dt-bindings: power: imx93: Add MIPI PHY power domain - EDAC/i10nm: Don't fail probing if ADXL is missing - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - espintcp: use sk_msg_free_partial to fix partial send - evm: terminate and bound the evm_xattrs read buffer - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: bound uniname advance in exfat_find_dir_entry() - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: move free cluster out of exfat_init_ext_entry() - exfat: preserve benign secondary entries during rename and move - exfat: remove unnecessary read entry in __exfat_rename() - exfat: rename argument name for exfat_move_file and exfat_rename_file - ext2: fix ignored return value of generic_write_sync() - ext4: fix kernel BUG in ext4_write_inline_data_end - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - ext4: get rid of ppath in get_ext_path() - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: validate orphan inode entry count - fbcon: fix NULL pointer dereference for a console without vc_data - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: sm501fb: Fix buffer errors in OF binding code - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - firmware: arm_scmi: Read sensor config as 32-bit value - firmware_loader: fix device reference leak in firmware_upload_register() - firmware_loader: Fix recursive lock in device_cache_fw_images() - flow_dissector: check device type before reading ETH_ADDRS - fpga: dfl: add bounds check in dfh_get_param_size() - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - fs: efs: remove unneeded debug prints - fsl/fman: Free init resources on KeyGen failure in fman_init() - fs/ntfs3: add bounds check to run_get_highest_vcn() - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - fs/ntfs3: fsync files by syncing parent inodes - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - fuse: fix device node leak in cuse_process_init_reply() - fuse: re-lock request before returning from fuse_ref_folio() - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - gpio-f7188x: Add support for NCT6126D version B - gpio: htc-egpio: use managed gpiochip registration - gpio: mlxbf3: fail probe if gpiochip registration fails - gpio: mvebu: fail probe if gpiochip registration fails - gpio: sch: use raw_spinlock_t in the irq startup path - gpios: palmas: add .get_direction() op - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - gpu: host1x: Allow entries in BO caches to be freed - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - gpu: host1x: Fix iommu_map_sgtable() return value check - gue: validate REMCSUM private option length - handshake: Require admin permission for DONE command - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: add haptics page defines - HID: appleir: fix UAF on pending key_up_timer in remove() - HID: core: Fix OOB read in hid_get_report for numbered reports - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - HID: playstation: validate num_touch_reports in DualShock 4 reports - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: wacom: stop hardware after post-start probe failures - HID: wiimote: Fix table layout and whitespace errors - hwmon: adm1275: Prevent reading uninitialized stack - hwmon: (asus_atk0110) Check package count before accessing element - hwmon: (it87) Clamp negative values to zero in set_fan() - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - hwmon: (occ) unregister sysfs devices outside occ lock - hwmon: (pmbus) Fix passing events to regulator core - hwmon: (w83627hf) remove VID sysfs files on error and remove - hwmon: (w83793) remove vrm sysfs file on probe failure - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - hwrng: virtio: clamp device-reported used.len at copy_data() - hwspinlock: qcom: avoid uninitialized struct members - i2c: core: fix adapter debugfs creation - i2c: core: fix adapter deregistration race - i2c: core: fix adapter registration race - i2c: core: fix hang on adapter registration failure - i2c: core: fix irq domain leak on adapter registration failure - i2c: core: fix NULL-deref on adapter registration failure - i2c: mediatek: fix WRRD for SoCs without auto_restart option - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mpc: Fix timeout calculations - i2c: stm32f7: truncate clock period instead of rounding it - i3c: master: Prevent reuse of dynamic address on device add failure - i40e: Fix i40e_debug() to use struct i40e_hw argument - ia64: Make acpi_cpufreq_cpu_exit return void - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - IB/mlx4: Fix refcount leak in add_port() error path - IB/mlx5: Don't take the rereg_mr fallback without a new translation - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - IB/mlx5: Properly support implicit ODP rereg_mr - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - ice: fix ice_init_link() error return preventing probe - ieee802154: admin-gate legacy LLSEC dump operations - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - iio: accel: bmc150: clamp the device-reported FIFO frame count - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: event: Fix event FIFO reset race - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: light: al3010: fix incorrect scale for the highest gain range - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: opt3001: fix missing state reset on timeout - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: veml6030: fix channel type when pushing events - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: pressure: mpl115: fix runtime PM leak on read error - iio: tcs3472: power down chip on probe failure - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: goodix - clamp the device-reported contact count - Input: iforce - bound the device-reported force-feedback effect index - Input: ims-pcu - add response length checks - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix use-after-free and double-free in disconnect - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - validate control endpoint type - Input: maplecontrol - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: maplemouse - fix NULL pointer dereference in open() - Input: maplemouse - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: mms114 - reject an oversized device packet size - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - Input: touchwin - reset the packet index on every complete packet - iommu/amd: Fix a stale comment about which legacy mode is user visible - ionic: Fix check in ionic_get_link_ext_stats - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - ipv4: fib: Don't ignore error route in local/main tables. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - ipv4: igmp: remove multicast group from hash table on device destruction - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - ipv6: fix error handling in disable_ipv6 sysctl - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix more places with wrong ipv6 transport offsets - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: pass parsed transport offset to state handlers - ipvs: reload ip header after head reallocation - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - ipvs: use parsed transport offset in TCP state lookup - irqchip/crossbar: Fix parent domain resource leak - irqchip/crossbar: Use correct index in crossbar_domain_free() - irqchip/gic-v3-its: Fix OF node reference leak - irqchip/ts4800: Fix missing chained handler cleanup on remove - isofs: bound Rock Ridge symlink components to the SL record - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - kcm: use WRITE_ONCE() when changing lower socket callbacks - kconfig: fix potential NULL pointer dereference in conf_askvalue - KEYS: Use acquire when reading state in keyring search - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - ksmbd: fix integer overflow in set_file_allocation_info() - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: fix use-after-free in same_client_has_lease() - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - ksmbd: reject undersized DACLs before parsing ACEs - ksmbd: require source read access for duplicate extents - ksmbd: run set info with opener credentials - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: track the connection owning a byte-range lock - ksmbd: use opener credentials for delete-on-close - ksmbd: use opener credentials for FSCTL mutations - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - KVM: arm64: Initialize HCR_EL2.E2H early - KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - leds: uleds: Fix potential buffer overread - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - libbpf: Report error when a negative kprobe offset is specified - lib/test_meminit: use && for bools - llc: fix SAP refcount leak in llc_ui_autobind() - llc: fix SAP refcount leak when creating incoming sockets - lockd: Plug nlm_file leak when nlm_do_fopen() fails - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - LoongArch: Add PIO for early access before ACPI PCI root register - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - mac802154: remove interfaces with RCU list deletion - macsec: don't read an unset MAC header in macsec_encrypt() - macsec: fix promiscuity refcount leak in macsec_dev_open() - mailbox: mtk-adsp: fix UAF during device teardown - md/raid10: reset read_slot when reusing r10bio for discard - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - media: cedrus: Fix failure to clean up hardware on probe failure - media: mtk-jpeg: cancel workqueue on release for supported platforms only - media: nxp: imx8-isi: Convert to platform remove callback returning void - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: qcom: venus: drop extra padding in NV12 raw size calculation - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: relax encoder frame/blur step size on v6 - media: rockchip: rga: fix too small buffer size - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - media: uvcvideo: Avoid partial metadata buffers - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Fix sequence number when no EOF - media: v4l2-common: Add YUV24 format info - memstick: ms_block: reject a card that reports too many blocks - mfd: cros_ec: Delay dev_set_drvdata() until probe success - mfd: cs42l43: Sanity check firmware size - mfd: sm501: Fix reference leak on failed device registration - mfd: tps6586x: Fix OF node refcount - minix: avoid overflow in bitmap block count calculation - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: DEC: Ensure RTC platform device deregistration upon failure - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix gio device memory leak - MIPS: ip22-gio: fix kfree() of static object - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mmc: vub300: defer reset until cmd_mutex is unlocked - mm/damon/core: make charge_addr_from aware of end-address exclusivity - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm: do file ownership checks with the proper mount idmap - mm/fake-numa: fix under-allocation detection in uniform split - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - mm: shrinker: fix NULL pointer dereference in debugfs - mm: shrinker: remove redundant shrinker_rwsem in debugfs operations - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - mm/vmscan: flush deferred TLB before freeing large folios - module: decompress: check return value of module_extend_max_pages() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - mtd: rawnand: fix condition in 'nand_select_target()' - mtd: rawnand: fsl_ifc: return errors for failed page reads - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: pl353: fix probe resource allocation - mtd: slram: remove failed entries from the device list - mtd: spi-nor: Drop duplicate Kconfig dependency - mtd: spi-nor: swp: Improve locking user experience - net/9p: fix infinite loop in p9_client_rpc on fatal signal - net/9p: fix race condition on rdma->state in trans_rdma.c - net: add a common function to compute features for upper devices - net: af_key: initialize alg_key_len for IPComp states - net: atm: reject out-of-range traffic classes in QoS validation - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net, bpf: check master for NULL in xdp_master_redirect() - net: Drop the lock in skb_may_tx_timestamp() - net: dsa: sja1105: round up PTP perout pin duration - net: ena: clean up XDP TX queues when regular TX setup fails - net: enetc: check the number of BDs needed for xdp_frame - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: conntrack: revert ct extension genid infrastructure - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump - netfilter: ebtables: module names must be null-terminated - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: Use vmalloc_array() to improve code - netfilter: ebtables: zero chainstack array - netfilter: ecache: fix inverted time_after() check - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: Fix data race between add and dump in all hash types - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: fix race between dump and ip_set_list resize - netfilter: nf_conncount: callers must hold rcu read lock - netfilter: nf_conncount: fix zone comparison in tuple dedup - netfilter: nf_conncount: prevent connlimit drops for early confirmed ct - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: xt_connmark: reject invalid shift parameters - netfilter: xt_nat: reject unsupported target families - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - net: gianfar: dispose irq mappings on probe failure and device removal - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: lan743x: Initialize eth_syslock spinlock before use - net: liquidio: fix BAR resource leak on PF number failure - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net: marvell: prestera: initialize err in prestera_port_sfp_bind - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5: Check max_macs devlink param value against max capability - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - net/mlx5: Fix L3 tunnel entropy refcount leak - net: mvneta: re-enable percpu interrupt on resume - net: openvswitch: reject oversized nested action attrs - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - net: psample: fix info leak in PSAMPLE_ATTR_DATA - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net/sched: cake: reject overhead values that underflow length - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - net/sched: cls_flow: Dont expose folded kernel pointers - net/sched: hhf: clear heavy-hitter state on reset - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_drr: annotate data-races around cl->deficit - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - net/sched: sch_hfsc: Don't make class passive twice - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - net: sit: require CAP_NET_ADMIN in the device netns for changelink - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net: sparx5: unregister blocking notifier on init failure - net: sungem: fix probe error cleanup - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - net: thunderbolt: Fix frags[] overflow by bounding frame_count - net/tls: Consume empty data records in tls_sw_read_sock() - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - net: wwan: iosm: bound device offsets in the MUX downlink decoder - net: wwan: t7xx: check skb_clone in control TX - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: Don't reset the write verifier on a commit EAGAIN - nfsd: move name lookup out of nfsd4_list_rec_dir() - nfsd: release layout stid on setlease failure - nfsd: reset write verifier on deferred writeback errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - NFSv4/flexfiles: reject zero filehandle version count - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - NFSv4/pnfs: defer return_range callbacks until after inode unlock - nilfs2: fix backing_dev_info reference leak - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - NTB: epf: Make db_valid_mask cover only real doorbell bits - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - nvdimm/btt: Free arenas on btt_init() error paths - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Handle preemption in BTT lane acquisition - nvme-multipath: fix flex array size in struct nvme_ns_head - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - nvmet-auth: validate reply message payload bounds against transfer length - nvmet-rdma: handle inline data with a nonzero offset - nvmet: remove superfluous initialization - nvmet: return DHCHAP status codes from nvmet_setup_auth() - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - nvmet-tcp: Fix potential UAF when ddgst mismatch - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: avoid moving extents to occupied clusters - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: don't BUG_ON an invalid journal dinode - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2: kill osb->system_file_mutex lock - ocfs2: rebase copied fsdlm LVB pointers in locking_state - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: use kzalloc for quota recovery bitmap allocation - octeontx2-af: fix VF bringup affecting PF promiscuous state - octeontx2-af: mcs: Fix unsupported secy stats read - octeontx2-pf: check DMAC extraction support before filtering - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - of: cpu: add check in __of_find_n_match_cpu_property() - OPP: of: Fix potential memory leak in opp_parse_supplies() - orangefs: keep the readdir entry size 64-bit in fill_from_part() - partitions: aix: bound the pp_count scan to the ppe array - PCI: Add kerneldoc for pci_resize_resource() - PCI: altera: Do not dispose parent IRQ mapping - PCI: altera: Fix resource leaks on probe failure - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining - PCI/ASPM: Don't reconfigure ASPM entering low-power state - PCI: Check ROM header and data structure addr before accessing - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - PCI: Fix restoring BARs on BAR resize rollback path - PCI: Free saved list without holding pci_bus_sem - PCI: host-common: Request bus reassignment when not probe-only - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - PCI: Introduce named defines for PCI ROM - PCI: iproc: Restore .map_irq() for the platform bus driver - PCI: loongson: Do not ignore downstream devices on external bridges - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: Move Resizable BAR code to rebar.c - PCI: Prevent resource tree corruption when BAR resize fails - PCI: rcar-host: Remove unused LIST_HEAD(res) - PCI: Skip Resizable BAR restore on read error - perf/core: Detach event groups during remove_on_exec - perf: Fix dangling cgroup pointer in cpuctx backport - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - perf trace beauty fcntl: Fix build with older kernel headers - perf/x86/amd/brs: Fix kernel address leakage - perf/x86/amd/core: Always use the NMI latency mitigation - perf/x86/amd/lbr: Fix kernel address leakage - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - phy: phy-can-transceiver: Check driver match and driver data against NULL - pinctrl: cs42l43: Fix polarity on debounce - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: meson: restore non-sleeping GPIO access - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - platform/x86/amd/pmc: Add delay_suspend module parameter - platform/x86/amd/pmc: Check for intermediate wakeup in function - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - pmdomain: imx: Fix i.MX8MP power notifier - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - PM: sleep: Use complete() in device_pm_sleep_init() - pNFS/filelayout: fix cheking if a layout is striped - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - powerpc/pseries: fix memory leak on krealloc failure in papr_init - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - power: supply: charger-manager: fix refcount leak in is_full_charged() - power: supply: core: fix supplied_from allocations - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - proc: only bump parent nlink when registering directories - proc: protect ptrace_may_access() with exec_update_lock (FD links) - proc: protect ptrace_may_access() with exec_update_lock (part 1) - proc: rename proc_setattr to proc_nochmod_setattr - pwm: imx27: Fix variable truncation in .apply() - qede: fix off-by-one in BD ring consumption on build_skb failure - qede: fix out-of-bounds check for cqe->len_list[] - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - RDMA/hns: Fix warning in poll cq direct mode - RDMA/irdma: Fix OOB read during CQ MR registration - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Remove raw RSS QP restrack tracking - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/srpt: fix integer overflow in immediate data length check - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - remoteproc: qcom: Fix leak when custom dump_segments addition fails - reset: sunxi: fix memory region leak on ioremap failure - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - Revert "PCI/MSI: Unmap MSI-X region on error" - Revert "treewide: Fix probing of devices in DT overlays" - ring-buffer: Fix event length with forced 8-byte alignment - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - riscv: probes: save original sp in rethook trampoline - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - rpmsg: use generic driver_override infrastructure - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: mpfs: fix counter upload completion condition - rtc: msc313: fix NULL deref in shared IRQ handler at probe - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - s390/monwriter: Reject buffer reuse with different data length - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - s390/process: Fix kernel thread function pointer type - s390/zcrypt: Remove the empty file - sched/fair: Fix cpu_util runnable_avg arithmetic - sched/fair: Only update stats for allowed CPUs when looking for dst group - sched: restore timer_slack_ns when resetting RT policy on fork - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: sg: Report request-table problems when any status is set - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Fix hexadecimal CHAP_I handling - scsi: target: Remove tcm_loop target reset handling - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - sctp: fix SCTP_RESET_STREAMS stream list length limit - sctp: hold socket lock when dumping endpoints in sctp_diag - sctp: validate embedded address parameter length - sctp: validate STALE_COOKIE cause length before reading staleness - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - seg6: validate SRH length before reading fixed fields - selftests/bpf: Add simple strscpy() implementation - selftests/bpf: Fix bpf_iter/task_vma test - selftests/bpf: Initialize operation name before use - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: do not manually call headers_install - selftests/hid: ensure CKI can compile our new tests on old kernels - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - selftests/hid: force using our compiled libbpf headers - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - selftests/mm: fix exclusive_cow test fork() handling - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - selinux: check connect-related permissions on TCP Fast Open - selinux: fix incorrect execmem checks on overlayfs - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: fix scoped_seqlock_read kernel-doc - seqlock: Introduce scoped_seqlock_read() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - smb/client: always return a value for FS_IOC_GETFLAGS - smb: client: fix change notify replay double-free - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix double-free in SMB2_open() replay - smb/client: Fix error code in smb2_aead_req_alloc() - smb: client: Fix next buffer leak in receive_encrypted_standard() - smb: client: fix overflow in passthrough ioctl bounds check - smb: client: fix query directory replay double-free - smb: client: fix query_info() replay double-free - smb: client: harden POSIX SID length parsing - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - smb: client: mask server-provided mode to 07777 in modefromsid - smb/client: preserve errors from smb2_set_sparse() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: resolve SWN tcon from live registrations - smb: client: restrict implied bcc[0] exemption to responses without data area - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - smb: client: use unaligned reads in parse_posix_ctxt() - smb: move some duplicate definitions to common/cifsglob.h - smb/server: do not require delete access for non-replacing links - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - sparc: led: avoid trimming a newline from empty writes - spi: dw: fix wrong BAUDR setting after resume - spi: ep93xx: fix double-free of zeropage on DMA setup failure - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: hisi-kunpeng: Use dev_err_probe() for host registration failure - spi: meson-spifc: fix runtime PM leak on remove - spi: rpc-if: Use correct device for hardware reinitialization on resume - spi: sh-msiof: abort transfers when reset times out - spi: uniphier: Fix completion initialization order before devm_request_irq() - spi: xilinx: use FIFO occupancy register to determine buffer size - staging: media: atomisp: reduce load_primary_binaries() stack usage - staging: most: video: avoid double free on video register failure - staging: nvec: fix use-after-free in nvec_rx_completed() - staging: rtl8723bs: core: move constants to right side in comparison - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: vme_user: bound slave read/write to the kern_buf size - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: fix location monitor leak in tsi148 bridge - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sysfs: clamp show() return value in sysfs_kf_read() - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - team: fix header_ops type confusion with non-Ethernet ports - thermal: hwmon: Fix critical temperature attribute removal - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - time: Fix off-by-one in compat settimeofday() usec validation - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - tipc: fix UAF in tipc_l2_send_msg() - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: reject inverted service ranges from peer bindings - tipc: require net admin for TIPCv2 netlink mutators - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - tools/power/x86/intel-speed-select: Harden daemon pidfile open - tools/testing: add linux/args.h header and fix radix, VMA tests - tools/virtio: check mmap return value in vringh_test - tpm: fix event_size output in tpm1_binary_bios_measurements_show - tpm: Make the TPM character devices non-seekable - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - tracing: Bound synthetic-field strings with seq_buf - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - tracing/osnoise: Call synchronize_rcu() when unregistering - tracing: Prevent out-of-bounds read in glob matching - tracing/probes: Fix double addition of offset for @+FOFFSET - tracing: probes: fix typo in a log message - treewide: Switch/rename to timer_delete[_sync]() - udf: validate free block extents against the partition length - udf: validate sparing table length as an entry count, not a byte count - udf: validate VAT header length against the VAT inode size - udmabuf: fix DMA direction mismatch in release_udmabuf() - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - usb: dwc3: run gadget disconnect from sleepable suspend context - usb: free iso schedules on failed submit - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: gadget: f_fs: initialize reset_work at allocation time - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - usb: gadget: f_printer: take kref only for successful open - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - usb: host: max3421: Reject hub port requests for non-existent ports - USB: idmouse: fix use-after-free on disconnect race - USB: iowarrior: fix use-after-free on disconnect - usb: iowarrior: remove inherent race with minor number - usbip: tools: support SuperSpeedPlus devices - usbip: vudc: fix NULL deref in vep_dequeue() - USB: ldusb: fix use-after-free on disconnect race - USB: legousbtower: fix use-after-free on disconnect race - USB: misc: uss720: unregister parport on probe failure - usb: mtu3: unmap request DMA on queue failure - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: keyspan_pda: fix information leak - USB: serial: option: add Telit Cinterion FE990D50 compositions - usb: sl811-hcd: disable controller wakeup on remove - USB: storage: include US_FL_NO_SAME in quirks mask - usb: typec: anx7411: use devm_pm_runtime_enable() - usb: typec: class: drop PD lookup reference - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - USB: ulpi: fix memory leak on registration failure - USB: usb-storage: ene_ub6250: restore media-ready check - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - userfaultfd: gate must_wait writability check on pte_present() - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - vduse: hold vduse_lock across IDR lookup in open path - vduse: Requeue failed read to send_list head - veth: fix NAPI leak in XDP enable error path - vfio/mlx5: Fix racy bitfields and tighten struct layout - vfio/pci: Fix racy bitfields and tighten struct layout - vfio/pci: Latch disable_idle_d3 per device - vfio/pci: Release the VGA arbiter client on register_device() failure - vfio/pci: Use a private flag to prevent power state change with VFs - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - vhost/net: complete zerocopy ubufs only once - vhost/vdpa: validate virtqueue index in mmap and fault paths - virtio-mmio: fix device release warning on module unload - virtio_net: disable cb when NAPI is busy-polled - virtio-net: fix len check in receive_big() - virtio_net: Support dynamic rss indirection table size - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - watchdog: apple: Add "apple,t8103-wdt" compatible - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: unregister PM notifier on watchdog unregister - wifi: ath9k: fix OOB access from firmware tx status queue ID - wifi: cfg80211: fix grammar in MLO group key error message - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: mac80211: free ack status frame on TX header build failure - wifi: mt76: fix argument to ieee80211_is_first_frag() - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: rt2x00: avoid full teardown before work setup in probe - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - workqueue: drop spurious '*' from print_worker_info() fn declaration - writeback: Avoid contention on wb->list_lock when switching inodes - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - X.509: Fix validation of ASN.1 certificate header - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - x86/bugs: Enable IBPB flush on BPF JIT allocation - x86/mm: Fix check/use ordering in switch_mm_irqs_off() - x86/platform/olpc: xo15: Drop wakeup source on driver removal - xen/gntdev: fix error handling in ioctl - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: use compat translator only for u64 alignment mismatch - xfrm: Use the XFRM_GRO to indicate a GRO call on input - xfrm: validate selector family and prefixlen during match - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfs: dump the recovered xattri log item if corruption happens - xfs: fail recovery on a committed log item with no regions - xfs: fix stupid compiler warning - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: move ->iop_recover to xfs_defer_op_type - xfs: recreate work items when recovering intent items - xfs: resample the data fork mapping after cycling ILOCK - xfs: use null daddr for unset first bad log block - xfs: use xfs_defer_finish_one to finish recovered work items - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Check frwr_wp_create() during connect - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Remove temp allocation of rpcrdma_rep objects - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Use sendctx DMA state for Send signaling - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Remove rudiment CVE patches- [bot] upd: 6.6.126 -> 6.6.144 - Changelog: - 6lowpan: fix off-by-one in multicast context address compression - 6pack: propagage new tty types - 9p: avoid putting oldfid in p9_client_walk() error path - accel/qaic: Add overflow check to remap_pfn_range during mmap - accel/qaic: Handle DBC deactivation if the owner went away - ACPI: AGDI: fix missing newline in error message - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - ACPI: PM: Save NVS memory on Lenovo G70-35 - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix - ACPI: scan: Use acpi_dev_put() in object add error paths - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: x86: cmos_rtc: Clean up address space handler driver - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - af_key: validate families in pfkey_send_migrate() - af_unix: Cache state->msg in unix_stream_read_generic(). - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Give up GC if MSG_PEEK intervened. - af_unix: read UNIX_DIAG_VFS data under unix_state_lock - af_unix: Reject SIOCATMARK on non-stream sockets - af_unix: Set gc_in_progress to true in unix_gc(). - agp/amd64: Fix broken error propagation in agp_amd64_probe() - alarmtimer: Fix argument order in alarm_timer_forward() - ALSA: 6fire: Fix input volume change detection - ALSA: 6fire: fix use-after-free on disconnect - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: i2sbus: fix OF node lifetime handling - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - ALSA: aoa: Use guard() for mutex locks - ALSA: asihpi: avoid write overflow check warning - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: fix stack out-of-bounds read in init_card - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - ALSA: core: Fix potential data race at fasync handling - ALSA: core: Serialize deferred fasync state checks - ALSA: core: Validate compress device numbers without dynamic minors - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: ctxfi: Limit PTP to a single page - ALSA: firewire-lib: fix uninitialized local variable - ALSA: firewire-motu: Protect register DSP event queue positions - ALSA: firewire-tascam: Do not drop unread control events - ALSA: fireworks: bound device-supplied status before string array lookup - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: fix some typos - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: hda: cs35l56: Propagate ASP TX source control errors - ALSA: hda: cs35l56: Put ACPI device after setting companion - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: add quirk for Framework F111:000F - ALSA: hda/realtek: Add quirk for Inspur S14-G1 - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: misc: Use guard() for spin locks - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - ALSA: scarlett2: Add missing sentinel initializer field - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - ALSA: timer: Fix UAF at snd_timer_user_params() - ALSA: ua101: Reject too-short USB descriptors - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - ALSA: usb-audio: Add sanity check for OOB writes at silencing - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Cap the packet size pre-calculations - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Evaluate packsize caps at the right place - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Improve Focusrite sample rate filtering - ALSA: usb-audio: midi2: Restart output URBs on resume - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - ALSA: usb-audio: Update the number of packets properly at receiving - ALSA: usb-audio: Use correct version for UAC3 header validation - ALSA: usb-audio: Use inclusive terms - amd-xgbe: fix link status handling in xgbe_rx_adaptation - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - amd-xgbe: fix sleep while atomic on suspend/resume - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - APEI/GHES: ensure that won't go past CPER allocated record - apparmor: fix aa_label to return state from compount and component match - apparmor: fix differential encoding verification - apparmor: Fix double free of ns_name in aa_replace_profiles() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: fix: limit the number of levels of policy namespaces - apparmor: fix memory leak in verify_header - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix NULL sock in aa_sock_file_perm - apparmor: fix race between freeing data and fs accessing it - apparmor: fix race on rawdata dereference - apparmor: fix rlimit for posix cpu timers - apparmor: fix side-effect bug in match_char() macro usage - apparmor: fix unprivileged local user can do privileged policy management - apparmor: fix use-after-free in rawdata dedup loop - apparmor: make label_match return a consistent value - apparmor: mediate the implicit connect of TCP fast open sendmsg - apparmor: provide separate audit messages for file and policy checks - apparmor: refcount the pdb - apparmor: remove apply_modes_to_perms from label_match - apparmor: replace recursive profile removal with iterative approach - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: validate DFA start states are in bounds in unpack_pdb - arm64: Add support for TSV110 Spectre-BHB mitigation - arm64: cpufeature: Make PMUVer and PerfMon unsigned - arm64: cputype: Add C1-Premium definitions - arm64: cputype: Add C1-Ultra definitions - arm64: cputype: Add NVIDIA Olympus definitions - arm64: Disable branch profiling for all arm64 code - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8-apalis: Fix LEDs name collision - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - arm64: dts: rockchip: Fix rk356x PCIe range mappings - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU - arm64: errata: Mitigate TLBI errata on various Arm CPUs - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - arm64: Fix sampling the "stable" virtual counter in preemptible section - arm64: Force the use of CNTVCT_EL0 in __delay() - arm64: io: Extract user memory type in ioremap_prot() - arm64: io: Rename ioremap_prot() to __ioremap_prot() - arm64: kexec: Remove duplicate allocation for trans_pgd - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - arm64: mm: Batch dsb and isb when populating pgtables - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - arm64/mm: Enable batched TLB flush in unmap_hotplug_range() - arm64: probes: Handle probes on hinted conditional branch instructions - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - arm64/scs: Fix handling of advance_loc4 - arm64/scs: Fix potential sign extension issue of advance_loc4 - arm64: tegra: smaug: Add usb-role-switch support - arm64: tlb: Allow XZR argument to TLBI ops - arm64: tlb: Flush walk cache when unsharing PMD tables - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI - arm64/xor: fix conflicting attributes for xor_block_template - ARM: 9467/1: mm: Don't use %pK through printk - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: clean up the memset64() C wrapper - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: group is_permission_fault() with is_translation_fault() - ARM: integrator: Fix early initialization - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - ARM: omap2: Fix reference count leaks in omap_control_init() - ARM: socfpga: Fix OF node refcount leak in SMP setup - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - ASoC: amd: yc: Add quirk for HP 200 G2a 16 - ASoC: codecs: ab8500: Fix casting of private data - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - ASoC: codecs: simple-mux: Fix enum control bounds check - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - ASoC: cs42l43: Correct handling of 3-pole jack load detection - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: detect empty DMI strings - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - ASoC: es8328: Add error unwind in resume - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: fix comment typo - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_micfil: Add access property for "VAD Detected" - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: Intel: catpt: Fix the device initialization - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm: move component registration to unmanaged version - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6asm-dai: close stream only when running - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays - ASoC: simple-card-utils: use __free(device_node) for device node - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - ASoC: soc-core: drop delayed_work_pending() check before flush - ASoC: soc-core: flush delayed work before removing DAIs and widgets - ASoC: SOF: compress: return the configured codec from get_params - ASoC: SOF: Don't allow pointer operations on unconfigured streams - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda: Place check before dereference - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: sti: Return errors from regmap_field_alloc() - ASoC: sti: use managed regmap_field allocations - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - atm: fore200e: fix use-after-free in tasklets during device removal - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - atm: lec: fix use-after-free in sock_def_readable() - audit: add fchmodat2() to change attributes class - audit: add missing syscalls to read class - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - audit: fix incorrect inheritable capability in CAPSET records - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - auxdisplay: arm-charlcd: fix release_mem_region() size - auxdisplay: line-display: fix OOB read on zero-length message_store() - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - batman-adv: Avoid double-rtnl_lock ELP metric worker - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: clear current gateway during teardown - batman-adv: dat: handle forward allocation error - batman-adv: dat: prevent false sharing between VLANs - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: fix fragment reassembly length accounting - batman-adv: fix integer overflow on buff_pos - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: hold claim backbone gateways by reference - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: mcast: fix use-after-free in orig_node RCU release - batman-adv: prevent ELP transmission interval underflow - batman-adv: reject new tp_meter sessions during teardown - batman-adv: reject oversized global TT response buffers - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: stop tp_meter sessions during mesh teardown - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: tp_meter: keep unacked list in ascending ordered - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tt: fix negative last_changeset_len - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tt: prevent TVLV entry number overflow - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tt: track roam count per VID - batman-adv: tvlv: abort OGM send on tvlv append failure - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: v: stop OGMv2 on disabled interface - bcache: fix cached_dev.sb_bio use-after-free and crash - bcache: fix uninitialized closure object - binder: don't use %pK through printk - binfmt_misc: restore write access before closing files opened by open_exec() - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - blk-cgroup: fix UAF in __blkcg_rstat_flush() - blk-cgroup: wait for blkcg cleanup before initializing new disk - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - blktrace: fix __this_cpu_read/write in preemptible context - block: add pgmap check to biovec_phys_mergeable - block: relax pgmap check in bio_add_page for compatible zone device pages - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: bnep: reject short frames before parsing - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events - Bluetooth: btmtk: add the function to get the fw name - Bluetooth: btmtk: fix urb->setup_packet leak in error paths - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btmtk: validate WMT event SKB length before struct access - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: btusb: Allow firmware re-download when version matches - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - Bluetooth: hci_conn: fix potential UAF in create_big_sync - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - Bluetooth: hci_ll: Fix firmware leak on error path - Bluetooth: hci_qca: Cleanup on all setup failures - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - Bluetooth: hci_sync: Fix hci_le_create_conn_sync - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - Bluetooth: HIDP: Fix possible UAF - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - Bluetooth: ISO: Fix defer tests being unstable - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU - Bluetooth: MGMT: Fix backward compatibility with userspace - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: MGMT: validate LTK enc_size on load - Bluetooth: MGMT: validate mesh send advertising payload length - Bluetooth: qca: fix ROM version reading on WCN3998 chips - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - Bluetooth: serialize accept_q access - Bluetooth: SMP: derive legacy responder STK authentication from MITM state - Bluetooth: SMP: force responder MITM requirements before building the pairing response - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy - Bluetooth: virtio_bt: clamp rx length before skb_put - Bluetooth: virtio_bt: validate rx pkt_type header length - bnxt_en: Fix NULL pointer dereference - bonding: 3ad: implement proper RCU rules for port->aggregator - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - bonding: add support for per-port LACP actor priority - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - bonding: fix NULL pointer dereference in actor_port_prio setting - bonding: fix use-after-free due to enslave fail after slave array update - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - bonding: only set speed/duplex to unknown, if getting speed failed - bonding: print churn state via netlink - bonding: refuse to enslave CAN devices - bpf: Add CHECKSUM_COMPLETE to bpf test progs - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf, arm64: Fix off-by-one in check_imm signed range check - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - bpf, devmap: Remove unnecessary if check in for loop - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks - bpf: export bpf_link_inc_not_zero. - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf: fix end-of-list detection in cgroup_storage_get_next_key() - bpf: Fix NULL deref in map_kptr_match_type for scalar regs - bpf: Fix OOB in pcpu_init_value - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf: Fix RCU stall in bpf_fd_array_map_clear() - bpf: Fix regsafe() for pointers to packet - bpf: Fix stack-out-of-bounds write in devmap - bpf: Fix stale offload->prog pointer after constant blinding - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN - bpf: Forget ranges when refining tnum after JSET - bpf: Free reuseport cBPF prog after RCU grace period. - bpf: handle fake register spill to stack with BPF_ST_MEM instruction - bpf: preserve constant zero when doing partial register restore - bpf: preserve STACK_ZERO slots on partial reg spills - bpf: reject direct access to nullable PTR_TO_BUF pointers - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - bpf: Reject sleepable kprobe_multi programs at attach time - bpf: Release module BTF IDR before module unload - bpf: Remove mark_precise_scalar_ids() - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - bpf, sockmap: Fix af_unix iter deadlock - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix FIONREAD for sockmap - bpf, sockmap: Fix incorrect copied_seq calculation - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - bpf, sockmap: Take state lock for af_unix iter - bpf: support non-r10 register spill/fill to/from stack in precision tracking - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpftool: Fix truncated netlink dumps - bpf: track aligned STACK_ZERO cases as imprecise spilled registers - bpf: Track equal scalars history on per-instruction level - bpf: use kvfree() for replaced sysctl write buffer - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path - bpf: verifier improvement in 32bit shift sign extension pattern - bridge: br_nd_send: linearize skb before parsing ND options - bridge: br_nd_send: validate ND option lengths - bridge: mcast: Fix a possible use-after-free when removing a bridge port - btrfs: abort transaction on failure to update root in the received subvol ioctl - btrfs: add raid stripe tree definitions - btrfs: add support for inserting raid stripe extents - btrfs: always fallback to buffered write if the inode requires checksum - btrfs: continue trimming remaining devices on failure - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: do not strictly require dirty metadata threshold for metadata writepages - btrfs: don't take device_list_mutex when querying zone info - btrfs: fix block_group_tree dirty_list corruption - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - btrfs: fix double free in create_space_info() error path - btrfs: fix double free in create_space_info_sub_group() error path - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - btrfs: fix leak of kobject name for sub-group space_info - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: fix NULL dereference on root when tracing inode eviction - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix super block offset in error message in btrfs_validate_super() - btrfs: fix the qgroup data free range for inline data extents - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: handle user interrupt properly in btrfs_trim_fs() - btrfs: log new dentries when logging parent dir of a conflicting inode - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - btrfs: move btrfs_crc32c_final into free-space-cache.c - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: qgroup: return correct error when deleting qgroup relation item - btrfs: read raid stripe tree from disk - btrfs: reject root items with drop_progress and zero drop_level - btrfs: remove btrfs_crc32c wrapper - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() - btrfs: replace BUG() with error handling in __btrfs_balance() - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - Buffer overflow in drivers/xen/sys-hypervisor.c - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - bus: fsl-mc: fix use-after-free in driver_override_show() - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions - bus: omap-ocp2scp: Convert to platform remove callback returning void - bus: omap-ocp2scp: fix OF populate on driver rebind - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - cache: enforce cache groups - can: bcm: fix locking for bcm_op runtime updates - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - can: gs_usb: gs_can_open(): always configure bitrates before starting device - can: gw: fix OOB heap access in cgw_csum_crc8_rel() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - can: mcp251x: add error handling for power enable in open and resume - can: mcp251x: fix deadlock in error path of mcp251x_open - can: raw: fix ro->uniq use-after-free in raw_rcv() - can: statistics: add missing atomic access in hot path - can: ucan: fix devres lifetime - can: ucan: Fix infinite loop from zero-length messages - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - cdc-acm: new quirk for EPSON HMD - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - ceph: fix a buffer leak in __ceph_setxattr() - ceph: fix i_nlink underrun during async unlink - ceph: fix memory leaks in ceph_mdsc_build_path() - ceph: only d_add() negative dentries when they are unhashed - ceph: supply snapshot context in ceph_uninline_data() - ceph: supply snapshot context in ceph_zero_partial_object() - cgroup/cpuset: Reset DL migration state on can_attach() failure - cgroup: fix race between task migration and iteration - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - char: tpm: cr50: Remove IRQF_ONESHOT - checkpatch: add support for Assisted-by tag - cifs: abort open_cached_dir if we don't request leases - cifs: change_conf needs to be called for session setup - cifs: Fix busy dentry used after unmounting - cifs: Fix locking usage for tcon fields - cifs: make default value of retrans as zero - cifs: open files should not hold ref on superblock - cifs: some missing initializations on replay - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: imx: imx8-acm: fix flags for acm clocks - clk: mediatek: Fix error handling in runtime PM setup - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: microchip: core: correct return value on *_get_parent() - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: dispcc-sc7180: Add missing MDSS resets - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - clk: qoriq: avoid format string warning - clk: renesas: rzg2l: Fix intin variable size - clk: renesas: rzg2l: Select correct div round macro - clk: rk808: fix OF node reference imbalance - clk: tegra: tegra124-emc: fix device leak on set_rate() - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - clk: visconti: pll: initialize clk_init_data to zero - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clocksource/drivers/sh_tmu: Always leave device running after probe - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clsact: Fix use-after-free in init/destroy rollback asymmetry - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: dt2815: add hardware detection to prevent crash - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - coresight: etm3x: Fix cpulocked warning on cpuhp - counter: Fix refcount leak in counter_alloc() error path - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - cpufreq: conservative: Reset requested_freq on limits change - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - cpuidle: powerpc: avoid double clear when breaking snooze - cpuidle: Skip governor when only one idle state is available - cpuset: Fix missing adaptation for cpuset_is_populated - crypto: af_alg - Cap AEAD AD length to 0x80000000 - crypto: af-alg - fix NULL pointer dereference in scatterwalk - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - crypto: algif_aead - Fix minimum RX size check for decryption - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel - Remove cfb and ofb - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - reject short ahash digests during instance creation - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: caam - fix DMA corruption on long hmac keys - crypto: caam - fix overflow on long hmac keys - crypto: caam - guard HMAC key hex dumps in hash_digest_key - crypto: cavium - fix dma_free_coherent() size - crypto: ccp - Add an S4 restore flow - crypto: ccp - copy IV using skcipher ivsize - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed - crypto: ccp - Factor out ring destroy handling to a helper - crypto: ccp - Move direct access to some PSP registers out of TEE - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: hisilicon/qm - move the barrier before writing to the mailbox register - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable - crypto: hisilicon/trng - modifying the order of header files - crypto: hisilicon/trng - support tfms sharing the device - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function - crypto: hisilicon/zip - remove zlib and gzip - crypto: hisilicon/zip - support deflate algorithm - crypto: jitterentropy - replace long-held spinlock with mutex - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - crypto: nx - fix context leak in nx842_crypto_free_ctx - crypto: nx - Migrate to scomp API - crypto: octeontx - fix dma_free_coherent() size - crypto: pcrypt - Fix handling of MAY_BACKLOG requests - crypto: qat - fix warning on adf_pfvf_pf_proto.c - crypto: qat - remove unused character device and IOCTLs - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - use swab32 macro - crypto: sa2ul - Fix AEAD fallback algorithm names - crypto: scatterwalk - Backport memcpy_sglist() - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - rename first/last to first_desc/last_desc - crypto: testmgr - Hide ENOENT errors - crypto: testmgr - Hide ENOENT errors better - cxl: Fix premature commit_end increment on decoder commit failure - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - dcache: Limit the minimal number of bucket to two - debugfs: check for NULL pointer in debugfs_create_str() - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - device property: Allow secondary lookup in fwnode_get_next_child_node() - device property: Make modifications of fwnode "flags" thread safe - device property: set fwnode->secondary to NULL in fwnode_init() - dev_printk: add new dev_err_probe() helpers - devres: fix missing node debug info in devm_krealloc() - Disable -Wattribute-alias for clang-23 and newer - dlm: prevent NPD when writing a positive value to event_done - dma-buf: Include ioctl.h in UAPI header - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - dmaengine: idxd: Fix crash when the event log is disabled - dmaengine: idxd: Fix freeing the allocated ida too late - dmaengine: idxd: Fix leaking event log memory - dmaengine: idxd: Fix memory leak when a wq is reset - dmaengine: idxd: Fix not releasing workqueue on .release() - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dma-mapping: add missing `inline` for `dma_free_attrs` - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - dm cache: fix concurrent write failure in passthrough mode - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: fix missing return in invalidate_committed's error path - dm cache: fix null-deref with concurrent writes in passthrough mode - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache metadata: fix memory leak on metadata abort retry - dm cache policy smq: check allocation under invalidate lock - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: support shrinking the origin device - dm: clear cloned request bio pointer when last clone bio completes - dm: don't report warning when doing deferred remove - dm: fix a buffer overflow in ioctl processing - dm init: ensure device probing has finished in dm-mod.waitfor= - dm-integrity: fix a typo in the code for write/discard race - dm-integrity: fix recalculation in bitmap mode - dm log: fix out-of-bounds write due to region_count overflow - dm mirror: fix integer overflow in create_dirty_log() - dm mpath: make pg_init_delay_msecs settable - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - dm-thin: fix metadata refcount underflow - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm: use bio_clone_blkg_association - dm-verity: correctly handle dm_bufio_client_create() failure - dm-verity: disable recursive forward error correction - dm-verity-fec: correctly reject too-small FEC devices - dm-verity-fec: correctly reject too-small hash devices - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - docs: fix WARNING document not included in any toctree - Documentation: fix a hugetlbfs reservation statement - Documentation: ioctl-number: Extend "Include File" column width - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - Documentation: trace: Refactor toctree - Documentation: tracing: Add PCI tracepoint documentation - Documentation: tracing: Add ring-buffer mapping - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2-switch: do not clear any interrupts automatically - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - drbd: Balance RCU calls in drbd_adm_dump_devices() - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - drbd: fix null-pointer dereference on local read error - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value - driver core: Don't let a device probe until it's ready - driver core: generalize driver_override in struct device - driver core: platform: use generic driver_override infrastructure - driver core: reject devices with unregistered buses - drivers/base/memory: fix memory block reference leak in poison accounting - drivers/base/memory: set mem->altmap after successful device registration - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - drivers: iio: mpu3050: use dev_err_probe for regulator request - drm: Account property blob allocations to memcg - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - drm/amd/display: Allow DCE link encoder without AUX registers - drm/amd/display: Avoid updating surface with the same surface under MPO - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - drm/amd/display: Do not skip unrelated mode changes in DSC validation - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - drm/amd/display: Fix integer overflow in bios_get_image() - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - drm/amd/display: Remove conditional for shaper 3DLUT power-on - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amd: Drop special case for yellow carp without discovery - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() - drm/amdgpu: Add basic validation for RAS header - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdgpu: Add default case in DVI mode validation - drm/amdgpu: Add HAINAN clock adjustment - drm/amdgpu: add support for HDP IP version 6.1.1 - drm/amdgpu: Adjust usleep_range in fence wait - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - drm/amdgpu: fix spelling typos - drm/amdgpu: Fix use-after-free race in VM acquire - drm/amdgpu: fix zero-size GDS range init on RDNA4 - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu/gmc9.0: add bounds checking for cid - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn3: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu: zero-initialize GART table on allocation - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix debug watchpoints for logical devices - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - drm/amdkfd: fix NULL dereference in get_queue_ids() - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2) - drm/amd: Set num IP blocks to 0 if discovery fails - drm/arcpgu: fix device node leak - drm/ast: dp501: Fix initialization of SCU2C - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - drm/bridge: it66121: acquire reset GPIO in probe - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: samsung-dsim: Fix memory leak in error path - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/display/dp_mst: Add protection against 0 vcpi - drm/dp: Add eDP 1.5 bit definition - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup - drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/hyperv: validate resolution_count and fix WIN8 fallback - drm/hyperv: validate VMBus packet size in receive callback - drm/i915/acpi: free _DSM package when no connectors - drm/i915: Constify watermark state checker - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Fix potential overflow of shmem scatterlist length - drm/i915: Fix potential UAF in TTM object purge - drm/i915/gem: Fix phys BO pread/pwrite with offset - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - drm/i915/gt: Check set_default_submission() before deferencing - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/i915/psr: Do not use pipe_src as borders for SU area - drm/i915/psr: Read Intel DPCD workaround register - drm/i915: Simplify watermark state checker calling convention - drm/i915: skip __i915_request_skip() for already signaled requests - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - drm/i915/wm: Verify the correct plane DDB entry - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - drm/ioc32: stop speculation on the drm_compat_ioctl path - drm/komeda: fix integer overflow in AFBC framebuffer size check - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() - drm/msm/a2xx: fix pixel shader start on A225 - drm/msm/a6xx: Fix HLSQ register dumping - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - drm/msm/dpu: fix mismatch between power and frequency - drm/msm/dsi: add the missing parameter description - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - drm/msm/dsi: don't dump registers past the mapped region - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm: Fix dma_free_attrs() buffer size - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/shrinker: Fix can_block() logic - drm/msm/snapshot: fix dumping of the unaligned regions - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/radeon: Add HAINAN clock adjustment - drm/radeon: add missing revision check for CI - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm: Remove plane hsub/vsub alignment requirement for core helpers - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - drm/solomon: Fix page start when updating rectangle in page addressing mode - drm/ssd130x: Replace .page_height field in device info with a constant - drm/ssd130x: Store the HW buffer in the driver-private CRTC state - drm/ssd130x: Use bool for ssd130x_deviceinfo flags - drm/sun4i: backend: fix error pointer dereference - drm/sun4i: Fix resource leaks - drm/sysfb: ofdrm: fix PCI device reference leaks - drm/tegra: dsi: fix device leak on probe - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used - drm/v3d: Reject empty multisync extension to prevent infinite loop - drm/v3d: Set DMA segment size to avoid debug warnings - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: fix krealloc() memory leak - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: platform_get_irq_byname() returns an int - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Release runtime PM reference after binding V3D - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - drm/virtio: Fix driver removal with disabled KMS - drm/virtio: use uninterruptible resv lock for plane updates - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - dt-bindings: connector: add pd-disable dependency - dt-bindings: gpio: fix microchip #interrupt-cells - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - dt-bindings: net: Fix Tegra234 MGBE PTP clock - e1000: check return value of e1000_read_eeprom - e1000/e1000e: Fix leak in DMA error cleanup - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - e1000e: Unroll PTP in probe error handling - EDAC/altera: Remove IRQF_ONESHOT - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/mc: Fix error path ordering in edac_mc_alloc() - efi: Allocate runtime workqueue before ACPI init - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - EFI/CPER: don't dump the entire memory region - EFI/CPER: don't go past the ARM processor CPER record buffer - efi: Fix reservation of unaccepted memory table - erofs: add GFP_NOIO in the bio completion if needed - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - erofs: fix the out-of-bounds nameoff handling for trailing dirents - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() - err.h: use __always_inline on all error pointer helpers - esp: fix skb leak with espintcp and async crypto - eth: bnxt: always recalculate features after XDP clearing, fix null-deref - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - eventfs: Hold eventfs_mutex and SRCU when remount walks events - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - eventpoll: defer struct eventpoll free to RCU grace period - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: Fix integer overflow in ep_loop_check_proc() - eventpoll: kill __ep_remove() - eventpoll: move epi_fget() up - eventpoll: rename ep_remove_safe() back to ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - exfat: fix potential use-after-free in exfat_find_dir_entry() - exit: prevent preemption of oopsing TASK_DEAD task - exit: Sleep at TASK_IDLE when waiting for application core dump - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - ext4: always allocate blocks only from groups inode can use - ext4: always drain queued discard work in ext4_mb_release() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: avoid infinite loops caused by residual data - ext4: convert bd_bitmap_page to bd_bitmap_folio - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert inline data to extents when truncate exceeds inline size - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - ext4: don't cache extent during splitting extent - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: drop extent cache when splitting extent fails - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - ext4: fix dirtyclusters double decrement on fs shutdown - ext4: fix e4b bitmap inconsistency reports - ext4: fix fsync(2) for nojournal mode - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix journal credit check when setting fscrypt context - ext4: fix memory leak in ext4_ext_shift_extents() - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix stale xarray tags after writeback - ext4: fix the might_sleep() warnings in kvfree() - ext4: fix use-after-free in update_super_work when racing with umount - ext4: get rid of ppath in ext4_convert_unwritten_extents_endio() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in ext4_find_extent() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_split_extent_at() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: mark group add fast-commit ineligible - ext4: mark group extend fast-commit ineligible - ext4: move ext4_percpu_param_init() before ext4_mb_init() - ext4: publish jinode after initialization - ext4: reject mount if bigalloc with s_first_data_block != 0 - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio - ext4: subdivide EXT4_EXT_DATA_VALID1 - ext4: use optimized mballoc scanning regardless of inode format - ext4: validate p_idx bounds in ext4_ext_correct_indexes - extcon: ptn5150: handle pending IRQ events during system resume - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: fix incorrect file address mapping when inline inode is unwritten - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix out-of-bounds access in sysfs attribute read/write - f2fs: fix to add gc count stat in f2fs_gc_range - f2fs: fix to avoid mapping wrong physical block for swapfile - f2fs: fix to avoid memory leak in f2fs_rename() - f2fs: fix to avoid migrating empty section - f2fs: fix to avoid UAF in f2fs_write_end_io() - f2fs: fix to detect potential corrupted nid in free_nid_list - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - f2fs: fix to round down start offset of fallocate for pin file - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - f2fs: fix zoned block device information initialization - f2fs: keep atomic write retry from zeroing original data - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: validate compress cache inode only when enabled - f2fs: zone: fix to avoid inconsistence in between SIT and SSA - fanotify: fix false positive on permission events - fat: avoid parent link count underflow in rmdir - fbcon: Avoid OOB font access if console rotation fails - fbcon: check return value of con2fb_acquire_newinfo() - fbcon: Remove struct fbcon_display.inverse - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - fbdev: fix use-after-free in store_modes() - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: offb: fix PCI device reference leak on probe failure - fbdev: rivafb: fix divide error in nv3_arb() - fbdev: smscufx: properly copy ioctl memory to kernelspace - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - file: add fput() cleanup helper - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_scpi: Fix device_node reference leak in probe path - firmware: dmi: Correct an indexing error in dmi.h - firmware: google: framebuffer: Do not mark framebuffer as busy - firmware: google: framebuffer: Do not unregister platform device - fix it87_wdt early reboot by reporting running timer - flow_dissector: do not dissect PPPoE PFC frames - fork: defer linking file vma until vma is fully initialized - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - fpga: of-fpga-region: Fail if any bridge is missing - fpga: region: fix use-after-free in child_regions_with_firmware() - fs: add for 'init_fs' - fs/adfs: validate nzones in adfs_validate_bblk() - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - fs/nfs: Fix readdir slow-start regression - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs: ntfs3: check return value of indx_find to avoid infinite loop - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - fs/ntfs3: validate rec->used in journal-replay file record check - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - fs: prepare for adding LSM blob to backing_file - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Update the mcount_loc check of skipped entries - fuse: Check for large folio with SPLICE_F_MOVE - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fuse: quiet down complaints in fuse_conn_limit_write - fuse: reject fuse_notify() pagecache ops on directories - fuse: reject oversized dirents in page cache - fuse: re-lock request before replacing page cache folio - futex: Clear stale exiting pointer in futex_lock_pi() retry path - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - genetlink: Use internal flags for multicast groups - gfs2: Add metapath_dibh helper - gfs2: add some missing log locking - gfs2: Call unlock_new_inode before d_instantiate - gfs2: fiemap page fault fix - gfs2: Fix unlikely race in gdlm_put_lock - gfs2: fix use-after-free in gfs2_qd_dealloc - gfs2: Fix use-after-free in iomap inline data write path - gfs2: Improve gfs2_consist_inode() usage - gfs2: prevent NULL pointer dereference during unmount - gfs2: Retries missing in gfs2_{rename,exchange} - gfs2: Validate i_depth for exhash directories - gpio: aspeed-sgpio: Change the macro to support deferred probe - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: acpi: Fix gpio count with string references - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - gpio: mvebu: fix NULL pointer dereference in suspend/resume - gpio: mxc: fix irq_high handling - gpio: mxc: map Both Edge pad wakeup to Rising Edge - gpio: of: clear OF_POPULATED on hog nodes in remove path - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - gpio: sprd: Change sprd_gpio lock to raw_spin_lock - gpio: tegra: fix irq_release_resources calling enable instead of disable - gro: change the BUG_ON() in gro_pull_from_frag0() - gve: defer interrupt enabling until NAPI registration - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - hdlc_ppp: sync per-proto timers before freeing hdlc state - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - hfsplus: fix volume corruption issue for generic/498 - hfsplus: pretend special inodes as regular files - hfsplus: return error when node already exists in hfs_bnode_create - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - HID: alps: fix NULL pointer dereference in alps_raw_event() - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - HID: apple: avoid memory leak in apple_report_fixup() - HID: asus: add xg mobile 2023 external hardware support - HID: asus: avoid memory leak in asus_report_fixup() - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - HID: core: Add printk_ratelimited variants to hid_warn() etc - HID: core: clamp report_size in s32ton() to avoid undefined shift - HID: core: Fix size_t specifier in hid_report_raw_event() - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: hid-pl: handle probe errors - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() - HID: magicmouse: Do not crash on missing msc->input - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - HID: mcp2221: cancel last I2C command on read error - HID: multitouch: add eGalaxTouch EXC3188 support - HID: multitouch: Check to ensure report responses match the request - HID: pass the buffer size to hid_report_raw_event - HID: playstation: Add missing check for input_ff_create_memless - HID: playstation: Clamp num_touch_reports - HID: prodikeys: Check presence of pm->input_ep82 - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - HID: quirks: really enable the intended work around for appledisplay - HID: roccat: fix use-after-free in roccat_report_event - HID: uclogic: Fix regression of input name assignment - HID: usbhid: fix deadlock in hid_post_reset() - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - hisi_acc_vfio_pci: update status after RAS error - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimer: Fix trace oddity - hrtimer: Reduce trace noise in hrtimer_start() - hrtimers: Update the return type of enqueue_hrtimer() - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - hv_sock: fix ARM64 support - hv: utils: handle and propagate errors in kvp_register - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - hwmon: (aht10) Add support for dht20 - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (axi-fan-control) Make use of dev_err_probe() - hwmon: (axi-fan-control) Use device firmware agnostic API - hwmon: axi-fan: don't use driver_override as IRQ name - hwmon: (corsair-psu) Close HID device on probe errors - hwmon: (f71882fg) Add F81968 support - hwmon: (it87) Check the it87_lock() return value - hwmon: (ltc2992) Clamp threshold writes to hardware range - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - hwmon: (occ) Fix division by zero in occ_show_power_1() - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - hwmon: (pmbus/core) Protect regulator operations with mutex - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - hwmon: (pxe1610) Check return value of page-select write in probe - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - i2c: s3c24xx: check the size of the SMBUS message before using it - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: stub: Reject I2C block transfers with invalid length - i2c: tegra: Don't mark devices with pins as IRQ safe - i2c: tegra: Fix NOIRQ suspend/resume - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - i3c: dw: Initialize spinlock to avoid upsetting lockdep - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - i3c: master: Update hot-join flag only on success - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - i3c: Move device name assignment after i3c_bus_init - i40e: Cleanup PTP pins on probe failure - i40e: don't advertise IFF_SUPP_NOFCS - i40e: Fix preempt count leak in napi poll tracepoint - i40e: fix registering XDP RxQ info - i40e: fix src IP mask checks and memcpy argument names in cloud filter - i40e: use xdp.frame_sz as XDP RxQ info frag_size - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: fix VLAN filter lost on add/delete race - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - iavf: stop removing VLAN filters from PF on interface down - iavf: wait for PF confirmation before removing VLAN filters - IB/cache: update gid cache on client reregister event - IB/core: Fix zero dmac race in neighbor resolution - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - ibmveth: Disable GSO for packets with small MSS - ice: fix double-free of tx_buf skb - ice: fix locking in ice_dcb_rebuild() - ice: Fix memory leak in ice_set_ringparam() - ice: fix NULL pointer dereference in ice_reset_all_vfs() - ice: fix retry for AQ command 0x06EE - ice: fix setting promisc mode while adding VID filter - ice: fix VF queue configuration with low MTU values - ice: reintroduce retry mechanism for indirect AQ - ice: Remove jumbo_remove step from TX path - ice: use ice_update_eth_stats() for representor stats - icmp: fix NULL pointer dereference in icmp_tag_validation() - icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns - icmp: move icmp_global.credit and icmp_global.stamp to per netns storage - icmp: prevent possible overflow in icmp_global_allow() - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - igc: fix missing update of skb->tail in igc_xmit_frame() - iio: accel: fix ADXL355 temperature signature value - iio: adc: ad7768-1: fix one-shot mode data acquisition - iio: adc: npcm: Convert to platform remove callback returning void - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: ti-adc161s626: fix buffer read on big-endian - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - iio: buffer: Fix wait_queue not being removed - iio: buffer: hw-consumer: fix use-after-free in error path - iio: chemical: bme680: Fix measurement wait duration calculation - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: common: st_sensors: Fix use of uninitialize device structs - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: ad5686: fix ref bit initialization for single-channel parts - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: dac: ds4424: reject -128 RAW value - iio: dac: max5821: fix return value check in powerdown sync - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: gyro: adis16260: fix division by zero in write_raw - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: gyro: itg3200: Fix unchecked return value in read_raw - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - iio: imu: inv_icm42600: fix odr switch to the same value - iio: imu: inv_icm42600: fix odr switch when turning buffer off - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: light: bh1780: fix PM runtime leak on error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: light: vcnl4035: fix scan buffer on big-endian - iio: magnetometer: Remove IRQF_ONESHOT - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: pressure: mprls0025pa: fix scan_type struct - iio: sca3000: Fix a resource leak in sca3000_probe() - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: temperature: tsys01: fix broken PROM checksum validation - iio: Use IRQF_NO_THREAD - ima: check return value of crypto_shash_final() in boot aggregate - ima: verify the previous kernel's IMA buffer lies in addressable RAM - include: uapi: netfilter_bridge.h: Cover for musl libc - indirect_call_wrapper: do not reevaluate function pointer - inet: add indirect call wrapper for getfrag() calls - inet: frags: add inet_frag_queue_flush() - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: move icmp_global_{credit,stamp} to a separate cache line - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: elan_i2c - validate firmware size before use - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: synaptics-rmi4 - fix a locking bug in an error path - Input: uinput - fix circular locking dependency with ff-core - Input: uinput - take event lock when submitting FF request "event" - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - Input: xpad - add "Nova 2 Lite" from GameSir - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - fix out-of-bounds access for Share button - iomap: allocate s_dio_done_wq for async reads as well - iomap: don't revert iov_iter on partially completed buffered writes - iomap: fix submission side handling of completion side errors - iomap: reject delalloc mappings during writeback - iommu/amd: move wait_on_sem() out of spinlock - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - iommu/amd: Use atomic64_inc_return() in iommu.c - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - iommufd: Fix a race with concurrent allocation and unmap - iommufd: vfio compatibility extension check for noiommu mode - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - iommu/vt-d: Flush cache for PASID table before using it - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - ionic: fix persistent MAC address override on PF - ionic: Rate limit unknown xcvr type messages - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - io_uring/filetable: clamp alloc_hint to the configured alloc range - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix multishot recv missing EOF on wakeup race - io_uring/poll: fix signed comparison in io_poll_get_ownership() - io_uring/sync: validate passed in offset - io_uring/timeout: check unused sqe fields - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ip6_gre: Use cached t->net in ip6erspan_changelink(). - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - ip6_vti: set netns_immutable on the fallback device. - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipc: don't audit capability check in ipc_permissions() - ipc: limit next_id allocation to the valid ID range - ipc/shm: serialize orphan cleanup with shm_nattch updates - ipmi: Add limits to event and receive message requests - ipmi: Check event message buffer response for bad data - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ipmi: ipmb: initialise event handler read bytes - ipmi:si: Return state to normal if message allocation fails - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - ipmi:ssif: Clean up kthread on errors - ipmi:ssif: Fix a shutdown race - ipmi:ssif: NULL thread on error - ipmi:ssif: Remove unnecessary indention - ipv4: account for fraggap on the paged allocation path - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: fib: Annotate access to struct fib_alias.fa_state. - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - ipv4: icmp: fix null-ptr-deref in icmp_build_probe() - ipv4: icmp: validate reply type before using icmp_pointers - ipv4: igmp: annotate data-races around idev->mr_maxdelay - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - ipv6: account for fraggap on the paged allocation path - ipv6: add NULL checks for idev in SRv6 paths - ipv6/addrconf: annotate data-races around devconf fields (II) - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - ipv6: avoid overflows in ip6_datagram_send_ctl() - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: exthdrs: refresh nh after handling HAO option - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - ipv6: Fix a potential NPD in cleanup_prefix_route() - ipv6: fix a race in ip6_sock_set_v6only() - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - ipv6: Fix out-of-bound access in fib6_add_rt2node(). - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - ipv6: fix possible UAF in icmpv6_rcv() - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() - ipv6: mcast: Fix use-after-free when processing MLD queries - ipv6: prevent possible UaF in addrconf_permanent_addr() - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - ipv6: sit: reload inner IPv6 header after GSO offloads - ipv6: use RCU in ip6_xmit() - ipv6: validate extension header length before copying to cmsg - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - ipvs: clear the svc scheduler ptr early on edit - ipvs: fix MTU check for GSO packets in tunnel mode - ipvs: fix NULL deref in ip_vs_add_service error path - ipvs: skip ipv6 extension headers for csum checks - irqchip/ath79-cpu: Remove unused function - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - ixgbevf: add missing negotiate_features op to Hyper-V ops table - ixgbevf: fix link setup issue - ixgbevf: fix use-after-free in VEPA multicast source pruning - jbd2: gracefully abort on checkpointing state corruptions - jfs: Add missing set_freezable() for freezable kthread - jfs: nlink overflow in jfs_rename - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - kbuild: Add objtool to top-level clean target - kbuild: Leave objtool binary around with 'make clean' - kexec: derive purgatory entry from symbol - KEYS: fix overflow in keyctl_pkey_params_get_2() - keys: Pin request_key_auth payload in instantiate paths - kprobes: avoid crash when rmmod/insmod after ftrace killed - kprobes: Remove unneeded goto - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - ksmbd: add durable scavenger timer - ksmbd: add support for supplementary groups - ksmbd: avoid reclaiming expired durable opens by the client - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: Compare MACs in constant time - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - ksmbd: do not expire session on binding failure - ksmbd: Don't log keys in SMB3 signing and encryption key generation - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - ksmbd: fix null pointer dereference in compare_guid_key() - ksmbd: fix OOB write in QUERY_INFO for compound requests - ksmbd: fix out-of-bounds read in smb_check_perm_dacl() - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - ksmbd: fix use-after-free by using call_rcu() for oplock_info - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - ksmbd: fix use-after-free of share_conf in compound request - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops - ksmbd: reject non-VALID session in compound request branch - ksmbd: replace connection list with hash table - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: require minimum ACE size in smb_check_perm_dacl() - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: unset conn->binding on failed binding request - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: use msleep instaed of schedule_timeout_interruptible() - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: validate EaNameLength in smb2_get_ea() - ksmbd: validate inherited ACE SID length - ksmbd: validate owner of durable handle on reconnect - ksmbd: validate response sizes in ipc_validate_msg() - ktest: Avoid undef warning when WARNINGS_FILE is unset - ktest: Fix the month in the name of the failure directory - ktest: Honor empty per-test option overrides - ktest: Run POST_KTEST hooks on failure and cancellation - kunit: config: Enable KUNIT_DEBUGFS by default - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: tool: copy caller args in run_kernel to prevent mutation - KVM: arm64: Discard PC update state on vcpu reset - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: PMU: Preserve AArch32 counter low bits - KVM: arm64: Remove VPIPT I-cache handling - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION - KVM: SVM: Add a helper to look up the max physical ID for AVIC - KVM: SVM: check validity of VMCB controls when returning from SMM - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated - KVM: VMX: Update SVI during runtime APICv activation - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - KVM: x86: Fix KVM_GET_MSRS stack info leak - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - KVM: x86: Fix shadow paging use-after-free due to unexpected role - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs - KVM: x86: Use scratch field in MMIO fragment to hold small write values - KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - l2tp: Drop large packets with UDP encap - landlock: Fix handling of disconnected directories - leds: lgm-sso: Remove duplicate assignments for priv->mmap - leds: qcom-lpg: Check for array overflow when selecting the high resolution - leds: qcom-lpg: Check the return value of regmap_bulk_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: check xbc_init_node() return in override path - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - libbpf: Fix OOB read in btf_dump_get_bitfield_value - libbpf: Fix -Wdiscarded-qualifiers under C23 - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: define and enforce CEPH_MAX_KEY_LEN - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential out-of-bounds access in osdmap_decode() - libceph: Fix slab-out-of-bounds access in auth message processing - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - libceph: prevent potential out-of-bounds reads in process_message_header() - libceph: reject preamble if control segment is empty - libceph: Use u32 for non-negative values in ceph_monmap_decode() - lib/crypto: chacha: Zeroize permuted_state before it leaves scope - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - lib/scatterlist: fix length calculations in extract_kvec_to_sg - lib/scatterlist: fix temp buffer in extract_user_to_sg() - libsubcmd: Fix null intersection case in exclude_cmds() - lib: test_hmm: evict device pages on file close to avoid use-after-free - lib/ts_kmp: fix integer overflow in pattern length calculation - locking: Fix rwlock support in - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - LoongArch: Add spectre boundry for syscall dispatch table - LoongArch: Add WriteCombine shadow mapping in KASAN - LoongArch: Add writecombine support for DMW-based ioremap() - LoongArch: Disable instrumentation for setup_ptwalker() - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - LoongArch: Give more information if kmem access failed - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE - LoongArch: Prefer top-down allocation after arch_mem_init() - LoongArch: Remove unused code to avoid build warning - LoongArch: Rework KASAN initialization for PTW-enabled systems - LoongArch: Show CPU vulnerabilites correctly - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: vDSO: Emit GNU_EH_FRAME correctly - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - loop: fix partition scan race between udev and loop_reread_partitions() - lsm: add backing_file LSM hooks - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - mac802154: llsec: add skb_cow_data() before in-place crypto - macsec: fix replay protection at XPN lower-PN wrap - macvlan: annotate data-races around port->bc_queue_len_used - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - mailbox: add sanity check for channel array - mailbox: Allow controller specific mapping using fwnode - mailbox: bcm-ferxrm-mailbox: Use default primary handler - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: mailbox-test: don't free the reused channel - mailbox: mailbox-test: free channels on probe error - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: sprd: clear delivery flag before handling TX done - mailbox: sprd: mask interrupts that are not handled - mailbox: Use dev_err when there is error - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use of_property_match_string() instead of open-coding - mctp: i2c: fix skb memory leak in receive path - mctp i2c: initialise event handler read bytes - mctp: route: hold key->lock in mctp_flow_prepare_output() - md/bitmap: fix GPF in write_page caused by resize race - md-cluster: fix NULL pointer dereference in process_metadata_update - md/raid10: fix any_working flag handling in raid10_sync_request - md/raid10: fix deadlock with check operation and nowait requests - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - md/raid1: fix data lost for writemostly rdev - md/raid1,raid10: don't ignore IO flags - md/raid5: fix soft lockup in retry_aligned_read() - md/raid5: validate payload size before accessing journal metadata - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - media: amphion: Fix race between m2m job_abort and device_run - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - media: ccs: Accommodate C-PHY into the calculation - media: ccs: Avoid possible division by zero - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: dvb-core: dmxdevfilter must always flush bufs - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - media: dvb-net: fix OOB access in ULE extension header tables - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - media: i2c: imx412: Assert reset GPIO during probe - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix digital gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c: ov08d10: fix image vertical start setting - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Initialize subdev before controls - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex - media: mediatek: encoder: Fix uninitialized scalar variable issue - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: mediatek: vcodec: fix use-after-free in encoder release path - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - media: omap3isp: drop the use count of v4l2 pipeline - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - media: omap3isp: set initial format - media: pci: zoran: fix potential memory leak in zoran_probe() - media: pvrusb2: fix URB leak in pvr2_send_request_ex - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: radio-keene: fix memory leak in error path - media: rc: fix race between unregister and urb/irq callbacks - media: rc: igorplugusb: fix control request setup packet - media: rc: igorplugusb: heed coherency rules - media: rc: streamzap: Error handling in probe - media: rc: ttusbir: fix inverted error logic - media: rc: ttusbir: respect DMA coherency rules - media: rc: xbox_remote: heed DMA restrictions - media: rkisp1: Fix filter mode register configuration - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - media: saa7164: add ioremap return checks and cleanups - media: solo6x10: Check for out of bounds chip_id - media: staging: imx: request mbus_config in csi_start - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - media: uvcvideo: Enable VB2_DMABUF for metadata stream - media: uvcvideo: Fix allocation for small frame sizes - media: v4l2-async: Fix error handling on steps after finding a match - media: venus: vdec: fix error state assignment for zero bytesused - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: verisilicon: AV1: Fix enable cdef computation - media: verisilicon: AV1: Fix tile info buffer size - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Set IDR flag for intra_only frame type - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - media: vidtv: fix nfeeds state corruption on start_streaming failure - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - media: vidtv: fix pass-by-value structs causing MSAN warnings - memfd: deny writeable mappings when implying SEAL_WRITE - memory: mtk-smi: Convert to platform remove callback returning void - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: tegra124-emc: Fix dll_change check - memory: tegra30-emc: Fix dll_change check - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - mfd: core: Add locking around 'mfd_of_node_list' - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - mfd: wm8350-core: Use IRQF_ONESHOT - minix: Add required sanity checking to minix_check_superblock() - MIPS: Always record SEGBITS in cpu_data.vmbits - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - MIPS: Fix the GCC version check for `__multi3' workaround - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - mips: mm: Allocate tlb_vpn array atomically - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - mips: ralink: update CPU clock index - MIPS: rb532: Fix MMIO UART resource registration - MIPS: Work around LLVM bug when gp is used as global register variable - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: possible double-free of cctx->remote_heap - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mmc: block: use single block write in retry - mmc: core: Avoid bitfield RMW for claim/retune flags - mmc: core: Fix host controller programming for fixed driver type - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - mmc: vub300: fix NULL-deref on disconnect - mm/damon/core: disallow time-quota setting zero esz - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: use time_in_range_open() for damos quota window start - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/ops-common: call folio_test_lru() after folio_get() - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() - mm/highmem: fix __kmap_to_page() build error - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - mm/huge_memory: update file PMD counter before folio_put() - mm/hugetlb: avoid false positive lockdep assertion - mm/hugetlb_cma: round up per_node before logging it - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb() - mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb() - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - mm/kasan: fix double free for kasan pXds - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mm/kfence: fix KASAN hardware tag faults during late enablement - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - mm/mempolicy: fix wrong mmap_read_unlock() in migrate_to_node() - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - mm/page_alloc: clear page->private in free_pages_prepare() - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - mm/tracing: rss_stat: ensure curr is false from kthread context - modpost: Amend ppc64 save/restfpr symnames for -Os build - module: add helper function for reading module_buildid() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - module: Fix kernel panic when a symbol st_shndx is out of bounds - mpls: add missing unregister_netdevice_notifier to mpls_init - mptcp: add-addr: always drop other suboptions - mptcp: allow subflow rcv wnd to shrink - mptcp: cleanup fallback dummy mapping generation - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: do not drop partial packets - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - mptcp: fastclose msk when linger time is 0 - MPTCP: fix lock class name family in pm_nl_create_listen_socket - mptcp: fix missing wakeups in edge scenarios - mptcp: fix receive space timestamp initialization - mptcp: fix retransmission loop when csum is enabled - mptcp: fix rx timestamp corruption on fastopen - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: fix slab-use-after-free in __inet_lookup_established - mptcp: handle first subflow closing consistently - mptcp: introduce the mptcp_init_skb helper - mptcp: pm: ADD_ADDR rtx: allow ID 0 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: fix potential data-race - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: avoid sending RM_ADDR over same subflow - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation - mptcp: pm: in-kernel: always mark signal+subflow endp as used - mptcp: pm: in-kernel: always set ID as avail when rm endp - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: reset rcv wnd on disconnect - mptcp: sockopt: check timestamping ret value - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: sync the msk->sndbuf at accept() time - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use plain bool instead of custom binary enum - mtd: Avoid boot crash in RedBoot partition table parser - mtd: docg3: Convert to platform remove callback returning void - mtd: docg3: fix use-after-free in docg3_release() - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - mtd: physmap_of_gemini: Fix disabled pinctrl state check - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - mtd: rawnand: pl353: Fix software ECC support - mtd: rawnand: pl353: make sure optimal timings are applied - mtd: rawnand: serialize lock/unlock against other NAND operations - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: spinand: Fix kernel doc - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - mtd: spi-nor: sst: Fix SST write failure - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - myri10ge: avoid uninitialized variable use - neighbour: add RCU protection to neigh_tables[] - neigh: let neigh_xmit take skb ownership - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - net: add proper RCU protection to /proc/net/ptype - net: Add skb_dstref_steal and skb_dstref_restore - net: add support for segmenting TCP fraglist GSO packets - net: af_key: zero aligned sockaddr tail in PF_KEY exports - net: ag71xx: check error for platform_get_irq - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - net: annotate data-races around sk->sk_{data_ready,write_space} - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: fix leaking free_bds - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - net: bcmgenet: fix racing timeout handler - net: bcmgenet: increase WoL poll timeout - net: bcmgenet: Initialize u64 stats seq counter - net: bcmgenet: keep RBUF EEE/PM disabled - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: switch to use 64bit statistics - net: bonding: add broadcast_neighbor option for 802.3ad - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - net: bonding: fix NULL deref in bond_debug_rlb_hash_show - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - net: bonding: fix use-after-free in bond_xmit_broadcast() - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: bridge: Flush multicast groups when snooping is disabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net: bridge: use a stable FDB dst snapshot in RCU readers - net: caif: clear client service pointer on teardown - netconsole: avoid out-of-bounds access on empty string in trim_newline() - netconsole: propagate device name truncation in dev_name_store() - net: consume xmit errors of GSO frames - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - netdevsim: zero initialize struct iphdr in dummy sk_buff - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: dsa: microchip: Fix error path in PTP IRQ setup - net: dsa: mt7530: fix FDB entries not aging out with short timeout - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: properly keep track of conduit reference - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - net: enetc: fix the output issue of 'ethtool --show-ring' - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - net: ethernet: xscale: Check for PTP support properly - net: fec: fix pinctrl default state restore order on resume - net: fec: fix the PTP periodic output sysfs interface - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: bpf: defer hook memory release until rcu readers are done - netfilter: bridge: make ebt_snat ARP rewrite writable - netfilter: conntrack: add missing netlink policy validations - netfilter: conntrack_irc: fix possible out-of-bounds read - netfilter: conntrack: remove sprintf usage - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - netfilter: ctnetlink: ensure safe access to master conntrack - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() - netfilter: ctnetlink: ignore explicit helper on new expectations - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: ctnetlink: use netlink policy range checks - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: flowtable: strictly check for maximum number of actions - netfilter: ip6t_eui64: reject invalid MAC header for all packets - netfilter: ip6t_hbh: reject oversized option lists - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() - netfilter: ipset: drop logically empty buckets in mtype_del - netfilter: ipset: stop hash:* range iteration at end - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: nf_conncount: fix tracking of connections from localhost - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - netfilter: nf_conntrack_expect: honor expectation helper field - netfilter: nf_conntrack_expect: skip expectations in other netns via proc - netfilter: nf_conntrack_expect: store netns and zone in expectation - netfilter: nf_conntrack_expect: use expect->helper - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case - netfilter: nf_conntrack_helper: pass helper to expect cleanup - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp - netfilter: nf_conntrack_sip: get helper before allocating expectation - netfilter: nf_log: validate MAC header was set before dumping it - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_log: account for netlink header size - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: nf_tables: always walk all pending catchall elements - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - netfilter: nf_tables: reject immediate NF_QUEUE verdict - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: nf_tables: reset table validation state on abort - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_ct: add seqadj extension for natted connections - netfilter: nft_ct: bail out on template ct in get eval - netfilter: nft_ct: drop pending enqueued packets on removal - netfilter: nft_ct: fix missing expect put in obj eval - netfilter: nft_ct: fix use-after-free in timeout object destroy - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: nft_inner: Fix IPv6 inner_thoff desync - netfilter: nft_osf: restrict it to ipv4 - netfilter: nft_set_hash: fix get operation on big endian - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_tunnel: fix use-after-free on object destroy - netfilter: reject zero shift in nft_bitwise - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: skip recording stale or retransmitted INIT - netfilter: synproxy: add mutex to guard hook reference counting - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: x_tables: ensure names are nul-terminated - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: xtables: restrict several matches to inet family - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - netfilter: x_tables: unregister the templates first - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - netfilter: xt_multiport: validate range encoding in checkentry - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - netfilter: xt_policy: fix strict mode inbound policy matching - netfilter: xt_socket: enable defrag after all other checks - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: xt_time: use unsigned int for monthday bit shift - net: fix fanout UAF in packet_release() via NETDEV_UP race - net: Fix icmp host relookup triggering ip_rt_bug - net: fix segmentation of forwarding fraglist GRO - netfs: fix error handling in netfs_extract_user_iter() - netfs: Fix overrun check in netfs_extract_user_iter() - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net: ftgmac100: fix ring allocation unwind on open failure - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - net: gro: don't merge zcopy skbs - net: gso: fix tcp fraglist segmentation after pull from frag_list - net: guard timestamp cmsgs to real error queue skbs - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix double free issue for tx spare buffer - net: hsr: defer node table free until after RCU readers - net: hsr: fix potential OOB access in supervision frame handling - net: hsr: fix VLAN add unwind on slave errors - net: ifb: report ethtool stats over num_tx_queues - net: intel: fix PCI device ID conflict between i40e and ipw2200 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: fix event ring index not programmed for IPA v5.0+ - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - net: ipv4: stop checking crypto_ahash_alignmask - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: ipv6: flowlabel: defer exclusive option free until RCU teardown - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak - net: ipv6: stop checking crypto_ahash_alignmask - net/iucv: fix locking in .getsockopt - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - netlabel: validate unlabeled address and mask attribute lengths - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: lan966x: avoid unregistering netdev on register failure - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - net: libwx: fix VF illegal register access - net: macb: fix clk handling on PCI glue driver removal - net: macb: Fix tx/rx malfunction after phy link down and up - net: macb: fix uninitialized rx_fs_lock - net: macb: fix use-after-free access to PTP clock - net: macb: Introduce gem_init_rx_ring() - net: macb: Move devm_{free,request}_irq() out of spin lock area - net: macb: properly unregister fixed rate clocks - net: macb: queue tie-off or disable during WOL suspend - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume - net: macb: Shuffle the tx ring before enabling tx - net: macb: Use dev_consume_skb_any() to free TX SKBs - net: macb: use the current queue number for stats - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: mana: fix use-after-free in add_adev() error path - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown - net: mana: Ring doorbell at 4 CQ wraparounds - net: mana: validate rx_req_idx to prevent out-of-bounds array access - net: mctp: ensure our nlmsg responses are initialised - net: mctp: fix don't require received header reserved bits to be zero - net: mctp i2c: check length before marking flow active - net: mctp-i2c: fix duplicate reception of old data - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - net/mlx5: Avoid "No data available" when FW version queries fail - net/mlx5: Do not restore destination-less TC rules - net/mlx5: DR, Fix circular locking dependency in dump - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5e: Fix features not applied during netdev registration - net/mlx5e: Fix race condition during IPSec ESN update - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Prevent concurrent access to IPSec ASO context - net/mlx5: Fix deadlock between devlink lock and esw->wq - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: Fix multiport device check over light SFs - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/mlx5: IFC updates for disabled host PF - net/mlx5: lag: Check for LAG device before creating debugfs - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net/mlx5: Query to see if host PF is disabled - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - net/mlx5: Update the list of the PCI supported devices - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mv643xx: fix OF node refcount - net: mvpp2: Add metadata support for xdp mode - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - net: mvpp2: limit XDP frame size to the RX buffer - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: sync RX data at the hardware packet offset - net: ncsi: fix skb leak in error paths - net: netconsole: move newline trimming to function - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - net: nfc: nci: Fix parameter validation for packet data - net: nfc: nci: Fix zero-length proprietary notifications - netns-ipv4: reorganize netns_ipv4 fast path variables - net: openvswitch: Avoid releasing netdev before teardown completes - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - net: phonet: free phonet_device after RCU grace period - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: phy: clean the sfp upstream if phy probing fails - net: phy: dp83869: fix setting CLK_O_SEL field. - net: phy: DP83TC811: add reading of abilities - net: phy: move at803x PHY driver to dedicated directory - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: qrtr: ns: Fix use-after-free in driver remove() - net: qrtr: ns: Free the node during ctrl_cmd_bye() - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: qrtr: ns: Limit the total number of nodes - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - net: rds: clear i_sends on setup unwind - net/rds: Clear reconnect pending bit - net/rds: Fix circular locking dependency in rds_tcp_tune - net: rds: fix MR cleanup on copy error - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - net/rds: handle zerocopy send cleanup before the message is queued - net/rds: No shortcut out of RDS_CONN_ERROR - net/rds: Optimize rds_ib_laddr_check - net/rds: rds_sendmsg should not discard payload_len - net/rds: reset op_nents when zerocopy page pin fails - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: zero per-item info buffer before handing it to visitors - net: remove WARN_ON_ONCE when accessing forward path array - net: rfkill: prevent unlimited numbers of rfkill events from being created - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: sched: act_csum: validate nested VLAN headers - net/sched: act_ct: Only release RCU read lock after ct_ft - net/sched: act_gate: snapshot parameters with RCU on replace - net/sched: act_ife: Fix metalist update behavior - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - net/sched: cls_flower: revert unintended changes - net/sched: cls_flow: fix NULL pointer dereference on shared blocks - net/sched: cls_fw: fix NULL dereference of "old" filters before change() - net/sched: cls_fw: fix NULL pointer dereference on shared blocks - net/sched: ets: fix divide by zero in the offload path - net/sched: fix pedit partial COW leading to page cache corruption - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix probability gaps in 4-state loss model - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: validate slot configuration - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/sched: sch_netem: fix out-of-bounds access in packet corruption - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: taprio: fix NULL pointer dereference in class dump - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - net/sched: teql: Fix double-free in teql_master_xmit - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - net: sfp: improve Huawei MA5671a fixup - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net: skb: fix cross-cache free of KFENCE-allocated skb head - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - net: skbuff: fix pskb_carve leaking zcopy pages - net: skbuff: preserve shared-frag marker during coalescing - net: skbuff: propagate shared-frag marker through frag-transfer helpers - net: skmsg: preserve sg.copy across SG transforms - net/smc: avoid early lgr access in smc_clc_wait_msg - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - net/smc: Do not re-initialize smc hashtables - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - net: sparx5/lan969x: fix PTP clock max_adj value - net: stmmac: avoid shadowing global buf_sz - net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz - net: stmmac: Fix error handling in VLAN add and delete paths - net: stmmac: fix integer underflow in chain mode - net: stmmac: Fix PTP ref clock for Tegra234 - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: remove support for lpi_intr_o - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: strparser: fix skb_head leak in strp_abort_strp() - net: sunhme: Fix sbus regression - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers - net: tcp: accept old ack during closing - net/tcp-md5: Fix MAC comparison to be constant-time - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net: tls: fix strparser anchor skb leak on offload RX setup failure - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption - net: tls: prevent chain-after-chain in plain text SG - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - net: txgbe: fix firmware version check - net: txgbe: fix RTNL assertion warning when remove module - net: txgbe: leave space for null terminators on property_entry - net: usb: aqc111: Do not perform PM inside suspend callback - net: usb: catc: enable basic endpoint checking - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - net: usb: kalmia: validate USB endpoints - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode - net: usb: kaweth: validate USB endpoints - net: usb: lan78xx: fix silent drop of packets with checksum errors - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: pegasus: enable basic endpoint checking - net: usb: pegasus: validate USB endpoints - net: usb: r8152: add TRENDnet TUC-ET2G - net: usb: r8152: fix transmit queue timeout - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: sr9700: remove code to drive nonexistent multicast filter - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - nexthop: fix IPv6 route referencing IPv4 nexthop - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - nfc: hci: fix out-of-bounds read in HCP header parsing - nfc: hci: shdlc: Stop timers and work before freeing context - nfc: llcp: add missing return after LLCP_CLOSED checks - nfc: llcp: Fix use-after-free in llcp_sock_release() - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: complete pending data exchange on device close - nfc: nci: fix circular locking dependency in nci_close_device - nfc: nci: free skb on nci_transceive early error paths - NFC: nxp-nci: allow GPIOs to sleep - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems - nfc: nxp-nci: remove interrupt trigger type - nfc: pn533: allocate rx skb before consuming bytes - NFC: pn533: bound the UART receive buffer - nfc: pn533: properly drop the usb interface reference on disconnect - nfc: rawsock: cancel tx_work before socket teardown - nfc: s3fwrn5: allocate rx skb before consuming bytes - NFC: trf7970a: Ignore antenna noise when checking for RF field - nfnetlink_osf: validate individual option lengths in fingerprints - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - nfsd: check get_user() return when reading princhashlen - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache - nfsd: fix posix_acl leak on SETACL decode failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - NFSD: Fix SECINFO_NO_NAME decode error cleanup - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd - nfsd: never defer requests during idmap lookup - NFS: Fix a deadlock involving nfs_release_folio() - nfs: pass explicit offset/count to trace events - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - NTB: ntb_transport: Fix too small buffer for debugfs_name - ntfs3: add buffer boundary checks to run_unpack() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ntfs: ->d_compare() must not block - nvdimm/bus: Fix potential use after free in asynchronous initialization - nvdimm: virtio_pmem: serialize flush requests - nvme-apple: drop invalid put of admin queue reference count - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme: fix admin queue leak on controller reset - nvme: fix memory allocation in nvme_pr_read_keys() - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nvmem: imx: assign nvmem_cell_info::raw_len - nvmem: layouts: onie-tlv: fix hang on unknown types - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - nvme-pci: cap queue creation to used queues - nvme-pci: ensure we're polling a polled queue - nvme-pci: fix missed admin queue sq doorbell write - nvme-pci: Fix race bug in nvme_poll_irqdisable() - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - nvme: reject invalid pr_read_keys() num_keys values - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free - nvmet-tcp: fix race between ICReq handling and queue teardown - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - objtool: Fix Clang jump table detection - objtool: Handle Clang RSP musical chairs - objtool: Remove max symbol name length limitation - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - ocfs2: fix listxattr handling when the buffer is full - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: fix possible deadlock between unlink and dio_end_io_write - ocfs2: fix reflink preserve cleanup issue - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: reject oversized group bitmap descriptors - ocfs2: split transactions in dio completion to avoid credit exhaustion - ocfs2: validate bg_bits during freefrag scan - ocfs2: validate group add input before caching - ocfs2: validate inline data i_size during inode read - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: disable per ring interrupts - octeon_ep: ensure dbell BADDR updation - octeon_ep: Relocate counter updates before NAPI - octeon_ep: restructured interrupt handlers - octeon_ep: set backpressure watermark for RX queues - octeon_ep: support Octeon CN10K devices - octeon_ep: support to fetch firmware info - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: CGX: fix bitmap leaks - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: Fix default entries mcam entry action - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - octeontx2-af: Fix PF driver crash with kexec kernel booting - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - octeontx2-af: replace deprecated strncpy with strscpy - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - octeontx2-pf: avoid double free of pool->stack on AQ init failure - octeontx2-pf: Unregister devlink on probe failure - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - of: unittest: fix use-after-free in testdrv_probe() - openrisc: define arch-specific version of nop() - openvswitch: cap upcall PID array size and pre-size vport replies - openvswitch: defer tunnel netdev_put to RCU release - openvswitch: validate MPLS set/set_masked payload length - openvswitch: vport: fix self-deadlock on release of tunnel ports - ovl: Fix uninit-value in ovl_fill_real - padata: Fix pd UAF once and for all - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove comment for reorder_work - padata: Remove cpu online check from cpu add and removal - params: Replace __modinit with __init_or_module - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - parisc: Fix IRQ leak in LASI driver - parisc: Flush correct cache in cacheflush() syscall - parisc: Increase initial mapping to 64 MB with KALLSYMS - parisc: kernel: replace kfree() with put_device() in create_tree_node() - parisc: _llseek syscall is only available for 32-bit userspace - parisc: Prevent interrupts during reboot - parport: Fix race between port and client registration - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI/AER: Clear only error bits in PCIe Device Status - PCI/AER: Stop ruling out unbound devices as error source - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - PCI: Do not attempt to set ExtTag for VFs - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Enable AtomicOps only if Root Port supports them - PCI: endpoint: Avoid creating sub-groups asynchronously - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup - PCI: endpoint: Remove unused field in struct pci_epf_group - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - PCI: Fix pci_slot_lock () device locking - PCI: Fix pci_slot_trylock() error handling - PCI: hv: Set default NUMA node to 0 for devices without affinity info - PCI: Initialize RCB from pci_configure_device() - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - PCI: Mark ASM1164 SATA controller to avoid bus reset - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI/MSI: Unmap MSI-X region on error - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - PCI/portdrv: Fix potential resource leak - PCI: Supply bridge device, not secondary bus, to read window details - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Fix polling delay for L2 state - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Use DWC IP core version - PCI: Update BAR # and window messages - PCI: Use resource names in PCI log messages - PCI: Use resource_set_range() that correctly sets ->end - PCMCIA: Fix garbled log messages for KERN_CONT - pcnet32: stop holding device spin lock during napi_complete_done - pds_core: add an error code check in pdsc_dl_info_get - pds_core: ensure null-termination for firmware version strings - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - perf/arm-cmn: Reject unsupported hardware configurations - perf/arm-cmn: Support CMN-600AE - perf: arm_spe: Properly set hw.state on failures - perf branch: Avoid incrementing NULL - perf callchain: Fix srcline printing with inlines - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf: Extract a few helpers - perf: Fix dangling cgroup pointer in cpuctx - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - perf lock: Fix option value type in parse_max_stack - perf: Make sure to use pmu_ctx->pmu for groups - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf unwind-libdw: Fix invalid reference counts - perf util: Kill die() prototype, dead for a long time - perf/x86/intel/uncore: Skip discovery table for offline dies - phonet: Pass ifindex to fill_addr(). - phonet: Pass net and ifindex to phonet_address_notify(). - phonet/pep: disable BH around forwarded sk_receive_skb() - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - phy: tegra: xusb: Fix per-pad high-speed termination calibration - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - pidfd: refuse access to tasks that have started exiting harder - pinctrl: abx500: Fix type of 'argument' variable - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - pinctrl: mediatek: common: Fix probe failure for devices without EINT - pinctrl: pinctrl-pic32: Fix resource leak - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - ping: annotate data-races in ping_lookup() - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - platform/chrome: cros_ec_lightbar: Fix response size initialization - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - platform/surface: surfacepro3_button: Drop wakeup source on remove - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro - platform/x86/amd/pmc: Add support for Van Gogh SoC - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - platform/x86: classmate-laptop: Add missing NULL pointer checks - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: hp-bioscfg: Support allocations of larger data - platform/x86: hp-wmi: Ignore backlight and FnLock events - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery - platform/x86: ISST: Correct locked bit width - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - platform/x86: panasonic-laptop: Fix sysfs group leak in error path - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - pmdomain: bcm: bcm2835-power: Fix broken reset status read - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - pmdomain: core: Fix detach procedure for virtual devices in genpd - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - PM: hibernate: Don't ignore return from set_memory_ro() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: runtime: Fix a race condition related to device removal - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - pNFS: Fix a deadlock when returning a delegation during open() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - pNFS: Fix use-after-free in pnfs_update_layout() - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - powerpc64/bpf: do not increment tailcall count when prog is NULL - powerpc: 83xx: km83xx: Fix keymile vendor prefix - powerpc/crash: fix backup region offset update to elfcorehdr - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - powerpc/warp: Fix error handling in pika_dtm_thread - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: ab8500: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: axp288_charger: Do not cancel work before initializing it - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: max17042: avoid overflow when determining health - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - pppoe: drop PFC frames - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - printk: add print_hex_dump_devel() - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - pstore: ram_core: fix incorrect success return when vmap() fails - pstore/ram: fix buffer overflow in persistent_ram_save_old() - pstore/ram: fix resource leak when ioremap() fails - ptp: vclock: Switch from RCU to SRCU - ptrace: Convert ptrace_attach() to use lock guards - ptrace: slightly saner 'get_dumpable()' logic - pwm: imx-tpm: Count the number of enabled channels in probe - qed: fix double free in qed_cxt_tables_alloc() - quota: fix livelock between quotactl and freeze_super - quota: Fix race of dquot_scan_active() with quota deactivation - r8152: fix incorrect register write to USB_UPHY_XTAL - r8152: handle the return value of usb_reset_device() - randomize_kstack: Maintain kstack_offset per task - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - rbd: fix null-ptr-deref when device_add_disk() fails - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: s/boost_kthread_mutex/kthread_mutex - RDMA/bnxt_re: zero shared page before exposing to userspace - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - RDMA/core: Fix a couple of obvious typos in comments - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - RDMA/core: Prefer NLA_NUL_STRING - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - RDMA/efa: Fix typo in efa_alloc_mr() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - RDMA/hns: Fix WQ_MEM_RECLAIM warning - RDMA/hns: Notify ULP of remaining soft-WCs during reset - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Fix double free related to rereg_user_mr - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - RDMA/irdma: Initialize free_qp completion before using it - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - RDMA/mana_ib: Disable RX steering on RSS QP destroy - RDMA/mana: Validate rx_hash_key_len - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - RDMA: Move DMA block iterator logic into dedicated files - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/rtrs-clt: For conn rejection use actual err number - RDMA/rtrs: Fix use-after-free in path file creation cleanup - RDMA/rtrs: server: remove dead code - RDMA/rtrs-srv: fix SG mapping - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - RDMA/siw: Fix potential NULL pointer dereference in header processing - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - RDMA/srp: bound SRP_RSP sense copy by the received length - RDMA/umad: Reject negative data_len in ib_umad_write - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/umem: fix kernel-doc warnings - RDMA/umem: Fix truncation for block sizes >= 4G - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - rds: ib: reject FRMR registration before IB connection is established - rds: mark snapshot pages dirty in rds_info_getsockopt() - regmap: Synchronize cache for the page selector - regset: use kvzalloc() for regset_get_alloc() - regulator: act8945a: fix OF node reference imbalance - regulator: bd9571mwv: fix OF node reference imbalance - regulator: core: fix locking in regulator_resolve_supply() error path - regulator: core: move supply check earlier in set_machine_constraints() - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - regulator: pca9450: Correct interrupt type - regulator: pca9450: Make IRQ optional - regulator: rk808: fix OF node reference imbalance - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - remoteproc: imx_rproc: Fix invalid loaded resource table detection - remoteproc: mediatek: Break lock dependency to `prepare_lock` - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - remoteproc: xlnx: Only access buffer information if IPI is buffered - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - resource: Add resource set range and size helpers - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "ALSA: usb: Increase volume range that triggers a warning" - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - Revert "crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx" - Revert "crypto: nx - fix context leak in nx842_crypto_free_ctx" - Revert "crypto: nx - Migrate to scomp API" - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" - Revert "ice: fix double-free of tx_buf skb" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "mfd: da9052-spi: Change read-mask to write-mask" - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - Revert "mptcp: add needs_id for netlink appending addr" - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - Revert "perf unwind-libdw: Fix invalid reference counts" - Revert "ptp: add testptp mask test" - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" - Revert "tcpm: allow looking for role_sw device in the main node" - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - Revert "wireguard: device: enable threaded NAPI" - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - Revert "x86/vdso: Fix output operand size of RDPID" - Revert "xattr: switch to CLASS(fd)" - ring-buffer: Fix reporting of missed events in iterator - ring-buffer: Remove ring_buffer_read_prepare_sync() - riscv: kgdb: fix several debug register assignment bugs - riscv: Sanitize syscall table indexing under speculation - rnbd-srv: Zero the rsp buffer before using it - romfs: check sb_set_blocksize() return value - rpmsg: char: Fix use-after-free on probe error path - rpmsg: core: fix race in driver_override_show() and use core helper - rseq: Clarify rseq registration rseq_size bound check comment - rtc: abx80x: Disable alarm feature if no interrupt attached - rtc: interface: Alarm race handling should not discard preceding error - rtc: ntxec: fix OF node reference imbalance - rtc: zynqmp: correct frequency value - rtmutex: Use waiter::task instead of current in remove_waiter() - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - rust: kunit: fix warning when !CONFIG_PRINTK - rust: pin-init: add references to previously initialized fields - rust: pin-init: internal: init: document load-bearing fact of field accessors - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix anonymous key handling - rxrpc: Fix call removal to use RCU safe deletion - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - rxrpc: Fix data-race warning and potential load/store tearing - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: Fix key quota calculation for multitoken keys - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix memory leaks in rxkad_verify_response() - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - rxrpc: Fix potential UAF after skb_unshare() failure - rxrpc: Fix recvmsg() unconditional requeue - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix the ACK parser to extract the SACK table for parsing - rxrpc: only handle RESPONSE during service challenge - rxrpc: Only put the call ref if one was acquired - rxrpc: reject undecryptable rxkad response tickets - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - s390/cio: make sch->lock spinlock pointer a member - s390/cio: use generic driver_override infrastructure - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - s390/debug: Reject zero-length input before trimming a newline - s390/debug: Reject zero-length input in debug_input_flush_fn() - s390/entry: Scrub r12 register on kernel entry - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - s390/pci: Handle futile config accesses of disabled devices directly - s390/perf: Disable register readout on sampling events - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/syscalls: Add spectre boundary for syscall dispatch table - s390/xor: Fix xor_xc_2() inline assembly constraints - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - sched/fair: Fix pelt clock sync when entering idle - sched: idle: Consolidate the handling of two special cases - sched: idle: Make skipping governor callbacks more consistent - sched/rt: Skip currently executing CPU in rto_next_cpu() - sched: Use u64 for bandwidth ratio calculations - scripts/dtc: Remove unused dts_version in dtc-lexer.l - scripts: generate_rust_analyzer.py: avoid FD leak - scripts: generate_rust_analyzer.py: define scripts - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Have mcount rela sort use direct values - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused macro defines - scripts/sorttable: Remove unused write functions - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Zero out weak functions in mcount_loc table - scsi: buslogic: Reduce stack usage - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - scsi: csiostor: Fix dereference of null pointer rn - scsi: efct: Use IRQF_ONESHOT and default primary handler - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec - scsi: hisi_sas: Fix NULL pointer exception during user_scan() - scsi: hisi_sas: Use macro instead of magic number - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - scsi: isci: Fix use-after-free in device removal path - scsi: lpfc: Properly set WC for DPP mapping - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: qla2xxx: Fix bsg_done() causing double free - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - scsi: ses: Fix devices attaching to different hosts - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - scsi: target: core: Fix integer overflow in UNMAP bounds check - scsi: target: Fix recursive locking in __configfs_open_file() - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: tcm_loop: Drain commands in target_reset handler - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix use-after free in init error and remove paths - scsi: ufs: core: Flush exception handling work when RPM level is zero - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - scsi: ufs: host: mediatek: Require CONFIG_PM - sctp: diag: reject stale associations in dump_one path - sctp: discard stale INIT after handshake completion - sctp: fix missing encap_port propagation for GSO fragments - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - sctp: fix race between sctp_wait_for_connect and peeloff - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - sctp: purge outqueue on stale COOKIE-ECHO handling - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - sctp: stream: fully roll back denied add-stream state - security/keys: fix missed RCU read section on lookup - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - seg6: separate dst_cache for input and output paths in seg6 lwtunnel - selftest/arm64: Fix sve2p1_sigill() to hwcap test - selftest: memcg: skip memcg_sock test if address family not supported - selftests/bpf: add stack access precision test - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: veristat: fix printing order in output_stats() - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests/memfd: delete unused declarations - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - selftests/mm: skip migration tests if NUMA is unavailable - selftests: mptcp: add a check for 'add_addr_accepted' - selftests: mptcp: add test for extra_subflows underflow on userspace PM - selftests: mptcp: drop nanoseconds width specifier - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: join: check RM_ADDR not sent over same subflow - selftests: mptcp: more stable simult_flows tests - selftests/mqueue: Fix incorrectly named file - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - selftests/powerpc: Re-order *FLAGS to follow lib.mk - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selinux: don't reserve xattr slot when we won't fill it - selinux: fix overlayfs mmap() and mprotect() access checks - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - serdev: make serdev_bus_type const - serdev: Provide a bustype shutdown function - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_dw: handle clock enable errors in runtime_resume - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: 8250: Fix TX deadlock when using DMA - serial: 8250_pci: add support for the AX99100 - serial: altera_jtaguart: handle uart_add_one_port() failures - serial: caif: fix use-after-free in caif_serial ldisc_close() - serial: caif: hold tty->link reference in ldisc_open and ser_release - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: imx: change SERIAL_IMX_CONSOLE to bool - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: samsung_tty: Use port lock wrappers - serial: sh-sci: fix memory region release in error path - serial: SH_SCI: improve "DMA support" prompt - serial: uartlite: fix PM runtime usage count underflow on probe - serial: zs: Convert to use a platform device - serial: zs: Fix bootconsole handover lockup - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: zs: Switch to using channel reset - sfc: fix error code in efx_devlink_info_running_versions() - sh: platform_early: remove pdev->driver_override check - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: fix OF node refcount - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - smb: client: add proper locking around ses->iface_last_update - smb: client: Compare MACs in constant time - smb: client: correctly handle ErrorContextData as a flexible array - smb: client: correct value for smbd_max_fragmented_recv_size - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - smb: client: fix atomic open with O_DIRECT & O_SYNC - smb: client: fix broken multichannel with krb5+signing - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb: client: fix cifs_pick_channel when channels are equally loaded - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - smb: client: fix krb5 mount with username option - smb: client: fix off-by-8 bounds check in check_wsl_eas() - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path - smb: client: fix OOB reads parsing symlink error response - smb/client: fix out-of-bounds read in smb2_compound_op() - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix possible infinite loop and oob read in symlink_data() - smb: client: fix potential UAF and double free in smb2_open_file() - smb: client: prevent races in ->query_interfaces() - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - smb: client: reject userspace cifs.spnego descriptions - smb: client: require a full NFS mode SID before reading mode bits - smb: client: require net admin for CIFS SWN netlink - smb: client: Use FullSessionKey for AES-256 encryption key derivation - smb: client: use kzalloc to zero-initialize security descriptor buffer - smb: client: validate dacloffset before building DACL pointers - smb: client: validate the whole DACL before rewriting it in cifsacl - smb: common: change the data type of num_aces to le16 - smb: move some duplicate definitions to common/smbacl.h - smb: server: fix active_num_conn leak on transport allocation failure - smb/server: Fix another refcount leak in smb2_open() - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix use-after-free in smb2_open() - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - soc: fsl: qbman: fix race condition in qman_destroy_fq - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - soc: qcom: llcc: fix v1 SB syndrome register offset - soc: qcom: ocmem: make the core clock optional - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: smem: handle ENOMEM error during probe - soc/tegra: cbb: Set ERD on resume for err interrupt - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - soc: ti: k3-socinfo: Fix regmap leak on probe failure - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - sound: ua101: fix division by zero at probe - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - soundwire: cadence: Clear message complete before signaling waiting thread - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - spi: at91-usart: fix controller deregistration - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: cadence: fix controller deregistration - spi: cadence: fix unclocked access on unbind - spi: coldfire-qspi: fix controller deregistration - spi: dln2: fix controller deregistration - spi: fix resource leaks on device setup failure - spi: fix statistics allocation - spi: fix use-after-free on controller registration failure - spi: fsl-espi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: fsl-qspi: Use reinit_completion() for repeated operations - spi: geni-qcom: Check DMA interrupts early in ISR - spi-geni-qcom: initialize mode related registers to 0 - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - spi: img-spfi: fix controller deregistration - spi: imx: fix runtime pm leak on probe deferral - spi: imx: fix use-after-free on unbind - spi: intel-pci: Add support for Nova Lake mobile SPI flash - spi: lantiq-ssc: fix controller deregistration - spi: meson-spicc: Fix double-put in remove path - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - spi: mpc52xx: fix use-after-free on unbind - spi: mtk-nor: fix controller deregistration - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - spi: omap2-mcspi: fix controller deregistration - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: qup: fix controller deregistration - spi: qup: fix error pointer deref after DMA setup failure - spi: rockchip: fix controller deregistration - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - spi: rspi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: s3c64xx: fix NULL-deref on driver unbind - spi: sh-hspi: fix controller deregistration - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - spi: spidev: fix lock inversion between spi_lock and buf_lock - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: spi-ti-qspi: switch to use modern name - spi: sprd: fix controller deregistration - spi: sprd: fix error pointer deref after DMA setup failure - spi: stm32: fix Overrun issue at < 8bpw - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - spi: tegra114: fix controller deregistration - spi: tegra20-sflash: fix controller deregistration - spi: ti-qspi: fix controller deregistration - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: tools: Add include folder to .gitignore - spi: topcliff-pch: fix use-after-free on unbind - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - spi: zynqmp-gqspi: fix controller deregistration - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - Squashfs: check metadata block offset is within range - staging: greybus: lights: avoid NULL deref - staging: media: atomisp: Disallow all private IOCTLs - staging: rtl8723bs: fix memory leak on failure path - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - staging: rtl8723bs: fix null dereference in find_network - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() - staging: sm750fb: fix division by zero in ps_to_hz() - staging: vme_user: fix root device leak on init failure - string: add mem_is_zero() helper to check if memory area is all zeros - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - sunrpc: fix cache_request leak in cache_release - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Remove queue-shortening warnings - sysctl: fix uninitialized variable in proc_do_large_bitmap - sysfs: don't remove existing directory on update failure - tap: free page on error paths in tap_get_user_xdp() - taskstats: set version in TGID exit notifications - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: call sk_data_ready() after listener migration - tcp: defer regular ACK while processing socket backlog - tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses. - tcp: Fix imbalanced icsk_accept_queue count. - tcp: optimize inet_use_bhash2_on_bind() - tcp: Rearrange tests in inet_csk_bind_conflict(). - tcp: restrict SO_ATTACH_FILTER to priv users - tcp: Set pingpong threshold via sysctl - tcp: tcp_tx_timestamp() must look at the rtx queue - tcp: Use bhash2 for v4-mapped-v6 non-wildcard address. - tee: optee: prevent use-after-free when the client exits before the supplicant - test_kprobes: clear kprobes between test runs - tg3: Fix race for querying speed/duplex - tg3: replace placeholder MAC address with device property - thermal: core: Fix thermal zone device registration error path - thermal: core: Fix thermal zone governor cleanup issues - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - thermal: int340x: Fix sysfs group leak on DLVR registration failure - thunderbolt: Bound root directory content to block size - thunderbolt: Clamp XDomain response data copy to allocation size - thunderbolt: Fix property read in nhi_wake_supported() - thunderbolt: Limit XDomain response copy to actual frame size - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - thunderbolt: Reject zero-length property entries in validator - thunderbolt: Validate XDomain request packet size before type cast - time: Fix off-by-one in settimeofday() usec validation - time/jiffies: Mark jiffies_64_to_clock_t() notrace - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG - tipc: fix divide-by-zero in tipc_sk_filter_connect() - tipc: fix double-free in tipc_buf_append() - tipc: fix duplicate publication key in tipc_service_insert_publ() - tipc: fix RCU dereference race in tipc_aead_users_dec() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - tls: Preserve sk_err across recvmsg() when data has been copied - tls: Purge async_hold in tls_decrypt_async_wait() - tools/accounting: handle truncated taskstats netlink messages - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - tools: Fix bitfield dependency failure - tools/power cpupower: Reset errno before strtoull() - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - tools/rv: Fix cleanup after failed trace setup - tpm: avoid -Wunused-but-set-variable - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - tpm: tpm_tis: add error logging for data transfer - tpm: tpm_tis: stop transmit if retries are exhausted - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() - tracing: Add NULL pointer check to trigger_data_free() - tracing: Add recursion protection in kernel stack trace recording - tracing: Avoid NULL return from hist_field_name() on truncation - tracing: branch: Fix inverted check on stat tracer registration - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - tracing: Fix checking of freed trace_event_file for hist files - tracing: Fix false sharing in hwlat get_sample() - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Fix syscall events activation by ensuring refcount hits zero - tracing: Fix to set write permission to per-cpu buffer_size_kb - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - tracing/probe: reject non-closed empty immediate strings - tracing/probes: Limit size of event probe to 3K - tracing/probes: Point the error offset correctly for eprobe argument error - tracing: Properly process error handling in event_hist_trigger_parse() - tracing: Rebuild full_name on each hist_field_name() call - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Switch trace_osnoise.c code over to use guard() and __free() - tracing: Wake up poll waiters for hist files when removing an event - tty: hvc_iucv: fix off-by-one in number of supported devices - tty: serial: pch_uart: add check for dma_alloc_coherent() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - tun: free page on build_skb failure in tun_xdp_one() - tun: free page on short-frame rejection in tun_xdp_one() - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - ublk: Validate SQE128 flag before accessing the cmd - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - udf: fix partition descriptor append bookkeeping - udf: reject descriptors with oversized CRC length - udp: clear skb->dev before running a sockmap verdict - udp: Fix wildcard bind conflict check when using hash2 - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n - um: drivers: call kernel_strrchr() explicitly in cow_user.c - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - unshare: fix unshare_fs() handling - USB: add QUIRK_NO_BOS for video capture several devices - usb: bdc: fix sleep during atomic - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() - usb: cdns3: fix role switching during resume - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue - usb: cdns3: gadget: fix request skipping after clearing halt - usb: cdns3: gadget: fix state inconsistency on gadget init failure - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: remove redundant if branch - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: core: convert ci_role_switch to local variable - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: class: cdc-wdm: fix reordering issue in read code path - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: core: Fix SuperSpeed root hub wMaxPacketSize - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - USB: core: Limit the length of unkillable synchronous timeouts - usb: core: new quirk to handle devices with zero configurations - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - usb: dwc2: fix resume failure if dr_mode is host - usb: dwc2: Fix use after free in debug code - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: dwc3: gadget: Move vbus draw to workqueue context - usb: dwc3: Move GUID programming after PHY initialization - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: ehci-brcm: fix sleep during atomic - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - usb: gadget: f_ncm: Fix net_device lifecycle with device_move - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: net2280: Fix double free in probe error path - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: image: mdc800: kill download URB on timeout - usbip: validate number_of_packets in usbip_pack_ret_submit() - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: mdc800: handle signal and read racing - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - USB: omap_udc: DMA: Don't enable burst 4 mode - usb: port: add delay after usb_hub_set_port_power() - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - USB: serial: belkin_sa: validate interrupt status length - USB: serial: cypress_m8: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: digi_acceleport: fix memory corruption with small endpoints - USB: serial: f81232: fix incomplete serial port generation - USB: serial: io_edgeport: add support for Blackbox IC135A - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - USB: serial: io_ti: fix heap overflow in get_manuf_info() - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: kl5kusb105: fix bulk-out buffer overflow - USB: serial: mct_u232: fix memory corruption with small endpoint - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: option: add MeiG Smart SRM825WN - USB: serial: option: add MeiG SRM813Q - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: option: add Telit Cinterion FN990A MBIM composition - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: serial: option: add Telit FN920C04 RNDIS compositions - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: storage: Add quirks for PNY Elite Portable SSD - usb: storage: Expand range of matched versions for VL817 quirks entry - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: tcpm: reset internal port states on soft reset AMS - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - usb: typec: ucsi: Check if power role change actually happened before handling - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: Don't update power_supply on power role change if not connected - usb: typec: ucsi: Move unregister out of atomic section - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - usb: typec: ucsi: validate connector number in ucsi_connector_change() - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: ulpi: fix double free in ulpi_register_interface() error path - usb: ulpi: fix memory leak on ulpi_register() error paths - USB: usbcore: Introduce usb_bulk_msg_killable() - usb: usblp: fix heap leak in IEEE 1284 device ID via short response - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts - usb: xhci: Fix memory leak in xhci_disable_slot() - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - usb: xhci: Prevent interrupt storm on host controller error (HCE) - usb: yurex: fix race in probe - userfaultfd: allow registration of ranges below mmap_min_addr - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - vfio: Create vfio_fs_type with inode per device - vfio/pci: Insert full vma on mmap'd MMIO fault - vfio/pci: Use unmap_mapping_range() - vhost: fix caching attributes of MMIO regions by setting them explicitly - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - virtiofs: fix UAF on submount umount - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false - virt: vbox: uapi: Mark inner unions in packed structs as packed - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - vrf: Fix a potential NPD when removing a port from a VRF - vsock: fix buffer size clamping order - vsock: keep poll shutdown state consistent - vsock/virtio: fix accept queue count leak on transport mismatch - vsock/virtio: fix length and offset in tap skb for split packets - vsock/virtio: reset connection on receiving queue overflow - vsock/vmci: fix sk_ack_backlog leak on failed handshake - vsock/vmci: fix UAF when peer resets connection during handshake - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - vxlan: validate ND option lengths in vxlan_na_create - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - watchdog: imx7ulp_wdt: handle the nowayout option - watchdog: starfive-wdt: Fix PM reference leak in probe error path - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - wifi: ath11k: clear shared SRNG pointer state on restart - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - wifi: ath11k: fix warning when unbinding - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: skip status ring entry processing - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath5k: do not access array OOB - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: brcmfmac: Fix error pointer dereference - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: brcmfmac: validate bsscfg indices in IF events - wifi: brcmsmac: Fix dma_free_coherent() size - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - wifi: cfg80211: wext: fix IGTK key ID off-by-one - wifi: cw1200: Fix locking in error paths - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - wifi: iwlwifi: mvm: check the validity of noa_len - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: libertas: fix use-after-free in lbs_free_adapter() - wifi: libertas: fix WARNING in usb_tx_block - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: mac80211: fix NULL deref in mesh_matches_local() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. - wifi: mac80211: remove station if connection prep fails - wifi: mac80211: set default WMM parameters on all links - wifi: mt76: connac: introduce helper for mt7925 chipset - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7921: fix a potential clc buffer length underflow - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - wifi: nl80211: reject oversized EMA RNR lists - wifi: radiotap: reject radiotap with unknown bits - wifi: rsi: fix kthread lifetime race between self-exit and external-stop - wifi: rt2x00usb: fix devres lifetime - wifi: rtl8xxxu: fix potential use of uninitialized value - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: check for PCI upstream bridge existence - wifi: rtw88: fix device leak on probe failure - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw89: pci: restore LDO setting after device resume - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - wifi: wl1251: validate packet IDs before indexing tx_frames - wifi: wlcore: Fix a locking bug - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom - wireguard: send: append trailer after expanding head - workqueue: Factor out assign_rescuer_work() - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - workqueue: Only assign rescuer work when really needed - workqueue: Process rescuer work items one-by-one using a cursor - X.509: Fix out-of-bounds access when parsing extensions - x86/apic: Disable x2apic on resume if the kernel expects so - x86/CPU/AMD: Call the spectral chicken in the Zen2 init function - x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache - x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - x86/CPU: Fix FPDSS on Zen1 - x86/efi: defer freeing of boot services memory - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/hyperv: Fix error pointer dereference - x86/kexec: add a sanity check on previous kernel's ima kexec buffer - x86/kexec: Copy ACPI root pointer address from config table - x86/kexec: Disable KCOV instrumentation after load_segments() - x86/platform/uv: Handle deconfigured sockets - x86/sev: Allow IBPB-on-Entry feature for SNP guests - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - x86: shadow stacks: proper error handling for mmap lock - x86/shstk: Prevent deadlock during shstk sigreturn - x86/uprobes: Fix XOL allocation failure for 32-bit tasks - x86/xen: Fix xen_e820_swap_entry_with_ram() - x86/xen: make some functions static - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - xattr: switch to CLASS(fd) - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - xenbus: Use .freeze/.thaw to handle xenbus devices - xen-netback: reject zero-queue configuration from guest - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: fix double free via VMA splitting - xen/privcmd: restrict usage in unprivileged domU - xen/virtio: Don't use grant-dma-ops when running as Dom0 - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - xfrm: ah: account for ESN high bits in async callbacks - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - xfrm: call xdo_dev_state_delete during state update - xfrm: Check for underflow in xfrm_state_mtu - xfrm: clear trailing padding in build_polexpire() - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: esp: avoid in-place decrypt on shared skb frags - xfrm: espintcp: do not reuse an in-progress partial send - xfrm: esp: restore combined single-frag length gate - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path - xfrm: Fix the usage of skb->sk - xfrm: input: hold netns during deferred transport reinjection - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - xfrm: provide message size for XFRM_MSG_MAPPING - xfrm: route MIGRATE notifications to caller's netns - xfrm: skip templates check for packet offload tunnel mode - xfrm_user: fix info leak in build_mapping() - xfrm_user: fix info leak in build_report() - xfrm: Wait for RCU readers during policy netns exit - xfs: avoid dereferencing log items after push callbacks - xfs: delete attr leaf freemap entries when empty - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix a resource leak in xfs_alloc_buftarg() - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: fix integer overflow in bmap intent sort comparator - xfs: fix remote xattr valuelblk check - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: fix undersized l_iclog_roundoff values - xfs: mark data structures corrupt on EIO and ENODATA - xfs: save ailp before dropping the AIL lock in push callbacks - xfs: stop reclaim before pushing AIL during unmount - xhci: tegra: Fix ghost USB device on dual-role port unplug - xprtrdma: Decrement re_receiving on the early exit paths - xsk: Fix fragment node deletion to prevent buffer leak - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: Fix zero-copy AF_XDP fragment drop - xsk: Get rid of xdp_buff_xsk::xskb_list_node - xsk: introduce helper to determine rxq->frag_size - xsk: respect tailroom for ZC setups - xsk: s/free_list_node/list_node/ - xsk: tighten UMEM headroom validation to account for tailroom and min frame - xsk: validate MTU against usable frame size on bind - zonefs: handle integer overflow in zonefs_fname_to_fno - zram: do not forget to endio for partial discard requests - zram: fix use-after-free in zram_bvec_write_partial() - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Fix CIFSwitch vulnerability- FIX GPO Frag vulnerability- Fix PinTheft- Fix memory leak in AFS code- Fix CVE-2026-46300, CVE-2026-46333, CVE-2025-54518- Remove dead, not used patches- Fix Dirtyfrag- Fix CVE-2026-31431 (Copyfail)- Fix regression with touchpad on notebook Positron Proxima 15 and probably others (bz#19950) - https://bugzilla.rosa.ru/show_bug.cgi?id=19950- [bot] upd: 6.6.106 -> 6.6.126 - Changelog: - 6pack: drop redundant locking and refcounting - 9p: fix cache/debug options printing in v9fs_show_options - 9p: fix /sys/fs/9p/caches overwriting itself - 9p: sysfs_init: don't hardcode error to ENOMEM - accel/habanalabs/gaudi2: fix BMON disable configuration - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() - ACPI: battery: Add synchronization between interface updates - ACPI: battery: allocate driver data through devm_ APIs - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - acpi: Break out nesting for hmat_parse_locality() - ACPI: button: Call input_free_device() on failing input device registration - ACPICA: Allow to skip Global Lock initialization - ACPICA: Avoid walking the Namespace if start_node is NULL - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - ACPICA: Fix largest possible resource descriptor index - ACPICA: Update dsmethod.c to get rid of unused variable warning - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - ACPI: CPPC: Check _CPC validity for only the online CPUs - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Perform fast check switch only for online CPUs - ACPI: debug: fix signedness issues in read/write helpers - acpi, hmat: calculate abstract distance with HMAT - acpi/hmat: Fix lockdep warning for hmem_register_resource() - acpi, hmat: refactor hmat_register_target_initiators() - ACPI: HMAT: Remove register of memory node for generic target - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Add setting of generic port system locality attributes - acpi: numa: Create enum for memory_target access coordinates indexing - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 - ACPI: processor: idle: Fix memory leak when register cpuidle device failed - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Fix buffer properties extraction for subnodes - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() - ACPI: property: Return present device nodes only on fwnode interface - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - acpi,srat: Fix incorrect device handle check for Generic Initiator - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() - afs: Fix potential null pointer dereference in afs_put_server - af_unix: Initialise scc_index in unix_add_edge(). - allow finish_no_open(file, ERR_PTR(-E...)) - alpha: don't reference obsolete termio struct for TC* constants - ALSA: ac97bus: Use guard() for mutex locks - ALSA: ac97: fix a double free in snd_ac97_controller_register() - ALSA: ctxfi: Fix potential OOB access in audio mixer handling - ALSA: dice: fix buffer overflow in detect_stream_formats() - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - ALSA: firewire-motu: add bounds check in put_user loop for DSP events - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. - ALSA: lx_core: use int type to store negative error codes - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer - ALSA: scarlett2: Fix buffer overflow in config retrieval - ALSA: serial-generic: remove shared static buffer - ALSA: uapi: Fix typo in asound.h comment - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: add mono main switch to Presonus S1824c - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: fix control pipe direction - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: fix uac2 clock source at terminal parser - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() - ALSA: usb-audio: Kill timer properly at removal - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Update for native DSD support quirks - ALSA: usb: Increase volume range that triggers a warning - ALSA: usb-mixer: us16x08: validate meter packet indices - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path - ALSA: wavefront: Clear substream pointers on close - ALSA: wavefront: Fix integer overflow in sample size validation - ALSA: wavefront: Use guard() for spin locks - ALSA: wavefront: Use standard print API - amba: tegra-ahb: Fix device leak on SMMU enable - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - amd-xgbe: avoid misleading per-packet error log - amd-xgbe: Avoid spurious link down messages during interface toggle - amd-xgbe: reset retries and mode on RX adapt failures - arc: Fix __fls() const-foldability via __builtin_clzl() - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - arm64: cputype: Add Neoverse-V3AE definitions - arm64: dts: add off-on-delay-us for usdhc2 regulator - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl - arm64: dts: imx8mp: Correct thermal sensor index - arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM - arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 - arm64: dts: imx8mp-venice-gw702x: remove off-board uart - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: qcom: msm8916: Add missing MDSS reset - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A - arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro - arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A - arm64: dts: rockchip: remove dangerous max-link-speed from helios64 - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: ti: k3-am62p: Fix memory ranges for GPU - arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - arm64: kprobes: call set_memory_rox() for kprobe page - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - arm64: mte: Do not flag the zero page as PG_mte_tagged - arm64: Set __nocfi on swsusp_arch_resume() - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() - ARM: 9468/1: fix memset64() on big-endian - ARM: at91: pm: fix MCKx restore routine - ARM: at91: pm: save and restore ACR during PLL disable/enable - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - ARM: dts: imx51-zii-rdu1: Fix audmux node names - ARM: dts: imx6q-ba16: fix RTC interrupt level - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 - ARM: dts: microchip: sama7g5: fix uart fifo size to 32 - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible - ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: renesas: gose: Remove superfluous port property - ARM: dts: renesas: porter: Fix CAN pin group - ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties - ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - ARM: tegra: transformer-20: add missing magnetometer interrupt - ARM: tegra: transformer-20: fix audio-codec interrupt - arp: do not assume dev_hard_header() does not change skb->head - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - ASoC: ak4458: Disable regulator when error happens - ASoC: ak5558: Disable regulator when error happens - ASoC: amd: acp: Adjust pdm gain value - ASoC: amd: fix memory leak in acp3x pdm dma ops - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 - ASoC: amd: yc: Fix microphone on ASUS M6500RE - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: codecs: wsa881x: Drop unused version readout - ASoC: codecs: wsa881x: fix unnecessary initialisation - ASoC: codecs: wsa883x: fix unnecessary initialisation - ASoC: codecs: wsa884x: fix codec initialisation - ASoC: cs4271: Fix regulator leak on probe failure - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe - ASoC: fsl: imx-card: Do not force slot width to sample width - ASoC: fsl_sai: Add missing registers to cache default - ASoC: fsl_sai: fix bit order for DSD format - ASoC: fsl_xcvr: clear the channel status control memory - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping - ASoC: Intel: catpt: Fix error path in hw_params() - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - ASoC: qcom: audioreach: fix potential null pointer dereference - ASoC: qcom: q6adm: the the copp device only during last instance - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed - ASoC: qcom: q6asm-dai: perform correct state check before closing - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - ASoC: qdsp6: q6asm: do not sleep while atomic - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - ASoC: stm32: sai: fix clk prepare imbalance on probe failure - ASoC: stm32: sai: fix device leak on probe - ASoC: stm32: sai: fix OF node leak on probe - ASoC: stm32: sai: manage context in set_sysclk callback - ASoC: tas2781: fix getting the wrong device number - ASoC: tlv320adcx140: fix null pointer - ASoC: tlv320adcx140: fix word length - ASoC: tlv320adcx140: Propagate error codes during probe - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - ASoC: wm8940: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8974: Correct PLL rate rounding - ata: libata: Add cpr_log to ata_dev_print_features() early return - ata: libata: Call ata_dev_config_lpm() for ATAPI devices - ata: libata-core: Introduce ata_dev_config_lpm() - ata: libata: Print features also for ATAPI devices - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() - ata: libata-scsi: Fix system suspend for a security locked drive - atm: Fix dma_free_coherent() size - atm/fore200e: Fix possible data race in fore200e_open() - audit: record fanotify event regardless of presence of rules - backlight: led-bl: Add devlink to supplier LEDs - backlight: lp855x: Fix lp855x.h kernel-doc warnings - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - bcma: don't register devices disabled in OF - be2net: fix data race in be_get_new_eqd - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - be2net: pass wrb_params in case of OS2BMC - bfs: Reconstruct file type when loading from disk - binder: fix BR_FROZEN_REPLY error log - binderfs: fix ida_alloc_max() upper bound - binder: remove "invalid inc weak" check - bits: add comments and newlines to #if, #else and #endif directives - bits: introduce fixed-type GENMASK_U*() - blk-cgroup: fix possible deadlock while configuring policy - blk-crypto: fix missing blktrace bio split events - blk-mq: Abort suspend when wakeup events are pending - blk-mq: add helper for checking if one CPU is mapped to specified hctx - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx - blk-mq: don't schedule block kworker on isolated CPUs - blk-mq: setup queue ->tag_set before initializing hctx - blk-mq: skip CPU offline notify on unmapped hctx - block,bfq: fix aux stat accumulation destination - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - block: fix race between set_blocksize and read paths - block: make REQ_OP_ZONE_OPEN a write operation - block: rate-limit capacity change info log - block: rnbd-clt: Fix leaked ID in init_dev() - block: rnbd-clt: Fix signedness bug in init_dev() - block: use int to store blk_stack_limits() return value - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: bcsp: receive data only if registered - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - Bluetooth: btrtl: Avoid loading the config file on security chips - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - Bluetooth: btusb: revert use of devm_kzalloc in btusb - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync - Bluetooth: hci_event: validate skb length for unknown CC opcode - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work - Bluetooth: ISO: don't leak skb in ISO_CONT RX - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: ISO: Fix possible UAF on iso_conn_free - Bluetooth: L2CAP: export l2cap_chan_hold for modules - Bluetooth: MGMT: cancel mesh send timer when hdev removed - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() - Bluetooth: rfcomm: fix modem control handling - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - bnxt_en: correct offset handling for IPv6 destination address - bnxt_en: Fix a possible memory leak in bnxt_ptp_init - bnxt_en: Fix potential data corruption with HW GRO/LRO - bonding: annotate data-races around slave->last_rx - bonding: check xdp prog when set bond mode - bonding: don't set oif to bond dev when getting NS target destination - bonding: limit BOND_MODE_8023AD to Ethernet devices - bonding: provide a net pointer to __skb_flow_dissect() - bonding: return detailed error when loading native XDP fails - bonding: set random address only when slaves already exist - bpf: account for current allocated stack depth in widen_imprecise_scalars() - bpf: Add bpf_prog_run_data_pointers() - bpf, arm64: Do not audit capability check in do_jit() - bpf: Avoid RCU context warning when unpinning htab with internal structs - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Clear pfmemalloc flag when freeing all fragments - bpf: Do not audit capability check in do_jit() - bpf: Do not let BPF test infra emit invalid GSO types to stack - bpf: Do not limit bpf_cgroup_from_id to current's namespace - bpf: Don't use %pK through printk - bpf: Enforce expected_attach_type for tailcall compatibility - bpf: Explicitly check accesses to bpf_sock_addr - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - bpf: Fix invalid prog->stats access when update_effective_progs fails - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - bpf: Free special fields when update [lru_,]percpu_hash maps - bpf: Handle return value of ftrace_set_filter_ip in register_fentry - bpf: Improve program stats run-time calculation - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Reject bpf_timer for PREEMPT_RT - bpf: Reject negative offsets for ALU ops - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - bpf/selftests: test_select_reuseport_kern: Remove unused header - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Sync pending IRQ work before freeing ring buffer - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - bridge: mcast: Fix use-after-free during router port configuration - bridge: Redirect to backup port when port is administratively down - broadcom: b44: prevent uninitialized value usage - btrfs: always detect conflicting inodes when logging inode refs - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - btrfs: do not assert we found block group item when creating free space tree - btrfs: do not skip logging new dentries when logging a new name - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: don't log conflicting inode if it's a dir moved in the current transaction - btrfs: don't rewrite ret from inode_permission - btrfs: ensure no dirty metadata is written back for an fs with errors - btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() - btrfs: factor out init_space_info() from create_space_info() - btrfs: fix a potential path leak in print_data_reloc_error() - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type - btrfs: fix incorrect readahead expansion length - btrfs: fix invalid extref key setup when replaying dentry - btrfs: fix leaf leak in an error path in btrfs_del_items() - btrfs: fix memory leak of fs_devices in degraded seed device path - btrfs: fix memory leaks in create_space_info() error paths - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() - btrfs: fix reservation leak in some error paths when inserting inline extent - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - btrfs: introduce btrfs_space_info sub-group - btrfs: mark dirty extent range for out of bound prealloc extents - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() - btrfs: ref-verify: handle damaged extent root tree - btrfs: scrub: always update btrfs_scrub_progress::last_physical - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: send: check for inline extents in range_is_hole_in_parent() - btrfs: store fs_info in space_info - btrfs: tree-checker: fix the incorrect inode ref size check - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: use readahead_expand() on compressed extents - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - bus: fsl-mc: Check return value of platform_get_resource() - bus: mhi: ep: Fix chained transfer handling in read path - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - cachestat: do not flush stats in recency check - caif: fix integer underflow in cffrml_receive() - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak - can: etas_es58x: allow partial RX URB allocation to succeed - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - can: gs_usb: gs_can_open(): fix error handling - can: gs_usb: gs_make_candev(): populate net_device->dev_port - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: gs_usb: increase max interface to U8_MAX - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - can: j1939: make j1939_session_activate() fail if device is no longer registered - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: netlink: can_changelink(): allow disabling of automatic restart - can: peak_usb: fix shift-out-of-bounds issue - can: rcar_canfd: Fix CAN-FD mode as default - can: rcar_canfd: Fix controller mode setting - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - can: sja1000: fix max irq loop handling - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - ceph: add checking of wait_for_completion_killable() return value - ceph: fix crash in process_v2_sparse_read() for encrypted directories - ceph: refactor wake_up_bit() pattern of calling - cgroup: split cgroup_destroy_wq into 3 workqueues - char: applicom: fix NULL pointer dereference in ac_ioctl - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - char: misc: restrict the dynamic range to exclude reserved minors - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - cifs: client: fix memory leak in smb3_fs_context_parse_param - cifs: Fix memory and information leak in smb3_reconfigure() - cifs: fix memory leak in smb3_fs_context_parse_param error path - cifs: fix pagecache leak when do writepages - cifs: Fix TCP_Server_Info::credits to be signed - cifs: fix typo in enable_gcm_256 module parameter - cifs: Fix uncached read into ITER_KVEC iterator - cifs: parse_dfs_referrals: prevent oob on malformed input - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points - cifs: stop writeback extension when change of size is detected - clk: at91: clk-master: Add check for divide by 3 - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: peripheral: fix return value - clk: keystone: fix compile testing - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: qcom: camcc-sm6350: Fix PLL config of PLL2 - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback - clk: renesas: cpg-mssr: Read back reset registers to assure values latched - clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register - clk: renesas: r9a06g032: Fix memory leak in error path - clk: renesas: rzg2l: Remove critical area - clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable() - clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R() - clk: renesas: Use str_on_off() helper - clk: samsung: exynos-clkout: Assign .num before accessing .hws - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - clk: tegra: do not overallocate memory for bpmp clocks - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clocksource/drivers/clps711x: Fix resource leaks in error paths - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - cnic: Fix use-after-free bugs in cnic_delete_task - comedi: c6xdigio: Fix invalid PNP driver unregistration - comedi: check device's attached status in compat ioctls - comedi: dmm32at: serialize use of paged registers - comedi: fix divide-by-zero in comedi_buf_munge() - comedi: Fix getting range information for subdevices 16 to 255 - comedi: multiq3: sanitize config options in multiq3_attach() - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - compiler_types.h: add "auto" as a macro for "__auto_type" - compiler_types: Move unused static inline functions warning to W=2 - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - coresight: etm4x: Add context synchronization before enabling trace - coresight-etm4x: Conditionally access register TRCEXTINSELR - coresight: etm4x: Correct polling IDLE bit - coresight: etm4x: Extract the trace unit controlling - coresight: etm4x: Support atclk - coresight: Only register perf symlink for sinks with alloc_buffer - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - coresight: trbe: Return NULL pointer for allocation failures - counter: 104-quad-8: Fix incorrect return value in IRQ handler - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag - cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist - cpufreq: Initialize cpufreq-based invariance before subsys - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() - cpufreq/longhaul: handle NULL policy in longhaul_exit - cpufreq: nforce2: fix reference count leak in nforce2 - cpufreq: s5pv210: fix refcount leak - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() - cpufreq: tegra186: Initialize all cores to max frequencies - cpufreq: tegra186: Set target frequency for all cpus in policy - cpuidle: Fail cpuidle device registration if there is one already - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: teo: Drop misguided target residency check - cpuidle: menu: Use residency threshold in polling state override decisions - cpuidle: qcom-spm: fix device and OF node leaks at probe - cpuset: Treat cpusets in attaching as populated - cramfs: Verify inode mode when loading from disk - crash: fix crashkernel resource shrink - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx - crypto: af_alg - Set merge to zero early in af_alg_sendmsg - crypto: af_alg - zero initialize memory allocated via sock_kmalloc - crypto: aspeed-acry - Convert to platform remove callback returning void - crypto: aspeed - Fix dma_unmap_sg() direction - crypto: aspeed - fix double free caused by devm - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - crypto: atmel - Fix dma_unmap_sg() direction - crypto: authenc - Correctly pass EINPROGRESS back up to the caller - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: caam - Add check for kcalloc() in test_len() - crypto: caam - double the entropy delay interval for retry - crypto: ccree - Correctly handle return of sg_nents_for_len - crypto: essiv - Check ssize for decryption and in-place encryption - crypto: hisilicon/qm - check whether the input function and PF are on the same device - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value - crypto: hisilicon/qm - restore original qos values - crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs - crypto: hisilicon - re-enable address prefetch after device resuming - crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations - crypto: keembay - Add missing check after sg_nents_for_len() - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - crypto: rng - Ensure set_ent is always present - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - crypto: sha256 - fix crash at kexec - crypto: starfive - Correctly handle return of sg_nents_for_len - crypto: sun8i-ce - remove channel timeout field - crypto: virtio - Add spinlock protection with virtqueue notification - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req - csky: fix csky_cmpxchg_fixup not working - dax: skip read lock assertion for read-only filesystems - devcoredump: Fix circular locking dependency with devcd->mutex. - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Disable SLUB_TINY for build testing - dlm: check for defined force value in dlm_lockspace_release - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - dmaengine: apple-admac: Add "apple,t8103-admac" compatible - dmaengine: at_hdmac: fix device leak on of_dma_xlate() - dmaengine: bcm-sba-raid: fix device leak on probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - dmaengine: dw: dmamux: fix OF node leak on route allocation failure - dmaengine: dw-edma: Set status for callback_result - dmaengine: idxd: fix device leaks on compat bind and unbind - dmaengine: idxd: Fix double free in idxd_setup_wqs() - dmaengine: idxd: Fix refcount underflow on module unload - dmaengine: idxd: Remove improper idxd_free - dmaengine: lpc18xx-dmamux: fix device leak on route allocation - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: omap-dma: fix dma_pool resource leak in error paths - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() - dmaengine: sh: setup_xref error handling - dmaengine: stm32: dmamux: fix device leak on route allocation - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure - dmaengine: tegra-adma: Fix use-after-free - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - dmaengine: ti: k3-udma: fix device leak on udma lookup - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing - dmaengine: xilinx: xdma: Fix regmap max_register - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - dma/pool: distinguish between missing and exhausted atomic pools - dma/pool: eliminate alloc_pages warning in atomic_pool_expand - dm-bufio: align write boundary on physical block size - dm-ebs: Mark full buffer dirty even on partial write - dm: fix NULL pointer dereference in __dm_suspend() - dm: fix queue start/stop imbalance under suspend/load/resume races - dm-integrity: limit MAX_TAG_SIZE to 255 - dm log-writes: Add missing set_freezable() for freezable kthread - dm-raid: fix possible NULL dereference with undefined raid type - dm-snapshot: fix 'scheduling while atomic' on real-time kernels - dm-verity: fix unreliable memory allocation - doc: fix seg6_flowlabel path - docs: networking: can: change bcm_msg_head frames member to support flexible array - Documentation: process: Also mention Sasha Levin as stable tree maintainer - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - dpaa2-switch: add bounds check for if_id in IRQ handler - dpaa2-switch: fix buffer pool seeding for control traffic - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero - driver core: enforce device_lock for driver_match_device() - driver core/PM: Set power.no_callbacks along with power.no_pm - drivers/base/node: fix double free in register_one_node() - drivers/base/node: handle error properly in register_one_node() - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() - drivers/perf: hisi: Relax the event ID check in the framework - drivers/usb/dwc3: fix PCI parent check - drm/amd: add more cyan skillfish PCI ids - drm/amd: Avoid evicting resources at S5 - drm/amd: Check whether secure display TA loaded successfully - drm/amd: Clean up kfd node on surprise disconnect - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Bump the HDMI clock to 340MHz - drm/amd/display: Check dce_hwseq before dereferencing it - drm/amd/display: Check NULL before accessing - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Enable mst when it's detected but yet to be initialized - drm/amd/display: ensure committing streams is seamless - drm/amd/display: Fix black screen with HDMI outputs - drm/amd/display: Fix DP no audio issue - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() - drm/amd/display: Fix null pointer deref in dcn20_resource.c - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: Increase DPCD read retries - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Remove redundant semicolons - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() - drm/amd/display: use udelay rather than fsleep - drm/amd: Fix suspend failure with secure display TA - drm/amdgpu: Add additional DCE6 SCL registers - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/amdgpu: csa unmap use uninterruptible lock - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amdgpu: fix a memory leak in fence cleanup when unloading - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - drm/amdgpu: Fix function header names in amdgpu_connectors.c - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amdgpu: Forward VMID reservation errors - drm/amdgpu/gfx10: fix wptr reset in KGQ init - drm/amdgpu/gfx11: fix wptr reset in KGQ init - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amdgpu: Power up UVD 3 for FW validation (v2) - drm/amdgpu: reject gang submissions under SRIOV - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/amdgpu/soc21: fix xclk for APUs - drm/amdgpu: use atomic functions with memory barriers for vm fault info - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - drm/amdkfd: Don't use sw fault filter if retry cam enabled - drm/amdkfd: fix a memory leak in device_queue_manager_init() - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - drm/amdkfd: fix vram allocation failure for a special case - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amd/pm: Don't clear SI SMC table when setting power limit - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) - drm/amd/powerplay: Fix CIK shutdown temperature - drm/ast: Use msleep instead of mdelay for edid read - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - drm/bridge: it6505: select REGMAP_I2C - drm/bridge: lt9211: Drop check for last nibble of version register - drm/etnaviv: fix flush sequence logic - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/gma500: Fix null dereference in hdmi teardown - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - drm/i915/backlight: Return immediately when scale() finds invalid parameters - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - drm/i915/guc: Skip communication warning on reset in progress - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/imx/tve: fix probe device leak - drm/mediatek: Disable AFBC support on Mediatek DRM driver - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() - drm/mediatek: Fix device use-after-free on unbind - drm/mediatek: fix potential OF node use-after-free - drm/mediatek: Fix probe memory leak - drm/mediatek: Fix probe resource leaks - drm/mgag200: Fix big-endian support - drm/mgag200: fix mgag200_bmc_stop_scanout() - drm/msm/a2xx: stop over-complaining about the legacy firmware - drm/msm/a6xx: fix bogus hwcg register updates - drm/msm/a6xx: Fix GMU firmware parser - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - drm/msm/dpu: Add missing NULL pointer check for pingpong interface - drm/msm/dpu: fix incorrect type for ret - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - drm/msm: make sure to not queue up recovery more than once - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/nouveau: restrict the flush page to a 32-bit address - drm/panel: novatek-nt35560: Fix invalid return value - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel - drm/panel: sony-td4353-jdi: Enable prepare_prev_first - drm/panel: visionox-rm69299: Don't clear all mode flags - drm/pl111: Fix error handling in pl111_amba_probe - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] - drm/rcar-du: dsi: Fix 1/2/3 lane support - drm/rockchip: vop2: use correct destination rectangle height check - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - drm/sched: Fix race in drm_sched_entity_select_rq() - drm: sti: fix device leaks at component probe - drm/sysfb: Do not dereference NULL pointer in plane reset - drm/tegra: Add call to put_pid() - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/tidss: Use the crtc_* timings when programming the HW - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - drm/ttm: Avoid NULL pointer deref for evicted BOs - drm/vgem-fence: Fix potential deadlock on release - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() - drm/vmwgfx: Fix a null-ptr access in the cursor snooper - drm/vmwgfx: Fix copy-paste typo in validation - drm/vmwgfx: Fix Use-after-free in validation - drm/vmwgfx: Use kref in vmw_bo_dirty - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml - dt-bindings: PCI: amlogic: Fix the register name of the DBI region - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO - dt-bindings: power: qcom,rpmpd: Add SM7150 - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner - dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions - dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215 - dt-bindings: power: rpmpd: Update part number to X1E80100 - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - e1000: fix OOB in e1000_tbi_should_accept() - EDAC/altera: Delete an inappropriate dma_free_coherent() call - EDAC/altera: Handle OCRAM ECC enable after warm reset - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller - EDAC/i3200: Fix a resource leak in i3200_probe1() - EDAC/mc_sysfs: Increase legacy channel support to 16 - EDAC/x38: Fix a resource leak in x38_probe1() - efi/cper: Add a new helper function to print bitmasks - efi/cper: Adjust infopfx size to accept an extra space - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs - efi/cper: Fix cper_bits_to_str buffer handling and return value - efi/libstub: Fix page table access in 5-level to 4-level paging transition - efivarfs: fix error propagation in efivar_entry_get() - epoll: Remove ep_scan_ready_list() in comments - espintcp: fix skb leaks - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - ethernet: Extend device_get_mac_address() to use NVMEM - ethernet: rvu-af: Remove slash from the driver name - ethtool: Avoid overflowing userspace buffer on stats query - eventpoll: Replace rwlock with spinlock - exec: Fix incorrect type for ret - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - exfat: fix remount failure in different process environments - exfat: limit log print for IO error - Expand the type of nfs_fattr->valid - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() - ext4: align max orphan file size with e2fsprogs limit - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() - ext4: clear i_state_flags when alloc inode - ext4: correctly handle queries for metadata mappings - ext4: correct the checking of quota files before moving extents - ext4: detect invalid INLINE_DATA + EXTENTS flag combination - ext4: filesystems without casefold feature cannot be mounted with siphash - ext4: fix an off-by-one issue during moving extents - ext4: fix checks for orphan inodes - ext4: fix error message when rejecting the default hash - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - ext4: fix incorrect group number assertion in mb_check_buddy - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() - ext4: fix string copying in parse_apply_sb_mount_options() - ext4: free orphan info with kvfree - ext4: guard against EA inode refcount underflow in xattr update - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - ext4: increase IO priority of fastcommit - ext4: introduce ITAIL helper - ext4: refresh inline data size before write operations - ext4: remove unused return value of __mb_check_buddy - ext4: validate ea_ino and size in check_xattrs - ext4: verify orphan file size is not too big - ext4: wait for ongoing I/O to complete before freeing blocks - ext4: xattr: fix null pointer deref in ext4_raw_inode() - extcon: adc-jack: Cleanup wakeup source only if it was enabled - extcon: adc-jack: Fix wakeup source leaks on device unbind - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: drop inode from the donation list when the last file is closed - f2fs: ensure node page reads complete before f2fs_put_super() finishes - f2fs: fix age extent cache insertion skip on counter overflow - f2fs: fix condition in __allow_reserved_blocks() - f2fs: fix infinite loop in __insert_extent_tree() - f2fs: fix return value of f2fs_recover_fsync_data() - f2fs: fix to avoid overflow while left shift operation - f2fs: fix to avoid potential deadlock - f2fs: fix to avoid updating compression context during writeback - f2fs: fix to avoid updating zero-sized extent in extent cache - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() - f2fs: fix to propagate error from f2fs_enable_checkpoint() - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - f2fs: fix wrong block mapping for multi-devices - f2fs: fix zero-sized extent for precache extents - f2fs: invalidate dentry cache on failed whiteout creation - f2fs: keep POSIX_FADV_NOREUSE ranges - f2fs: remove unused GC_FAILURE_PIN - f2fs: use f2fs_err_ratelimited() to avoid redundant logs - f2fs: use global inline_xattr_slab instead of per-sb slab cache - fbcon: fix integer overflow in fbcon_do_set_font - fbcon: Fix OOB access in font allocation - fbcon: Set fb_display[i]->mode to NULL when the mode is released - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds - fbdev: atyfb: Check if pll_ops->init_pll failed - fbdev: bitblit: bound-check glyph index in bit_putcs* - fbdev: Fix logic error in "offb" name match - fbdev: gbefb: fix to use physical address instead of dma address - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() - fbdev: tcx.c fix mem_map to correct smem_start offset - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - filelock: add FL_RECLAIM to show_fl_flags() macro - filemap: cap PTE range to be created to allowed zero fill in folio_map_range() - firewire: core: fix overlooked update of subsystem ABI version - firewire: nosy: Fix dma_free_coherent() size - firmware: arm_scmi: Account for failed debug initialization - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - firmware: arm_scmi: Fix unused notifier-block in unregister - firmware: firmware: meson-sm: fix compile-test default - firmware: imx: scu-irq: fix OF node leak in - firmware: imx: scu-irq: Init workqueue before request mbox channel - firmware: imx: scu-irq: Set mu_resource_id before get handle - firmware: meson_sm: fix device leak at probe - firmware: stratix10-svc: Add mutex in stratix10 memory management - firmware: stratix10-svc: fix bug in saving controller data - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc - Fix memory leak in posix_clock_open() - fjes: Add missing iounmap in fjes_hw_init() - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - flex_proportions: make fprop_new_period() hardirq safe - floppy: fix for PAGE_SIZE != 4KB - fou: Don't allow 0 for FOU_ATTR_IPPROTO. - fs/9p: Don't open remote file with APPEND mode when writeback cache is used - fs: Add 'initramfs_options' to set initramfs mount options - fs: always return zero on success from replace_fd() - fscontext: do not consume log entries when returning -EMSGSIZE - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - fs/nfs/io: make nfs_start_io_*() killable - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() - fs/nls: Fix utf16 to utf8 conversion - fs/notify: call exportfs_encode_fid with s_umount - fsnotify: do not generate ACCESS/MODIFY events on child for special files - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fs: ntfs3: Fix integer overflow in run_unpack() - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - fs/ntfs3: Initialize allocated memory before use - fs/ntfs3: out1 also needs to put mi - fs/ntfs3: Prevent memory leaks in add sub record - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs/ntfs3: Support timestamps prior to epoch - fs/proc: fix uaf in proc_readdir_de() - fs: quota: create dedicated workqueue for quota_release_work - fs: udf: fix OOB read in lengthAllocDescs handling - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() - ftrace: Fix BPF fexit with livepatch - ftrace: Fix softlockup in ftrace_module_enable - ftrace/samples: Fix function size computation - fuse: allocate ff->release_args only if release is needed - fuse: Always flush the page cache before FOPEN_DIRECT_IO write - fuse: check if copy_file_range() returns larger than requested size - fuse: fix livelock in synchronous file put from fuseblk workers - fuse: fix readahead reclaim deadlock - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write - fuse: prevent overflow in copy_file_range return value - fuse: zero initialize inode private data - futex: Don't leak robust_list pointer on exec race - futex: Prevent use-after-free during requeue-PI - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - gcov: add support for GCC 15 - genalloc.h: fix htmldocs warning - genirq/irq_sim: Initialize work context pointers properly - gfs2: fix freeze error handling - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - gfs2: fix remote evict for read-only filesystems - gfs2: Fix use of bio_chain - gpio: 104-idio-16: Define maximum valid register address offset - gpio: idio-16: Define fixed direction of the GPIO lines - gpiolib: acpi: Add quirk for Dell Precision 7780 - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler - gpiolib: Extend software-node support to support secondary software-nodes - gpio: ljca: Fix duplicated IRQ mapping - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - gpio: omap: do not register driver in probe() - gpio: pca953x: Add support for level-triggered interrupts - gpio: pca953x: fix wrong error probe return value - gpio: pca953x: handle short interrupt pulses on PCAL devices - gpio: pca953x: mask interrupts in irq shutdown - gpio: pca953x: Utilise dev_err_probe() where it makes sense - gpio: pca953x: Utilise temporary variable for struct device - gpio: pci-idio-16: Define maximum valid register address offset - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - gpio: rockchip: mark the GPIO controller as sleeping - gpio: rockchip: Stop calling pinctrl for set_direction - gpio: update Intel LJCA USB GPIO driver - gpio: wcd934x: mark the GPIO controller as sleeping - gpu: host1x: Fix race in syncpt alloc/free - gue: Fix skb memleak with inner IP protocol 0. - gve: Correct ethtool rx_dropped calculation - gve: Fix stats report corruption on queue count change - hfs: clear offset and space out of valid records in b-tree node - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - hfs: make proper initalization of struct hfs_find_data - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() - hfsplus: fix volume corruption issue for generic/070 - hfsplus: fix volume corruption issue for generic/073 - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfsplus: Verify inode mode when loading from disk - hfs: validate record offset in hfsplus_bmap_alloc - HID: amd_sfh: Stop sensor before starting - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) - HID: asus: add support for missing PX series fn keys - HID: asus: add Z13 folio to generic group for multitouch to work - HID: core: Harden s32ton() against conversion to 0 bits - HID: elecom: Add support for ELECOM M-XT3URBK (018F) - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - HID: hid-input: Extend Elan ignore battery quirk to USB - HID: hid-input: only ignore 0 battery events for digitizers - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen - HID: intel-ish-hid: Reset enum_devices_done before enumeration - HID: intel-ish-hid: Update ishtp bus match to support device ID table - HID: logitech-dj: Remove duplicate error logging - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL - HID: multitouch: fix name of Stylus input devices - HID: multitouch: fix sticky fingers - HID: playstation: Center initial joystick axes to prevent spurious events - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 - HID: quirks: work around VID/PID conflict for appledisplay - HID: uclogic: Fix potential memory leak in error path - HID: usbhid: paper over wrong bNumDescriptor field - hrtimer: Fix softirq base check in update_needs_ipi() - hrtimer: Remove unused function - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimers: Unconditionally update target CPU base after offline timer migration - hsr: Fix supervision frame sending on HSRv0 - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (ibmpex) fix use-after-free in high/low store - hwmon: (k10temp) Add device ID for Strix Halo - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models - hwmon: (max16065) Use local variable to avoid TOCTOU - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - hwmon: (occ) Mark occ_init_attribute() as __printf - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - hwmon: (sht3x) Fix error handling - hwmon: sy7636a: add alias - hwmon: sy7636a: Fix regulator_enable resource leak on error path - hwmon: (tmp401) fix overflow caused by default conversion rate value - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - hwrng: nomadik - add ARM_AMBA dependency - hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_* - i2c: amd-mp2: fix reference leak in MP2 PCI device - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Add quirk for Intel Xe - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware - i2c: designware: Fix clock issue when PM is disabled - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA - i3c: fix refcount inconsistency in i3c_master_register - i3c: master: Inherit DMA masks and parameters from parent device - i3c: master: svc: Prevent incomplete IBI transaction - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - i40e: add mask to apply valid bits for itr_idx - i40e: add max boundary check for VF filters - i40e: add validation for ring_len param - i40e: fix idx validation in config queues msg - i40e: fix idx validation in i40e_validate_queue_map - i40e: fix input validation logic for action_meta - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path - i40e: fix scheduling in set_rx_mode - i40e: fix validation of VF state in get resources - i40e: improve VF MAC filters accounting - i40e: increase max descriptors for XL710 - i40e: remove redundant memory barrier when cleaning Tx descs - iavf: fix off-by-one issues in iavf_config_rss_reg() - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - IB/sa: Fix sa_local_svc_timeout_ms read race - ice: Avoid detrimental cleanup for bond during interface stop - ice: Don't use %pK through printk or tracepoints - ice: initialize ring_stats->syncp - ice: stop counting UDP csum mismatch as rx_errors - idr: fix idr_alloc() returning an ID out of range - igb: fix link test skipping when interface is admin down - igc: fix race condition in TX timestamp read for register 0 - iio: accel: bmc150: Fix irq assumption regression - iio: accel: fix ADXL355 startup race condition - iio: accel: iis328dq: fix gain values - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: adc: ad7280a: handle spi_setup() errors in probe() - iio: adc: ad9467: fix ad9434 vref mask - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver - iio: adc: exynos_adc: fix OF populate on driver rebind - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: rtq6056: Correct the sign bit index - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains - iio: chemical: scd4x: fix reported channel endianness - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: core: add missing mutex_destroy in iio_dev_release() - iio: core: add separate lockdep class for info_exist_lock - iio: dac: ad5360: use int type to store negative error codes - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - iio: frequency: adf4350: Fix prescaler usage. - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - iio: imu: inv_icm42600: Simplify pm_runtime setup - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: xilinx-ams: Unmask interrupts after updating alarms - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - ima: Handle error code returned by ima_filter_rule_match() - ima: limit the number of ToMToU integrity violations - inet: Avoid ehash lookup race in inet_ehash_insert() - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - inet: ping: Fix icmp out counting - init: handle bootloader identifier in kernel parameters - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - Input: atmel_mxt_ts - allow reset GPIO to sleep - Input: cros_ec_keyb - fix an invalid memory access - Input: goodix - add support for ACPI ID GDIX1003 - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: imx_sc_key - fix memory corruption on unload - Input: iqs7222 - avoid enabling unused interrupts - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak - intel_th: fix device leak on output open() - intel_th: Fix error handling in intel_th_output_open - interconnect: debugfs: Fix incorrect error handling for NULL path - interconnect: debugfs: initialize src_node and dst_node to empty strings - interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS - iomap: account for unaligned end offsets when truncating read range - iomap: adjust read range correctly for non-block-aligned positions - iomap: always run error completions in user context - iomap: factor out a iomap_dio_done helper - iommu/amd: Fix pci_segment memleak in alloc_pci_segment() - iommu/amd/pgtbl: Fix possible race while increase page table level - iommu/amd: Skip enabling command/event buffers for kdump - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/apple-dart: fix device leak on of_xlate() - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal - iommu: disable SVA when CONFIG_X86 is set - iommu/exynos: fix device leak on of_xlate() - iommufd: Don't overflow during division for dirty tracking - iommufd: Make vfio_compat's unmap succeed if the range is already empty - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED - iommu/ipmmu-vmsa: fix device leak on of_xlate() - iommu/mediatek: fix device leak on of_xlate() - iommu/mediatek: fix use-after-free on probe deferral - iommu/mediatek-v1: fix device leak on probe_device() - iommu/mediatek-v1: fix device leaks on probe() - iommu/omap: fix device leaks on probe_device() - iommu/qcom: fix device leak on of_xlate() - iommu/sun50i: fix device leak on of_xlate() - iommu/tegra: fix device leak on probe_device() - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - iommu/vt-d: PRS isn't usable if PDS isn't supported - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - io_uring: backport io_should_terminate_tw() - io_uring: correct __must_hold annotation in io_install_fixed_file - io_uring: fix filename leak in __io_openat_prep() - io_uring: include dying ring in task_work "should cancel" state - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - io_uring: move local task_work in exit cancel loop - io_uring/poll: correctly handle io_poll_add() return value on update - ip6_gre: make ip6gre_header() robust - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - ipmi: Fix handling of messages with provided receive message pointer - ipmi: Fix __scan_channels() failing to rescan channels - ipmi: Fix the race between __scan_channels() and deliver_response() - ipmi: Rework user message limit handling - ipv4: Fix reference count leak when using error routes with nexthop objects - ipv4: ip_gre: make ipgre_header() robust - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe - ipv6: add exception routes to GC list in rt6_insert_exception - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - ipv6: annotate data-race in ndisc_router_discovery() - ipv6: avoid possible NULL deref in modify_prefix_route() - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - ipv6: clear RA flags when adding a static route - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF - ipv6: Fix use-after-free in inet6_addr_del(). - ipv6: np->rxpmtu race annotation - ipv6: use the right ifindex when replying to icmpv6 from localhost - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() - ipvlan: Make the addrs_lock be per port - ipvs: Defer ip_vs_ftp unregister during netns cleanup - ipvs: fix ipv4 null-ptr-deref in route error path - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - irqchip/gic-v3-its: Avoid truncating memory addresses - irqchip/imx-mu-msi: Fix section mismatch - irqchip/irq-bcm7038-l1: Fix section mismatch - irqchip/irq-bcm7120-l2: Fix section mismatch - irqchip/irq-brcmstb-l2: Fix section mismatch - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() - irqchip/qcom-irq-combiner: Fix section mismatch - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - irqchip/sifive-plic: Respect mask state when setting affinity - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() - ixgbevf: Add support for Intel(R) E610 device - ixgbevf: fix getting link speed data for E610 devices - ixgbevf: fix mailbox API compatibility by negotiating supported features - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted - jbd2: ensure that all ongoing I/O complete before freeing blocks - jbd2: fix the inconsistency between checksum and data in memory for journal sb - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key - jbd2: use a weaker annotation in journal handling - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - kallsyms: Fix wrong "big" kernel symbol type read from procfs - kasan: fix GCC mem-intrinsic prefix with sw tags - kasan: refactor pcpu kasan vmalloc unpoison - kbuild: uapi: Strip comments before size type check - kbuild: Use objtree for module signing key path - kconfig: fix static linking of nconf - kconfig/mconf: Initialize the default locale at startup - kconfig/nconf: Initialize the default locale at startup - kernel.h: Move ARRAY_SIZE() to a separate header - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths - kernfs: Fix UAF in polling when open file is released - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - KEYS: trusted_tpm1: Compare HMAC values in constant time - KEYS: X.509: Fix Basic Constraints CA flag parsing - kmsan: fix out-of-bounds access to shadow memory - ksmbd: add max ip connections parameter - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - ksmbd: close accepted socket when per-IP limit rejects connection - ksmbd: fix buffer validation by including null terminator size in EA length - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - ksmbd: Fix memory leak in get_file_all_info() - ksmbd: fix null pointer dereference in alloc_preauth_hash() - ksmbd: Fix race condition in RPC handle list access - ksmbd: fix recursive locking in RPC handle list access - ksmbd: Fix refcount leak when invalid session is found on session lookup - ksmbd: fix use-after-free in ksmbd_session_rpc_open - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - ksmbd: fix use-after-free in session logoff - ksmbd: ipc: fix use-after-free in ipc_msg_send_request - ksmbd: skip lock-range check on equal size to avoid size==0 underflow - ksmbd: smbd: fix dma_unmap_sg() nents - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: transport_ipc: validate payload size before reading handle - ksmbd: use sock_create_kern interface to create kernel socket - ksmbd: vfs: fix race on m_flags in vfs_cache - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - ktest.pl: Fix uninitialized var in config-bisect.pl - kunit: kasan_test: disable fortify string checker on kasan_strings() test - KVM: arm64: Check the untrusted offset in FF-A memory share - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - KVM: Don't clobber irqfd routing type when deassigning irqfd - KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() - KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits - KVM: nSVM: Fix and simplify LBR virtualization handling with nested - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 - KVM: SVM: Fix redundant updates of LBR MSR intercepts - KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN - KVM: SVM: Set synthesized TSA CPUID flags - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 - l2tp: avoid one data-race in l2tp_tunnel_del_work() - lan966x: Fix sleeping in atomic context - leds: flash: leds-qcom-flash: Update torch current clamp setting - leds: led-class: Only Add LED to leds_list when it is fully ready - leds: leds-lp50xx: Allow LED 0 to be added to module bank - leds: leds-lp50xx: Enable chip before any communication - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs - leds: netxbig: Fix GPIO descriptor leak in error paths - leds: spi-byte: Use devm_led_classdev_register_ext() - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - libbpf: Fix reuse of DEVMAP - libceph: fix invalid accesses to ceph_connection_v1_info - libceph: fix potential use-after-free in have_mon_and_osd_map() - libceph: make calc_target() set t->paused, not just clear it - libceph: make decode_pool() more resilient against corrupted osdmaps - libceph: make free_choose_arg_map() resilient to partial allocation - libceph: prevent potential out-of-bounds reads in handle_auth_done() - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - libceph: reset sparse-read state in osd_fault() - libceph: return the handler error from mon_handle_auth_done() - lib/crypto: aes: Fix missing MMU protection for AES S-box - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit - lib/genalloc: fix device leak in of_gen_pool_get() - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map - libperf event: Ensure tracing data is multiple of 8 sized - lib/vsprintf: Check pointer before dereferencing in time_and_date() - livepatch: Match old_sympos 0 and 1 in klp_find_func() - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - lockd: fix vfs_test_lock() calls - locking/spinlock/debug: Fix data-race in do_raw_write_lock - LoongArch: Add machine_kexec_mask_interrupts() implementation - LoongArch: Add more instruction opcodes and emit_* helpers - LoongArch: Add new PCI ID for pci_fixup_vgadev() - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Automatically disable kaslr if boot from kexec_file - LoongArch: BPF: Sign extend kfunc call arguments - LoongArch: BPF: Zero-extend bpf_tail_call() index - LoongArch: Check the return value when creating kobj - LoongArch: Correct the calculation logic of thread_count - LoongArch: Don't panic if no valid cache info for PCI - LoongArch: Enable exception fixup for specific ADE subcode - LoongArch: Fix build errors for CONFIG_RANDSTRUCT - LoongArch: Fix PMU counter allocation for mixed-type event groups - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Mask all interrupts during kexec/kdump - LoongArch: Refactor register restoration in ftrace_common_return - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED - LoongArch: Update help info of ARCH_STRICT_ALIGN - LoongArch: Use correct accessor to read FWPC/MWPC - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - LoongArch: Use __pmd()/__pte() for swap entry conversions - LoongArch: Use UAPI types in ptrace UAPI header - LoongArch: Use unsigned long for _end and _text - loop: Avoid updating block size under exclusive owner - m68k: bitops: Fix find_*_bit() signatures - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse - macvlan: fix error recovery in macvlan_common_newlink() - macvlan: fix possible UAF in macvlan_forward_source() - mailbox: mailbox-test: Fix debugfs_create_dir error checking - mailbox: pcc: don't zero error register - mailbox: pcc: Refactor error handling in irq handler into separate function - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - maple_tree: fix tracepoint string pointers - md/raid5: fix IO hang when array is broken with IO inflight - media: adv7180: Add missing lock in suspend callback - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Only validate format in querystd - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() - media: amphion: Add a frame flush mode for decoder - media: amphion: Cancel message work before releasing the VPU core - media: amphion: Delete v4l2_fh synchronously in .release() - media: amphion: Make some vpu_v4l2 functions static - media: amphion: Remove vpu_vb_is_codecconfig - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove - media: cec: Fix debugfs leak on bus_register() failure - media: cx18: Add missing check after DMA map - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - media: fix uninitialized symbol warnings - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe - media: i2c: imx214: Fix link frequency validation - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - media: i2c: mt9v111: fix incorrect type for ret - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - media: imon: make send_packet() more robust - media: lirc: Fix error handling in lirc_register() - media: mc: Clear minor number before put device - media: mc: Fix MUST_CONNECT handling for pads with no links - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() - media: mediatek: vcodec: Use spinlock for context list protection lock - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: ov08x40: Fix the horizontal flip control - media: pci: ivtv: Add missing check after DMA map - media: pci: ivtv: Don't create fake v4l2_fh - media: pvrusb2: Fix incorrect variable used in trace message - media: rc: fix races with imon_disconnect() - media: rc: st_rc: Fix reset control resource leak - media: redrat3: use int type to store negative error codes - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - media: samsung: exynos4-is: fix potential ABBA deadlock on init - media: st-delta: avoid excessive stack usage - media: TDA1997x: Remove redundant cancel_delayed_work in probe - media: tuner: xc5000: Fix use-after-free in xc5000_release - media: tunner: xc5000: Refactor firmware load - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID - media: uvcvideo: Use heuristic to find stream entity - media: v4l2-mem2mem: Fix outdated documentation - media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: verisilicon: Fix CPU stalls on G2 bus error - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index - media: verisilicon: Store chroma and motion vectors offset - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path - media: vidtv: initialize local pointers upon transfer of memory ownership - media: vpif_capture: fix section mismatch - media: vpif_display: fix section mismatch - media: zoran: Remove zoran_fh structure - mei: me: add nova lake point S DID - mei: me: add wildcat lake P DID - mei: trace: treat reg parameter as string - memcg: fix data-race KCSAN bug in rstats - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - memory tiering: add abstract distance calculation algorithms management - memory tiers: use default_dram_perf_ref_source in log message - memstick: Add timeout to prevent indefinite waiting - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup - mfd: da9055: Fix missing regmap_del_irq_chip() in error path - mfd: da9063: Split chip variant reading in two bus transactions - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: madera: Work around false-positive -Wininitialized warning - mfd: max77620: Fix potential IRQ chip conflict when probing two devices - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path - mfd: rz-mtu3: Fix MTU5 NFCR register offset - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - migrate: correct lock ordering for hugetlb file folios - minixfs: Verify inode mode when loading from disk - minmax: add a few more MIN_T/MAX_T users - minmax: avoid overly complicated constant expressions in VM code - minmax: don't use max() in situations that want a C constant expression - minmax: fix up min3() and max3() too - minmax.h: add whitespace around operators and after commas - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: update some comments - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax: improve macro expansion and type checking - minmax: make generic MIN() and MAX() macros available everywhere - minmax: simplify and clarify min_t()/max_t() implementation - minmax: simplify min()/max()/clamp() implementation - MIPS: Fix a reference leak bug in ip22_check_gio() - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add missing properties to cpu node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - misc: fastrpc: Add missing dev_err newlines - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - misc: fastrpc: Fix fastrpc_map_lookup operation - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Skip reference for DMA handles - misc: genwqe: Fix incorrect cmd field being reported in error - mISDN: annotate data-race around dev->work - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats - mlxsw: spectrum_router: Fix neighbour use-after-free - mlxsw: spectrum_router: Fix possible neighbour reference count leak - mm: add folio_expected_ref_count() for reference count calculation - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() - mm/balloon_compaction: we cannot have isolated pages in the balloon list - mmc: core: SPI mode remove cmd7 - mmc: host: renesas_sdhi: Fix the actual clock - mmc: mvsdio: Fix dma_unmap_sg() nents value - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function - mmc: sdhci-cadence: add Mobileye eyeQ support - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode - mm/damon/core: set quota->charged_from to jiffies at first charge window - mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure - mm/damon/sysfs: fix use-after-free in state_show() - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() - mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() - mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() - mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out() - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() - mm/damon/tests/core-kunit: handle memory failure from damon_test_target() - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm: fix arithmetic for bdi min_ratio - mm: fix arithmetic for max_prop_frac when setting max_ratio - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: check ref_count instead of lru before migration - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - mm: hugetlb: avoid soft lockup when mprotect to large memory area - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/hugetlb: fix folio is still mapped when deleted - mm: introduce and use {pgd,p4d}_populate_kernel() - mm, kfence: describe @slab parameter in __kfence_obj_info() - mm/kfence: randomize the freelist on initialization - mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios - mm/khugepaged: fix the address passed to notifier on testing young - mm: kmsan: fix poisoning of high-order non-compound pages - mm/ksm: fix exec/fork inheritance support for prctl - mm/ksm: fix flag-dropping behavior in ksm_madvise - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - mm: memcg: add per-memcg zswap writeback stat - mm: memcg: add THP swap out info for anonymous reclaim - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: make stats flushing threshold per-memcg - mm: memcg: move vmstats structs definition above flushing code - mm: memcg: optimize parent iteration in memcg_rstat_updated() - mm: memcg: restore subtree stats flushing - mm/memory: do not populate page table entries beyond i_size - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory - mm/memory-tier: fix abstract distance calculation overflow - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/mempool: replace kmap_atomic() with kmap_local_page() - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() - mm: migrate_device: use more folio in migrate_device_finalize() - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - mm/page_alloc: prevent pcp corruption with SMP=n - mm, percpu: do not consider sleepable allocations atomic - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/secretmem: fix use-after-free race in fault handler - mm: simplify folio_expected_ref_count() - mm/truncate: unmap large folio on split failure - mm: workingset: move the stats flush into workingset_test_recent() - most: usb: fix double free on late probe failure - most: usb: Fix use-after-free in hdm_disconnect - most: usb: hdm_probe: Fix calling put_device() before device initialization - mptcp: avoid deadlock on fallback while reinjecting - mptcp: avoid dup SUB_CLOSED events after disconnect - mptcp: avoid unneeded subflow-level drops - mptcp: clear scheduled subflows on retransmit - mptcp: decouple mptcp fastclose from tcp close - mptcp: Disallow MPTCP subflows from sockmap - mptcp: do not fallback when OoO is present - mptcp: drop bogus optimization in __mptcp_check_push() - mptcp: ensure context reset on disconnect() - mptcp: fallback earlier on simult connection - mptcp: fix ack generation for fallback msk - mptcp: fix a race in mptcp_pm_del_add_timer() - mptcp: fix duplicate reset on fastclose - mptcp: fix MSG_PEEK stream corruption - mptcp: fix premature close in case of fallback - mptcp: Fix proto fallback detection with BPF - mptcp: fix race condition in mptcp_schedule_work() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). - mptcp: only reset subflow errors when propagated - mptcp: pm: ignore unknown endpoint flags - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR - mptcp: pm: in-kernel: usable client side with C-flag - mptcp: pm: nl: announce deny-join-id0 flag - mptcp: propagate shutdown to subflows when possible - mptcp: restore window probe - mptcp: schedule rtx timer only after pushing data - mptcp: set remote_deny_join_id0 on SYN recv - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - mptcp: tfo: record 'deny join id0' info - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() - mtdchar: fix integer overflow in read/write ioctls - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds - mtd: nand: raw: atmel: Fix comment in timings preparation - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: relax ECC parameter validation check - mtd: onenand: Pass correct pointer to IRQ handler - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - mtd: rawnand: fsmc: Default to autodetect buswidth - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - mtd: rawnand: stm32_fmc2: fix ECC overwrite - nbd: defer config put in recv_work - nbd: defer config unlock in nbd_genl_connect - nbd: restrict sockets to TCP and UDP - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() - net/9p: fix double req put in p9_fd_cancelled - net: Add locking to protect skb->dev access in ip_output - net: add skb_header_pointer_careful() helper - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - net: allow small head cache usage with large MAX_SKB_FRAGS values - net: Allow to use SMP threads for backlog NAPI. - net: aquantia: Add missing descriptor cache invalidation on ATL2 - net: atlantic: fix fragment overflow handling in RX path - net: bcmasp: fix early exit leak with fixed phy - net: bonding: fix possible peer notify event loss or dup issue - net: bridge: annotate data-races around fdb->{updated,used} - net: bridge: Bounce invalid boolopts - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct - net: bridge: fix MST static key usage - net: bridge: fix static key check - net: bridge: fix use-after-free due to MST port state bypass - net: bridge: Install FDB for bridge MAC on VLAN 0 - net: bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry - net: call cond_resched() less often in __release_sock() - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts - net/cls_cgroup: Fix task_get_classid() during qdisc run - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates - netdevsim: add Makefile for selftests - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - net: dlink: handle copy_thresh allocation failure - net: dlink: handle dma_map_single() failure properly - net: don't touch dev->stats in BPF redirect paths - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: dsa: b53: skip multicast entries for fdb_dump() - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: fix off-by-one in maximum bridge ID determination - net: dsa: hellcreek: fix missing error handling in LED registration - net: dsa: improve shutdown sequence - net: dsa: lantiq_gswip: do also enable or disable cpu port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: microchip: common: Fix checks on irq_find_mapping() - net: dsa: microchip: Fix reserved multicast address table programming - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: lan937x: Fix RGMII delay tuning - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: do not transmit redirected XDP frames when the link is down - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - net: enetc: fix the deadlock of enetc_mdio_lock - net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - net: fec: cancel perout_timer when PEROUT is disabled - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not register PPS event for PEROUT - net: fec: do not update PEROUT if it is enabled - net: fec: ERR007885 Workaround for XDP TX path - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan - netfilter: ipset: Remove unused htable_bits in macro ahash_region - netfilter: nf_conncount: fix leaked ct in error paths - netfilter: nf_conncount: rework API to use sk_buff directly - netfilter: nf_conncount: update last_gc only when GC has been performed - netfilter: nf_reject: don't reply to icmp error messages - netfilter: nf_tables: allow loads only when register is initialized - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - netfilter: nf_tables: fix memory leak in nf_tables_newrule() - netfilter: nf_tables: missing objects with no memcg accounting - netfilter: nf_tables: pass context structure to nft_parse_register_load - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: remove redundant chain validation on register store - netfilter: nft_connlimit: update the count if add was skipped - netfilter: nft_objref: validate objref and objrefmap expressions - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation - netfilter: nft_synproxy: avoid possible data-race on update operation - netfilter: replace -EEXIST with -EBUSY - net: fix memory leak in skb_segment_list for GRO packets - net: fix NULL pointer dereference in l3mdev_l3_rcv - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - net: gro: fix outer network offset - net/handshake: duplicate handshake cancellations leak socket - net/handshake: Fix memory leak in tls_handshake_accept() - net/handshake: restore destructor on submit failure - net: hns3: add VLAN id validation before using - net: hns3: fix data race in hns3_fetch_stats - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - net: hns3: return error code when function fails - net: hns3: using the num_tqps in the vf driver to apply for resources - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx - net: hsr: Add support for MC filtering at the slave device - net: hsr: Add VLAN CTAG filter support - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() - net: hv_netvsc: reject RSS hash key programming without RX indirection table - net: intel: fm10k: Fix parameter idx set but not used - net/ip6_tunnel: Prevent perpetual tunnel growth - net: ipv6: fix field-spanning memcpy warning in AH output - net/ipv6: Remove expired routes with a separated list of routes. - net: lan743x: Allocate rings outside ZONE_DMA - net: lan966x: Fix the initialization of taprio - net: libwx: fix device bus LAN ID - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup - net: liquidio: fix overflow in octeon_init_instr_queue() - net: liquidio: Initialize netdev pointer before queue setup - net: macb: avoid dealing with endianness in macb_set_hwaddr() - net: macb: fix unregister_netdev call order in macb_remove() - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure - net: mdio: aspeed: add dummy read to avoid read-after-write issue - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - net: mdio: fix resource leak in mdiobus_register_device() - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - net/mlx5: Clean up only new IRQ glue on request_irq() failure - net/mlx5: Drain firmware reset in shutdown callback - net/mlx5e: Account for netdev stats in ndo_get_stats64 - net/mlx5e: Consider aggregated port speed during rate configuration - net/mlx5e: Don't print error message due to invalid module - net/mlx5e: Don't query FEC statistics when FEC is disabled - net/mlx5e: Fix maxrate wraparound in threshold between units - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Fix validation logic in rate limiting - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Harden uplink netdev access against device unbind - net/mlx5e: Report rx_discards_phy via rx_dropped - net/mlx5e: Restore destroying state bit after profile cleanup - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload - net/mlx5e: TC, delete flows only for existing peers - net/mlx5e: Use extack in get module eeprom by page callback - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() - net/mlx5: fw reset, add reset timeout work - net/mlx5: fw reset, clear reset requested on drain_fw_reset - net/mlx5: fw_tracer, Handle escaped percent properly - net/mlx5: fw_tracer, Validate format string parameters - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Serialize firmware reset with devlink - net/mlx5: Skip HotPlug check on sync reset using hot reset - net/mlx5: Stop polling for command response if interface goes down - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: mscc: ocelot: Fix crash when adding interface under a lag - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - net: netpoll: ensure skb_pool list is always initialized - net: netpoll: fix incorrect refcount handling causing incorrect cleanup - net: netpoll: flush skb pool during cleanup - net: netpoll: Individualize the skb pool - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write - net: nfc: nci: Add parameter validation for packet data - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy - net: openvswitch: fix data race in ovs_vport_get_upcall_stats - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - net: phy: adin1100: Fix software power-down ready condition - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY - net: phy: clear link parameters on admin link down - net: phy: dp83867: Disable EEE support as not implemented - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - net: phy: fix phy_uses_state_machine() - net: phy: marvell: Fix 88e1510 downshift counter errata - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - netpoll: remove netpoll_srcu - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() - net: ravb: Enforce descriptor type ordering - net: ravb: Ensure memory write completes before ringing TX doorbell - net: Remove conditional threaded-NAPI wakeup based on task state. - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - netrom: fix double-free in nr_route_frame() - netrom: Fix memory leak in nr_sendmsg() - net: rose: fix invalid array index in rose_kill_by_device() - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - net/sched: act_ife: avoid possible NULL deref - net/sched: act_ife: convert comma to semicolon - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net/sched: cls_u32: use skb_header_pointer_careful() - net/sched: Enforce that teql can only be used as root qdisc - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change - net/sched: ets: Remove drr class from the active list if it changes to strict - net_sched: limit try_bulk_dequeue_skb() batches - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop - net/sched: sch_qfq: do not free existing class in qfq_change_class() - net/sched: sch_qfq: Fix null-deref in agg_dequeue - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module - net: sh_eth: Disable WoL if system can not suspend - net/smc: fix mismatch between CLC header and proposal - net: sock: fix hardened usercopy panic in sock_recv_errqueue - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - net: stmmac: Correctly handle Rx checksum offload errors - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - net: stmmac: Fix accessing freed irq affinity_hint - net: stmmac: fix rx limit check in stmmac_rx_zc() - net: stmmac: fix the crash issue for zero copy XDP_TX action - net: stmmac: make sure that ptp_rate is not 0 before configuring EST - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: tls: Cancel RX async resync request on rcd_delta overflow - net: tls: wait for async completion on last message - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - net: update netdev_lock_{type,name} - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - net: usb: asix_devices: Check return value of usbnet_get_endpoints - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock - net: usb: asix: validate PHY address before use - net: usb: dm9601: remove broken SR9700 support - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: pegasus: fix memory leak in update_eth_regs_async() - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast - net: usb: rtl8150: Fix frame padding - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - net: usb: sr9700: fix incorrect command used to write single register - net: usb: sr9700: support devices with virtual driver CD - net: vlan: sync VLAN features with lower device - net: When removing nexthops, don't call synchronize_net if it is not necessary - net: wwan: iosm: Fix memory leak in ipc_mux_deinit() - net: wwan: t7xx: fix potential skb->frags overflow in RX path - nexthop: Forbid FDB status change while nexthop is in a group - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). - nfc: nci: Fix race between rfkill and nci_unregister_device(). - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() - nfp: fix RSS hash key size when RSS is not supported - NFS4: Fix state renewals missing after boot - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags - NFS: Avoid changing nlink when file removes and attribute updates race - NFS: check if suid/sgid was cleared after a write as needed - nfs_common: factor out nfs_errtbl and nfs_stat_to_errno - NFSD/blocklayout: Fix minlength check in proc_layoutget - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap - nfsd: convert to new timestamp accessors - nfsd: decouple the xprtsec policy check from check_nfsd_access() - NFSD: Define a proc_layoutcommit for the FlexFiles layout type - nfsd: don't ignore the return code of svc_proc_register() - nfsd: Drop the client reference in client_states_open() - nfsd: Fix a regression in nfsd_setattr() - NFSD: Fix crash in nfsd4_read_release() - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - NFSD: Fix last write offset handling in layoutcommit - nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr() - NFSD: Fix permission check for read access to executable-only files - NFSD: fix race between nfsd registration and exports_proc - NFSD: free copynotify stateid in nfs4_free_ol_stateid() - nfsd: Mark variable __maybe_unused to avoid W=1 build break - NFSD: Minor cleanup in layoutcommit processing - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: NFSv4 file creation neglects setting ACL - nfsd: provide locking for v4_end_grace - NFSD: Remove NFSERR_EAGAIN - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - NFSD: Rework encoding and decoding of nfsd4_deviceid - nfsd: set security label during create operations - NFSD: use correct reservation type in nfsd4_scsi_fence_client - NFS: enable nconnect for RDMA - NFS: Fix inheritance of the block sizes when automounting - NFS: Fix up the automount fs_context to use the correct cred - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() - NFS: Initialise verifiers for visible dentries in readdir and lookup - NFS: Serialise O_DIRECT i/o and truncate() - NFS: sysfs: fix leak when nfs_client kobject add fails - NFS: trace: show TIMEDOUT instead of 0x6e - NFSv4.1: fix backchannel max_resp_sz verification check - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Don't clear capabilities that won't be reset - NFSv4: ensure the open stateid seqid doesn't go backwards - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4: handle ERR_GRACE on delegation recalls - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - nilfs2: Fix potential block overflow that cause system hang - nios2: ensure that memblock.current_limit is set when setting pfn limits - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot - NTB: epf: Allow arbitrary BAR mapping - ntfs3: Fix uninit buffer allocated by __getname() - ntfs3: fix uninit memory after failed mi_read in mi_format_new - ntfs3: init run lock for extend inode - ntfs3: pretend $Extend records as regular files - ntfs: Do not overwrite uptodate pages - ntfs: set dummy blocksize to read boot_block when mounting - null_blk: fix kmemleak by releasing references to fault configfs items - null_blk: Fix the description of the cache_size module argument - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - nvme-auth: use kvfree() for memory allocated with kvcalloc() - nvme-fc: don't hold rport lock when putting ctrl - nvme-fc: release admin tagset if init fails - nvme-fc: rename free_ctrl callback to match name pattern - nvme-fc: use lock accessing port_state and rport state - nvme: fix admin request_queue lifetime - nvme: fix PCIe subsystem reset controller state transition - nvme-multipath: fix lockdep WARN due to partition scan work - nvme-multipath: Skip nr_active increments in RETRY disposition - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - nvme-pci: disable secondary temp for Wodposit WPBSNM8 - nvme-pci: do not directly handle subsys reset fallout - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-fc: avoid scheduling association deletion twice - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - nvmet-tcp: remove boilerplate code - nvme: Use non zero KATO for persistent discovery connections - objtool: Fix standalone --hacks=jump_label - objtool: Fix weak symbol detection - ocfs2: clear extent cache after moving/defragmenting extents - ocfs2: fix double free in user_cluster_connect() - ocfs2: fix kernel BUG in ocfs2_find_victim_chain - ocfs2: fix memory leak in ocfs2_merge_rec_left() - ocfs2: fix recursive semaphore deadlock in fiemap call - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() - octeon_ep: Fix memory leak in octep_device_setup() - octeontx2-af: Fix error handling - octeontx2: cn10k: fix RX flowid TCAM mask handling - octeontx2: Fix otx2_dma_map_page() error return code - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - of: fix reference count leak in of_alias_scan() - of: platform: Use default match table for /firmware - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - once: fix race by moving DO_ONCE to separate section - openat2: don't trigger automounts with RESOLVE_NO_XDEV - orangefs: fix xattr related buffer overflow... - padata: Reset next CPU when reorder sequence wraps around - page_pool: always add GFP_NOWARN for ATOMIC allocations - page_pool: Clamp pool size to max 16K pages - page_pool: Fix use-after-free in page_pool_recycle_in_ring - parisc: Do not reprogram affinitiy on ASP chip - parisc: don't reference obsolete termio struct for TC* constants - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace - parisc: Remove spurious if statement from raw_copy_from_user() - PCI: Add PCI_VDEVICE_SUB helper macro - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/AER: Support errors introduced by PCIe r6.0 - PCI: brcmstb: Fix disabling L0s capability - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - PCI: Disable MSI on RDC PCI to PCIe bridges - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - PCI: j721e: Fix programming sequence of "strap" settings - PCI: keystone: Exit ks_pcie_probe() for invalid mode - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths - PCI/PM: Skip resuming to D0 if device is disconnected - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI/sysfs: Ensure devices are powered for config reads - PCI/sysfs: Ensure devices are powered for config reads (part 2) - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - perf arm-spe: Extend branch operations - perf arm_spe: Fix memset subclass in operation - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() - perf arm-spe: Rename the common data source encoding - perf evsel: Avoid container_of on a NULL leader - perf evsel: Ensure the fallback message is always written to - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf lock contention: Load kernel map before lookup - perf maps: Add maps__load_first() - perf python: split Clang options when invoking Popen - perf record: skip synthesize event when open evsel failed - perf: sched: Fix perf crash with new is_user_task() helper - perf session: Fix handling when buffer exceeds 2 GiB - perf: Skip user unwind if the task is a kernel thread - perf subcmd: avoid crash in exclude_cmds when excludes is empty - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf test stat: Avoid hybrid assumption when virtualized - perf tools: Add fallback for exclude_guest - perf tools: Fix split kallsyms DSO counting - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - perf util: Fix compression checks returning -1 as bool - perf/x86/amd: Check event before enable to avoid GPF - perf/x86/intel: Correct large PEBS flag check - perf/x86/intel: Do not enable BTS for guests - phy: broadcom: bcm63xx-usbh: fix section mismatches - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - phy: cdns-dphy: Store hs_clk_rate and return it - phy: drop probe registration printks - phy: freescale: imx8m-pcie: assert phy reset during power on - phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it - phy: mscc: Fix PTP for VSC8574 and VSC8572 - phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path - phy: phy-snps-eusb2: refactor constructs names - phy: qcom-qusb2: Fix NULL pointer dereference on early suspend - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() - phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() - phy: rockchip: inno-usb2: fix communication disruption in gadget mode - phy: rockchip: inno-usb2: fix disconnection in gadget mode - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: stm32-usphyc: Fix off by one in probe() - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 - phy: tegra: xusb: fix device and OF node leak at probe - phy: ti: omap-usb2: fix device leak at unbind - phy: ti-pipe3: fix device leak at unbind - phy: Use device_get_match_data() - pid: Add a judgment for ns null in pid_nr_ns - pinctrl: check the return value of pinmux_ops::get_function_name() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - pinctrl: keembay: release allocated memory in detach path - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver - pinctrl: meson-gxl: add missing i2c_d pinmux - pinctrl: meson: mark the GPIO controller as sleeping - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping - pinctrl: qcom: msm: Fix deadlock in pinmux configuration - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins - pinctrl: renesas: Use int type to store negative error codes - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: samsung: Drop unused S3C24xx driver data - pinctrl: single: fix bias pull up/down handling in pin_config_set - pinctrl: single: Fix incorrect type for error return variable - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling - pinctrl: stm32: fix hwspinlock resource leak in probe function - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver - platform/x86: acer-wmi: Ignore backlight event - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led - platform/x86: hp-bioscfg: Fix automatic module loading - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names - platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing - platform/x86: hp-bioscfg: Skip empty attribute names - platform/x86: huawei-wmi: add keys for HONOR models - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic - platform/x86: intel: chtwc_int33fe: don't dereference swnode args - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks - platform/x86: intel: punit_ipc: fix memory corruption - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - platform/x86: intel_telemetry: Fix PSS event register mask - platform/x86: intel_telemetry: Fix swapped arrays in PSS output - platform/x86: msi-laptop: add missing sysfs_remove_group() - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup - pmdomain: imx: Fix reference count leak in imx_gpc_probe() - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state - pmdomain: samsung: plug potential memleak during probe - pmdomain: Use device_get_match_data() - PM: runtime: Add new devm functions - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - PM: sleep: core: Clear power.must_resume in noirq suspend error path - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - posix-clock: introduce posix_clock_context concept - posix-clock: Store file pointer in struct posix_clock_context - powercap: fix race condition in register_control_type() - powercap: fix sscanf() error return value handling - powerpc/32: Fix unpaired stwcx. on interrupt exit - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format - powerpc/64s/radix/kfence: map __kfence_pool at page granularity - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - powerpc/addnote: Fix overflow on 32-bit builds - powerpc/eeh: Use result of error_detected() in uevent - powerpc/kexec: Enable SMT before waking offline CPUs - powerpc, mm: Fix mprotect on book3s 32-bit - powerpc/powernv/pci: Fix underflow and leak issue - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION - powerpc/pseries/msi: Fix potential underflow and leak issue - power: supply: apm_power: only unset own apm_get_power_status - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery - power: supply: bq27xxx: restrict no-battery detection to bq27000 - power: supply: cw2015: Check devm_delayed_work_autocancel() return code - power: supply: cw2015: Fix a alignment coding style issue - power: supply: max77976_charger: fix constant current reporting - power: supply: qcom_battmgr: add OOI chemistry - power: supply: qcom_battmgr: handle charging state change notifications - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() - power: supply: sbs-charger: Support multiple devices - power: supply: wm831x: Check wm831x_set_bits() return value - pps: fix warning in pps_register_cdev when register device fail - proc: fix type confusion in pde_set_flags() - ps3disk: use memcpy_{from,to}_bvec index - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. - ptp: add testptp mask test - ptp: Limit time setting of PTP clocks - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() - pwm: bcm2835: Make sure the channel is enabled after pwm_request() - pwm: berlin: Fix wrong register in suspend/resume - pwm: stm32: Always program polarity - pwm: tiehrpwm: Fix corner case in clock divisor calculation - qed: Don't collect too many protection override GRC elements - quota: remove unneeded return value of register_quota_format - r8152: add error handling in rtl8152_driver_init - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - r8169: fix RTL8117 Wake-on-Lan in DASH mode - r8169: set EEE speed down ratio to 1 - rbd: check for EOD after exclusive lock is ensured to be held - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - RDMA/bnxt_re: fix dma_free_coherent() pointer - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() - RDMA/bnxt_re: Fix the inline size for GenP7 devices - RDMA/bnxt_re: Fix to use correct page size for PDE table - RDMA/cm: Fix leaking the multicast GID table reference - RDMA/cm: Rate limit destroy CM ID timeout error message - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() - RDMA/core: Resolve MAC of next-hop device without ARP support - RDMA/efa: Remove possible negative shift - RDMA/hns: Fix the modification of max_send_sge - RDMA/hns: Fix wrong WQE data when QP wraps around - RDMA/irdma: Add support to re-register a memory region - RDMA/irdma: avoid invalid read in irdma_net_event - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY - RDMA/irdma: Fix data race in irdma_free_pble - RDMA/irdma: Fix data race in irdma_sc_ccq_arm - RDMA/irdma: Fix SD index calculation - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/mlx5: Fix vport loopback forcing for MPV device - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation - RDMA/rtrs: server: Fix error handling in get_or_create_srv - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure - RDMA/rxe: Fix race in do_task() when draining - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests - RDMA/rxe: Remove the direct link to net_device - RDMA/siw: Always report immediate post SQ errors - rds: Fix endianness annotation for RDS_MPATH_HASH - rds: ib: Increment i_fastreg_wrs before bailing out - regmap: Fix race condition in hwspinlock irqsave routine - regmap: maple: free entry on mas_store_gfp() failure - regmap: Remove superfluous check for !config in __regmap_init() - regmap: slimbus: fix bus_context pointer in regmap init calls - regulator: core: disable supply if enabling main regulator fails - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex - regulator: fixed: fix GPIO descriptor leak on register failure - regulator: scmi: Use int type to store negative error codes - regulator: sy7636a: fix lifecycle of power good gpio - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - remoteproc: qcom: q6v5: Avoid handling handover twice - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - reset: fix BIT macro reference - resource: introduce is_type_match() helper and use it - resource: replace open coded resource_intersection() - resource: Reuse for_each_resource() macro - Revert "cpuidle: menu: Avoid discarding useful information" - Revert "driver core: enforce device_lock for driver_match_device()" - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - Revert "gfs2: Fix use of bio_chain" - Revert "iommu/amd: Skip enabling command/event buffers for kdump" - Revert "ipmi: fix msg stack when IPMI is disconnected" - Revert "loop: Avoid updating block size under exclusive owner" - Revert "mtd: rawnand: marvell: fix layouts" - Revert "net: Allow to use SMP threads for backlog NAPI." - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - Revert "net: Remove conditional threaded-NAPI wakeup based on task state." - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Revert "nfc/nci: Add the inconsistency check between the input data length and count" - Revert "nfs: clear SB_RDONLY before getting superblock" - Revert "nfs: ignore SB_RDONLY when mounting nfs" - Revert "nfs: ignore SB_RDONLY when remounting nfs" - Revert "perf dso: Add missed dso__put to dso__load_kcore" - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - Revert "SUNRPC: Don't allow waiting for exiting tasks" - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - Revert "xfrm: destroy xfrm_state synchronously on net exit path" - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - riscv: bpf: Fix uninitialized symbol 'retval_off' - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - riscv: clocksource: Fix stimecmp update hazard on RV32 - riscv: compat: fix COMPAT_UTS_MACHINE definition - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - RISC-V: Don't print details of CPUs disabled in DT - riscv: Improve exception and system call latency - riscv: kprobes: Fix probe address validation - RISC-V: KVM: Fix guest page fault within HLV* instructions - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - RISC-V: Remove unnecessary include from compat.h - riscv: Replace function-like macro by static inline function - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: stacktrace: fix backtracing through exceptions - riscv: uprobes: Add missing fence.i after building the XOL buffer - rocker: fix memory leak in rocker_world_port_post_fini() - rpmsg: glink: fix rpmsg device leak - rseq: Protect event mask against membarrier IPI - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: gamecube: Check the return value of ioremap() - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - rtc: interface: Fix long-standing race when setting alarm - rtc: optee: fix memory leak on driver removal - rtc: pcf2127: clear minute/second interrupt - rtc: pcf2127: fix SPI command byte for PCF2131 backport - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - rtc: rx8025: fix incorrect register reference - rtc: x1205: Fix Xicor X1205 vendor prefix - rtnetlink: Allow deleting FDB entries in user namespace - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target - s390/ap: Don't leak debug feature files if AP instructions are not available - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/cio: Update purge function to unregister the unused subchannels - s390/cpum_cf: Deny all sampling events by counter PMU - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - s390/ctcm: Fix double-kfree - s390/dasd: Fix gendisk parent after copy pair swap - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - s390/ipl: Clear SBP flag when bootprog is set - s390/mm: Fix __ptep_rdp() inline assembly - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump - s390/pci: Restore IRQ unconditionally for the zPCI device - s390/pci: Use pci_uevent_ers() in PCI recovery - s390/smp: Fix fallback CPU detection - samples/ftrace: Adjust LoongArch register restore order in direct calls - samples: work around glibc redefining some of our defines wrong - sched/balancing: Rename newidle_balance() => sched_balance_newidle() - sched/deadline: Fix race in push_dl_task() - sched/deadline: only set free_cpus for online runqueues - sched/fair: Fix pelt lost idle time detection - sched/fair: Forfeit vruntime on yield - sched/fair: Proportional newidle balance - sched/fair: Revert max_newidle_lb_cost bump - sched/fair: Small cleanup to sched_balance_newidle() - sched/fair: Small cleanup to update_newidle_cost() - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - sched: Remove never used code in mm_cid_get() - sched/rt: Fix race in push_rt_task - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep - scs: fix a wrong parameter in __scs_magic - scsi: aic94xx: fix use-after-free in device removal path - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() - scsi: core: Fix a regression triggered by scsi_host_busy() - scsi: core: Fix error handler encryption support - scsi: core: Wake up the error handler when final completions race against each other - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: mpi3mr: Fix controller init failure on fault during queue creation - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - scsi: myrs: Fix dma_alloc_coherent() error check - scsi: pm8001: Use int instead of u32 to store error codes - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod - scsi: pm80xx: Fix race condition caused by static variables - scsi: qla2xxx: Allow recovery for tape devices - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: edif: Fix dma_free_coherent() size - scsi: qla2xxx: edif: Fix incorrect sign of error code - scsi: qla2xxx: Fix improper freeing of purex item - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Query FW again before proceeding with login - scsi: qla2xxx: Sanitize payload size to prevent member overflow - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp - scsi: qla2xxx: Validate sp before freeing associated memory - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - scsi: sg: Do not sleep in atomic context - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls - scsi: smartpqi: Fix device resources accessed after device removal - scsi: stex: Fix reboot_notifier leak in probe error path - scsi: storvsc: Process unsupported MODE_SENSE_10 - scsi: target: Do not write NUL characters into ASCII configfs output - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - scsi: target: Reset t_task_cdb pointer in error case - scsi: target: target_core_configfs: Add length check to avoid buffer overflow - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error - scsi: ufs: core: Disable timestamp functionality if not supported - scsi: ufs: core: Fix EH failure after W-LUN resume error - scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() - sctp: avoid NULL dereference when chunk data buffer is missing - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). - sctp: Fix MAC comparison to be constant-time - sctp: Hold RCU read lock while iterating over address list - sctp: Hold sock lock while iterating over address list - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: Prevent TOCTOU out-of-bounds write - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - selftest/ptp: update ptp selftest to exercise the gettimex options - selftests: arg_parsing: Ensure data is flushed to disk before reading. - selftests: arm64: Check fread return value in exec_target - selftests: bonding: add delay before each xvlan_over_bond connectivity check - selftests: bonding: add ipvlan over bond testing - selftests: bonding: add missing build configs - selftests: bonding: Add more missing config options - selftests/bpf: Check for timeout in perf_link test - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - selftests/bpf: Fix failure paths in send_signal test - selftests/bpf: Improve reliability of test_perf_branches_no_hw() - selftests/bpf: make arg_parsing.c more robust to crashes - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - selftests: Disable dad for ipv6 in fcnal-test.sh - selftests: drv-net: fix RPS mask handling for high CPU numbers - selftests: fib_nexthops: Fix creation of non-FDB nexthops - selftests/ftrace: traceonoff_triggers: strip off names - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: check no dup close events after error - selftests: mptcp: check subflow errors in close events - selftests: mptcp: connect: catch IO errors on listen side - selftests: mptcp: connect: fix fallback note due to OoO - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: disable add_addr retrans in endpoint_tests - selftests: mptcp: join: endpoints: longer transfer - selftests: mptcp: join: fix local endp not being tracked - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: properly kill background tasks - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: join: validate C-flag + def limit - selftests: mptcp: pm: ensure unknown flags are ignored - selftests: mptcp: sockopt: fix error messages - selftests: mptcp: userspace pm: validate deny-join-id0 flag - selftests: net: amt: wait longer for connection before sending packets - selftests/net: convert fib-onlink-tests.sh to run it in unique namespace - selftests/net: convert sctp_vrf.sh to run it in unique namespace - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - selftests: netdevsim: set test timeout to 10 minutes - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests: net: fib-onlink-tests: Convert to use namespaces by default - selftests: net: fix "buffer overflow detected" for tap.c - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - selftests: net: fix server bind failure in sctp_vrf.sh - selftests: net: local_termination: Wait for interfaces to come up - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - selftests: net: replace sleeps in fcnal-test with waits - selftests: net: use BASH for bareudp testing - selftests/net: use destination options instead of hop-by-hop - selftests/nolibc: fix EXPECT_NZ macro - selftests: openvswitch: Fix escape chars in regexp. - selftests: Replace sleep with slowwait - selftests: traceroute: Use require_command() - selftests/tracing: Run sample events to clear page cache events - selftests/user_events: fix type cast for write_index packed member in perf_test - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - serial: 8250_dw: handle reset control deassert error - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_pci: Fix broken RS485 for F81504/508/512 - serial: add support of CPCI cards - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - serial: max310x: Add error checking in probe() - serial: sc16is7xx: fix bug in flow control levels init - serial: sc16is7xx: refactor EFR lock - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - serial: sc16is7xx: remove useless enable of enhanced features - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready - serial: stm32: allow selecting console when the driver is module - sfc: fix potential memory leak in efx_mae_process_mport() - shmem: fix tmpfs reconfiguration (remount) when noswap is set - slimbus: core: fix device reference leak on report present - slimbus: core: fix runtime PM imbalance on report present - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - smack: fix bug: unprivileged task can create labels - smb: client: fix cifs_pick_channel when channel needs reconnect - smb: client: fix crypto buffers in non-linear memory - smb: client: fix incomplete backport in cfids_invalidation_worker() - smb: client: fix memory leak in cifs_construct_tcon() - smb/client: fix memory leak in smb2_open_file() - smb: client: fix missing timestamp updates after utime(2) - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value - smb/client: fix NT_STATUS_NO_DATA_DETECTED value - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value - smb: client: fix potential cfid UAF in smb2_query_info_compound - smb: client: fix potential UAF in smb2_close_cached_fid() - smb: client: Fix refcount leak for cifs_sb_tlink - smb: client: fix refcount leak in smb2_set_path_attr - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path - smb: client: fix wrong index reference in smb2_compound_op() - smb: client: introduce close_cached_dir_locked() - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - smb: client: transport: avoid reconnects triggered by pending task work - smb: client: validate change notify buffer before copy - smb: fix invalid username check in smb3_fs_context_parse_param() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: don't use delayed_work for post_recv_credits_work - smb: server: fix IRD/ORD negotiation with the client - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - smb/server: fix possible memory leak in smb2_read() - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix refcount leak in parse_durable_handle_context() - smb/server: fix refcount leak in smb2_open() - smb/server: fix return value of smb2_ioctl() - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - smc91x: fix broken irq-context in PREEMPT_RT - smp: Fix up and expand the smp_call_function_many() kerneldoc - smsc911x: add second read of EEPROM mac when possible corruption seen - soc: amlogic: canvas: fix device leak on lookup - soc: aspeed: socinfo: Add AST27xx silicon IDs - soc: qcom: ocmem: fix device leak on lookup - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: qcom: smem: fix hwspinlock resource leak in probe error paths - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - sparc64: fix hugetlb for sun4u - sparc64: fix prototypes of reads[bwl]() - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix error handling in scan_one_device() - sparc/module: Add R_SPARC_UA64 relocation handling - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: cadence-quadspi: Fix clock disable on probe failure path - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - spi: cadence-quadspi: Implement refcount to handle unbind during busy - spi: fsl-cpm: Check length parity before switching to 16 bit mode - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - spi: imx: keep dma request disabled before dma transfer setup - spi: loopback-test: Don't use %pK through printk - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: rpc-if: Add resume support for RZ/G3E - spi: spi-mem: Add a new controller capability - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-nxp-fspi: add extra delay after dll locked - spi: spi-sprd-adi: Fix double free in probe error path - spi: sprd-adi: switch to use spi_alloc_host() - spi: sprd: adi: Use devm_register_restart_handler() - spi: tegra114: Preserve SPI mode bits in def_command1_reg - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - spi: tegra210-quad: Fix timeout handling - spi: tegra210-quad: Move curr_xfer read inside spinlock - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer - spi: tegra: Fix a memory leak in tegra_slink_probe() - spi: Try to get ACPI GPIO IRQ earlier - spi: xilinx: increase number of retries before declaring stall - Squashfs: add additional inode sanity checking - Squashfs: fix uninit-value in squashfs_get_parent - Squashfs: reject negative file sizes in squashfs_read_inode() - staging: axis-fifo: fix maximum TX packet length check - staging: axis-fifo: fix TX handling on copy_from_user() failure - staging: axis-fifo: flush RX FIFO on read errors - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() - staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0 - staging: most: remove broken i2c driver - staging: rtl8712: Remove driver using deprecated API wext - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing - strparser: Fix signed/unsigned mismatch bug - SUNRPC: call xs_sock_process_cmsg for all cmsg - sunrpc: fix null pointer dereference on zero-length checksum - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - svcrdma: bound check rq_pages index in inline path - svcrdma: return 0 on success from svc_rdma_copy_inline_range - task_work: Fix NMI race condition - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - tcp: fix __tcp_close() to only send RST when required - tcp: fix tcp_tso_should_defer() vs large RTT - tcpm: allow looking for role_sw device in the main node - tcpm: switch check for role_sw device with fw_node - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - team: fix check for port enabled in team_queue_override_port_prio_changed() - team: Move team device type change at the end of team_port_add - tee: allow a driver to allocate a tee_device without a pool - testptp: Add option to open PHC in readonly mode - textsearch: describe @list member in ts_ops search - tg3: prevent use of uninitialized remote_adv and local_adv variables - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - thunderbolt: Add support for Intel Wildcat Lake - thunderbolt: Use is_pciehp instead of is_hotplug_bridge - timers: Fix NULL function pointer race in timer_shutdown_sync() - tipc: Fix use-after-free in tipc_mon_reinit_self(). - tipc: use kfree_sensitive() for session key material - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx - tls: always set record_type in tls_process_cmsg - tls: don't rely on tx_work during send() - tls: make sure to abort the stream if headers are bogus - tls: trim encrypted message to match the plaintext on short splice - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). - tls: wait for async encrypt in case of error during latter iterations of sendmsg - tls: wait for pending async decryptions if tls_strp_msg_hold fails - tools bitmap: Add missing asm-generic/bitsperlong.h include - tools build: Align warning options with perf - tools/cpupower: fix error return value in cpupower_write_sysfs() - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - tools: lib: thermal: don't preserve owner in install - tools: lib: thermal: use pkg-config to locate libnl3 - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/testing/nvdimm: Use per-DIMM device handle - tools: ynl: Specify --no-line-number in ynl-regen.sh. - tpm: Cap the number of PCR banks - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - tracefs: fix a leak in eventfs_create_events_dir() - tracing: Do not register unsupported perf events - tracing: dynevent: Add a missing lockdown check on dynevent - tracing: Fix crash on synthetic stacktrace field usage - tracing: Fix fixed array of synthetic event - tracing: Fix ftrace event field alignments - tracing: Fix memory leaks in create_field_var() - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference - tracing: Fix tracing_marker may trigger page fault during preempt_disable - tracing: Silence warning when chunk allocation fails in trace_pid_write - tracing/tools: Fix incorrcet short option in usage text for --threads - tty: fix tty_port_tty_*hangup() kernel-doc - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - tty: introduce and use tty_port_tty_vhangup() helper - tty: n_gsm: Don't block input queue by waiting MSC - tunnels: reset the GSO metadata before reusing the skb - uacce: ensure safe queue release with state management - uacce: fix cdev handling in the cleanup path - uacce: fix isolate sysfs check condition - uacce: implement mremap in uacce_vm_ops to return -EPERM - ublk: complete command synchronously on error - ublk: fix deadlock when reading partition table - ublk: make sure io cmd handled in submitter task context - ublk: prevent invalid access with DEBUG - udp_tunnel: use netdev_warn() instead of netdev_WARN() - uio_hv_generic: Let userspace take care of interrupt mask - uio_hv_generic: Set event for all channels on the device - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe - um: Fix help message for ssl-non-raw - um: virtio_uml: Fix use-after-free after put_device in probe - Unbreak 'make tools/*' for user-space targets - uprobe: Do not emulate/sstep original instruction when ip is changed - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - usb: cdns3: Fix double resource release in cdns3_pci_probe - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget - usb: chaoskey: fix locking for O_NONBLOCK - usb: core: Add 0x prefix to quirks debug output - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor - usb/core/quirks: Add Huawei ME906S to wakeup quirk - usb: dwc2: disable platform lowlevel hw resources during shutdown - usb: dwc2: fix hang during shutdown if set as peripheral - usb: dwc2: fix hang during suspend if set as peripheral - usb: dwc3: Check for USB4 IP_NAME - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: keep susphy enabled during exit to avoid controller faults - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: dwc3: pci: Sort out the Intel device IDs - USB: Fix descriptor count when handling invalid MBIM extended descriptor - usb: gadget: configfs: Correctly set use_os_string at bind - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - usb: gadget: f_hid: Fix zero length packet transfer - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: lpc32xx_udc: fix clock imbalance in error path - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - usb: gadget: Store endpoint pointer in usb_request - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - usbip: Fix locking bug in RT-enabled kernels - USB: lpc32xx_udc: Fix error handling in probe - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - usbnet: Fix using smp_processor_id() in preemptible code warnings - usbnet: limit max_mtu based on device's hard_mtu - usbnet: Prevents free active kevent - usb: ohci-nxp: fix device leak on probe failure - usb: ohci-nxp: Use helper function devm_clk_get_enabled() - USB: OHCI/UHCI: Add soft dependencies on ehci_platform - usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal - usb: phy: Initialize struct usb_phy list_head - usb: phy: isp1301: fix non-OF device reference imbalance - usb: phy: twl6030: Fix incorrect type for ret - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - usb: raw-gadget: do not limit transfer length - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() - usb: renesas_usbhs: Fix synchronous external abort on unbind - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - USB: serial: ftdi_sio: match on interface number for jtag - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC - USB: serial: option: add Foxconn T99W760 - USB: serial: option: add Quectel RG255C - USB: serial: option: add SIMCom 8230C compositions - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: option: add Telit Cinterion FE910C04 new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Telit LE910 MBIM composition - USB: serial: option: add UNISOC UIS7720 - USB: serial: option: move Telit 0x10c7 composition in the right place - usb: storage: Fix memory leak in USB bulk transport - USB: storage: Remove subclass and protocol overrides from Novatek quirk - usb: storage: sddr55: Reject out-of-bound new_pba - usb: typec: tipd: Clear interrupts first - usb: typec: ucsi: Handle incorrect num_connectors capability - usb: typec: ucsi: psy: Set max current to zero when disconnected - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer - usb: udc: Add trace event for usb_gadget_set_state - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. - usb: vhci-hcd: Prevent suspending virtually attached devices - usb: xhci: Apply the link chain quirk on NEC isoc endpoints - usb: xhci: limit run_graceperiod for only usb 3.0 devices - usb: xhci: move link chain bit quirk checks into one helper function. - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - vdpa/pds: use %pe for ERR_PTR() in event handler registration - veth: fix data race in veth_get_ethtool_stats - vfio/pds: replace bitmap_free with vfree - vfio: return -ENOTTY for unsupported device feature - vfs: Don't leak disconnected dentries on umount - vhost: Take a reference on the task in struct vhost_task. - vhost: vringh: Fix copy_to_iter return value check - vhost: vringh: Modify the return value check - vhost/vsock: improve RCU read sections around vhost_vsock_get() - via_wdt: fix critical boot hang due to unnamed resource allocation - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - virtio_console: fix order of fields cols and rows - virtio: fix typo in virtio_device_ready() comment - virtio: fix virtqueue_set_affinity() docs - virtio: fix whitespace in virtio_config_ops - virtio-net: fix incorrect flags recording in big mode - virtio-net: fix received length check in big packets - virtio_vdpa: fix misleading return in void function - vmxnet3: unregister xdp rxq info in the reset path - vsock: fix lock inversion in vsock_assign_transport() - vsock: Ignore signal/timeout on connect() if already established - vsock/test: add a final full barrier after run all tests - vsock/test: fix seqpacket message bounds test - vsock/test: verify socket options after setting them - vsock/virtio: cap TX credit to local buffer size - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - w1: fix redundant counter decrement in w1_attach_slave_device() - w1: therm: Fix off-by-one buffer overflow in alarms_store - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - watchdog: starfive: Fix resource leak in probe error path - watchdog: wdat_wdt: Fix ACPI table leak in probe function - wifi: ath10k: avoid unnecessary wait for service ready message - wifi: ath10k: Fix connection after GTK rekeying - wifi: ath10k: fix dma_free_coherent() pointer - wifi: ath10k: Fix memory leak on unsupported WMI command - wifi: ath11k: Add missing platform IDs for quirk table - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode - wifi: ath11k: fix peer HE MCS assignment - wifi: ath11k: fix RCU stall while reaping monitor destination ring - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - wifi: ath12k: fix dma_free_coherent() pointer - wifi: ath12k: free skb during idr cleanup callback - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - wifi: avoid kernel-infoleak from struct iw_point - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - wifi: cfg80211: Fix bitrate calculation overflow for HE rates - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() - wifi: ieee80211: correct FILS status codes - wifi: mac80211: collect station statistics earlier when disconnect - wifi: mac80211: correctly check if CSA is active - wifi: mac80211: Discard Beacon frames to non-broadcast address - wifi: mac80211: do not use old MBSSID elements - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice - wifi: mac80211: fix CMAC functions not handling errors - wifi: mac80211: Fix HE capabilities element check - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - wifi: mac80211: increase scan_ies_len for S1G - wifi: mac80211: move TDLS work to wiphy work - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined - wifi: mac80211: reject address change while connecting - wifi: mac80211: remove RX_DROP_UNUSABLE - wifi: mac80211: skip rate verification for not captured PSDUs - wifi: mt76: Fix DTS power-limits on little endian systems - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() - wifi: mwifiex: send world regulatory domain to driver - wifi: rsi: Fix memory corruption due to not set vif driver data size - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - wifi: rtw88: sdio: use indirect IO for device registers before power-on - wifi: rtw89: avoid circular locking dependency in ser_state_run() - wifi: virt_wifi: Fix page fault on connect - wifi: wilc1000: avoid buffer overflow in WID string configuration - wifi: wlcore: ensure skb headroom before skb_push - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 - x86/boot: Fix page table access in 5-level to 4-level paging transition - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - x86: disable image size check for test builds - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - x86/fpu: Ensure XFD state on signal delivery - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers - x86/kfence: avoid writing L1TF-vulnerable PTEs - x86/kfence: fix booting on 32bit non-PAE systems - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - x86: make page fault handling disable interrupts properly - x86/microcode/AMD: Add more known models to entry sign checking - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - x86/microcode/AMD: Limit Entrysign signature checking to known generations - x86/microcode/AMD: Select which microcode patch to load - x86/microcode: Fix Entrysign revision check for Zen1/Naples - x86/ptrace: Always inline trivial accessors - x86/resctrl: Add missing resctrl initialization for Hygon - x86/resctrl: Fix memory bandwidth counter width for Hygon - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - x86/umip: Check that the instruction opcode is at least two bytes - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) - x86/vdso: Fix output operand size of RDPID - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - x86/xen: Fix sparse warning in enlighten_pv.c - x86/xen: Move Xen upcall handler - xen/events: Cleanup find_virq() return codes - xen/events: Return -EEXIST for bound VIRQs - xen/events: Update virq_to_irq on migration - xen/manage: Fix suspend error path - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - xfrm: Determine inner GSO type from packet inner protocol - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - xfrm: flush all states in xfrm_state_fini - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: state: fix out-of-bounds read during lookup - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfs: always warn about deprecated mount options - xfs: fix a memory leak in xfs_buf_item_init() - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - xfs: use deferred intent items for reaping crosslinked blocks - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: decouple endpoint allocation from initialization - xhci: dbc: enable back DbC in resume if it was enabled before suspend - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: poll at different rate depending on data transfer activity - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - xhci: dbgtty: fix device unregister - xhci: dbgtty: fix device unregister: fixup - xhci: fix memory leak regression when freeing xhci vdev devices depth first - xsk: Fix race condition in AF_XDP generic RX path - xtensa: simdisk: add input size check in proc_write_simdisk - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Patch from Hans to fix SYNA3602 touchpads- Update initrd size (kb#456)6.6.148-1.module.8821au6.6.148-16.6.148-15.12.5.2_0_g78821au.ko/lib/modules/6.6.148-desktop-1rosa2021-x86_64/kernel/net/wireless/-O2 -fomit-frame-pointer -gdwarf-4 -Wstrict-aliasing=2 -pipe -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -fPIC -fstack-protector-strong --param=ssp-buffer-size=4 -m64 -mtune=generichttps://rosa.rucpioxz6Tx86_64-rosa-linux-gnuELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=abc121808d7c9bc1c3ceabc6d8fba54b7c2b7bf8, not strippedPooorosa2021https://bugzilla.rosa.rubasesystem-minimalfilesystemsetup@@@utf-824a8ef01842911253783ad655a185c02541b7ae10fb161472f34b44792a3de39c463a075a03ce13a6da8231b0cacfc039f444463186fad977de0ab0e7b773cc6?7zXZ 2!np] crv(vX0bRb(E+fza8gsk2XPRMEte jm#V2SZx 0caygSruZ]נH~LDw 8kn֔#·ۢ|BΩ_Ӗ>4B 5^t6o@bKG4}8҈^ozy18q:-สq^Lb%Dٺ|ל7BwLОQqbSj ~63(+m1ݷ|wێL}ҟZà73$^wqg/*V˾UiʜXŎDu7|#Q;~%5݄O[ ꭸI,mP/x]ozhk]";%֗}l(HYgT@eEU-0.fes$}LƸ>l +$'r*abښ@@a we#{>h? n "YopN12Gކ'0}m9do&wkTv ~K!" 8UQK> 'I>6Ed06}!F:.}|;BabȪҡ(#KUgX2*ՋVQq\_-Ln°.Atde$1O(Vv5(~x=g|>VgdS-H2iS]FY R& 3C9Cl;k_^qrx+a [%eT!7/1z \x(h5DQAPKY=9}F`뺚3ӻم!]=$eX#Pﯟ87jTv ˝G0WP.z5#b{-dԿ,ܴW9cGʰDZX]BѨE3"3U tVLܬp;lE4#D$F]{VPC+jyV@T28{)h$)JtJś^ f@ٴx-9@Y`K"ޡTD(xC)F'y : )ԐMr} @ϗk58WRߎVp=.ZP;Ye4H 62*\cL- 5SpV0J~>Jҁn#} (]`/F̨n=%f>gkC!iqWZ@Ƶ{i⬧u9Ǡ"#v^Yv8'V B;Rg7@UE مߢY|o.jǴQ&+@+#b-ٽ>i$rWυY(\S2:V!GV45+2_{` ]~<=r UzBjbeך󣁾,K#~⚌Z {{p^nBumrn OEh;%~0rNw_grXr6CK>ȩa +t,'R̖vb8)NuPO4_bk}\U]~iaihr qJ!(\ 79Z:9-ºWO4.˜~CMY֯<#7Jg9故a/+Kyx`cPƪfTb9[^3tz!<:'rt03;܏ (ɣWpT+AA .d&"3(wt BsaI( /٪[.ΝkWAڜnEV(ykmXNJ`9ȼO٪/u{ '6Wt.<|rdt; B~ nwj%׈CqQHeF^jW{L֫㋘^$R/oWjH)dYɚJ7y͏2oZb]B/r)t<4GË~dA;-[&c> UNZ1|5QcZݦ+[S. Wc5)tG۰zOn&=[+qԥGOǸ97M(J6!0r /wreYHZtAewnIToqLQһlFѣʷ0Y ;/Ƙa8UHˋ]{=o5'p#dV]z7*W~KEAL, Qa(7(]HEi \#k8^pZ1[-^E'ϛNxV 3E@FfnkS=:HdG3+0S1.fk^<>BN1G ܹQZWϭ<%FIic˭=oӝ[ OM|x#51Vk'qO5dј r^HK6/?%:c }1ζ#uy> }{/Pp.Y(cGy>HdQ5{?T5rt7BUiWܮПq-F.߸0 ȑ^^)`?stTYۛy.Wd5ɗ+[Kqئ+`JLOe odcL P~6ȔyWfZQ+WnɆ_8y3nu-E6FxB+aSeC0^$ mцp OAiہ]= ZϐvP'p2.!03KUlz*W"xUue׭x;W#H {#Q ťCEܔza}& g.n;Sd)!,`BV()Ҕě /i1$RT yNVtoTy2hdk׸(YTаz%kuFR23T'CRJUv7ؖokHK#!̊kjδ EF6=j*t֚?«᚜@}9GCRC*ˤLbtL O+\Sy8%vJwL$0K02o+,j)K6xj.8oM',/o+9Īfs3<$Eh2}_^wsz L۶UrQ,-11ڀ]tm7#cG5IhӼ*eq䀦B݄;hu\ufku툣 ?M=?%2;{C4O'}U~;.wB}-*ڶ&aǡ$ ohi=J_m@Cj_tl#x\!¿w Z91fQկWΫQEK7En:Mr%GLմV@4|13rGdʤmBd}>+z*4"ؠ?c [Y, >K\{ǑYx/dMHʒXı'`43C|JMFENj[rjNmh`SC߾K%'oUzh#J >!la]3NBҘԘ1PmٹV0_4Q9xd5^SdQ Z뇺Vl۴e?]|)Hcua=^szyluJIC_̮ݫ0-j9"|RM~pvyI\ =H*O0]ڷxdtgUGI]`ݠײMRZ_~٧._In!I8U)h6nɄ<IJ/!aXIjF zXQ<<dh<*}ҫ@f[oZ"LRmA[!:|D 6fJOs:^tuupY#}4r@ĵea 3gȱz(S7S)ly;> mI0&yWoGlSҖ4ScN/foN[HUjުj#P9@_mT^ V@asvdNdv1 }ӎ+^ t CbUKC=B|Nq kD"'))MS'VaT:\-49T.eVI1SOoR>> n3CY0jW;rXKUK;mxk#I6Df M˴{K;kn, IaYr0(+^T0ѐC713&ܺLT5Ie`w3+X Q^()V'$ۑeI--߱KjIK :.`JEt9cp[Kp5S!¨nyR _''.O\$#iQ":iWD&dAZW+bvL ,(obÝ74Wc=(IK_hJɧ!3TGcy)f~?u ^{܊hjElT2_8MQjIR2IYPN^a (oG.[rڸ&Td7[ ~!% ]c!Ueȓ W^^.`kVxJ ևa[PxtrLyWL14QQ+J!oE6!jöHʙg "#: +e2sl a!WjlȬQ1>W2%JБDZ(B vn;fy](7"\yke*R+z"xF["qǦ\mje.40\#FcAzBI47+_H_`/,fTJت y\ NꔔQ6yH"-`~ C0oQ[\T8OrNNE;jS̽wf0PKr!M*OG:pu!ijT9N{t,7s΄e(\,? !k;l^P?\nĘ*bs[PMyOsm(3)Чst JY9>b'3Wzx=[" Qi3\GYTY=.ISD^T5+ڔҭqLVEm2M|\gLr"Eb~8R4qMf%kӖ?i1XlEocD#:$pd-0Vq+V$%ڇ\0Q:2_vn|ܷuI- z+E\hrgXAc0ٲ3{0x$C2A1՟B)zC`")'}+pkL\rq@XmE&B%n$mP1\Ԙ>ۛ!-siV3B#6[#4-镅njP-hvq5΁{]T]CD3ecݺ6u)n͕H٦% h,^DHHPq]P{2FF"~W&x3+ )ו*sV.>LfZdJ@=Q*}_G+KxlvOc6 /g?໘&uJ(u+֓%RB#*qk҉uv3#TaF긡vgLhr詘oLOE)+Q7VdI !}3WMf|!voN6=Kgg\De砭`~t =qR-I2 ( ՉkXZwV\ #Ȥr逹i\;2fvEaњuH ˋ^V _0A;/.zW7o1)̜pR~TXHrM8{U8oQy#+pfYCnX4=CXR*%T~˹1!NoIEwX[1ۆlCG'!` VLay`,tH7`T@`tj,!bŽ`{bʝE`-L( U0B@wZ X oJtC;xΞ\>4"y0ůf8̦f>3~IBrIc8~)W,-g{TEFSKүKrh?Z{s0z:;1 b#Z!&p%qJosFo;3淔cr|Y( $m~! Z"ޟ>TX U QA"Ai)+9p=tȴA%M,oқ_M]u:7đb-~n@6 Mh+;ʲa_ 4]jtI[`4Ҝ)(Fr `]\n| p陑d=> Tlܬ9A:ŚzTÕIPv6Fi6kD:jFU挮b zV.5jBd`r(t秮/AuIbR6ZY*뤶xz6AGno<:LʘH}edݫbdF$R{젼%<;u$ EY\L`]#e*[yU{% sRBO!wkavgwBl-ǿ;u< #+->!7m8_҇iҎ;J6{jk^W|8/R.,GvQARkr&Kc"*:#=lV? 3{7I4,Hw*ReEǚG0{<<-1>DlJ6.B; LƨIYbi>J{GT<+Q(g獗'SQ?5zXCz uKs#.~1 GsՎ/¨%W_G |1fmnD}YyGGK_7q ^頄3}bqF/$79t q\ q[H&rҾSv 'l@l)|ph_HyM-~Pt>O m,Ϥ껮B/*A:`A@g,|e{+?ve<ᢪIݢxUg#~)]hډcRrR^$h.)5v:@5['kEԘxH>Ysf SJS9Jw+Ee4LDGm@'+1RrP Fʼn\ndE t 5*$yhĕJ`Fz{@;4q(!=Pc;*X>X<ȀgW7e=Y_MWTߠ&6KEf\AԺ>CD5VXd&}%ًgbX͟ wh_( RY Jw;8NdQ͖o"K)B1] ҩ _JI(Uu2\?%RbUAHB-2K{̼B е5.ב6Ƚg%٠s#|wp dLcN\\<'݂Arj#DwE;եkKp;A3#*!ve0 Hɧ^'-<=B̀쓩On Gujt| qQ?81c)Τ:{TH2 23Hf4ŏY$ІUoB` Iּէg v2X+9~ТgN>  UcI 0wQ^#s w;'?X ;?y\Wix:6z0=1R ^.|߱QaNY?$Uኤe]󻠊fe=3M-׶ߖHj$Bܾ^+>ϮrM7NVgpkYwӚ (HRlC="6:*SY nyR/Q45xa(m"}pby6[K{zO5*qm 79#vq~w5X.s$+2OJbLܨA+?mTu0tnNMacl޴>+lh(Jnsf!tvbC)L)vcUUv!>_eSK{D<0xGho7E5 ܇xGvs&݉+]ٳ]9C)d\)~7@R=a6ԎXdn_P ~Еa?nUSHKJϴFL ?Ӡ";G36,1y# ԩO O@k)FzDkH˥s`U*^%!w7k8S\j海 \Pa;P2pJ3q{>8-1w{嶞\°U4a$=4ӼT7HN:dJV}gbFrQ|}9!VAiD} ESߣ)޼ADQpd M/?%Wjd&WrA= _e2 vU}iHbDc.nJDa aoΩm{sllImj׊%$n^z. phyHUJ'hk;)4 &f*";CL*5lHB16]\>Jjq"aC/q'f??gܺ_,'G8(vMrkobƐzcΖ=\t 88{WdBč+EX?e;w1Mt}C2!+.D%ǐY4R 4®,󑩡Y(,D-x٧O cn ЄeJ7#-ijeѣ︂nyhDQ!6fXhU4iVN4q:$^( >= -8Vˇ ?+f:E({IH hթLP0FC{ tmY @HkczcI~K ,e،5êQd8 fb}gh TCam,T+LT$8 cddhAsv*SS"iJ+F*>/+>wA:H}!B^ +FSZ?ȯLpA ̬ ;sHat.̤DXGL477-CXbOHqev+G=՝1+5يd-VXrUGjp9<c~QmJjқƎ$^1veK?ǝ 8 &[:gV$N幠XrMQ*k"t1L&~ݼ'H~oaWթl(-.CCHؙm{.OTfkyfa z2MƳ}Zvlُ29ªn*r^ 3LLݲ1aTϷxr$kl/+{(l|\䫆a/UZ1/tw;yegbRxj#O&5-&hl8HXb ; LtF{<:p!SJonp0sΟGRع{~lH0a_6i܍Ŏ*&d~3Rjpk5;.'zaAɒp֫IoC8U.%[:5wބvd"&SFL`LB[L `5_T5lWmsr;@n+M a-QmWAG. Q4\XQi7+$OBiu̮%zAO sQp4++]$JGMx4╚Rq[PEUn#񚫊APlϖGUp)޷]88ذyjKyدTb zf]]JqP)sFj sX橂u6?39DlYh4*!3*3Tķk>?^(:Bسv EB GI9{vMPX;EhK!ϴ#*Bo%W#pGSg"d}yJ|G8ޏKLo^nVq:zƂ/"_rw]xgoz6*o&U]C~@'a2 ial:2Hw)"EȯѺ1C O݂c)ꐥ0Y=enaggf>ˁ#?y<9Iɦo =<-3e0W{0uͭnf2 y9Щ-*Pj?XER0(xujv{0 0Ƈ9Kt΄ j'F9k5vu lZ1tǃ6cP L K6V6`kۦBCs8s]kf7[whT1#ho*;!^'Yg7^e@\y^cw3ї{]#ʠӆFs#5P÷+O W>G`IZᤝga&5N#wg2gx [ǝ]7mKvgA<GQb@p\Qjtĥ ś |z[M[7|jh*jmA]7.QGpV 55el@l~@suIy@3GԲ0.x|533JL^a $wmƺ*(-<) &8&YLr!-2>iÜg:C` Ye_uIH+CtXUˤ,sn,5 >}{ " N AgE5~ߴ}[4GE&S} #)n%i MH֊8eF>B; [Ld|Ҵ?$HwNeE[X'wnl>n ~yyNE&X? ^Tl3?^-ʵi;|3pӎRdha b>LDҏ*RR8}VU T:(_~ ]uk"0T~Xgތ9#Cmxͱ %hɨ? V]Ⱥ<{$4Z! F?(e= Z[_qE  x? fPb槃HQ.%llYʻO]XYWkLP= d }D7x*&"lMeݝ`US"BXpp D"q+s!%H4(_FaQV8 ETymi o&̎ynLl%T٭B>+XWթtAײrf*GTɐ !DPdB"…'Dm͵W zef[epah~>EԎ6J@ lY^:AR9$~1c(5 G4r byyag׏=omucVλ:ءN"z\d P) b•7V|;Lc@NV.EWpH_C{}*\B0wƭUnB4sK\aK~"vřr[A%JF̚9D.$K2HKF|b>쒈)PL{N6xE Uf0Rkr)qAVO l]h3 @ikڇb9c`!r%|/g',5|,Yυ"m*)Za&M'@#2_Kn<%q,, Vy34`X}+ΌrL="7"M;^@Da` _ $Kxz^)i|?^8v8Pn/M%[ _Ih}F;@"}%Y6Adax+:IAUj&}rT)X'Y@DH !CUDvĶtrCcخaXvཕqS'm+z}Ŭ2 ])TZAVVk5r}tfKXϊ~'%ȍ\\k H0\q4p${Cg5(368me1[y%x\EhmʤʇNY8SZ;~Nvh/,A\}!2.9u񷣍gt#.FLRI}ajWn:5@ChPLNRi[]Q[Zs3/rj~}3̱U3J4<9~!)Mz#>}Nh5E d !e d,2ml!12KvueQ Iq9l,YUQB$UK1@='n/iWO`A.D*چC&%ߙOkNEG}&}ԙNYkt~&ίspɘHz&kkXPXסBգqʕPSa9zVaÅ+T2Uc&d)UbLmZ/DBV| 3,X!S"&ٙS)yU_M88xޥn l ~\Nvt0`ތ̓LS[ 0'17̃ .%M2k`W^:1R{]KHEyQeh6RE4oC*Cv #K:u ;I; >*>\+|'xUgd #f-iM|eH(7^!~K2mԃ[%@$M"Y%}"3s9Hjy؟":u:s2t[Nr+Οw +{ᔏۜ)u*0 ى l4pU0+Jni=|?`VXuV|ݚEix/m ,A4E)vW$PJRiUG1fAecGYRPxS/)Z?a߹a ̮¶Qh~E~~L L LF#8r :dE-w3:`FIq"_ULazR|~59w?3լ3/օUMIbFm<ƶPBL 2UCRo;[5RBtmFTÍ'qtw:Is2'JVy6FBcҌON8qp]#L,r8iE~ЎtY,7RaWJ|OrDDtض?ѭ7Mzo[/.߄Cی5t)ϜEmM{{S 0).`kU^D3}r KB&mr(5R](}.FL%e Ngr dV@W#%N]6 Jr#W!B #>վ2|"4zU+&ްJ_-Jj[9g2r•hBl/c^Rmg߶(Ed  sqȡB j|:aawY2ܳQFR; 1v`ZdD||: #''ٟq xC^29ZRŧ6H˕ad@KB3BR{ZPT]8MtPZS 7+8?6!&ȤIჽ#(`+eqL)3=m76غ>N& >[Ft9Uk-؁Ju~2w(#YoB+jLFy%& h&C!g6ik(Q|O4Y,eΆ7*;k=g%bF2ƦIW-Q韧 |*A_@Ólp2(˜c& 3mޡJԅ͇OK|Ek 71)zHmTV/-V#x"_A<a(qF2\C/iAcxDeu㞉qjNvt̅XYj1 vG!vi[[mGi^L'b.L[Bi_bhG#qmJz*j{_q5\9CU `\SȭUFo~fdS=']& 3P "͌a'<Nj#'. .fdk?T`pEޟ,{&p7s^KYy|VD9`qy$?22ꢣ" z3 #|@:LsnEiiEqH>Hnwʟ;} PZrӜE{JL}}w%I`x[C ɘ3o%Qr2zrc1n,~ޞ"mGCmքȣZvqA2!KdN:̮T 1f|J-f_SnL`娹XB4l!/YIL'F/pݻZݟL)FqMmr}Np5H媿HR(}z+fM-uyu܃76s5sկ{]bfr|y]쇯hL7uƖ||T!] :z&[ZE6*RDl}e k6$*D{hviD*Y)oM@N+E3: KJژdI#܇,n,φ#a+f2$ˮ(B hou٥\ᡏ~UH!VT:el;x]J_>&=b_D%6FpFOar锑8].h,/`_-n\(3ϊM,^_9r ijL_,;?= ;ߤi>CڒR]Wfje7e-۵Iߠl q|x Zձ !hC#p3=U6^7;Νt G/p㕞C+EEۮq,1+쪼1 abkՇ5HTvҔc*p> DCKgMc1cl[v] 6E 驭S%=W4.c3q#9 c?P`j?a-MyuZ #br7{}p'DGFiG1M Bc]OvK:DtaX KN 4#|y]7JxgDt!s3+u+|iV0EHLlT0'qB`S-DM*eQ߅ބzݘ/Tww{ԥz r$0Ý2O;麙yZ{<{8:vbTlMx]nWu_"ug$e 4Ų$|޸s",û]-1|Z)4}pc  ?1LCI ~8O9KL~zK s 90[giΆk5 Wt!ܗ.}%G&:8 ;Ar?1=FdSU35Ty (y>hDfg},E/ |oxK%):L/YG*@pۧ2>-nWqQK""ٝ g][qqi֝}ЌXul|ր! |W؋f67կr7`YGRсQr@ۜݷrz#/ldQUivQHleqD1A[:i^;j~"Cm4Sg}oz,^Kudžr/n)vOvE:kCG5T?X>I& fv$}'n&g;5Km od[u0uHFknng:8Tq(>YZ2CBd]@uoNt/lFye_f**gt)l!K9MB6Ԛ+?4~i;yia[j~_ `Ԁ!n֗ #ubg9S,)ʕy>+ ֊l2cvC8b5AReA_{ M5gإёz%SlBcGDCdZS*Kd኶ Q9~s;ޟkX |9nl̀Hux)7pbw=#Q Q Wx)r Xq5*$HHtnPF*庞2Z%jglyJ,fbm>WЌӂ 04Y)z @ϒCz iÿ|v֯]=~ح:j!D5⽤;Ջ&H ]9/ ZvƼ8w z:tӿ9 ^  ?_A9hP_L$ o."vk;Iim& >|y&~ O|Kj,ymXkA ɹ0@UyN$tg? =bp"e k$R%F08 {Ljt'KD'K^㜿*W-(n3GZ9[l>1ꉉy=REhieЮgS$ׯ4#Bq<́'<=a{.HgOδffX.D" i}=e&*Π[*jSoRaEu}Wuxnl X#YѥkP/.]KuSPq_+ǿRoN $=֭;%fS6%[U.[զ{CdzNBqΞt( 4)cbI[L=6K) 9<#Rnz_~,3˫,BvthqgEl,A=_ 4}q=D9Rɕ-]pʚ{NVoB7Imps0wDKQO*'EC qd Cؠ/fVJŊwI["|+m2-V׷lǴq Pׄ <=s"M?`9Eox|A}HQcT2W+;K}@$0B8yDR[HدR,'F*OSʑf]](~>=T 5K\Z@h;{Oxb_'g;q)ɍZZ9W3T˸10Zh6QlD&VWLO66nqeVxؼ"2K"*RC3{3XcKKFhGt(۫k^Y)^s%9I\Mq8QIRv#$(&zWrnLkK6k#3FFe0OS$zC.w֠Vl&3P?cf4][\MIՙö\@Bgc JV:'#"uOAC*#52a9s脄 O\nZQHVvJ/:EL4pa!A CrιY $J}'K p"hye$1^XML-r{&4kz{\]5~FQ?a\:\QfF;}_'|tw+b-^':Tx{#8C:3q&g"wTIGO8l ߚf+yY3.z!كcWA vP+ch KC!mYե=YY39#PPB~8P$ ioI7 {H< )Akӊ{9K~0snoBd  c+(c&xs3XGo|^Zj.U9V`8F.9V?BVe.$E<Ͳ4 |PU@|^}k:bLkhXK#w *Iy"t\$!ël.y-q7.YFQcbKO-A0QZN 9\,-ۦeK)8\x6bw ;p(huŜm_LsїkGM[n(%;3Us|~}02P1^z$J_vz}BK/\z=?!9@|^ΰFo |ܸ x0y,-4#bʾ3q73r=o BP%!Z;"'uXƨUǢC2TLRc Bp>OZ~>>ǃ X O""ɼd|~7|9ԗgireX׵2L'u{s>^_3ecV@ծa.l$n=Bl9 K~rJ *-ŒFͥ8]jaF6ₑY؃!G%iQqU;U0Dum<&"^#iK~ug(W aH R tor}aFz>s{A:΂`>I#RP`~~C;`g(fM}`)ri l0ϗ$#3ͲtΑu\+|7]܉Ax+:tsROaBHRA1o>ri!z80r\:!hޒ1C(Y7eB!h|(s[8D՗ا}TD;c:bWztV|B.ݿ{8Tx m ayf|\!y"cf'ߓ!ib/V?EvC?%~)ܭً9 M>nKzewjTh`໚̆fI^ϱvwP,L >l0,oMs)0_\tFz߽1' ;2dl$4}j}BAw83~ K3I~eQ0}n~KxwY;$УPh|[RkXgh@|9(qs&tx|\(n) $rC,g(.]-KGM[MuHr$j/Œ7+41@_vQeͫ"+<|dײ ]aB\DMΣocS=bv/ akA clڕk;`}-=זHq4N c[K٘dXP WÍN WHP !P⨟PTv:Pm2egz?'mrQE+}Xv4ѿ{d칲F'>L|Yy5\5 w{flAy#ɕQYG:aΐгDZf6cxn-Jyhe 'PCHCUcPw$mVrw:h,8CQt{{ax _$!M$:Fd }XJuytX KMD.U$>5,9By9@_Ey7Ze7 X64󊼅~3ox14Qlk3RCjQ %^b Uxm^cZ 킱z. ,)^uu`-yl 7H`8#Dѿ%|Ƹu3)AM̏ w+SaY| B7rq_@􆭉[6% {b0bݸ;;i+Dt gP c A=_+s:3|@ʜ=^U( i0vG[I 7׼vK]&+V5b ݶ&dBjj*f+V9)>4]plb6W>'c:lc<6ˌ\?Lk8lڏp'CV FmyC1'2R;tT(y5$27;B (DpW[H7@3MV's/ y)}-3Y&#[:v _Gmv+AhgGAN]Fw??@Z+_.ڰDֈَqkl(r[%?x-V'jki7Pbj/»:W+p ݠh~/Bf~3] ?հeC<ꍟb/^hJ񦿅_pRIY~g+vcxǵйAK}gh0S?;%8B7 lBnkoAMf;kA.GPU,Y.=G~wr]F AZDKvO]6 K"撫ޭ+ qDaY:tMG=e“:~;P$dlɐuX;4Þ OOY,ϑpݕ˅s/y>y,M -D_ji}R\S4It +SHw６>-}C Es ON$X!֏`?Ѕ&X.~?P!e\;hƾoWkow!-1}A uX"(]wI}l#Ŵ}^iU[`݈$Zɛ9G-MyR-;3|pЋOҙ KEO$10gEPb& k}D$.vI1Mx THpp"%s=>hx[(C"S)%STPFI˫*T*P*=PJ/_r_Wߪ7ntWqw|i 1#ٮ[הEIk֨8C.O,r`HY"G \ nGҝDYݗs1`O.!7 BSG(fQFσMqS axcŊ:f#Z[W5<>7/ :=w DyStdl1YW qMWQxn5}eH=2>[+yJ`yґ[x&LC1?Sթ10 bv\w Ĉ hbpj6UEXn2mv!'t<jCU.<''C `iaNF9"+tb0WwI/H}(!FUϘGl@1H9MbB|PL{p2*+S;L?0ޝk}`LvRjL~ Pȹ sMna8Tyhn~vȉkv*|ߜl [| pQS7E먴!)[ ǖ^̲t/G7Y~N(prհ,~iBKlr֙8]EWKZSilWR2x96i$o9&l6:xS+!V6 AY=h>xH.ӥ]=-T,|4Eؤ,𪘑Hbs'#dر4EqZ4wKFF/ :ӣ~ĸȇok钔,H=5VR*@PM"U^+)~P;ӜÀY/RSՇƀ 7yI+ 4Y<KPP)aƖm J&z_v!0|I/[O48uFaxyr4*A}E$S0 NI gzrBې1 rQ;%Gpbݔ,=y*΅R9RN"irL;Z`wR0*0TTVӤʋ !;;(Ls :9qю5U^1ݚg _-(kZOBʤT`kzU è|_c{鈹1dXTM6^֟0K}o5?`fӾQ% @'!h1Hu)^X)#Mq1c=.U})E& -+m0Sa1<.ï,%5\n ຐ!kށeQEyWgNr,G0Gtnჭo3g|ȪmʇI mbo}gkB-'kbYw} kA'M0kwH]8^ qT[hcjRġ^XS߅UbHy4R }u b_!Or^o6BM<$@QTpuzqn.L\ʏݫMKQDR֤XR "P^Wy9ġ9/H{P´._Ct5lJ7Ca되=8fTX:t!sFx!!J1Ghw0+qΗ_^a߀*Iul񈲱QqnL'Prf5<9!<$"v8LA=~۾2Thkm7X\#Oxnym}(ع 5~?Т*!j P~e|v 1xNf;nR?z0mgՎ,D): z_+>|;)ˀTJg4oQ %K(ne-/r [&9?4)]/w"p XSٵq+f@i;oH m#Ž8E΋ح3C`j+E%}X}u6mJ:)i%|\vkf +}LiY@Cs!]и.̧8b+4 8%l3SHJ>sr -Ԍfމr)H@5D1m}mR$%Zk,v8 I[wVF4Wfv%Ր0oDQk-n;gunSک ^ʚƲniHSzWd)VĒ"; W` gJb)7X?/; Wx7M+wkjݚEBj$( WHeUJHwo`%3KAT<..lJrlN3 8Up:powCӬ{->gw/>N^\sٙ2z#{Ysv'NW`%јzJ&+ ҁIz`k{ n]>hO2$ɾmR/KYO'Icig0]#<з }]:_WA)1͠5}˔|G6!7~n]E-DGC{F?`>-?XFx$[>\+uئ$%Ab]4l/*h`Źg6;AFs7J' {aBHIe71{h=hI?Ͻ^Da>tP#-{eJfI5y'β !/Att#XX"3F={ʽh,/dP)QB9\ڄQaPNz3Y |)$8vB Ih }.EQ00P2k?Y>/LNOXa~,#[ 2,ҹtf/mאFKl!!-% {oyJO}71 l5Yirko%V}Eƕp݄.;l6j"\n'f#*M `FK^Nϝ7 V + a0`|f9ߣ:\^lJV _U Pea ,fp$AV`sW 2B2q:-|@;sTPG$\1Kx>޺pjh'txHH*^|m:cʘ5+2dmN%m+W5MM̴7A ][ʽ='u@_C~d~S>C ukT6idTrBՇLp%IvRzh畳pN+8Ni4KxAV7F<% 'feKQQE "rgѕBY>Hu 22ÿ [Qh[ZŨ5G<Rţіh#9j*"?o8Lu + J Ege͑2"uЌwY" Vj|g4֥#z̫Ə2'py DYtk{ːe~wfZ~;Yz l9zh)fj](|o2-xL +N%Fo#Ǡ :e'ϒe) ^+CsAPv#E!Tp(orkhwAb X,_96MUւUt5) s4N )jrg yF~ Øő4%Gd@9Zѡ y9s!C+<\L`C0F-vFn0?Փ`p3^jo誗?C b{5 fC ϟET,x3S^]C x qɎ-QH55S[+XJKexԩez1 q&K4Eb2Q&oZtH}DHVgQՕG+?֞sqUx٠!m1 E*w- N1~/?(#<[컾p;H{fښm-_:EIn~8;>S=Xr+{`dV6L*9⢇Iv*̃I\CVj# 6@S]DOzFWus6${0!Tb^T*L1hU)_gcJnlnx-M0\nY/]#+ ڴhYk]rSBEt4`ʸ(t@EХ~8&}&!Cl;Ĵ6age!^Y{žCB6*@N )[4U#XPiێ!"*tpLw`QB!cRXW{O r(|wW'8fi_!ՍgE(ﶯ}NTL#k:}Gxk乹rIXG:G-˃m;&,Zb¸J'jl:m&k뾣G+av HNZl]c94#|˚mM˜r$bqvr%|Lg 3ʄAl¡)YF[ɩ=0ъToC_[n*Cnf8.D_W1{|p}7<Ԕ zGOE xi* A={H!mtU W `T%p)GCJX!d,>[Aa] Ȭz~@yikqC`~kr̮㑩ۿB(whoG&^D-7g% sӭ%Y!(Zz47Gn}8Bj<B.L>u[ҴY5ňo[ky[T֑0>iwT6*]vxHhŜu H38t+|JSeZ`4;eT-Qez˰ԘG64i1 N/FiYRda9BȎ{{Ĵb&M顶;\lGy;2&"}+H@;}-jQC$U6j;dNOIG6mUkN1u023 jMG ^,MTZ?@hG2F=e4UsTuMtWeTpUYb!~r<FC1I!. TM=Y/*VMC8 fL 2#ZBZ`d%wIL:byoS͸tj"e \Ѹ+|D{EM(Cge#;Ndiv%pSX.–`E3Qjo\nZC+oPvڎiau Oo@8A\bK)تNhr[1;61,q.K#OH|˹DB[MlD=JU-u=&~A}HDIV m'XO0o ޗ\CUܳemgbb4 r)0) oqyo\WFvTr—;+㿶ý#)j#nhQNШ.5DhNb9}wpz"$|0{Zڝxu簂&uF[Qռ>9}>}(si+zgwfն;%gtQW4ٙa@+ ׭q.Og>BI.HhjIc ereCc7-V7j͜a=|tgU"k1heu+dv9h*IU9(@}Aj# 1Qf78xyzXʪ?ɲYpO5ow;ieSss1_U/i7XH#DT&]) 7W2{=H$czv}Vĭ֤Dm"NP1xmZ yji\>vwsѲz+T |˫hZ6wm6~T5*ٻQ \x?hʣZS]&wY  OiW8ρݩ9RDRD߹= .%z#j3r6= OZm'd)wD5 {ЍsPԿ~JyjyOBj9a ÎMlf½3#vS r`X!p eץE@4Gj|#g^{VT 5?&"^o&~y-nID&KXΖܷ.N WiJ0^Ggy/0}744|@D(GqaԓP;s 6ıS]=nlGvwkf:IӰ|-tV+ϴ مm,6k8G&a^ڙLfAOڨx:u=7iQb40=09eՃ>0kS"&S~ e/ s,ld{D|#4qjOQ\f|—2t;d +bo? #Ȫ\B{ֵ1xqRh ̍`ހ-B\q^7$<̞\o{iցia~Ql%N(&jeK"BCyA4JGe8'r-0BRZ6m ̱ì!͉~^Q%!ϲs_$c b4^+bYC#*3C`͛\ |$83mϺ&94d)ۣsGov:HzS'7֘%x,px'"O~-;?=]gwJy884l9}@H;#LrPn^G@Y Uc{vkeUA0VVo?l4)XٿQ{;3LY7H2W?MٍtI|@8GB} ٦m#3Ucdc,F\R|p|czGF>;Eϻϯ5Ђ<^qd{V>ا* 3 `Hũ*M v̭,y7pQѲ:Ew14w }y3B$Qx;g:,^,GY7sX%.a@0;w+4=[;p`+Nx_05+Y|xEGEt63zBG>/XlWHB\,Db^ jXPQ<=6\i3jBQ<˃W~&, 6fZi8U9u5e)JS\!Ȋ'   :c$d2b#69]gnEuTG~(|ⳃECb?h iwy`ުD 8/ƫ*nPRTFE-Rkz5_4\׈Q'qĊd5uF]{Cb[D)Դ)lka5ZםCyT`pf};']Qu%m&L C@렡֤J{R<j8^!l,H/v„]/ & C-$T@׺x8_޶e~9]&/|l?E4! YTȊlNTHBb ؕ{e6*hYBfPu𨮳&P1A8/ywj{o)+\ߌ }uoYHZ~Mߡp׏U5O낎 ,tj*Rf`^U)t_{ݮx KFTC}1Sw~@7&umMw@ n]x'{Rqi;(?]uvO@8s5G *l3lMZ;G4i" vēj'0CVqBxM۸&2 uϗ}4w}2IS9ݪ* Q)C\oP`<5T芆=V# H9JQs%xɑ(ed pFIVW|-ZPljJAZL;N8yk$5Җ;BJ4vo[犄nqˇ괉ӃxI]6`ҧUHGua["+1RȮ:k5~˓tD x Br1Bnjcm-K?ݿ5)r/`hG\4]nJ5nc=PF/3!^ imGPz?<֏Rnߪ%Ԗd$eʭ?<we49`T88ό/N TIHF;>Gd3Cz^(٫VG$e) {UymZ-*Jpd!viTe]6k?ׯ*(H >V'a51^1ϴ֪tVbO(2RHO*&ҳJ,qZ1' ƈV c7]w\ j +ob0E~'45_eDzB>8|8Gç౏> _6f^@kT21};И_C] nv3ϟ0l1՟\qy>wuq!7v(. *p c 2kg~`*Ct\KR DaOL 1 _*+8pH.Z6oMsSn}3G5(GhKY'mi{5y~]À/P,T,"PMU*޼k*'~a=\-*l׊_0l A.ҙhgeAL7r=/n2Id?TkOd2\qHS{]r +J?^G~- [(d P4KaH|CX_.Q&_,P} )q'Ef^rJ@U>hd1zP(^g2 Oeîc6KzL 䁲2v=HE_SH۾j5(T,V @R6Rt9lJ2У~ڤӰ_ZÇ.+XAYf(a NR Xy5=Mk'~‚ ͱ kq7XÑ7nUUkppYB Um (n* n/<{]W h˼iYFk;}RXLhO uM5R]sE6{~G7׃hh 0zZUmYݍH(|JSnC)Ǹiufy8? )tp/BWS) A*H6c8S΢lGV3s i.s*s+sCE$ђl50_nHgcbJrGj]b85kt?Buh,ˠx)+6ATvOV:݄ʐh8Ab!)$(YOB Dc#D*ټ!Ǡd:ÿXanzIKU~^1U{pWѼi6rY HbEB)g 6G&MPS!ynXݬS~staS\r29("Q7X(*-)jOUOG>F^Dhy弚@Ri&k8[Zzq³=aB"1[):.(5~XG&e[ ? H{/͘.}M5nwG_3됯'=ϴd'GL)4w06d#8(?![J;K$} QH4?`)?\Ф`ROх*6R40hWv6a7s)QY-@qŲm):[¿$2#G^pk5g㳻̕UF]1Y5u꘧dHEI]E({iX x {TI>$^LeKg{%ITHpu8^Ň{5' lc7`2Nhȩ3m(OV|' ߶Gg\:FqGXS!6 z44gggu!-mt+rLw;y2>:;ds3[#zMwuߕqHCe]EKmf[`d_q޿δʓmiҦ&z L:c{Jx؄HKx\sWSXI JGvE&^ '806iz͝[(B70k0DSɷR>mĨy8X̡5_k=E~1\FʞRTU!{]5'/#s!I0X\-L[('Gxh_ur7(tY{rKHuToHfBHVq1 pIn;ԏr׈ݏ[%c ͼ?Ρ=V 0yUn;PC,nZc;G&,Z&ܒIpCF _$d!rUh.US-f86MSE([ьdbW>HczYSX<$WK!5/ۻ. DstS\Y3OY_6W&AKkݮ(aF;Q_C׾0nkЁKW+QqEYVJ0,aB Flw> ~3›㌼z67͒]D}:ťkVy,|nT.?FIxb^bR.YOO4 dҎ¿66 sO0G(䗿F3OuJSE#}kZB-MQ^pVbd1;:<-{!Ƃ#«%$$oW˷bFἊZ7!fyؘJ9PoD!VwUǪ^FLc&{onvĖPvAS1"OӀV,j6<5̡a 7Ϟe3VNAfڄ% I៽! :ܨ)9769ߞhgcwMX^vP|bl?/Q0RBU"mΆ-\?3`ehIgF{ؐi8Gk%!(v3L3.B2FVϽL߽nfQ2^ʳ4jrIF蕳mE)tp/2`"l@-i*g4)d_9}d7&l)ĀKU޽~`Gm$˫+nJmif:6Sb"I$ز>PUxm'o@TT?#Ik51B_EY2w`]K$}8tUgG/IVt&OY尣LI2 \D{~ 5Auڏfjpo]L. lJXbr. n6v h͕{Z0򷤠vN1>ն}i.Y,'̑屃1i (L8 I:o-gC'K _$n le3h.Qkp씱.R@H>K ?aQ}C:'Yj5Sg[}XЇ WH!z9k$G.iR9 *EY*T. ]aS4Sk\:񨷰ASi /@|Cb҂E89ȸei9{.d}H@@=&amǽT`zʊj."JLh @[l&}j$yFQyC_Ϫ#H?Ëދ܎dz /.ij mwyܽDa0PY' ^ͳ!oSg_҅sG^mcWkfNwl|0(ZLk/e^3Vm[~)ϺMQr:h=!30Z *nE1D5Y=fUF4 7i?j=<~(=ʅ{driO o1sӒ٦N:Y1{( J-\q@NX#o`}Kg2_ Tf%fb WDy6)^]|wg9]XB<g:; 2Fn~NI0jM\aLPQ !%eQ!kǠF´&f[ m*a#x٠ v8ZpcMx~"\v]CU5+Ȫ;Z`fhvuߚv9yuU|8dMk"٭F HllTzE>aDZg4aEA&!9?1*Y6Z/lv2PNq,_+*  LX >#ݎ : E,lϩ"6aַo`NC%L.n81XchS;rMu,1dYQ ^\-? cK Խt1n&13̸)R8!I5Io"kE.68s@i:{H$x2orKwߒ];o`^qpI4 V/ۏat;1Y :0 5]g9@93amW#xԑܤX;[LmkpF9C è4!R%ӑM$x\z=v96A| i֚z \u>fXv26ץ^5٩g"+ k|?⁰1X9wsam\O%,Cɫԥa:txJ90: z1'̲8oҲ\+FV,߉)3g,kwTR' 7r&89I$y)EۋC@3Q_[f?;LK1tW>iqB(z7CxH>NOiN1GJVrBoR]:H91m)TX+*X723쥡[6QqT8001ңZsꕴWaO pJE 6MXv2]733 QL;?liygllQ![dÃa؎h(_,9oL(ӏڟUAwXp9S Dbri_s*\ճ@hjt ;f -t?$PE7$#aU6: ug|}np.7kX) _zL NLq}Uo$*ʉX`I#1?H|Ƈp>=c8,T8l{ӇnA?474$F WЫ*W$yȢRaըs9G؛ Ug='eI : >:nbeF;*R$dk-Mi4s> MH*Llˋo?QN~O$ A۴~Q -nױhkI-$JfwC/OCcLӐT0fW:.`ޑtQg⦉P(D|q<n-=Kukaݛ~"r).ה3Jd|1,El{~GXkXV8{nEoki+ 1ݰ\׫6SZM~b!ˑ!<>X JoQ ?Ũ;˻'y" DC>L5#x]Ϧh" 1 K nGT+ DY; ±w,HcKyd /ܦ(BKf F1ccE(qHi۾N K> ?. M1+̖_d o_#VQ& ፾ p/8G}n۪9 :r ͸,3k+g0O@(uė[iJpp4. OZAur YH3 ]b|3S\ɻ{qygJ6sl H ;|~[{vV7+V0N7/kaÊu5Dx]sڬ$-alRC;>k=̳=I".#oSY\-v_uj-m5}_Z5E0郚*LJSq9/;JkW%a_w ;_* Ts< <뫯2JLVN%ǭ{Z3 > RLZ[&]6T | VQ/:LNN0qX-1ȥҋzSA-YL|qbj+ZQpo57_lUI̤H &]̒baC!#aorCVI$D1PVJI|oAeˈ?N shb-a 'Rzop-Z,KϹ2 PVd֋VKju{ҨAˡpj!Kܽ+AΙYB(듌J yPO:}8u+COQC]ЫżSF^K><Қ~ ӡ?+5q^=ס+[yУ`TRrɆw6E :39!Kt0n4 ZNy݄ϑ"35=G2q6: cȡjkOARn+A8`s$wllvpu XD0D+"*n lo{T Pmf`#lnݶd( T;X8utNw-)F8"Yd2A`n}ÚHIk0!#{S%E.4ݥ a,'g~T G됙 ƱQ,i$,a ϡVN~!8),&|[I.*/@;{XLtXvaH/ţBS83%D!@#~N;T5 `J$5dZX`0aæN뚕wLº7c t#/[Sf @Vwp|FCQ+oҜ\3B=)΄E~5 YplW. J@!yFS9D_W?v.}Ģ+(^ d]%Oy.ndh.nU=8LZET* ǃX2n('(~(V%C A<ֈgI]6Fgd:[樣<<6|{a!2 u>#9(͍NeB0$y j/KN=^ [$5wYև̘?:#Yze{F"]A!gȼ4r[,y|WՙIfO^;g87 ܣMZU,eN9EZz`Q 1 Q*Fa*V[gIldߜu=2K_Weռc>4F=XZRu.: :}.?(kZtvQ,F CaY4+`R?:;[ ^yEuS^_`<ÑqxbD2Ky`kƩ9N^?Cאjpns"vB8ۄTEi!\'Lz@~"H([cNV29i<7(>ǎ+bD3$28uΓD[$9ތ0mF`}Մ1c &mwJfL+@~ޘsP`k-^4L?KǩC˲ $ЦkaD5V;ͺH>dG?{ Yg-Qu'qK@IIi"QUW> YCȋv=_|..5^'E!m jӮ=&\Fv4^F+F9L~Ab3LVB5%0U'FI8P:)K-NFw*?r0=mC U2ffRIV-Tfd?[?v :=S @o X"j|#dz(52ur'lʭ} gC܄KRr3!VoY{7xm Cbzd(r/!ז%_tt#!jpl>I4 /vwu\DT gFɶҾټHW/)wfps,mdo<& s%A(O7此g6aXcO4!oEUik:>BOP,"ep@漴|o&/6/8ۿ+5d0V;Rކ꜀N\^{54ŜIUHЖDT%|#a{ވKwj6׹řſ5S2X[F=>j46ay%xBMwO~~pbH~ml$ugx@/w#2|;;K3VWd$]hM?<;nw0'/f#aE|^&s#j&;g<`x1*hu6An'pF+yX#|p(<>>!'/3l`4zO$kLĄs^X } E_!Iq ;[Nrfj쀟'X7f : 2 6\P%T:kv(jJƑT>8?v "'?l{8OB.Eq/(Yt;oJz]iI%v?Ŭy Ж:&U %VӇ^-'@[U2M_ <((iE\:/ m; }L. &x .L𞇦_bF;{ISH(%p3 V.Apcop~B:rEѭo|crKLk`EP^tꗄy(#gaw 4-Id!l䳼bkAOZysbliP]TlϞO,h#C-q4m|XskJlY̽+lh|D@֠Mv([\z_zgpgb]@\֫ , @ŞU Z Шj(Ym.8Rzt$[| &7~4f&ƊEɱ&Ȃ -!twGMt5O-޳:D̼ $qyʅZYt$ *B 9Շ8-MẠͿr39稞Ro ;AZSH[}=B;,/*a&+!AcV]z0RJ[ o\?fS ua69u8Hi`pô9]լhmٜASS`- _uͽehp\8l0"Ht]fVS@yr’e>Nerv.fUHI0)U=_t;5K ]^.DBw"dSQh@/iIMVJ,uB?jlK!" nZxjonWW[ŔqEFk5:^S,!7("&V9\Q>>af`Y:3Xuk. O&e XN<Œ&c/yc!kUBV>=G^tH~"f_jU*jл▤Ss43Y^gjffn]M}1EVP "9I%HSȪQR4֗ݩZg-,1ˤqdz4u9Kc]>RIi:Z o{H;je*!H65dE:"27sˇhD8~ J;U`C n6'>c6bPWCb#ع 6ܝ~qRoLC2Bp+} ;GԾE[ xw$˝FRlK57$d r} +•cSsűREXns~3cyA: 8ҫs]Qj1 1А 8 y8I&YL˨S nc\@mG^wǣ"Xh |4 ̏ /PO}if"B'/Dw:U?r{-OĉGMDpoWkFo4jnC/s~(nޭ%*a$3ة%)M7]4X,h+ӝNjJ ~umu!,QfRI_vCB"x7<$@8{(x2 թ`'R;h@E Pf'6BlYw=!t@D [?dHE/)]>5<_4#J߿0*=˳,Rds"0rxLœȀK-֎0G:<*1;= ǹNg^8d~̜uk}5d;d6DB;Am _|`D[pft6B,{OC6^}R+՛Sye0 hK4uBڎ8zT7-j-GC ٭DG .aŹPE(H-l;_*χ_q]M%mW,0H4j+^BE4r݈Ζ38`-vUgs|T/p/"LB!P)ncpIZT5 Q$ =* `ԗ#2K~ w|~& .<TbՑ%F}HKxWaFu'd=\1fFD,tΞڳ^(iN1,ުp#ii(M`hw*iʕcCZ>il+mt%N\0ھB: hWho)5M{GoϬp:m3kU|z5Y*ÒQ]\f jb'lsYqէli fwEEꕼpNIc)8Lx.9LH$3_lS&3k &%O:IIDn%OB^.LhrwХY1U(^Gϼ\B#7+`[pi1O}Ef"Jb3m\)%7 Ā@N_ҞWYOeW攪p{ D*wvKWoW)3XR3UOJQ^ gO ^+RC[Anb\4dX <.+?(EV*֮ Ca|O6 86JvgDNũ jojibG`V14ޚxHtij83l >lFL{NH>Qt/\-iem[\VڈEϞ 8 $H1Ҧ穟Ӹs+n#H%߅EEcr>Cze2vuյ$ _S>8^=pa5H&9V7o&EhHL\M~e?zX'aj*o=A2N@ nИaWs:)AUi.×.U_Jw\stB3S+u5"'3:2ְx]~u4'mQދ[@A.!scYnƒE*x;:[ ` ^җg"ۜɊ0c辯KB'= z$ VJ* =YWvL Uj R `iE gcaߑ5ud (bk#,=kٕMCI1lx 9ŵ@})tͷf2=?~gZ W}ZS}D27N+agxS_7XJNtN0*:mWS1G l`an1{Es\ B:hmmm KTpEaSڲvUvV7lƜ+)g 8lN큓-Iơ=A*$&wM53" S0[SIvL8f.r _PHZZ]e\Ηʗ1/YpPJ ޣ'Iq>H68 2T]xx*AD `ТƵ6T4+1ێߊFvy } 6S anpTX rt[ rCǼ8ґW;0gͱd L8gXkÆT_; ͅ.j4Z8&o^wٺHLOʔ]py4d}?ם'h7Ne\U+!.e %{f1(wWPPĮyeԌUn:ARJΰ7.Ku&{`c;=ȏ[G*ڵ{-+]CQПH~+*.?l tQk@ܸXdZ;wc$w`F?MVѶ}oH[ӱ81)!&VGnœx䛨+GYrʭ؝م& [xj|]dM'>3Gmck&I/j+wP ?kD G)sRٵBFN?ark ƞ%] 2PЀȵq}$ccJ⨐c&vuc>fs~S}M=s}J#$WndA15_V ۦ/ NSz֤)\q7MɜgѪE:lX~|`Cϴfw+ dlI 퍼$"j+/Ԃ&;]s 4~Mep*gdTcTPpfL:M+E7#!c+^Gzd<t#ɬO}l}# [6iT nS ?jś#!gK_{^1|@[~&gؕ|+IöQdcDꟴs1#l`ր~#grۗ4Y);Xjj5iX֡B!<>gX*Y\ Z\' =iz=O"DqU 2='Vq R̩vz U0_]l3 –cjAbJu#4uIb[%>22-he>oH.֣Ku>lnƜ}Ox'^kZbJT %iKSBH=e{"K8oW\N(V#1܃f:ṰE&Cʝlq`qz (О'pWgY`q~HaIH$}]RĞ%⮈I)ʴ ys7Rr?J\=,ek]8^-#^Z ebɇ+49JZm#E?m8DEA0=,'T,`ke~?_Il(łn/;%RyxScz fi-M?ʋ%&@- @_JBb4HWi@r2"BqZBqodpq/ jrp{e١|JaX8xTZǁ):n $9b|OיLd_yŌ?f+_RN=<}X0iqY<`܃Yt l.:Wbܭ mXVJEp~>zT=2+1혰,f_BGq™YNf#?Еɦ8o/{!,`/`/L< z{uW"sԎ딽=P g :$YCT? |޷1yv':-GJ!>x]>Sq4ȨR՜R Jd$zV@޸]wfݡ{eCШ<;q'$S&:T, \٠-$;>˶C~FroH:ĬQ)E\NTA0;2Z% S֯7RTLù]TMW(փyfh }ˬ0qZXj1W,cU&rLK 6(9@׼I眚ِ?v_if^YDzsOV.8_n25Zf8&cfq Q]]*+UZ{{w$QEQz3"Yox㆗x<4u\Jo|$.Ҁx+nEY-X[ dTr )p!V'q 5L/Y*mxwū:8X}j328*j1a N$ewMcҾCɪxř.ca2 lπZ(kbWDPE&fONݞ3xM ~$ͨ ҊP d  ?W>Zâ諌Iy-FJ\ϖ$]eOo0Fx#ZL鞂+E5 76P׶IM{`Y.vk$3\tj}p^'Lo}bzh@ByHI-O74j8ta"M90O]+!?Ȉ$HBlqx738FfLiR>u;a WJYM^'N酀[Q擧K?Ӵ}وA@Zg76[ǽX 5xoQ(6$^!~tomrvc_jn7ZbOhsQ=yu(*w;&idA*iP6]7Ptdnz΅ΏTqAROMika[]֕5vq,i2}T-лC:ږE~2VL 9t;i&WdUwG Z.#@=/5"$oKIe^oe@]>/٧!NWV (p՜R/˒JR!cgGBeXs{#<ޔT&Y/z~MN?>(|lV" ^[eVBu v,GT98&\ ⑳ck" ]Eū2Duaϋ2jnGlxXSUn "W UI)8sjP awX}B+s6h/ d` , Ӗk/(eʻm WC'K\ȇ^–.\߀q sX$.g: Wlq|BEAahY.W!H6vDp#S֛5\IU* oP]9RgbN58(ɭBWfױ!8-%[ګ1aa`گ#'A $K?1^ 761CKQ|),uѧ $8C`})FRmu7߿6!%EËh摂L}o;[aG*<մUC^y3'\UJvZ/4oȚ 6$#]F.uhP"*A쓂HM ;v|jfgHBhkУ6LN% s_ߩc')$6IUZQ!_ 7LpIS $s?6P{IK徨 5vu#If-[?,F,*(9~-h)rF'N蠆$ ʥ\ʄɺ}pz2tK3;Xd^C&KPB0paU3[(l0~`e4 g4dRZ 4~mPjunK#SvCJ5ـ8hcT9#HUqN^'ٻ*-fv5 2Jz:yo]qL{CUaXѺl!ӡKZ/V͠+En)N[(M;祶Bl="gas51VU{t+ &*i\FJ͈64ٯۗn(w$xw;{9C˧<a<5;Dk:\E[7| +|HkMi)%-Ρ" #sJP_oʀ&cknUY;c[uм^d^߸ͮ)!Q: A ]E Vb)g'62EDֆ&U)/IXY%66fwx#]d{Q`ߦ:Rm32@=j1}akJ"0M;}c AWٽʆyKL 3Ǡr$$9Mj#?4hGp"CM)eZ/-dh \=qA6ek-,dHh!6Lp+@M$,"oб 1GAVSi\,:ʔ Ŝ1|iƷfά>[:;}C@qH™#V 16wB`枯3Gä_1i߲vIWJz ;'C\ DL9 \'?[N/#68/6Ӧ#⼄1>e­6 iW6q1za b:K.sds+_;{lr8=ۅ4=Y8I`0ob |)bF'W,-u -K):eS)@Iv2!d` 5v"uN枢vagVA|@xה9F(` #ҡxpTQKMf m3:X|Zњit*S4+:z5)۶fs>vHUpYhΚ0v@\q1)mci"*{[,6]R$_}yUۆ"/O={#1q'S0'Wpż5HP~d>12o'/g-Lh0Hq))ާyŲ OFM]t0/JD#0> )9NW(R *lOG"-8&$o T9t.? 4ߧVY쮁,qK8_^-Dutn_k/y2kOn!v(1=U @{.~ OW*~\\Td@ݢ{ %JE(?\!@+/e+O2#cXq=-_4x< Z ^d`/"JY3lR&!~5GsƗ#":?_|B⏩E W}7l~s(,-[Q6u=UxZ ?Ԣ2qs#T}y)èU.0umU7v rf'F3@)0MU39r.(b3a I/V!p+!ej\l eHzD];CF?g,ъ쌌N06,9TTu??3vُ@`6q:ZKZ'D;Y_HzH_5#I[dd(-be _LpcH,~EXCŋ5K5  U]r6={Tfk=݄튓0̹JP % ` @ޮ˥(87. wnf8M/ QPhv6n8VTavz! G p 7+GQXxm<f +WQ iOBLQFx"ZcTwڨ7/k$M'baMb;yvdJM@F*t %Y&Ql#Aڛ\z"w\KZbSO,ʠvJ;׾TlxC*_4JI;5zBÝՖ=;˲qoHh}/]~[zUlf255u2V$+ dS%-K2eK d∢d& !\`mT6 sHDYfK4Mj{^8sU\^ZGfJOnnZY;ν8a94\ei{ceu6vvd9iLTȫEn"낁 &?#Ne2`W/V/*5s|~9KjMťK=v;kFGp"H3B .j_&D upxrfO˭Q"Y\֗ks ep*ե_RJiCIX.W--}9[M>_I*n=3jH3+~ILػ-Y}82PCEG.zڌ_Mh 㣉/I6{qJg3.5Ȱ)s;})˞;.jFF:+ lw0W(i *S-s[D$=$ZfxWxV,4<)8IQћ!LFBidi04K8@>V*DHdQP70Gs(Z/q}r{l.Jeybaj{N{[w\EŚVP VqX"ZV˦Z Z=q幀; `vtE‰${&|p~,E3Xp.D;'Y=pM*_lO,Z9`I1آk%};(u"8Wl h͏x~@ //0N&dxH8y6+ 4`'y5Zj&彐Qer SwbC>VL`v"P,79;bܔ֯6eh;м 8|^P=kO6ے / g+1lNuw7U9fK$^oQ,fwBhS*C2u|śawTZyIbAGU5%:Qz:Ѹ(Zf>V~#ٸhdX{r(A1-Ky'rJؿB\HQ]x-eU\ۣgX_W䴍]e&8/ABN yigu#|3@b*J( UWƶpzmFcvXu, &Ŗl=,PBs&?DΎ$SW !@*orY3` R '='PE<'&|LYl|6[)\XIw};b˖U4oȐ{!2< +x?/2{= &22 +F)ˁJ(G@’ AG'v?43ͦm? ,N[hA*{(ϓE_hlDl/:0a+IQ8'8pVޘ5%t7ǶR@Tpzod‰AAY7^= &}sܓSLWP̦}\PdlYcYa9.1ܯ([y=`P ɢi ;ӺlɹeC8r'-@# ql{a#S`dN1$\hVzAX30^=Vւ*~B?'hKqC惄h"‰~8)s;{Dv]*0Ij11 iHg{ 4] ͚%GԠJwr`\{]0>Y+<"T?BlSWHR-b \чE#a*U}rL;V?bl5<ix &Cg#bX0$j60aL!>a6I $hc->ytaҁ|R1{Tfah BUK M |h!y{!mz ͋~"Lεp@ƀԨ^5Fba~g?^Dv襘W4AFA 6%pzX VYQ^JW8-w?ZP6Z`!oQ Fj r,8VP4ṓ'4G(L~|yW:1W E?:\} aݖ -|Yi2SN,(""XUUQ4اz1i HIâ<]`\Vx$Jkvv|&1<&6W-XAfH K[jÍy A4G](8~pAU_jv = B3{hEx"BGDppsՠپ^<hP~>F 썿7JǺ"-"` $,~dJ7&g!_1=|9ITZ]dx ^}~uL & >5c[3'pY40"*=.`ݼ( \ê DΦ w;0@(~yBD_Y FE*\Y-ФMׯbvz'=;Ux-G@]P먔/YKZ5CΧ^UY`rW~"ܣ/Yޯ۴ .o)*ny-~hѮcB#a[R#Jmmy! P2ʝÈ'Vx9?-Xd0 j$Vr Yy|%S xG߀ ՋL޳ldb{6εk@?K3s z_bcD["i5y|=n[|Omv;5;4ZԛWn:kֳߒ0V G؁}mERkB][3!zMö+gl d"if94d Mfz?vUI|JlCš˦:=^$ʼn[n>aF:Ɏew!kXk1唓?yӦZFPBv;ˋ쵡p~K#>]՘I$E2cHH+zt1~vͯ^S:)醵t1ĩCQ1ޜ.V"m ruQoPlE5iӖ:],'^Boal(h&1vh>RcNwzd:6B0Q8w7Ilߤx.Ȳ%N Lt!Y]"p߸he;1h'8~LԾ{ejv?=1-(E8_ 5" Uc22r&TN@Z9 V *oD!:lP; %+-iM۬pW/1'V+JC;7s0(s<[= Mw*Mb @e7B&5xΈ7&ΪQP5 9(g=.93כa*G]4r`ҼPpO"|<NſwY䀗dIp4=gT/; 6)hLɎl|Oi[P=X‘ 9AZ2Qoٍu{ۊWB@ 9L B1GH߃︿Uo^ k:'Ww'GNʿNP^&'tF4PZB|%*Q V^Aΐ+6vdՀ[Tbjh>{2yCaQ8[dYf\M,z YFwJJ\Ԫ0QM4^!QnT_upcli$C,yՒ790\}@\aol8%@Gw9J"A3$we]0?IUvs DCa =?˖]t{nެJva:?o&FC:+HmVDsd+ߦ4]x(5Uw:ޢ U>7 5 I4nqU묿2Xp85+DIg3V]q'܈j`?bGTLR4Cfd,S`ϣ</y)N9eȷ#~1Sx…A31 rU 1MljM*c Z9BþʥCCl9-;:GEdcZuj3߶p@`5%z?q91(,ʋ}!¸0?]H$ N\X]v~ztwucJ%gBS[=kkG =8019**UUkQ0i#+4Kk&_Gu)S# "HF]/txUqu0F0,un 췑 $ՆϺ0Ve7npEG_\#dWMYg?LP{ߥ0"a}F ih?g6}`9IOBe8/۸ drBQ7И$puPbATYQnn40ue@C?$D}1mW3:o&yN  3`~"l P{_Nvb=Y"͒bŮON-ۿKsV6 oj?;vӓfM+vᚘooK0H2_<7(>*͑}Yr(d|@M4÷ةJ|ʨ L933C4K^ux]yHxSJTt{22h[B j |_a,T-74x&~@XqҺ6ݿAD]PJ[zq ɤ\;=GMuky}~=#ܛ}q3Z}=tr4jM?mÁж~_e|ã~ZS"hB`)W/wF㊬!I o\%FP;q倛tO9]F$ī3{_M2#2 ^o1$; aЫ>rrnm2Z= VXݣɔ2`Zż&>k8"$m7 yv5$5@t$SUu \Co2*&f̵ZzݗvcN% xdj R 2oG C9FF;3EȂO&,!.[#Ur_jO$.mTp"(ajregX,y 0Kx3􇖪_'O3? VLPJƗęx_,$YkH:[|ť_"Tr8"vfَ>46% &ߋ詧cUkt,-~P=e;oqiwt"@t-_Ce8EP^%nm@TR-,q$[QۭP5v[TЛk^*`"XeuQ^K{ΤAR8HRl2pdQ{bҝۊ.ZÍh^zdݽ aRqT"~BMzPOw0.&35l .?O=_ Iy(Kj4M,XR=O_zσi֑P!SdqND…u_qS?/ۤVp _ԫ])K.:,_׷~$E@)zN! |NAA0% +e2(jG3ۯ*緢I) Uۇeu\zDx/)ڧ9 2=ϹF4:`p/ߜ ÔQhݓaT\=c Qa.˙Z(^xe3tǎ>#Faî;3,uy#^:w1GGvSJp.z#-EI{= Ws~)8#g6ލh?6P{̔Yt>KV!q ~{o s$aZshZ9=ӀЁW]ՇQ<2luxTh238$/Vv+Ǝ2wꈵQnED̽Ou!xוK`ޡF+a2ˇL2;MeVL/7<qC*4%l]K:Si3iW"̵Y ?2Ikz:b] C8폾!G&w_{1{[dg(R,w4Y (So*9luMqVfD)ct(F|8&(؏?Ĉ>M=awWR.kR2}ڋXXNm1^@ f.N6BNeβ}=kxue|*-VkAz9z<%#uZW\QiDrG +:F]>?l"307Cyc$I8w??mWMCfҖ׸ 1 )Ru16igv Jdyy?tI~B+6LԳ ho=rMI;btV=RE,8g!V쫿I^{GJVz+B˦5,bd0r» 8"Gm@`gI-4w+-ek&1>"+pP;KQ%7ӮtLVq ?)_Yfyvb^2T?@PaI@H?"T#yf*o+1$=q]z)ܖcÝ>a)[|tnVQS3@gBx2edJnH<+H- 6R0ݹ9aPc5(Q1/o#z z~w~~._ G9tDNjHu,U}vט#tU]]3chkصߋԵZ3#ޜ>HOmQ n;} Ma"v(lU#G"܊fYU{<'R-j.;UC-Uè b= P~ ./`mO0֡7z30-6JnCDry$W19'(ڴ;_d b1try؝ATS>vE~v }i$poOYP#w=f=ґ_/ cp݁Ei=.):N*Yƍ|}64;DH\gtJwZAyʟ}#!ed׀Zb ̈V)smk+jDF#PZmciȻUeʥ (]1GOfHz`qy f 7z|"xMMf^$4 ߱׬m&h QN<_l^,(lq- ZA[m h\ 因.j顆Fqt'դx`TX!]}{C`FQl(SXv.)Jf/G] u /e=S8k= S?F޻˃O)\cӡnS ru<53#>έ8_ p^mɎUpWD9  jkd )Gi!PU+~ 2εH6EɝU{,mr4l1K|c)3ЍВͬ1@v@%+RK ;I4bw*)#N.X}u@֊++;H>V-Lw g+geMIݺ7DM s\WK: ǶD=S'C1;1S)+zIH[mK#-wYƽD]J|W7PwpQF@s9CK6%}wTMYc`:V-Y-ֱ/5m9qJnPQU2XwF\Y4|RQ뙶x\Gd~Zuc~+/-cK/-]oBdPg*>؀\Z >NF ؚЫI&>a#{b7%Y̰%;N=3DB)ƞtj?=%ɚib>;[/)K"Ы|3E엿`#2sUcOΉa7orE]KA|Sf tp_(9 jg}AxR%CrEĄݞBCuzQ j3dLž8PZ4y 3HP^CfuQEdKq:}^&[rTJp8ܝm*p7~SG',m8=pՐvJh9n|9o]*}> D*U@fI]ꃜ ;TDe7(C0%Ϥw|bt쪵j(:jCbp7E dbɺ~~Y7Vf?F"8`Ad%%е~e9=xl+oLKbUݿz.Y*Oد+epNvE_2hF"uAV$69Zt\o,uN"ԬBnOkPU `N/Y- XDҊzJ)xFOߺ"^x8 K2}MDuLj׾,2@# aa ģv+Hڃ2b);WeƵuvz S23uE^_?&N/0I^g\5hcz56/xyNh}BwPV 'T^IF TkFnROۘKgbBfZ>ve*70:[<7QH |z꒜w$tnM*0⥼i_vtiGwr '3~qB^n;N?V/X>2vi :| f}NyQt&F+wU!4G)]”W8#|C~dx*ET*$n̫y4Dl+1J ?p*/T>qBigNqT1GěLC׽}&"iu~^聝mcV&0gf;WO%]z Y"vvbEl;./J|oYDgk̲rB\Ԡ*")T2J9dϧdU] +4 SWyM}͆KRzr8zu"47LDQx:ݰ[zpW_f9 ͖e  a]>W Lj=bajHacd+5ם+vE;}CDž=~=2_=s5v(U+O~ge{ AM 8;ebb g6^Ԝx x)!G3T|o@헭#X]5CY砣H=OɌ9XyOZ 623ﱢ@E3ow(%|ڬR}(}p qlrk& ˊC X3tFuÒRQ`a6]妻N/nbpgur!qʯ#1-g^-/g>1{a F"v"w,4j^4wY7} q1od4)-imxNϙrw=RAmLnr13o?Ež~!֛}*P)LF8n;ƀf&&]w{7YUL)DUgҲ2=~R&3fKzn_GUS8+k@nta& ^Fld¬VUyG0T+*X lURPV_FX|7o kاʺ[(ׇ@&W]+; $ ]iMsօX/K8Q }DגޥLεҡ3ڭmtx ?VV۶&eKY4uD >A-cg{Ei'[[B)^fY"q3b3Gq7)o`>F%mլIUm#C@j7M}Ú>sG5XiiUnW9]s|=AV]?XfhZQ!qq^z Ӭc}FN|"=~ ?OCckm_т t:KV+GWQFmsmW|h, ',-#ヘ@KVp{q'Nq/po Q|YK*?o3;J;/EY g3;|RX ۙۻB^mR5$-#8zR8X?SNYsvnK^?L"?Ý43d)1ƾzp,@CRCBM~`NPy)OiېVNY7P|q.h% ]ۨ$r(QȰJbx8XNW$#feK>*|"0q[&C\AGի~:ZR> #rۀzK)}\iક"a mYoT@2jY JV+/&B [: m A@bBVp4l GXrF}0HQ`f_7emXK15#,zb5CXCF?Ԑc fM%Ki>:Sޙfj$^a&N; r) `KSrsp:wKjBy 2 t;od_ e|:mFZSn0y<ź}V8Z :jKqQhvжejdxvL`F|*&CV֓Ώrhn]C0355`Ꝛ{jhLehMJM#b K(d `& oGI];,Vad=MW4Kd'va~(wƉ"F"J"a $9 c P2gk+I./UӔ6_ dY-QRV~ kޔ}aMvQ&L<<a ߝMS|q;\9`ZMxt.!)'-@Fd'fo`u}Z8 AyEBKsndRxN q*dq]=՝NS00ԫMuF3nkw, "zA1"@ H!;W]+=6ȨՙL֚Użzk_jLL|X7;CЛ |ƆO zVY/+81aJDz}̆cTp8IBY}gfAntJ(ir8EZo5j-*7(d"L$A/p6?U{RJL4֙H;,kNkKմ 2tRyZBՂ;*kuf,Z z7( Hݏ>]g:=85SԨARu7xxmVSE X0;1iűqQ$i$b- Gݶ_~!f (FTxٓ'^Ӣҥ&W1zZ{ђ2R\9؊ضN ΝZ)9p0évè`5`F!"$ʌ\xG۬.10mwcML@ސQ}{Q_{ϩKJ+%}OOJMo)xn|] %Q0sR\_k*7-"nn|b͆0#u47lP޴͸84n jBmܭuoN|Usʄ p.;E}'"=b$qL7|zm9˚ywS+&V[tIxemג %BQ0W۷it⬖ibB:LHg"GRRU~8VCTǑat@mDUي^ߜ2b0Yj ن˾Tr=ϓ&2Ky-zJq8WJX/T!ol#ݲ{z*}sGD%oUtN7YF~ ߰UߒӅ5}BR?s%bUMc2*',(PUC5-5[N'mxtzn g:?{ 0\sz>[0W}v iD׆2Hf}5JLcZ;GME KrXݗ#C-;- }H;Ho=Y7Ӎ\Bs';>V93W ia*Etwolv}?gi`{^ k0S7Ӷܠ)x IȰaH)UI?肻qp@#K&LM[PZhl&r= T!t 9zm▹nd`;h9U~ `ű|]ǡ.Vg`A(Sx<_7 (k>͖߂:XL2"wR#&M^ƨ ʤ)u4Uh4. Ÿ00KW fjHA4/0ݞv8`~ذf/3bAzf_MxY@:XĊ-DaMFVŖDȣrP9*r;C((i.D Za/ {rNj&:tҲY;3FTRNCΖUV΄}ĝݩr6j: )tcL;ERV2s;>d}=AO8_22:t^-tOLviz5[}G.?&rҠd@; lv7M/!8b4.#Zoh` l?BN\?d$ҜlZ 3@|BF؂EKVh"y.__kM| v*h~вobhߙ^ye@/IWO2aήJIh.:_'gzDx%2vi7\ϖ1cҹ>;r\zD'3gB.p !$k2~1|!_b>}T9y It\*^R_O#R1R]]5~,|m <9۬Ohg ;HqDrPԪBh]lY rlC7R,ɖ^pֵ&E*q*mtmL*QZE/U2^o\V3.5d49ɣ&3s:F.^6X%&:'\ /w d_$ea*ZW!`G|d`\ܡ=qeJ{psv9' C>L9.ď똊j+#&JKku‚w}/vV7Hgh2gTN}!T[qԟI3D4v$VBzs #83hڋ;<j;@tGdJ͋0ELx}4` )?+URDZ=1b|\ɜ4}dj@v'ڻ ;с̗`TyWٲ$+G -IʝC{%'oT3$ks*e}-C!6HV-zN!`kroNLf@ )cl^v ۈ>*#1gss.VGd^)7bdԴ8*-.BOuploEC cQP~5D7a3RJqF{`n 4D eWŧ:56†Otj̓R虇ØRu,쎇FyZ5uri~i~1eA-Ӓ 񍇒4${wHZB]8rW졎ӡNζfZ½\ly"l*wt<<%t#//R4uG.SIWpi >6\zj"kA yI6SO9mLc-qNg Swe0- Tͷw7 iӠ 9z"𩳟G1 9XnNӿ+kwUDE~9&-9E5醵(?ؙuL}}W?s``,7Sszc0!)}fG=*hOEDsI?BgL=f߂KDW Ǒ ʶMv|!<|ZL3HuUA 筎swUL!6P2mN dK萭4m͍g/􌞒wFEF`W[x/_C$FU7y4&~4kmz0Ź8YMOyj_` ݐΩ~M "V{u*7UKuɜ&ݧ W05K7&3V/3g]A8C? H=tj?go5 >P/K_7jktcq1bS]yME&|=QϞ~^ʃق{fsyr}-GEʏEZ,'o9 #y_ker>f&d0[*!ϵ6{o5.G 4J$|n>$pF`#p`߮ ӳPXR ;?uLyw~@. J+q2IůreYCAidkZ)6۰Ҩg6r1j֏tGM U=A(@@9IB*gR;[0HSV:rɈZtIt8OL*xДO/ /Qc*i5mGEgIzK,GgB</)i|t`gɓFOjrza6"6PbEE; @% ?;ZF jaY1K+,W9%Tj-ϻ5~:i"Sr?^0OBqytJ!}E=|N cܺ{Ur;f[bu8@?Gir]6pK?U;VĒ "R<35:M&o:b={Q;~kao=ܫ)_ʿBa`_*{PA}jυ/,yj#u↴ ^ƹt>@+D (m+5sU2ݒ+ݼ#S͖"YQ%](ǂ~.[ohUTADhf[_i@~3űmrGuթMnn=|6 F(} 5who=NcT"*4|Nz5 UXպ" Y (>,tR.Hީ0ē^a |їTM?$va_ݔ|Ʈ m,P'=.Y ٛ4#+J1xGjH BJZs}#WiPUGirUO˧dh6-ʛH׶NfILWQr(1M\5GC};/gao+ly/ F+ Uǖ˦a$'47d+kQ10GTa&8֫@B |lJTx29Ѽ޴>4yY xQz,-Q^pOJ!?-x<&̔VeH23=>zdx"@l\qv D:o$ v#`ir#ר2 pV/T:k`)<.#UC.Xo>yx4Z^Uf遠>Jcs7w;su}#Ą6v!rעV̻} bqN/gzĪ.ϱk#)ݒ&<0a˶0-<@QH l 2%- qG+"f.Eqk{V }*{>B-2VNj2:vnE"@Џ}SDd)tL ™!i"MfWD=p !fEo?X3703PE L`!,vrEWIC)JXe tTk{mDoa6Th?}=%jRtY&$}ė[>%hcQ*haTb=@%1wN(F[sG:o^ 2<5(K@?0)]RlE g*I0Q$5)2P+ K03%6FrL6+EѭlnM4@rO0vo}"*[ETUQ!g ƝA;mfޣ鹹Yr<Ưf -q (%DU(r:]UxY* P"(2R9h],%cVm*.Zq,O\Y:+pA.gs?mOdy(hƒm>WJ|;WhLC;TOE$!sa >Vqwm h7oYa ~hNBQ{e"N ^)r7=sman]oq͏1 #UoiR~¼8Oyp&C!3\o_l0>a_-P\b5Sʻ\>-"@DA+'pƭs ѝ׾S_t\YA/"t."Ǭ{u5n[ͳcUW^k˱ `2!I \BQ=v8K+|:$# x`_~QQDzgYX6_m':.sεd|MҪ!gc5%8y&߾J[1ztg_}UUJdtk sGg7%ry ʹw@;+Yex;[YӃV."*#~TjNpSK6;l;{Z{T>ًTll WM^gڮj\ok?$ īnM9ǚVO:)IZx#Ƣ M' -P߳?N-eM\pc ebe"@+F ]j}>SќK̟dK%[+`RW\:صnͶ5r.ȄӍrfB /7SSv{0*IGZ1 h Vxh;YߎoQTM Eq_h=|eQ,TDM{ք SxnP=mx拘JP4@,1V?OЏƥi5ώl2~4Fᛢ>4~A+wά Zӌ譈N,M8Tn5?"q"%%!j e"ʮ뢅bH!"Gstmf t sJ'$پ.)%@tNo kB +AT7|32'RaݞU/;2Lh&֊bmlw KScNVh胉/Y0׏}n 趉Bzav V;<}`8։8L4!ze f'M1W*qtrn#x0>~c!O裎zS6dMtkXIp P4<4W7PXfrRZ$ (";iʰgG4)ivE-mi*ߓe2I8ɻ i-߁?&+S}i1tCF1\x1# )t фԘ6eF="RE+gOuҍ6xPd_O̡7'ZĨvj(ρ_p&( kg`T v;тs+)h>;t;Rէ9f&Ígsݎi%33vW8MCw~dC{3ReMS@F֖kkIz/{)ř66A] @fm J>A=vu"*sE}]Wr7>,Xj{f¨37/ڑd+x p-!hS%/?&YM J"WCy72-shʴɱkťNFufEWꀧ"8٬X*οÇ/:R .gv93u#H:0> :O'+{d{n+ђ26?: -؊ܐӞt9(ܡbn M,0$ԕTQ+Z[Tةw&.z=YOb*eW j:#d=$a]4JbU_ϸ)8;TLs`i 2/k~yWc &4FE)u ;[M>f>oSWBc{jM;Ibu.u\ `\bjT|Mil9N Pzh}RWa{Pe2HrTF 3w/,Vd, %|[''4%+' n$&CL{NN))C4Ǝ\ R;lv#e9AS t܉L%'6lBRh9&,D Q◇_]HnkکDHV'TDb3t?m5AuǍ긅>}nDt(G{Z<Xb>23g6rѹsTT+fnE[$]DseRA/(cCs@꽏vM#RؾEv&q2BD=)(Z6IGlC҃qZ`UZנ_Z຀KڽJ `v)*>~nnu9q 4'EJ 4a1;>ONO'6'hR۾n;Z"dnH:E ?@s݀U]ð[9(jV}@ʯPܦGY, %L5v(LVֺu*%vgGp`< P 'ޣГb;Fw[>VeٰKh?eg7ޒrp~!s=oyCeM}8pNFx}]6nYW)2͇>4h 枖3# >(8rt}J`t_|sX5olsہ!%[o $F7vdIA8aѦwޙ\eQ2 Eғg9pԇ ѩcaඤ҅A`yw.6=ur!Ԩ&s^2+])yJfY{C*KB b"OݾhWH>Nd.GVx_Q^ 8^뾖mc_F#x턮 */!;[|H"Hl@|Y-y&@wF$a* ;5%$m S2 4JEIncnTu0圍! )!f[#˜a썋A& ~xnK: *yL5EG^,?:|I BtCJٽl'N\RXFKD s|DXO']&-zGVl Bx _c Fz V]iN.}>/<Md,6api6:J+&]śWͥnC22ֆg1} M BU6I¯xwZ Ds~yѢ:2~ )ęzkag$`-d<_Ue˖A{ɶ旞5>K=\bFu1^ 3(H[!xؔ60v{9e6ʲUJWoZ A^jNow:tS o9?t QZJR=gjUgT>.uԓ]Ο6˛QY_F7R4>+a> j#G[<}Q+>#7> vC(mG(=t:#Bg~6co޷zGJ%Gɻs=$p]VZ(zLj (dM՚&fcpos@'Ayo|*nA:F FlCu@?XX*h.0ld2b!LA7,|]?4DZqM' @C/G)Sۖ*:pD|gi&qT;/cC3'~?+u1Hh6M70{DNEJ:( ߆RiU] YQ+_K' sG} w&=ޫ뙉m, 6UӕP- DTZ=8s:1Ml_$ɥ/+SQw[e< ?F$ϱmOZ1-rES+`^RF?z!*8bOGRnCNM|M^sdQ)<ʟ*!%Sپ"M?GjWzuo3u}u#p|1[BGQ$X h3S&^~ȞfCJRTVyK'ʡ=5 >\46<}㙎>U/`j=oUt!N\ܟQ9ez3QXnP~`{}!rOCz KD a\!Thl~i {j- Վ-S\7vV%mE*n>s@aF z4JOCt )h4%)NutRu-۪F9&cXB/^s Iȓv5|pyAٳ{hj}>} )%m>Ɠ6ڠa]`W'\ "np'紺Kof/=/FzM8Ko69\#Av`o©y츅ZNBʗԙ]>1{?ӱOE=q{S~G#;4eX~cqV+UBƅ 6 A+3E%K @q,QOKy t?Ccy~ThS R0ȟeb-O(7;h:?YaB=*yO?E}~x3Kڋ ctl2AB{CGU#f^#`Ɩ!Sq ;Я.Y2R瓽4Mj x hZ@BwRL$"=qfRiJSgJȩH}qg Ⱦ_Gw*ns?dy{n}$W\lUr;$(uK Np/:5 SζH*]"75Q|W߳>qcnMzs˵ ~7+Cq7V*|Wpk2^)R5(bńe!h,$ =~D;\F~ai݇~WVjò&ʏt>@4No5^O^a pSDmpܱgV CDECnc%b۝}YDעۦ/"ͺÓ1g˛̆cNy:>Ov:!\z`uyrضȧ0^7_뻘TR14HUaA[>uyre8Ʉ5.8tbރ~fdI\1mRWUttl(]UBK4k崐ԒdW qkP[7+P&3_ ÜXl#t!ĀL 4$GqU6bw~E]qn04r=@0Rſq,c%x&w"τ,+C'RPt|Mѿ@$sh\F˝|mq_G\T>!5r|@ω ^H<} L;fG}S몹N 4.IͰ<$mmEfY%h͚ ` y1f ʾ*9D *?g&V$M5V=,8+]|i$یԻs=a Jzyiw#ó0Psg ; _Loc>> ص 5B0-o\ #cnSPk*չ72]0nT'ঠ!#@ zh,t+з%Us-ʷ`rD+Mp,Du1T㸲`n#aҠ-NCYJTrC4KNDSհE3𯋌 ҭdR  )ZŮ8jj6V32{vkddmÓ qx]) p\^mUCxmC T"ձԉ_/˒r#ν߉YqFd@DYӫk2E?" : \`<lne閘nN?F|W3!]K߀:¼&xO",[(YRyus/eJ?5,P @piO;C%*0nhtb9z"*_>z-ɉ\`3@GJ+ MljJfQŷFomG-CуKUmVCy"R؈)!ZԐ,2oQsTIM<Ϻ/\U@(*+HpH DF%ǝ0OEQ#b 3SY7ޙ"HZ.+UaZJW }o@Oxե][S #6\tV:ގ㝘 2[bn'͕ءfcd@WE#6g/ܗ)u&_k TP_ݔյ{ u 4fkNѤpM|ngY!刲(UR;k"J}i4ƅYĿGwGrҶh=OIp$Hxc#&x{%VE7AjgoJ).d ;jO.;j5oۙ+_FR\9㼽koמԖ)81yay׿F` ڭ:pjyKK:8%9aGCu'*֘%=%7$Ev9wӉz榴Z ?8Ԡ=fH_v~hW,CBWvq "ҏ\R=*<ZGsIc긶ch Qq2xJm)^n6V`[2Wk=3ZD[@8V}lye!?+֌H4*Z(|FM2V|+2CAd>ҴS{HYd$襆&H*|Ţ2Dն;@\r~P]̌@!evGOQIЊݕq\Lr WC٭(/bJuGlGK98xӍtC&4VɬˌuoG ^@選pJ3zdx!c,x$( lZNogPK,iǀ:oRpC/{*H0p0lnKqcS'(A3}Mvʶ)T6 75HIA)PIy`+<=x<"2O[ֈ@ᣚɚa3UTIA:ySΠi!Y"j3R NIGAۺЍv>i$uSH2eah\{7e$]EWb?Z 9JshxIF;*N_kI֒Dm-U!pK졸Beَj3 R8]GP:aMW̬%OJ1T;Gּl's/s:b݉n9 (Ʋ2;z)V03LBJJ QDEK5 ]~Lg @Mg/4nG>t d$[`ǣ_Ύw!k ou$FBLkWvAc0Ta\凭r G%j[BL_-JOB XH4 @`3\F2:9>l/C, 5n13 '+U-. \X~mK^KOnQ1CBZn)/V3&Pvw܌UjA^V:h{F_^U32]]y{E$FS< `3Mš;\lO{Y,FC<\8yka8ɧ(\7_6W?P{4y}TwxW䋪;#Dw3'N p]iXnǻo/qԗpu@ހ5hŢIs095*0|bh=Y+#?%*u*HEA)VWrbEUr.)X! 1`)Eӷ5hH9 x gi͋~ZءLnqoHA /T..kJsn% 1O`r4V.r+%04.nr#To? k}㟝._t iWGt }' Wk@%l;&X;_8:W) ,0^ ~aƓ *@FUIOd~]y1}(u|C 4ZO1,W<=0T!VPGN}{ -FTλtJtvvei9f}Y&RcD+A*A\inj BZãՠe@RG!fE-VUѭq$A{Ywב*/G_" $SM;ёhO!J747Țh5zs$Ԯ5 Qoo\q}o* ]Y 95!,zr͛f4E\:35ڳśC!PEI{骽2Q`;&m(?d3i0xLZ_+l(9ޛh`rBMSϣ^2ˍSRK2 Β3'.dJ٪A̋.O|z:MG9޵wA#y%G#Ahul1WA2)mʪxK]( ňV=AcxL 7ܶ tv(,-o P4q {N 4ogQJ`3֨fL3Q/ƴ\>Z]PV[ 6@`np}Org6@n.DBx.}E5e_,_{(ך~vg}oJfMmwh_-+׮JHQ3A)n?R/W`6hN$ dfevmaHMbqv-k{t z[Ym{lr?>-tbT4NNUX\gg~عyNiAiIFfsg?^Б TR^fD]=A%Al|"!'jwY~i} J^>W*A>YS-P Hn7zIkSH!YƂ;FHw鬿պVaLԬ"a&,.nq2}ΎVstm<}̬|S⩈ TAQΖŰDf8pGsˡlc< EQfS!bґ=7ann*A5:[\QD5EOZy4 eE˱zGۘ8NCx-e&HJ]ҫoOp?3gڒw!sM7F\ѸU>7 zAN̔ Mm-f'֓:E)qq]xɕ!hHv_}͚DBpyU%Wm(Aww͸RL4ʟ< ``w9>Ua\R ogELy?.8 & %E7(S2Ur޴GNǾe-R(XS ;Bgw3p.Ѡ>C8^¸m6,3쓿dX*HlV d,PCM6hE".@us:֙ůIpVaX_nKuaK3pmRϢ@}5SJؼueHc+`ʾ֠d))ȟ h(oU8LV9-E%n QLF:D g4 g>0G.l0g_V<(lgn۪3 ͍dHU4Dp'{,OHbBh8=<2 |He +%_<@!S̐$+oyoDӞd R.'&?J^Mc`&qt$:+ȅt Q_TtR%VS>&l"' H&ڝfQ4FSzr +hvۮ?4h7 qZ Nŕ2u=X+7cق=&5V'pt%ZͪIE#X"@V%ZVlզ Vs/%cjO!c_'ccbz;4[UoC\Iz E7xd;U./"Q}FPҌv&͋YvzVIi{Me]\6Wn.G Di_cp(CFp-L X#|vCGSazN5-_cg]ص?CDgJ P:W+ uǿݭ{<@ArÝ8]Ѽ5뇒l+aH@4o:MOPμ7a.{M [ϺvsR&-eof0Rԓ*!wK3^*8[ڇS*n%x9LwRinp.'@Z(J,|}ejY>t!u_˿iƎD6W\"+^/`1 ],y'ۣדzDKኣx?A$V.$!ߦjyٶ*j ̳Psp2PViVDZ "U \!~ڴR1_|CU~?1ՙN% b>&,..&v:QArZ:~3Ջj#S)E"$h%&(t vg1|5˼D7XZm@78EIP֧'CyW^G= jos1Aˈi vȜ0B2A209!CODx(ID w,4F%ø4\u_ , $ǒk<l[PY63sZ 1s'`ZԸBgo\ dF*WFAIM?pd<5QXlSoUrL4+!ɒ_YJ s1]<P=%Ou9he#7`ffdZ0">GDz3BH(J8-AcM]i}Bb U\5$rW!LBqo~%ҐNמ_ ʝ%kzʃn{ Dg`;_}zsP3y'm@Agnc <۷OU&;sj0!7¨"+A"Eu-Y&Z&QzIɶj4ڶeȌ߸3ERKMb} @ iQY蝜|/PE^!׽g I(Zx~J{:jWZ22NGZ2 B/0UN6 3x?/ObWʱ{򂴵_l03]5O#mO\@׋ hr],$ݰcUV8T/O1#d\b)ҚO~|E.s6͇pHߟ[St C'/OHt_`ȵ.|1\nحkѪRl_TTW7b1fZ$d/2 }tCIBⷥPVBbd}[whD/fѼ4df5Q`wF'aV3,VRI7+KDUJ(N̓~dtؑ'H^6𢻯YPף^$D#2a1=wU9[׋b` c/Jyx\ GDbj͝ 9g1Ru Ky$TSK#UTuz@0GVqwX(.ݖ%)beU (Y "Ԍ)'/ aiI|TUAK2%)Q ^?sA沧t+ \,U $ F|ҷտ? | Ff{#>h|>#c BœxQš]|ՂyR/Qp[tRef+h-Z4]:k,E*`63pɟHlHHD3axɝ?-b×OYMl[Q |~TޯĶ?0IqNđACxAwvlY;} $"P w?'1K4rwQ"}leo{fN ˣ-?Wj,Wyz.~O:=$[* ;LާhzJL@" J=@A{v\dvx!ASKQzhZb蚨_P/(]y71M}:7! Tj&bdÅ6BHi!,Ή̲<; } O|qM%QȊآFl"_RpHΟբkN<L,b+rhs=sBo'W6BEh2#U|+EJbG`-蠎8VC]cm! 5 IՓsCS D\7&>LZYzz}lU}_ NsF0<, JNWlWJ,Tb>RԺ֩|W/=}p<xQV;гͤ݋/oqxt[lU{Y"pa,h2L Tg6^Xz δ\v!(hpSC;b3 \js?GnWM*A۶8DF>3]K/{8QaW"qT" ?$7ׯ )O[6*kiU0G~R\n؝xrs{*#RbѪiZ . %jDWCҭư<;ϡgfTcz4&n`F{ne&5hy\*;줄,~l9y +;+[WQdb])\TPrCҺh\~iy,%r B*MVŸ+T#s^\R/7c /p`]]qoaFܺL}ͻ<-I%B jek:[T7i*V#:2XiC 9ޏ:r=hM&&ұcp2Zx éRipI=p3TL.y5&Ee8 G<4QW(k 2Uof]lf ҆TߔڂڙCzK":1pU.z5lKLw-LKvYe=n@g_`bb/1O޾62q+῟XxUpGA3p- IR@==Ly.޿Qz sHi= bh/+a  UVq&:3x6s>wv$[&6mLܰiuwWC^*\SDHinn'A{ro4*#>->90ؒsE3V Q7 ّV=0zګpO1$!OBcIyII_6<ϗ(]"D]K 0DOi3,Dϴ{ lqCf _ ((*6W]~T+N#zpnRȵUN]|Ohwx!>G#np?, &瞏0?J"=+SmlQ4\} µ>qn6oB[zuђQp&WC+T ?fJGFitG#;#v  ܐUyϫ'ѷRl\*ZjLu=8)!ݻ;35 縈{M/:1XFP9NU*C獃ίڊf9V63u@K)/ GNyݶ{}`)%Yg;C_@REqܤ%J# m?d#eVTJ*HGky E[W@7c:F^h,I".8cfѬXLre؉VY0@IS%Cd\Ad c'1mt< eM. $oc)z1zsܟ/f>֫"jW(v7@.sK$/ߚI9:Kre2cy ܨ$H4Y^e74'.!u ec C>w|daa騜GJ`e )Q☣5`-˞Ή9!E^@tIH@ŹP_9*Lr=?!ƾL֟ = Q3)w&=3r{YD匀RГ7翧/'Xw*-KMc,)n$Ja k#[2U[qjh{m 4zƟUˊ7?8Lދ 5 rI[惺) vt2sLOF4ՙ%]1}X|ojl-u5/؝A7ڍծ7Nj¯?o -Ї챡2.KQƱEűGU)-SNRҫZP@_)7`v$8~H,~\DSor0puƉQ\YPǚK |Fv}M`V4ä8T:-ӡ;2%>7ihdєW2\ZS,i@hP(D 3seu0jVyGyJ€ψ\)ON s@Gp"yYsb˯,6i՝꜈5C~Jv80l>0 ڎQՍ2Ho*0$ e TYU@f r7>!Ǿ̣ytՀ[+B S7} "SQR.YHC?N䍅楿?:R2L"R/qDͽOh9+%v*my{,_E\qt✜A:?пyX2a`u#6z@n-?F#3xִouȰE,iLJb% 9'KVk{3avhP(RVk@Nhv{zYxtvR(_qCC Kߜ3,dßm-w>IM8R@p$އ}u|4!K21ޤo+&F qOS5/ u]=%2'\rzCHaᗤ8;,㦱 asF =糖zcR/KF(Qw,j.:[eӧZjH1j,i咵kL4iAř-UGΖf{Z48I9.e @Kgm7٫Hiž5BӠssT(8: l^Sa %JH6<( UQA2)Gq1v еd Mb@R7! K)iz A5U儀!2v:ݍӈjYm` cN NK~ O7'kxЁ K6%e._J6L;?'ca>9عu bK+Pb3X{?QyWj>"jFgw\GYt0V4 |oQdjj'dc<:?n`T iHZ@ NKÙ]:"ˉ"ך6n v-Ѷmj_%Woyr4IIN"IzUxMx}\\KKNWE*';2:<'{{u|>)waU0ohؖq/Y߾aސfF9>U2I~ukzh7x@Cݥ)3'KbkBK~w &Ӑ֐y/w"U%fgWJie]ї {vU*,|֛ Hej{!yjHt;?;S J& DŽ>e7ن'$[B7IH i s zxnݝC *&s~LA=y=e5[aQ}\IXn~Bz?"0cKz#n*t صMl^'|o$iOR?`i_9@rz(4qx`rR}dw%6[m$χ_!2eW6y pq:wM@ w-a=W=Uh DVZGFY?2{zd棐LyA;ʍS2Ǘs|]cϊeG._0ҜXlUۢ:kZeULBΨѵm*Cf;c:.;yWm:Gl1, Ā&YBh'K1+2 Gk]YfRp=@T :ڃ%A:2.ӔO(E`g5KED+;%J2 ^12KorIMx7A OA=HJ6 H\F`mB> ӗ=Yו5!;+{wļxI>I뜀(ޑ7fT^bt𸭘O}>tdJ{G5 3)(S(?'\bJ&x`A]jĕ_R c#c~,X.˩'{c\g$OIٿKopF 3O 󍀀C(rW >%pe ?eܬsecR#%OGyLܡn.gCj#ч;]cxh5hkv&X+z<8{;mZq?9Tmh\HZ$B˲xvEDi×/i' fL`kW*h*V+Ya ܥA=iU'`Ew4D=^(h.du4ƒ!,̈K!nt;>pVc1f9L CK'z?WZ)LŢyhtg~8޽#"`}74S{6Wxc+Se"G#q k,[:-P;Rt#W}k$>Ri6UH|juxI×k.%C!ƢLʪs]p4­+Um)uWT%6`!&SX8]MޔN;ﶒ:YZ^_b LZƜUfܙ17%2+r.IR ~4uW($MҪ27|ٓIPorz _' y 8vcI3l.wjtγg1Kb&鷺-EIttސwm۰:ͳ]SFY!6q0/%ް^=`VAԾIlHgI`yP$DNd -!`*p:}gQ˦"ׅ3eۘ{B;X1i^(Eٸ}vmX@|%Ϳ䴩;9G"miTΥIB_َT6ܬf$IE"򥧴`*dtb^-'!9y_a:R*N5rݓ:]|eMva;F&o#{E+͍⃻vDcs[n2j,Q)XA{)p‚PtxTj)AI~P$\_-ѱլm\ENiw%v4cLOPzm۶V~ {+C`!JM~iȬsDTY?FFn%},z"@㲧RĊiQs/JxH(I~y_AMfTqHWQNOQ?;M8#6R/-5)&B B 2.4F3{Q%Mm:WRaؾFF#"}b6 Y<2/"h k($pdA)횘0OM:[FȄ 5Q"}#pRXpOD }jT-%43xr('U߭k9lsp*`#^ZؿhE5W?0Խ;HVŸƇ Z ;aN¡jbepҾzy&WP{=Faw,&ɈTێ/l$:3!HXb  vEw&\®BN^Ѿʂ tq4ݵaCJ;LCAO(.S `+Yui C̸-DLD^b4'{!bNtxh90yk+ .)Gq +-Z2ţf)dz::e[2u,Oʡ8Qܜ*uRQx X|?-#vsa2 WDҙl|Zj'U2-`t9 4& ngXQ4icYo9cemybL2`蒎IouaޤM55؄>łvF@]Nx՟$x1kD>6?QV"pASɴ3E *-B¡ܮڢ./>4`)f* HtFwj? 0Xv" |oYtO6L"e@nDPL*_2fQA01zSWbIo8]Oi*G. :t5WA, ;s9v.WD)އ4VݕIR d%@5Rުssa4.1oHgIhh󅚔5֑/}!JpكqWx)֢WC4G<&J2-t%3 `܈ mq`&rʏpVm|/F, K}\k-a u1LxݶcHm6-q%cW%#w/0)d.A{>M(_ᄖjY9ZVQ| ![qz9q)k35n@Ax &w#z?+`({g#F%)rmSRI, >oRV@_8œ{[._iúBDp|SI,ԣ%!7?4w k21'L4 #c_6uJ&'lBncOn_ґxdrșRal7j:?\ iWKĒ۳Եn5%+` 4ŜcX&;YqB(o&<=Ϣ+FK ټ#Qç28ZXHq;o1Lbn6DPO(/w_Lpbrv^ZpG>ǫR,}|jD^IU4mPAORe/"Ҽk$jɆS3hc+C@bTB j2vt23*=EDR?c (Q˗Nhă`C0iޣXr̃@EPHcOi OM Llj5ljmy&ߴ(mKsh,΀Jʸ n꬟XX<]N+0T7,vm?26qŅMLuF֙tثNKHU94'$na_z(B%Fj{dK[dh!-ۤ-k 7uu!'I߲=[뜶yăZ܋eMI؇3va9F,F|p O.\x`| Sc)(OΖʾVJ(ptP6he# s$F(Z?,YU%];&8ǎi/a3vRhXHB q`S+Pi4.KU VWr.,O_n]~3H 3$@"~{aqW{7ͣ&gIzRh ~FSi\PG<e@ [bs1Q1R݃*vəS&zX3.BUYY"B^#;ԃkkGCBLK_b~տ |C,y i'ZfGkA~`?&.w-?a9` u>5vgE޹0$UW]T}VhiumĐx53ѱ@$Z.ܕ؏Diי\ 2D*@a0 l(WjQSn$lEcIb+AO[RmзEhKdK^_~t^_z_7 UG絭wi|\Eb@(E@|EÂY@1/~-a̶"@QQ9Цn[B9M1kIgmFwd"hDf_UcXV_cbS.وtew$`!i#%ŋ&zSmДRP4 %ԭB=y/EZXZʝ'ՉNы!?^$Rb*Ayseo7Ǘi&[̬.hZo,_3ݭ?T@o\F Ĵ (m>^1(q 0R^5XywrD^R ס] 1[FE^ F ;.i30Cśzr;EFR,#@X,XpsF|oxg?ZfGD^lԍM!fe֫Om0ZمwX2 ߉#]0Xmk<]R_|y5Ω ),ʮ4S*.gj-eEt{_ UUHb:sum Yrjsg<8+8Wᘨa5v~QZRi.얡$ͳ_ 2M&!h\E!vbpg+ `MfRM>>̜&HFߢſܙ6 E^ m;!7_ph*xJ$)GzbHMкɗWL*&S$2Կ MA]R8>PZ9VbB<AdmL~e,2D :02 k|`ϡ FٌD ǿ6vUt}{D"c>Xѕ4g& NrD6e4Bx__324p^y>˩ (K4ĮM4]0 OZ?(ީ]"E2VNP+T_"#$S `륢 ~<3H%6 &wP ˩=kl}|̔04eȯM 3V_et̳eb ipU)깄yJ=_$bf3‘5S4BlVBY,NJ_Yvwl' RHC/vH' G1/{:p M#A2y?.RU!)w{6t=adr`nA+xM Pn+0$Z%M~,uGaH˩$Smc?9eF~~PPMD`]2刜;PYn3lm~/zz$rU|CBG`^!LJ-w37h>>ž)CRu8B;XPf)D {/=?J/r1Zڞ[t{.\  і$ҡJ$ u )&I+Iq(s8NBA>d7!z\'S+F95H0yM)˟'xYRd@" ԷR%e{QRQJϲ*m Bjr=t !:X3dvk8 S \ncvΏ q%p$-|5 gub2G[U(;w2}G*Jq.(WodLI 3Š{dOrK2ԏyY\Hi._LdTp nN' };,u.CuT_ ZyZ%9jMm=pέ][CČǫx6}eNF$vڹ@A4GLkj^3$3 樑G~snu[ ]^u96/7>ѕN8dǟo0ALWVI T$A1/UڜHgͩܶ[gK \. V25&.=>N?N*Spjti_ 3d:RnMkTlpI uAAH9o]nN"T94q;~|5>M/o֊Nz8ԇY:ʧIMƥg'IF\wPhBctZ8.vҦ4  xq'Unog4':Hr#$?!v%˿9/c+KΙXf,?kK!lpb %d ÏN0 m57J>7׺݇Ԇ^{> $Bٞzqch58}ϥܕwZHAޢ r_u ۅ(% \_ -;H0_#[뿝AVIּ UxAS46ʮWX | ةq|;|In=p!+Xn{P4ySB 5+&JͧX$āe{inPLeӪq,;F.*Y˿?'": "0knE&gD17 nG`Zr\HpnPUvUiY t;6kݺJKu1Yk*k3WH#1譟Q.\[G8@TM p.^PTW78&úrw֑G;ޕnbMֿhm%WF+ûُ(:6j]S|8}E)L $4V9qnz!kJ uk1kVRb(^raAZ_Nnqk>Ϫ0eѾZ/= Ѐst@RFbĪ+jW]A\ ZfP4ߝZ673M]P~w+]<,A0&v=A+"X5ݓ֯H \tR[ g݉N6{|F ++ eiW{J8"!Gߕ8fX˃6Pd!/ȡ~µ Po|bSG2hRL)%l} bO(S"tPh0IӾeaQ.o,ٖ &Qn+\1('pwB'Imu:3)"Y# vDk+9 E K4CɿҲҡleKdpF!ta ׽X4_Wd!3<ȡM q]\ՇzqBz1:N)wW).3w 'Kn" d/si asu>XO*VyԘ.Xi.#'n;.)#>L>mbr@H/Jotoˮ*!n|y艽5EN{:4R1lżгr(d7mgѵ+ ZNtMfO2ϸD鏎h&H>랞eepz&WA&@8S-h)? αg~ՂWJMPln:a˫}o/$/+ = pP hTT0sBtY.]Q}{*; `OlƬX2zOڕ5(O-!]5hyzLa_ϼe{Us_&Ր bQV>͟wP@)zr񌗝r7mMTSQ2TS=Z6vS s[mUn6}=LLF䭗jBN‘c' S(aǻS괛(xszq6PI  ҍX_jvn"D_ܲRsl׵k !(=D vDY-ŕ~xGui&C2ٴnqJ*/g?ŏGŝm25`ROf/˞\-l}R)`cf*?IA ~at n|8s08 N%؝ۄ-byJ>{e3BZTD-yA8yJ.*ZΠ6_i1Ġ{ƁT3ڤ~3ȹC'xchpft2\,<8HG DE VG0=pMeSYܸ2Wr{@DkDGSIw(O70gU+|"JÄKWHF,ey_9uX]c D(̊U9>-o^[BſHpNiw[`"|ԙs! <-yNBCq/a5 puz@-:B+D jD]e)a?-?jMҮSqb҃ϤSO Rj,(DCH6ZLAjqݞ1v6Autpn xgFOIl{R(Ƌ" $f[lR[k{z%'T">TI* g|IyN2_'peX3UaDO&cF4Sv0U} cCxȨU5E=\%|9e}X*^QHٷ]ni:eL:b!֚;n#:ty}=> ,H'Ӊ2{%6FKW\?dM)v(r^k~mzȺ 2S'^95k7Jv1qx֞{1hcpl&诮תDVD.44?&),f\ ŎhkL?DF;]V&9$;1&! >/kjpO䘩k e]j(@s /iJx9 *5%m3 z#Q۟Q'3!~ϥ8iR ,Os&B XSVl 9/j"0Bu C0yo0&u%\=)@sMt 6zz\z핿>6 =6LYJxo%N^.ڠ4͘h/_ciǝVriI9ٟ~ ی$'sATaBDUĹPqPq%̓FN1dU|aW*8ӉVU B#1׺Nxx USCC0 qhp0x[3iϖ_U"gR?}56 hX( & 7 n,%gW/I`yVi;cv%scu=˰\Yc#63Fct`VU]pB¾th[Â[끔BU$|F*X͘;ƳHh& cAeyX6 d[kSoLr@փZ3*6@n^eॵ|8(+;%1I%JI5kڨ/VsNi}υ~Ҳq=';1%96Dc ЎY h5co;M_ߥ8/0IS,r)7/03 Oq]؟Րso>X/wb(:}gcĜ/,̮4*$P|'&1ä.y&\lXo1`B)7 J,aϭsMET YtUk4cx_?`wltTvU@\˚%;Bvb$Eɨ|-)>(ˀ Gx. Axn=k.S=/1x{9.n?z8;O/O萱O92U,o_PMtxXLV/uh)CoD*+~ȕ{\.G"D|r3O~ !~"A.;Ұl6zWûMɖ렍+9@ x>:ur 2wZY+jy:y~&|"r3jj2{ͅ߆ M̦ zjrFڔ={[lWTl*ʳ??&agL2? ދ{}z)E@y9PSl8Һ%8~ ldq\;|'yҹ0AWOܕ. bʶۗ4YVX%9qUck)( \(fٝK~ON Eլsv3 $Ew5/c佦qCj.Hb o "?"`9Ҕ-8Ax0Yj,Ig&DzR\q&ۤ>٪1%/hHE ݕ6͉!8ܢsmtsgxt7St~E5x;?Qq05YW`R Sf[8+^]8|KDr<ͦIFw+t~mw:l32`^8MU<X5w&JT,a0YPE5Kwio{H vFwx{̒bL3v?aK#%!&aC A`Xnj$ݭ>0\N_H#X40Bz%v?5kt҄9rg74!Be\'_l? D L` 姛m;WsPR?Ir`%cd҆q-۾'.Hk4H)+*ԹwmMC{k`[kS8=&O_°o2`hP̓t\+ڄ+7SY]&)zӝnى|U~lQ< 5O7ۏt睧c ɓBuDܪ ,\ɧ+e%ZֱatψuKZ\2PǍ/Yl|U>-xSH[~3^)뢑ݒz %{  Be7i8QPa)zk;EC)Q+`b$)!5q~RD`̜P+Md2/ I7Ȏ(S`@]yI|=w)Od̵ (d~+NX?C[{ hp*.Bj~J7zW!34=e{8 IX+ɟX ]cD<tN^Qf4Bj [=8[+OtIy|wEFy4/c Udw1{>,JI@'=mGCC|W g6 2NQoD5,CZ.GLZbp˯qɿRayT&|LǫA%F<.r30.VHrgfѱ*j}*Ð4RűA',-R:*1<\߶^ǶdykUިvg"Dϫ"G.\^^_ at·EAy:ļ3ci~aTGRym%!*ANCT1Pu{m vBΙ'PeDͩ͂|F1cG$@7tؤf$(^&^+k3OALLr?ݲUG`-ZtʚD4a!c:pfS77n.hz7qXHHd) ^9W.I Bm& QJ)N9ا[OLfK!`7Au*]\FvQ\Jꁆ:91<M ;;!9qǪ5eFZL`{Wz%590wHY4)(,!Ӏ"YȱݓUZ_':Z>XIUD~頟__ '?zx-n{hy9)T_*jON!Pjc pgm4^uNOCn)rAl})͙m{Ym_)wmt780,Vnr ֳ+e yHhl<۽l82l4 ~ q@QnxPpͧY3eLws+"))Č7hPOkR@ Bg88 X /iDSem҇aQp3_ vW/a>Y{Oǒgΐt,pqYG ,-,se)gBoR& Ֆ8."T oivZc #贩kT//4 JeqGQ@KjMk`SLBT!K̖ f\G|f ls , j1OhFm% cE կu%τ C]:3S&&yA#t aR1yJy8 Q$?KV>ɯXů0-*PGc3~;eus|a}?1ʿ-^}`b,adTcPqm?nz&Z_fe|>z󨢨sch}BsHGkC2[+:T'cS=AHiuL;SR7iXGJ?py0(`?103Kh¬H!'rbϦyٓ0}骤$[C+!a#\zmG%zw9UZnh6S}xE36 Y8cLn8-̍[ 9IDg򼕳(CrBoA/.ciXEÐzaJ^ QfT>c>EQ%ˁEEױ `C{_4.@459éǖ +at%]Zeb=@Dj:n z6L.q9rF#!oH& Kfe%k|EKXD,̤ Ljι&|ʡC'pCNG:@ΣRv %.zq*#v!Y-HCL>Q7:!+UH&p N9DGotڗ7q>† N%鎯qk3p*97]kc܀a\JT\{Ay="/P^;bf#Ӏ# mm!23JϪ2OK/Z4OcA{GjlB#<_:;xeG䡽朻\Q\$b">JFD((h蔒s&QF+_I;cUdyZpnk/,j~+yh۝m3.ܔCV5Rx-4%D"K PA!EqBG w*Oɯ&:с}GLl,﨓_ %~3Mg A:YH ̍[WP)b"EޝkMD,9-XܳYf%Xƃ?3ClzZ9nxg?w ׆\eW}.aax3C[mN؛o -Vq3d=DTЬ&O'EqR,Ȱ\لJ ܧZiwФPF([ZMF}|NDTxGxZ o9\{eEQ4 ID['3ޜ?%#.W4ҤmeR0&axNE3 )R$LĈ_d!wSW?H]o!@cCUILA6v; YRi=fgR?s%̾pNn)ޝ|<ǩ=qSV$|.RugǙq,S k q^؜L^67m4>F WBIV^/ta|!7GE倰wAT_"/A Vqk1p'RV`e\D:var@+ꑂ= t/yEj=*j=V]]O]L߸BGM-aщ"?;EM44]l b220ʯ[Rp_'deK9',צqjAFA/š3u8uUnp}Ʋz&4N&'u柦֔U̝C{?%DlKH?1rx}o = hҁ{$b]}*$hCŊ :?ZM CKvf/)䤂a&Xt]0tM-'a%rk R]yTfm"wPT r!;|-PPMI(4OLX҅GRD0Rr#APJcioF[bģSUޖ[*p9g әXx'cXmQT iMrF6ma'w%#)"z1V]SC'sg\EC-рJޝP%!F*"$2 ț"gT^!ء;58^IŒo4Fђc5 zl7'g ԉ2mo)X9nQvQƮ`+[Nψ pC>zF ^ cRbQo`9[~NDg. Tn'yA Go╵ZqXR!}(;{THyDFbigiq$a{k8 ?Bs%Gha:!27/o+.|?.;Tm]-=q`##z}B!ixQAI]de|ѯ8+3m6z,4|qI/ZٮZ{Ìq*H{O:F('#|xJƊTQbZ+9<|dSg5JS1@v1X،l!Z'+f,>TI}" Ÿn'h0o㸔=0Ҧ)T5-z_yyJ x,"1h۩ x|}9%ʢvT\MoޝVPvhY̱Vڲٛˏn( # `"O}\p=$k`+,"Ao $Ic`'VQSsHCnݰ-'g7c"7x.fW_H2písWFyKom gcIt|@&t[d\zo]uDGtcL4xj~h]qE@_&r@Gf(ɓ盧 >kc`0Y' IPg%؀  vOfǃ9ݫ4O1*o Hs^> nnyPHHR#t厒O4oXJb~A*`a"yt)IK*{O a6B|>& ,OTp >G6}^#Jm8DMɗ}o|X[7h߲K } 1Rrh FVb"r ${SY5Xl!ݒR>FPKX7 N* GZEB!lCԭ08M\݄ 4nqK)OJBEX9W:T=䲚B΍ zh4C{ph֓kac$bĺ~Fw\4qyxCVȳNS w\꠵dK߫ c;=ￊr湟Veƽ#&{* }9tu`dotAу "Mn'D?ӳ>&-pHQ5I8EDzr&1Smm?cRא?\6BK&Z1cR`˗uuaN ~ż ux_JsLBZ;M~@g w@/&͘ {v0ch0J'm+ZPNf[$M(/Y"}viYSkpkZ8;ߕN<+͔\b?=rVe %PB%6cN)[vY:t4ptL6|0%QI9"bH,;E@7ȿj%ɇ}{ʰ#͉Z;D wOeG R4k#y?oX{DBETsY21^ '7Hsd硼,TGjiS^[h7T'|EN {V H\%tݴrZPƞ |3| 7 hweåfZk|4⦅ $Ȏsrxd@7Rø]GSQ"5wZ[_̔Cи)ӻ#qOO'r!:ʶ%GdX }O>$>qS2 8GۋN ឯF__jq`pQP`1saa)uՑ ]w/nDB57QcQkqch^r6̦9d8@)y 2E_b?,MSBES8f;xAVDE*Hc$agni(Wb~J6Ϥm.\whɢ30NUVXB(VRG*躦5diW>f~8pذۍ| p?gs4b(k2Ƞx鴁i0O<; WS'CL|-k>>0ʴj̺-efmc2eo]am%%ͤ3W (ns'tj& MY Ǔ;:4x$u-;3.|T|s`^2"EH罓IA fU8W?Z\D\6y "*5k $!,`WD!So͕%` ae[h\׷SNA(SD빈<_|UY(s20.kti@.ۥ=g3%E) LEK}*#AScw ۠"^+k̂M8K%,&"0_p W2cxWrRNO1osqwQċ{W\?@$6"drb?=B-Ϭm9F>@i{o-W }|.*mb[?U ,LA,*e0ٝH%eZ^N&}i}/O ;[fcG?n-:& zߓ`OI|*>Kb.LF e<ǜT ^c#bBR$U^`jjIF'cX鬞-wZ_dW0ʟM9^9}9Mg\J )xwScC Q97 xB=s8ө҃]52Xɧ؛, E`]- ͘s!V\Ƙ!+up f`Ģ<kipeOm-lY>Ymn;j{ LCXvKY#%לvū\@(dhi71MH`M"((8OM)بI#uD6͟~"K`*9dX]`d1Q!6lMuN{TqO :o*e]Soö#brKk$λbڅ4 =E+b{" a[8Jګn0\-%0:K,013djW O=~Zic|nZD$dG b3NF޷%P z%ڥrܷDi^Ft7|ACŎGO "x:CHpꖫ\Uo)1d}@kP! X$7DҮP35Jc0K?遌/.sdԙY8IRƉ]"0DГ4␖"kʄ؍2Y,(&B1Dΰ g1[ 餄De`!ZUȠE<إAJn:n3}!ow چ TSF#PYw)i+G½FO>"^oR6+@·{%="Gbv^!4֦3 ďe'VAD܊lD|F{`rq,wQ3lۣL6 ;5z?#&4ʇBS=ADr}%I65MWW }(svQ5v84ycPAF]9v 8Inۈ@]ߤDTncW _&zhM.-n9^5PJsO@:7ȃ;+efL); И+ӡ:I}&%|8,ZelmG$GNUbsX\ZC@4 zx:p-X*%nvpZ&@  % @5hŝKcB`qWZFWK?f<2R):TWh5 2a.Vm`` Mf_!7wpc~֣G=!JJˮܖu,5j@{7#{j!d/Zʗ{0N@w",B֜;h7;qq/U c m[֓V1T_-0~sE(Y>{65&"m풺!=yOf0!&֑pHHRoD?C%pظV}0eu<;p1F|SŬmSYOrBig Enk"4IK9}%UIL%Y ]dR ٟ سd 0J0pێ0\xHOFͭr6;JȢǏ@ z w1͢$7jԛU=ۂmѰ`9[6Eѭg,:/?;=X~,ta@_~ ;b,"fm|(EzPsϽTH>hA<Dg2V2?~-c<$u}b9כ jʹZaмպ'?SBR7K*Tsx|\?KҤZuZQZu`޸,x@I`8_Pmq3Dy&Rx/|a1J/\ñ!m՝Cx5nۆD~vad\L$ rX1)FBgd;qp P7+1nS;ֈc;Z9,ˬjJ h޸M$ g"%Ep25%#${2])Ý qEhGab45r<>54#TkΌ|瓜*,$a$RQ+mQ|7@߫č|%spi:wBj9Sx{yE7֌8=~3<=T%4sXi3c\yo 0=w/5lɵS&[r)ؕ \u2vpHfHP;l^qQ9`؄RZ@;\/֥=/(rj\fr˽#qr2VE67'SNڱICi}NcZ%JW; #e9 -'=*kfo-=*Q5h9ĎD 8&n5'彽9tM4buv11n[GmzڥuV nP餽y~zn-Bʣ@apPi}MNdH+&5yDw?ƩP:MK6l=NɣdXGOb=ʻ7HB7;yT=>AK;)^r8#6Rj '˥04ڀ<gHZ(4[VѷUmdjq` xJ25Ÿ Fxo o1>T!CX2^poddpJՉQŤg?v .c;J#&.AYdIG0p^|\a국Y56κo*cCߖW<8-܉]G_j+{zS닞~-y6_iϐ,BN Q^coX~y1Y5lg} -dA|s( NRF'[M I:堙||szdqCj3nR<ΉVѩyݓ6"[t mS j BY\ϛ+KkT@ȋ{'r! ~M^Q _6jkAw#_1IeEaVbS[ ] mHeʴ2W^AGDG^ [r5)|G l{9@Ƿ o#cRʿC-DO|,:WLõߑ-0Ԩ̻ٗCb̑}S0${+^~#)|3hw^bgM:u9og = @{vt|MӇ,%*TV_M"f.юW8Фc;Zm&,!,*>VFܠZUPS|6tBRѬ!Q<L݇4B&`u\ K4lNi>C܈ ԊU[X4,X!#,ۭBcbfWLg: 4>H_"KՠE卞}Y`ٲ2+hD0"(/ 񲋳3~&!EOz:^%rӝgAApRUug9hGv̡H [E/: xm4HS܉qSL"pc$xZEj+ϪL0[m/Ώ O%"3Ba l& ֟eDW~-m_.?;&cK('Ҷ[ug4 ]jh^y/ߞ &cg7HvhEGiǀfeyb;A,[h:V=G:[*&o HߤG'cHmFW/Yz~j*k'DQ-ϵ3v]m"odTHJP% rW箌j-jmWZom#ՠT;kիjKy$`w?M>$QGG_[%ZE83K&`>fDzlV MSNX+ ":>񸯙r?ansቝ"+):W9-x3#Jg/c٠(@Uef!~a5*FSƊy!Md ֝U@"X䒌)SG/h%Ҏ]AgWsMQ%u_h h.ܮT3ӥ!֍ 9 ՘>AoRT}j/<ժ!ٲݴ {_.~Cg&QR.x.ڱO(O"gES*'om{^=4d! 3> }"@S1MB<Bl/Qj@=DUG6ѫq9mXk~INEhU;-,KLͼ!Eh5,o*AT؊8tҐ@ErD2XQ5hᖱ-@`u%d'<ՆuQ5KVq?\i]v|o֤[wpMs/>agqa8/+A1[^KK ]}oTwT%ۃnsm5b7)(4Җ-W z`z϶]tVa8cb UUߨ%+::o8Ra D9vNY6T92<I2ZO] ]Ozgb< U}r_LX 8Byk'*tDۨ~D(ADz12BpP۲ERCS3L_1m1 R/Cr07k. Fr ?BWcCsrgsY^lNv>U$J6EV]Û:O.G;=3*Wi;-M%4MfmQ}mbfpA@2R.aM,^CȺ,fD5QU $#KdQ9{H9ԇ*RIq*" [ӛ| ;W3R]矦YăU%vÃUBRx\1{9$l ߼Y_mL}yP'T~r 'ڡؠM+`Jlv.aZY`m7lo O nfE3&z\//^K)#Mf8]!FU}M2LpDsK mBw_"QQ%TI4"#( HgC*~p0Fht(]Ȼ3Yl"s=Oe4Fd]BƱnmjg49M[{β G^ry-uw f\3a"'>;Z9w.pp(И/<wv&B] ?6VK!yq2Ob eTK_vfjƙ*q2G+Yh?̎ "훙_o!>>pv) "o?gw!ܡ0=UdVg!FEo c¢O(Zv +Ĝ*35!3O:Lfu$)#'UBntgK iX8CMB\;4q NEɁi=QG^`VmRgWuYGV&|OxbH[?o f/p)>?[fI`2 ""QiFy?ܹvJr+mh Ԃv2pv)^85ەGe fMa]#b] {3׉ c+u}3џ_=|yW+[Gg(cG{qjpEjy,z,o'<+3co 7$dlt/n4I!xMq<6r+ܚWMO*zm.1t2Bʍ^E&BqhA7냰 'Z/]zSI O6PB.n23Ksy[&ҡ$ Wj#Ę%s;ا` ݎݾTly4 sf{S}{,%+Y_*:=W~&cPNά \TW s%B:}byof,&NΈ+P]󗜾8=S\qJ7fG(Z垹K 2uJAvU?DO,*!BdrI͊稦Y="Ty \m |TG]q p`cL̺U'RtD|k#`QGe؋zЕ"ֱ>ȄaXkuBE['׭em@U=!=#QW.=ϩGZT>3 R$e92KUD\ XJ& tUI )p'X\)e#Eª؉[#式h7iX[x?V5J zDNtB7vk0( @In4Z_԰;\xa.QL,)!Wuzgs5y Z._^ ,ׂHYisȯ&A( l~R ][)guv\8=cbHl_ / IvAPħ>ZyA(/x{ [ ]칢X1MgL4iJIRR(# #x{6DH-4О-bhJDV^r7󥪅K8Yiykox0(r`?#v `~&cٴ=Ll | ZCbMM䬠Oy'Zjp8 jfO:1aꬸ$4aSW.Sx`hs.=*4Ch6&| ma=ZAs3rniBI(X[=*i x>ȁ'`oy>w@]mPY;xs5baIGPʄ);^龎n5+UqH.#n٪{bx$F#YBsݗן0!P2~ ѓoAPX´RͰdrH5؁`#$gf}%(;F7YiF\dU䉶(՝2ʴ>62(~Ig~A뻅x?|1~.G3Y= 옸eX%_@K V~CJ3bHZ YOd^@|?:pC^+Qٜf[=-[뇟V:cBK!rq*f8Y~<޵72 'u+Z|;o n [\p+/Fk# W5h.:r:J8qqC ĻakNanyQ8ͱ_ lSBZq%0Ife/'̜d>qn2ÉpR-wGH]@qPv}urQx?] u=@ *mp8v>Zj47Ip= m;2?T.fc2slBŬ%`v]^h_+iZxDcNJ27 g`<Ԩ "*5^zⓟfw8eOs4ۦeluɖ-5{2ZVgK͎s9WoOXjRi6@Th,ψctYHnQKdXwwkL\_@l+y&=%Q)pw#O/Qy( 6K img҄rSbj7 PY<ȈoyF-d16p}]#SjwټkԳփ0ԗz!+΃1h8T(=_0t\ Ng4~}B.`Yԁx(Mc54 k$eC ;1Q]>ԫ%d?C:1 tBBiL =^:~] E&ѡq(k UUe[ޚaiOenܩ#BY`Qn$u:M='nHͭ:1/ F`Tރ#A²kF%wOճڹ?>qg!ManRۙc|b#R&ϐljӨ?GXKVH`|!oa_yf`38"sa$߯0EHێ(d[/33]l 5" (9NZC3͢z9}9hE1ޓ &(3ͶǁdwڌWay| jz??͚Hy |XVԝJ+cj[;Kq֤m;1MD_H_ խ&糿5N6[)coĻE]jb7rT)߿4QewZG6x*5B˄h1a7TU 8B=Wvfy BrQǶgXdm9aJYiذU՝M,\}:"fߖ33PT.Jk4/pQsߑFE @ :fH=SA!siB乡A£$qœծzAꠄb6[y<E<B'+Htn!vrN J}y3?C cU?3 Nj}R?Jljj㙂f)'h`uj i6fۅN6+ZQ 0*ĘG-+f˾/︒N(/AZx6杈Y>3MήݭĠ8Sze?=PV ԟ;> L]np=ԬLQpL[c} LaH\ -2} JU$w6McD2tA;GW3oTP C6NXm>/lZpɂ# R vܻ̯I2n6-Z֡dqto9)C#LȥD~QiUWm~+ j"yuNBDk3uc}[߷/]UUNݪy;.3"EZ}ڐT7cB_y6^p8V2yAMՔH:S"/0h Zr{.{/27qT 7<-"VΆi׆[6wɒ M -6`v=g+iIqJ벣>>D浭?gR\t^3);'=?R6Y`k؁TOn^gkkh9#ԞM}-Zh=>~7s G3fͺ1up75,TbMARLDeXSYY 9 0ܖ[ Ews8[4+`*Uh#gܔݥ)ywZGtFq3RT(pj=wم.' ZD"~3*J?.- m!_%Rɧ2L=BB~=q`R#G콧Lihg79`V}z9ÅErdP8YżpÒ]MnC6r3;E[]OpmU!,:kI݃SljⓅO3UUWH"ԏw`%)j}6@|<, Mu 6%G,zP Q|J /{xw]9%npI׏ٝ-rJ8yH`D"au;xmJݨME$X:PHC zQr/J( "_P糆qr7[ 0ܡstyrbc<c6czxTL3 Lwevmg=YԿ45pp}:[ĞFlQT"@~ƚ- @M#\>Dtb|B R[gUMQ:7(.ox[L+')Wvችkm-]2oHAVM0E1c 539㻦3;Dq>g`zhU# 2/Kbt,?ǿktmC!.a5zT@ٕ-*677zRf-64[ 8 a2I~G^nd bvI6 Lڵ a*i=qȿW3ftƲŵC)yqw ںnihbꓘŲ#-3;bҾ-֛*>S@0Tj/PЅj޵(΢<}17hp U+36Wy r.w3رIdB|wK}1#89{R`9HQ|0W`|2%P;bnHAIu {0RvLq2#gȵ_v~CeBk&,x9A,\mcK/7w]92$/h)*nMBZRW,[Ě0^3m4e l,=0BnRs,"xnwbFPsLšnt=< rO a3` er RL7Ko)<˜DOKDO\W0Q!.ޓ*H`k5,z]e:%JD}Ey]يw|s}?K_~lZ=xyJ 3sRm؅4t DCv\УGy;#N{c8T^6֮]-6:Wi8All"IUjds\Lܾ2ѩ=F[Gez)HłIz5+0-%=A_|ݯteQ>g^?րˆ1:ߝ# /p%!J,f.sX1x=Og1jn05(L{6-  b9vDg<܃d~j k&R,u+ybӗI1'713Jե%gs%x'`Yi0652!Hln Vף:R+\Uk,/-R) Kd<>wHE hGSER${OEV$AE U]$Ǒ' SZJOM`9"IO ۥ-Sm[MZͧ$eh0:l@c`RIk\>>sѺ%݃8Q@D /1<~Κ8Ekb8ƆN"e+^3Sk -Ӡf5Q]:yv~w,| yQ@&eh E&.)(9uyZz!(@6Zo-Jd6أM+߯)htcB+9d\ey0H`0beҎ^#v}%堭.RFbQch\N?wɘ}?g֛;;x',=Eƣ ҈)9ht2RW-]z;4h|oGq/n^_NPVou66 ܮukb +Q<;@nJxS±n,8;޹!ŐƥpTQB|Pk7㘲Iy&=@wX,ť 9;/!h]5SӔNb[%Le ḧOVm #!8OL("A = ~:dG~qGGb3&فc̮M laIc&io8O)nq&fc:$b Ua(p6r+4mҤEHgL i^ntr38!d8ҖT`x?߭igzph>W4zLE1~ghkOȳ30p @v ̒F&:4]qKaԇ|q-:Hj$}ۤ90:Lꠞ㢾dR-/|Щ<{XA$' A{풎ߍoɮRq' m72:|cAHWBnb},P/ kSZ!qGM67汒)QܟɕT88ҳnQhrԍtAtWˮ=5#s HwDpz&>pĞ("$>opYJm `_TurĊ^B^EQ ]@U|JĢW=4w%fcg`م #hl1oi 5 V.$-;z* VLcBC~[>r 9^/sf'׈rr@`īi 7 Ze ~唸B5 $jo_dXXI3h9So,熤:8OVI_ !eQjh'gQ"x:xHzX)U߯,].Z{C.r# O'n4wS+ rŐ:Ȕ4p-^*s fT˩KA^FSvr1;ȕA?^%5z\GoUy Hjd^EN`Yh I0wyw.X[5rD0S3 J*2ҡ/ ]*ڞ7$(jWM@,+aUFE5и6;r-` iơdeBB9t4c@:A;|r:#qb@b^k8|x !4aꕸc& zmJ}YDd{ͨj{qB7a62h|_tʐ~+TGA#/Zyn<֟9tZLO1VS䦡҅*#ɽu+wmNd 'JWLkD>N˰,pBAo'tTb޼/a5$Zg!sEio[BHR wuS[J  gQ^X9ϵbc#ЫEAvŮ0H:ۭ6حL%;$G Ij3Xw"p~Ӎ2hK2F* f\%Zs~e*ʊm7įᘼY}V>Bȧ6Y?Q0!U| 3gӴ;YuCMI_E.-:/v9 =寇EZ4.ʵ3!Gk);G^׍kz޵pa {y|`܍b/Rub  |? I/O5SCttx5Vؓ'2= ![Šx+ ~ ^L9 7OW9;cɯ;Kq׶nl4i-^?M]3gIB=45+>7VPUێk&sϜ6^~_&g 8ݗ3gIq L+f'{+G I?IQ_7FxPGIE𱳮` ZK&w]Ԛ4~ uWDAa )`t1n>zG!%aIl\E5{ŘX@ZaC:KZY'&24V8A )S^5oMj`3L[\iLEfOTM`5c]ځMv9Hz3 uuBQ.&Ge0)L,*L=7sS3nv$hDH$h)gZf S>c**J g>tH_NQNdAPovpgx'uYh\_{E=䘔A~s'߸`Zɛߙ7 {.ZihGFfio0|tPc-׼y*iH ]r)4K0I۱٦PWl);.yL[ثs7+U:@y#);kFV 0i/8YNvwq)o1Hld{ 4P& /I?Lz޶o^%:-ns荲_^`EZK딁F:fXTޥ{I+y* c 'O~eJbOe3ؠnz1b]G4pL/l1UѲI+Ȍ'bb8_1Y(&W^#H[kr@L nB])FHf7O?s VVY ;w TL8\ ,wUf}Ύn`eR^W]R(wp5 bЋ͉zSL%+Rچ[f"^F(S  ; O;[}ҪÕ?Xs+@"k̙~KQ8un}TY+@#冉_v7 J {=Wʸ`xV_NyДX|8R, +q˦Y5OZAz`](T)?;ͼR=M+_ )ߐ& WZ7xaҧ_R'NNE9 fAHr_ڿw4)'C ˎe_MVC^g}J{ ! 䛐]ļ`rŝ̒zD|r]=%UA&y?|櫁}#[L4EG kkhl ]ǽ1E۫P%2kj܂iShL` 2rӞ_z P;p XD~Cw+KgJ`<-qʸ/(4}u`{^ZJOjpj_֎􌯲Y tW& sP=S&K}q| η-³No!?nK!Gxu^vOv]Z*%Օnj]Xz`‹LwdK1kӈX ڏKηrL= aϑ yy]rPցN-|3"\mƍJNeH6ʶUOAߑo2v`R+Wȳ&;uG}nP=yU|TsY ȶbIdJis7T# L<5'29BRuhdeLI'L &,t41¤K^Wjء۩ #ϑ kl %^v(4ˢ4Bn1GWgNԇ$?H+mTu2s{K/U6VRȊӎq Ҧ<O%8 8b$0xlDyV,q],D5^ G-3/\$/SĠ~2~ڡ9zգ]"r+'G䓅I3npcw!˺z9<ɷJ$ak[Jh$.?v8F5>mm[qʺƐTZ2CL59!!Fj/rga$5OTɺ>ٻ?ędtWk;7 %*bLH,U A*{{rׂ(?A/ZhB*ڤ#0$87CsMv8 Ht"+ C}ŏ@EuW]͊nhCd^1XCG0,VUހp?$Ogd@x,q_RG_Je8d'IR_a` |qh\jLUv89ԚK%3Ig\ _B42$ކdLPt.Ƀ.‡j(.8 o>Yif!.gvCՓ 8 _ہ&vwhWLT>jY̍oڗw+F%_=_E! <U ڨ Hzڵ)>UsO Vɔ.i#ی?L`0sJ_Jc*xhZak^Ș;"^ӵkم$[Q8-N^U F fo/ 8㗱YT1Ao:Ue1|C*S_;@ieU7y3^:%ʧI8@qBm'CPŀp!zWz6O{w&1Gn!p+M) eiwx 2)@ηXi^&DP#BASe= EnFF&(sjv9#荻C_h3j-z<"1El@ƛDt us 疀b)VE@x3ɋml\;W H ERY7ylBe6K'݌z8UURiTMLOFBhQ6r3\Ri{5"kSf‚讛~n=-) ,kҽ5-Ď2id1p") ?NÝ^@ ojτB%X6'5uap!ѓ8BgTgҖxu>D=a l4r/vkIqb|S-;%*pfA=nIHnix4Weh{yBjyR@7 *> KS*G ]oZ?qwT8xPgDf.] 4xgT5K<~m:'GQ@+5"ˍW|bPƓ0%PKԉ fg>%J56ʋʣW=ȿQP^L,R 2iaPPj3_gr$f' Ln6p1)vhAcu7+~Tkӈa]aKTsRrRX& RP?VÉ(ň]:磩[~w|:Kv.9b3tUd0=RB[! N%T~e /vc|e&<#_}VAZG~B*p|D6WñwuT Uk&1|E": c`>\k:AAZE:ߎ7~Odgt>[ikzyf az]}@76Js^+رk4@b)[24{kRô$ʬ4>(<(T!M0ҲqjqB yQx5)S>=Ay%-&%g_mvߪ?QC*7yfʸ?,Sy/sxMͮej8wyL@P'%P<R n {8 ukN5@xu6qe^=Bng(}cG )1>kٓȝϼbQS'"\# ?U!xY`{#jEJWPD0s-Qtz#kƃR"SgDNz7}>/E}ՎQ7C|Wy6vmg[;k/lC89t&_~Cʆ ' Ms'D3Hurr!>-3[p1+DQy|m M\%Pz/'~'^B8 b=?@440.rA 24JE9; 2Es`aXOrR7mr|Ul>zpZ ׳O`GvC qXfh~|l㎉pidܵQ1*QE]MzkukLrp dN,%/ zɈiLtM;.d;]W=f[S@80c!>OX 8A5gWAJB^j?A)GNW \Z/2-=,+-z$,{ݴQ0#i'V몝K=:Z:WҠM;ܙ/ld1MyEgc :|)($07;(p(BX)M b){WGFo:+:$#27M(W <(bڢN^j2Ҕp^H&S'PuIOa^5ד ʇ[T$YND0Кc%Xy*]d2ZHen[|񔦫a2戴rSd1kpy)#eje$2x .rɴ匚S$. ?u$Dcs NT&Ͼˍ&nvS޽ոծ@qd3<_ e=2u;"#"3==νx4$ X{,Ñ>>a lZ_vh1j1Y5YВJXe8:wA.%tܿhϥ9xMS{LtxJXnk;3մC~qotqfvŘX#HPR,1O>"1\b#- øR_=_>0]5yи{C @x墷ὑFhp|W_r 46aXj6O-pߧwixxD*EB"%qXcJ5DW9mpQ9G 0~殃[?|K\ah8`ҜhjxsЦNE(C$}}f"Rt˸*Z{4<:GxcB-ұ-CJ1!T{+XUo,&Q#+YvN #襩ںbDdw Vn/?(88)*8mnv4ޝ7yfnY MJtO"c;G6H'Z*-5c-au?gB n~"HA'[xj_bUe*^xwP;wBPv{ 8xű^0B4^wy C4BO=_IK?Y(7Lt覝E+$e֯IO;] xDX2K's9@MwULٽr UC>UnJc&*7f7* :*iA_pk#^)9^ Ӷ"-G3];캃/`C4wсj+:)$pnCة"-?XIo+m18 W(RMtz BMPy)\v8I-Am}B~ xf 5 B6_)b$9>AFëx`$€؊gGb>x>w6b3ES"y+Fu} L!^co0vҕЛ~)=еR@y01Q5ڬô6)>b)Qo_s`MzLXqAH} &~mp'Re?pwhH}&ٜBƊ2D5 0`I%=|%|L̍ KJ {nqBW sVǫ;XL afaZ\!LA&sǶlcJI.Oyo` w|=adv]ZZ6Gz"^=":PB楌g= )7E ŏ沬Z\V`\b#u˹'!g$n}Ğ/Rvor=g:n]֛]%GA7LzCwO^W0#:qeQD'+f3,/ֿzo sM8)nʴx6Owt8L5ͱC'J2$oEo!WK뚛+4sIOkx0uxglMnBS, |p;v7h%yh2fL=Wex? KT5oɴm'ۈ e¾C 4.i^4Ul"_/V:1iBYsd6k BPG PoԍղzN9PR0H~jEPBZ]FL/%'kvg>>vCRĦA7ލp vAf]T0 @9>f{XUo^d!ZU"K$icf6>X:%b!Hv{Qi췎E.*ۦG4{ rA>]|ǜr6+8Wg?3K7 07͕cz1疣PRu)b"ۦaT35镐>U4'awzw0zq!;UЀJHo=5#S~[E: AmOMO_,9MhoSv d@m  Ňm,.cEYD5eB5Y3(`g DAb*_!"#lʦW)zdBW:f`{R%?ual"l2Z 6Q;G+χޅە|UT z>1X֍@GjnѶf)|#Ge9&soDl'p6چ?I8 忷&{l)fz U̇2'jTLj Hϛ8Ǝ!M i`e:P})cL@xنpW 7]s]!7)Y_FBmh#f<"3?&B l{BIxeE묣\#KlzA[-^waWy Y`f2q9p)_?>q-ێMjH<{xJo O5ׅ2o5np@7CyQG6{2@'T >=y T$c(!a#]4lp ~Wax o%Pae&=˯v 1Tqsd#Ct+n ))@/ůFBqB qnn7ۊ4k3w !=`$sδD4m7 c {5a 2Q-`Ѿ48 aZ.ѦˊVBAD~s{nD!cSQ:R,~}oڕx w0IԿeŗK3C@JV%WqS.!r/xlbߙ::hr*q?1Wi]*Y3S.^TʩWb|3λs  1 .eG)LhYM5qR+O*]XolE깘;t5SM2yNjT- Ba{ODjA,}\JUM-Bb|ʩ6C#7@ljYr ;6P)Zou&xOOhV$.$C.R#k%n n84cMP"; ]9d@pc-]Elhkv+n%qhчsr*B_*:GA $q9|<~k?JoL=J (t&`ld|8fߠzɵL˓v #G5Wb!]c`_0e<sn- @zUU*~±~ 0;HW͛&w>NQ:1#U1h)My~_[9XVDu'O|3pWX2 >u'CK_x/:5ߍRW}|1oI)޻nj.r PEy)|Ā.52_5١K¦6ТqwR Auu$rW4,%}{4.}DߒYS6ݶ.=¹7h-}pb0ټc ,Y HHrZ4@4՞MIg<ǭ^|xm;Z蹥\2h 𸽗}Ơ^) [;?rU=/ tSkYw-:m "3(ߑֆT@?kWa]iN]oal.$9O-|>^l );L`[5)P1]>~>΄ݻd#aWOD Qݱ訓^Ш*(NZ,Ouu*ԾbnGuL5кEʍy~1Ka۱\y "h?LKL9V$ A 82Pw;Oc:GS?x,'ndE1!G&5z!ŧ!EqekЎQwdc. -> 9{ <Aьnҕ1\!{gZ's'+ba*3n U$/| |(Zܡtj-ĝ<8ٍȅ.qm~x ;J<`KM9(JURp۪S1 ƒeg6TywQps,9d%,V{B~$r"P ИD}l֗jkG>j!a}C2塀)8???݄!3|L #ұDqxt7@N.;J&\gڜ.)bgvCEP\T{GVas)9ÔyRUTU+)qq7mA0WQ8uBgzvܵ^gi Al+'IէZCJ:J;6aO%U`ye_e;v`_@rGg5c, qCxѻRx'!BQt_ݬkΤYa%:p芷}PDs1^L+9bSbQ[#5Ir /eFOK1Yq0zYixnU Pd..gP)ޤYubFuacNrrS57*N(ݟp+qY`4:ED/p#hՉ}Tx'KNb=;@JA:Q2W!ݜ z{BAm,,7"j.qD'faJvy3qm`BYÚߣ`Qů~ ,ow th7cÑρ l8XFۈ)cmqUD_M&9b˖]E  "˯F OXc,?=("<>phEzFpZL@:>5ߪwkΆ(`+ gŇ.J " "OpYx-$h;@gqmf~n ;xPgvx^ Xa%4cp tHߠϖ=UzWƜKk7`S}%,bpK]%~c<c'*&(>vx-D*8x*zN]C; 36V ζJbB4f 'ǠR.'L& 4u=EpZpjo-wXAV(灾4^~1\aW@%95<ؙaŀFzLqˬ| ڙY 1̉mOͿXT.] n=鯊ą{%@ s@T[2࿧ED\\HkT0;AoR.J&Pp<@4/y4F9s!M V:H?߬ i<݃88Z(6xT]F$nKkNTg5px$8>|v+/ p^|-}d^B -IUE`y; A{Go˲Ȇ@ LVV_Vˬ hI9_b-Ѯtރi4* 1STzE~!Dؿ~{|QCsi;)-" YlہW&~vJd^é1rs .oćs=_A̫y_P|`5.Ĕ [>*E:fgeM"`%z˭̈ 5Ǣyo炏73:+@ ۻĺ{?5F\Rj>TQ yZTIE#SdԹ:v8tA'$^gum_1W)#GɎN(|h()Q|'32*9ϮQz!2I_p `^ea[=xyh!ۜF##pH'*Ф*O .nc@'*y͋[7,EY0 (8}Xtp(Fc,Ǿz&0#rK_r%xx!`U1~o){X{NgϭqVf.^i \?r.od6%MG_Ҝ>);z!eQ]^б^k2Yeؕ$̪~NԴ\x:V 2!.at\T?U_̖X!Dh#Oh@=QWэzV&@n=lHD){5:[p^\DY ]@k@#tEHk#nZQ vEš$) l^%_o˛t0,pSqqH3lh o8,>Z ?Ⱦ"x275B;VH"P/JBv7 4Ma,K@ "ȣO+vl QK߃MȪ|z.1IN01dC*{zHSoɔ).=ZA0h>TQFBj;唫x7ޢ~P> y4P=F`1mꪗRR)*ʞ[!ldL 0/q:uٽţn]Gtt\^dJ M  |7ΗP |( ?Rd+-΅`OD/}洅/{1T}ەk*fv:y}}7}h#.jZŌ#J^$|z"٤6no<];~1~\aqG8cBƨ4rUr>\S=7+FzA@"xCem(/:IZ7BXE#EHu2!ΊۍnNJTmt\Ou6 IPRȏOy~6 (o gY!S󸲍0+o'P͌}+1 v1hkϙ>vXG}MKH.J1{5N1.\f{}F6y 75EaRM[(~az{oi;:FqY<=V5JqKӗ9BIt1~bU ,="~+=[ tʬwN溺jNMY2B]C=r 590 ['ܨRXDS\&FO\¾yu]O'#pdF3J7hC}U.!eC*ʣfCjF$ 4~k֣&`Tqg&b=C?'(p6Yf@ !ҷ*׈ y9|qh+?/Qq8j{=k *厴9EB9Ds#:|L9ytVizqe'^{ݬ~IOt2BϴYqE˦$S;á󾊐KV&\-{5 6 ΨpyMdθ*8sOO@Ή_\&̒ Uʭu/oʺ H )X*)N)1{FLr?_{ӏP@q"6DW<(:YGh@a& b[\W&^=q>:M$deX4ve!ˀs _zWOxS! ^pi(:ey.V11pBɽZ9mXF͗gwˑr3M`9{BtuȾR6Qđ%ϡmnZLYTgP}~ ʵ=C"뼨gy97WDqg[*Ad#uIKU\*KJ@k|[+rsYyj5}sqg,Ufސ}iZ!9.m^SƱNg4~6a< Ң7d8. 2]w㭿^.l|'}pI!1 qfO.n;'L)aZ\mBGVgD0oAҢψ~s %Xn3J\Owʟ/Cum qY^ky9e7qu]x 5Z#v MYG .4i 0ra*9]:W\OTk=m4$KA#X֖j<ƞl97جI`( =P-K+Dpà64c 3y"$W)' *3XLp{䐼g^swhYeJ=-ZHXet Q5J]ꮝ0TrIKĴLa1riw1Q f7:'<0ל[̝i@@1&2 k Qw{ :ƑߡQĹ}}̑CYX42ym-v1R$\9K}Vi{aCYud@e2L-E.7kwOKRڂtGJ^~vFYmEqup'R) y%1,dd؂ _z1zml5ߡ3 N/jll]#N C+Nlqxu{;MI`2ʒxg")Yɩ­Nd;r)wi]D\}&5=*ю7۵bV+; +b5-8C[h ]|~=u̩1@I /Nd7ݦuD(~Hϼ_vvJf1Eȅ5_w^U>$g՘hU1Ĵ̢ gbM檥b]C[ {j o:p\yP:q 0붖$j.nbҋUC>'':Zp/W .2zl6mw@e˒?(kMlk&f4O:rn?wSo1oARApFY_7ّ8G-abC9To7A pY{$suh}TZx͌`aF#? vhyQR[2_\>&:楸lrV1v}t`VX_,> 6,O,^nK"ny:<3$2{| "J~Ey8w[-?OOcΟݯM Znsfy='(6Ɲl26[x/F85Q5҄?̦?4|OkD7Ө2`¢O!et,Qt+Bc~1CLD:SJ*.^'+Y>e> rlWjL vz1U&cdRٸu HR:y<_> ˒4&(ӣTG(Z)B17)!ֈo>szAX)72|}K1+vd^5꫋nXh*o^/Tf9q F`@9\,rbr|_#5zv1@X/NdaլE\{ۑ:\Z[:̭;Y~R'g GC/Й<1& wIкCQ*ʥ@SP+²ļܬB3àVPO-kM_'C񏶫QNӘYI(=N;.3O1q0-n͂V'PLD8LlOL:E,le ?;R9W* ~iz9.qA$~tClnTSC^gΞ& ՚M4[skf.Old(ITÝE#jh;M<}QWYy #31(K*Jfd#@l1-Ј/O =.OuQ硑-J Iq6~n"(d)l j1u׳=9}Vl|Gn<+}QwKݹʝV2hvDvMʻӁ]j zNe ^Bq7d $"Բ݆3b}fupˮh*6rkgSp%e &P>{)r9,wJ psU4'uc 脊:lYN*[y=(}2WF< :Cխ(qDuO1U2>e (S'cM+19P$uW`@vjx0'<-#wDľHB51ؘ+8e9Зȸի/$~+D'cUqgC}c}g("^Fb^zӡ6(p܇Qkbؒ́{4~Uv=KP AMF6E_Q{N!m ~5eNE[ڤ`U wٓsYF\0zjsTzm+93U |$E$ F9џj2d`ͩ77AAr*Mc^5R wF2;*c$ex EhnG; !:6) wxeDNa`,*#RLk^Hk ru)8G()@:J wyV_6P[cWוЧnZ9oHbV;$jwRU?D[vJ8$^ziġxI͝ ,X>we|z5C3pQʫ`X% PʥqcN#˹DD==RU*1r6 az\ "Zer;wǵ<~C3}ƨ^D؛nI==sTU#t̰oľ}Dx?q{㔲O=H!) r<{.`oT4<`&z\Hc*!XpAO6' :PU6u킝t>Ʃ8 ݬ8 *65E&9n̄@vcj-@:,,&L!iOj+x `+e ~^K{ڤT(F1,of'GU lCU=)G;W=-摆[.؀ʢ/'"छb˨iYΧvT)"hnj/w{'*g}aʭEwdj^ʓ kC,t*b-;lzapH^kpJ0࿪W0)vJ4p񌙉XR+keԟq_SNwR:h8^[$͂.f"KTMUw;Ԁ&^2sZ!}Kpeb :E^Wvhw(SWΚ&zqT^{4}>lXa) 5HÇ${tZn^H7TZF7PwJeqJ=gO$z?1f5V3 /Dl9\\OcKRdéOѪ+D1 KlsgeY*Lc|M!i?N#oq(չ8hiA"cZW̍b_(x9ĵkPm8 u={,v=ƋMY&fWR92. V˂K&Z+m@!F]0w(P[vƉC)neWJ,_C \,co,Zeu8TAt><.QBVyBl-򨤚FiS?.%B!y[0rͦBj1U. jz< 50; G%vػmK8lj-dd 垢.ބ[R$E5\^m%nL士>p=4BBπIλݐ|d* Z)/p)ᥬ'Rӗݪuf w StA"ۤEtB>F`>|ڌnULD/U7=dNs}N'mqq g!9w̵l=':l.uD4&|`&Wzz} _A|d}C>}7EaaT^'RL%ank1$&}P<"VL(:kh+EMN" P99s^f51dS:&5Y{x2Fழɶb4b Y2׶y/?DN]Z@3J9DRud\{35=|K=#F)EOr9p=I7>!hR<Ǟb2r'Ey 竊˩i5r%`qڙJRO6CVluP63[ysp&|QV;vMi8I_E4 (^6$}"3ΖDcnOK>hGN}_s)^Ur ^iZ:2$G*t^dG1 dsy_3o̰n%||V#U"s/#?M- K=cNy!-Jctfhv%c \5,{@QbJis.uS ClM%Wk ;+q{b,"A{og01V1~YVE!LDX^#t֓ɔ9 gG1BcrgK3#;g}+^uh@@ -cRUгFQ= ;`o`P66BV -=$[#dBkS-o߀_$lWub޿ڹhba@y[iX(}i G1&娟qBaB5|[EA(#2דfNt2ʼnOiэ !jKfPc6@JAL0pPB>s xǝ?T앉B 9fu1Ðzl>-qenvv+?ɏoH P~ YO$'CP6$Xe7ѻF}MbkUo{#M<{d?%pWQaK0Lݝ4Nt5X){SU)#sD)\&yv%ZrAP\ ;_xu]{l0juI9b+Kq@Xߛ[: ^VԔ+){VnYeQ; TK~;义/UgBe_J\(i_׸OO,oj[[8A"W d8Z.dN\i*"vԟh s0΃K,h4M_[Uje@ۆtG>Mao.:͚F/Љ>>-{Bـ䥷N,0}٨}5Xؠ2m3Foje A:zpzb^V;&54aWÅθVSp{`ڲqT׳ΒOpJ|a-<;&O bA #͏<23+MT*ZpxQ'ʄ;j+Tnf\)<|7 :xK1DįsBVWʻ/m!-NmTi%1!.7qIžLuOZVjn6f7dY}/XG[3KkHJ3H&fay{a}A9OcA$#FD5YVI8vR~%4$Q%+ydMّ(p9eD'}g2ϳ-ް"uzz"񗟦<%ব ʻ8N"\heژ'|r q)[&M$fu1S"UVDo݊ vlx loI20yhE{R)l);ߜ3G:s;}ON~zn@8S2Nw WyNTH] ҵ=0 IBÂ4Bوs{AS=mEN\ b6ddؼMdyuPBG욀xPArogs_oF1&⟤/?w8I߰QO!?qN7 C}b>)Qhk<#֡!!"2| (rp "'tD}.\K"$K'>[7yw%>x^atq@Մf,vGg9苰&1r mU.ٲ$BuA"Mԫ@xש65a+aC;'#wyt*r_5P(4] ʁ{L qC##.~XM&꥽@amߙhkaQ뱌^_ 4MM1ۇS ӕgIdL=֙y,PZl=pV\t>+@BZ(7ZVGŹɳvŪ7gHXPןPj/B8z:wDLET#̴z]fĶSQ|)Z*< yiڤ;F[q‘ x[?M0 C~`Q.9–6m XҎ\XnOTKߞD' } P O; )y ϩ` {\hhmD M؍V;LT`sN(7t݄be@,JFZ)Xr~*+xdއUG+989jAfK@dv'2Y Q"'V"#˾)R m(!>%7PWmOf2(MthjM&WK).?YtH<#Np,lOId"&,4MÑnώMڍPf 3=1}jaRϱ C`uڥg LlM_xiDU:+륞298G-N +8bWhqcy;d&pYmIHl3 [Mz!)zFAeOQ:]hd鞴sxQj'(x-;OC0'T rTԼ atB\pvXjXXg@W6?&n+e#T\Zb\FKA!0wcim*mo7|/cs$EDvOuN3z%@Нs84L29L6g~jpxFx̚螲F Hh2UӦZbˁ%Ui/N^ЇsJdzBJ,ߪWl mdN(KR1_3GQ oqN-_Šqq$-4^q3uLOY s.?]ҋ^Iu0ˑC^4Tly<0M>R&]2-EBP&*`Bq'w˭~=>Bndud<#G2u&wJy_,SD\#He%"k7♪rU8̅YSYCiF%b3HCn'žS÷(cֿ(\ͥǶ$y| 5. xjr6iS[Qv|(ǭ&K,ɡ?W~%C al1!7_iA+ue.!kDkFO]@u l0^ wP{>*,Q.U~xB*oSiA(3L~fkH<^y[e]83>}>NTҮa$_RT/a,sq_K5(@F5 ֔_hgG;sI$;脷xgS?ߤESN`qkyQu?!ҬCO#;HI *WLJ,6PNDh7_NyPIx@&Sz TݦaMXZ@zLVwaU(l͂`Ⱥ 5yqPu B=nd;\aHX ngTV[S9,痦qAKdl ;tKy$-Ecp%m0rx}ީ (4 C?΅>m>xP{"t Ia+@?Pwe"b h&xEXCJ,$~Lggwn|lGA[m>Ҳ=}FJE4"P$]$7QCZ[fxex$ܹ !6aư8P.Nt;8ӌTu8굁6-A?ty@}mYFO|BЈ8MȰb5Niߟ5]*14ӌF2w+{GH0QI'\E9d"/']Ն̴6ΐ*^~pC Vr:TZ]⻫ĠU/ A|V {JoQ J䳕ڔ{#Zɽ?_ NZ#0(,kAOJ˜R/t,66xo5ӮR%hbRpkI9N 0^ yj\/Op0nxtbЈg܈k2NP5h[>-rdKh|=^J9Km#YeµɁ~ mܝzb!)Vۨn'U+gXE2G{}rI7;SqF:i hˮ_i0Gc~Hpk0_*@[pw>DD> G?߉/ /W D.Y6a^:&rR8qn?c.oo=omֲm̟9h?Yuޭ%S{|F>@]49cVdп35ak>**{ؑF΀CjaI!W\^o1L"$Os&}-(EΣd#"it,iH|=oK v^AĂ*lA, v?K;#[_7D ʟ>>PRGe\bHF 敤NCq&/P\u:VB^m-W3+}@JR:5]%{&[0>7L"=oV;, u{օْH1qM:WPۻxbhD:W4WbF$tCĤ—%ٵ)ѬRR:fR >۸&-.h2#6'rI-q*j-={&R jo! &YU?Ny5݇4]|F&q@BΥ9}T\&A);P4f-Q'Q:ٕưІlRLOi̎}yPeo}h\ġbtP8n/i=X{k!τHI(HDV΄h.ElѶ3q/>88mArRDrG)U>i7ۄ=QE~`i2^ݧ*`T0q=[D߹/"xE}Wƶ=:O+0pn<86 sH=c >xgQ <4[ëpb/-^ҷ㎰gzoW?J^)Kwɽvշ" K$4tP+Jp`9WD#eI ꨃA@@4%Γ4S;Aϭpi쪇is!`aϣXf!čD_<`]~_QRd#HLv=`Pۅ%npKw>)xRD6d,̲ Ca͏yf5iUN]q{5%@z}],v@ȬKoOvSeZOc_0 O]b% 8yj p)}̠?q= H{u@:΃C|/ Rtf㟗~8(3@#TOfŶCpoTz?f_)2zCPgy ҃t}[)`f GFPog\7fwf2pLkZrhPwrdI^^$޿@r\$fKx8pz-EM|e?1ÔÅ]_+DIe $ȳ2fZ\698DMB`'A8[/K_׫lR\ߞ羵9T*[B95{V#Q̊) [2 }"R,Т\㾐)RhL_w'N4tȚmtP+߱M[˾W)g`8YxrHo` k,"ad'S+R? `p7o/9`ch+l * i]`:HYX30WQ$`Q 'Ş݋76zWGo±SI?VHy'xYwЙ-za"UuέvH n, 1ە͜eBX6,Y}aK'g x2Ϸ6ދ}XA$deEvY I>c8) D=bQ;c'uE| Ws]{,hƉ& ##|D3k}VU>:dL吢lt]BV.>f;n-A|cXK==vρ<]c\z[ET E; {LW(}; ):E~^%soZ4h|Y UH1᦬BH7v!cuH, ukdv3~k( Ge1qWof.كtc82µmOW;֛v{#\MEb4Jsn j5aѮh?ҥxvdYCfyea3GA|ÞH̤9<\eAR!0%Ă!AoK jg=w+6l3P dͻ &ix@rk೛p9V8{<ꑭe^ˤ3IkS{j&W&Z%Ň>9F$9bT?aY؀=M`sU]:}eRVOA;]7%aOa6A%=M+^j cksz \#X#02@])j/_gFk/6,)vUNP}WXh.uROYhNlhD|9 aSll/TfuL k(d07\։~hY:W.%9DBl?0PT*aHjt-@;yz dz!)(BPR^ʀCHNʱZ3 =1<0rCnp6+S,jֵt@l;֣nFQ4PGkT}o kzW=)I&xS^?\M 4+^EPg׶vzb*Ԙ< F7@ưl_)qE;\tun)h[JJg?H_W9ꆰF\jC1;,JI,PE~WQO/YI\Nѐ< E؝||XeDnCje)W8RoP!T5?&* th_#"PQ)bNjߊŲoE>q8e#w(=fs;!6oD cg%-mm6'5(@)9ѽ 8s8 oI4w>g5|z"4rÓ~]àmѐ賈jI]zrXT{u4r |f9mN~#o3e1zmMiG:niȈ)zWe u8,=yvR( cU?EPJϮC8WitqD!Pּut.o×s][ p¥]ۑ3L0Xȿ8&&p0ƅZ%W(W//ƸlFcy$ %+` пM5&yqWÌ7DhoTsZ$LKKD)s4FCH6ҁ !Q0)ZwHyc:`ZX$q6%ur`NLKZ>iLഇ+5 @pҿ s`,H(aڒ@ݹO\4GRG"R4n#A.v 6hN6jYlZ2AS .@YAV]#kJBExB&!jH-Z6`+t<&1y$-gJs0 i g}O/ \|sOPݫWKc9 Qx#o(6=rW=9\PB؝`3wѯc94w$Wt-dSQ0 NgM_iW LA5_b`]|׻$"a.a{膬|z ¼`X[^2 aUC|S$R2ZP 7DcZ=W$@;\" (A⧾g;V@X],;\54W9MJ_> Cu8+ C, 3 cKn2;lyU{$CΛcgsl1&!G!pZ\\-X֦$nZ>ֵ/V& zґ*9e- /9?ټ]K@{MFv\uJRx̝)6O#d-fk; &Kt˜2? L[FY.xm㶷x{EȢ6~6X>hp!)E #KwX 8;&7r#X{.>f3M#ZhB=j}/&{Ɯ"ExZ8쳸=Q'N]Ы/8PRI=ޟƄ#UVBZǩthr1%eig=jJ&0%|ٞݨV素s.Md:kJ$G 0wb-܍btcGMs(MEٯcfOo9wgeXa4^{>DyR$CQ@|ph=:P]|n#ɚV 1LVK (S{07 rKwC}oɅ"`|(CYzdmntT^xxpK8KBw8+ۅHjVy+8uSW|}l f;wSkV-ԉga^VI4|0(6)jPv|yACN&;y8FeDEPi+ޤd'$v1hp,T1g=LFX8#B ݕ1PwYJ9dTpO lwȊ0ѳG9}wO-+';cFW{ytF#[64*<ΌyrԍM|GbGgB u ιۓET0:!DG*̒НUqy =O~<26@UrKJ3^U; ,iu`L: ݋誒TX9l^ }ys|`srI6l@]iP䒧tYۧ KpB~yG2ދRtCr4:GӱAKOSЮ&[ !OD<05-}ЩX21>xbYBQP3p?-YQRpӌ*n*:VԞ ==ӣ7 4[ 5ȶjL!dϭ38:5㙃bA$Nv<بզ /ԛ i`%05{ +N#W25jxPOK2{ǡ JzS~,_ט_N6>o?iQR^)Kߛd*qT []Jq&dh]jD>ob@X>%!}ˏZ`Y?gN}""oW<2dr9 n'=MrYR̞ӎѷ`>@X0)]lJAgViag8[6=׽N̙b]g}]]ဍ7}1Ni7&닦 YRsm(QCxqH>Sf[GmT2,e&3R{)a\9>L5$>yoхX + `XH* ݝl B'3U㺛Us`BlRNv 2x/Om& uC)AyLeA P?qvv4Izu{W2ȐY@=D%9>ԷL}'~hrmU^U_} /]vͰaV-*:wokcmjR?e:?IvEo_ ֨/ Glt f,8h-j%\ߍ-DIRL5 !\IFkqYʂ1EҊcr _ 9waY/}]yěFPQeӀCEFSn?g]= ֶ* 7؉! սLj4IH-׮GI4ZQ(&\w { wY.?p+JNz ƾP|L{#9ꆹȼ~BT;HO9qP~'qiePI]"MPd2wkNP T'<0tt"5R֦NjtSGqCm"KRb}-"_,eB=sx붩1<5c*rc%S=O0rˇW ٮD |`pfp[;4DFowLq5͎g+^~5X̒(ۏeShvZȜﲉ <+Ω{3{0ȔWJ%'`ܠIaž&t&: 5u,ݽ;& </.[ FV.cBb)O}W g`sp &Q=!IRl#\_/^rk9b>97ii?~D$S}lPWh"1 k!& d6U`үcq }qyt=@OE9z)*N ?՘ٌCÔA!{?`F蚆z7BNYH@O&3H`<0,^6 ! VJhF"8X#d.sMwWQK=5=5 ]ydc< NSTF!O4ץ"랜7WvfC LwψtDgU*L:D]F]\(5a\@'r`o8 G~D 6J;J!`Xf\;*eYUVxzQ)tS.&Av4wxe5T Usn=!"oi2IKn$nNMr}Xp_caZ^qqv hDsK,Z­zKU8 Ze吭ㅓJ5-L`F<Ci-rFVE`s6/M7&"(ȥ@w;FVm S1~[0j<*K¥_{TK SELr{ 봪r匩}[)BI`]WE}'vNBI!P Ym:SzzXH֛aeaC)B[TGsS%jݡςsC vcEY.A]aE6=<0SsF_NHHaϣN K.1hZrD]6Wb)GSR3BD-h".բ1[fOb/>Οߞ'q+SwCDj ۀ?|l3EW|͔G?՘A5+`vb_*`h ]b-4CVdJFJX?tbH-6 S} uL"Ɠ E9aN9#CXҌr''Nϫ,YX+B sNZ;Q\fN1 AB˔ot>YMנ+HtSi@|3xЗag# =/53Z?0EiNisRtG %z AiI5wgi p&z@ Sgq4Հ+(%r_B>JJ&ʬJ0@3=@dY u֭PX6MQzo0vnfH4{- Қ( NOJK*mVCLz)>vHކjU|5s*Eζ_m7ە(=4ir Ls":[RJy,fX&vw0<"VOm_-&45=0 j q8o jLА"Lu3zWi͛L:G3?)=1ge8\%1[ɳ6Nm 5fRM&1ADLzB/JߵJ$܍[tC'ק{ndː &[Йj[]PVmsJ|7t 6K.j$d)Qtr"rhqe+˪~o]FppwE` lޓ @"ЇC#fdn^-tul))!gd^cO~HdqS:lA "c 0:US!;Fpw~Yےӹ:^=岪(](B{5,߫g 1O AHR7eq)xIrcqiF&uG^5r-OX\a`(5$}D ]Jf<2'HbO?}oJf52ƎW$t!͏.慠f[b48Z4opݴţvDLbk&w_6[C:=ˠ |x* -6$+SP(#Gb/&0(榦͜ySk''ɈW ')Cw~ Ku D3DPSPc$դ\t$,嬓|1%'H*>|)ꁸnfrj6ق<"b,-hwuƔ%t蝙ێ::rs43 kS񅤦 Col d~VB`Nu^Il"z?褟eDT:QMRa8b CuީO^#TDQ0,a[M40L_S&b0p5 pDyIA=IKa`2cktE* tVS;ݼ tP&;[m٣ _a*m$tAZZər/|vz YW; L6Pu$cz'}9X~)-sC i_^ʌ;\`'`e;˲%RDs~sI&vU[[;s[IKl%e-x a%ֶlT,Zpvf޸*U*O?pG Ѐ{c_: fQ2< ӌHK{R wdߞ[q"&D>pOQQf~ ^AĈup[ zx%XCIޱZt/+׵LdS=dyh^GSA{Z&udH٧޺0D<2] ǜx;!=6J FQ,4ມ]p)O/|`nZ>\C_ZId4J8َMnPrt;E"ӎ!^omG70lyi*Ȥ^޲ݐVKH/QVwS;(+t+C2MxIgul>`#<5w*n'?k.턔|'iA\$$Fc Vz6wltfBD t{)6JLPwY5vCA$GwFDUϙ(uMJX)1oB=۔t_RLu"3MޠtK8bƭZ\RfF5r1T`K,мg9guJկU=pW_00$x͉("G_U:{CSkT"3<4?erK,C \ k`|Me iMF9{WXu>_Y.|Ah:`PUwݻv'e4Cp‡y `H9p C]Res/55ZwF` 2Ȁ3܏qF#-y >#\sm p84pr(S7xT\@]YEQJ4I(>{h@h@V05~#[kD1ڶ-ՋȈxS;J2 >%/ v%_GEi[ٚ~8rۊecLCչY7A\*B ws jp嫷*0bqU:bBq`CJx_u)ow1 !2|ٳ/=yD<澱$KW5^<'ɟm̞i?Rqt1)I?hE(9ʻTA(9AYjR-qd ɟNt MpF@G+ե JMa(4 "'kB?Y[uw![?<[9ضɠW]鱩̍ޞDe2qz^3_Teͼ ac˟0X ҫc\۬mSC- &HK$8usymp30HH)vQAT<׬úB *!aOhSckv-3RF*/lz&^$Vk\1\pI.sj/ 긹h`:&R?)詣C´çl<>!VF̾ntU'K{Ŷ*U n~}*u.TJTB%^љj.>a=pLv ~/UFkY%ۏص{/qGhp'`bX=7x~}e/ ) |r ha6JYdnnlOTiґC;"z iCGcQw 8LiWѼ#8XK4@%z)=FdddkYn<=w)!!fgћ‘Ttcs+%3kx9M~[=ԵWji#-OrRR$.!jKS#69z_轨T3Pܱ_ ? z3rgeWKgLҝ24c9SoinFYEOJҴ4"o+Ū> fϷټE(IVp g.0[< f(o1(S~ۖDL`* N֘mXHTP55S$Pk_s鎺A|'eW{-MPfX?f,HݤDŰbN̠cl"l(G^jF6F'7!ݤ+@F9;Ht-loz#t_F6,w6W |%q~ K9zES8Н#)he)t|N1UYۿCӓ*̵K|%&x4uG܆*k{UkwG )ˢ-&[프)ZqEe=Դfv<"3yH3 nYD+=0 ·B$삻 nw{8%l*zU$xT6G[FxuIY e NYzXI}س_Q)3!\txKɒf&Fv1X(:eD +'v̇ON""{ ,V(|Q@mZk8ONʼ6x"7\q /..裏2]JLYDo1ND*}EYmY4x!$%?\Gwn CW/za06׋8e/]'N{jДhKg~Vh8 X$yPiO} H#]js(e`GF!.RDH k1L|2?3k nE"_E4c̡օq:őJCqB 3+|SEH!eY- C,veClL]2|Pnt~ư t+Ata咾{Φ>+J4="kmTN/I=@]:g{(>Pt2 M[}Ra7&̨9J=E-r[f弸\l>S*.wҫ DT,9KZc\ T-8_;>{ˬ`- FaO-$5or'ZomI-65iʹ<.ev.<5:Xh9`|PnKu ȏȀ!܈/4ZJ=_ṢH*|S04XyՈW$}iב (d 朸pȩT^mEL]]p¾D\ >@a0!Ls ixVΩ wou_LPCYKv#i-1_,{'](m>;vOOye<Q(spWb fLЮ^KSkMykHΐ}-"2jJ^\j~>)>zk'G&8>%S/n2F*XO )%TbS@ NTGİ)Zy8qbeϼ # ]'lr+7_0|XTիh`EF(GqM/ĹNՏ@v/l4J6A7l?C5ne2^;am$JKhyanj #,ho-m6__J~8טvQή"nH/1#'p9#2bUU}; `j&KrEz꼼_h$.ۇŝBlP kp zB9O+|1$ K,d `Gi/ D狾_+Ux\=tDR4aD2x6dᖶًiڠM$׫<rn24|ִ?Kro͟b;=-DT='dN,p&K>L~^N]҄1Boj_uɂ]t[<^˶LLt0 l_ Ic&1f̒"cU 2VRd&f)n/j(,[ "mBCv<,H_j༊&b6&c"hxQ0%թB=^ٮ'Pz+0P,ֺbܔ\y:3xL]xwa%>5nT_<&sr8 bpf)Ύ+h!EWZ?_ WկisNЭ gLħG4-9-* Cfje5 4Uc;S8Y b35y+-@l\HG&X*v.q'RQWV;]ٖ2{ǚ¢ᢳt }K|:!7"г;|I4JЉ%g#ث]e!"8!||tQz<ƐVn| 0;cu[{ucϓzcZަh`s& 4JٜwnC'/ 'WlE$2Sz1hdiz~}80ё;e3@`h//-,E%Wzryqܛ T6.`r/<]db*3ϑKu!])UHIZ.;GRϮg롬D#2TGYejҪώ%$k;G nH_&pmΙ;RnIyt̝Ÿ<T+ `.v]0̀fl .D#UN˩$Aȥow~@Ţ֛<%ٹ݌{Jy%*&<&trxD!嚤,$v^f~7UXMCnU1R«[0( z0x5}[m~O\s%4G#G+d`I_\ o4}QO+ǿ-2坩7Tji[;/C090fh ( [ڨ{Bn=bI Bl/hyb SUME4pI Kv5籆bW/\ŒĚ`:{HjYwf#y'Z*:/3Ţ=铄)^%̟8s+OuPrl0LVN%勘Uh}[pCqOQƳpn;*(,9X b팭Cdh'AoQ rbUO ߘfA&5B v:p;s@OP&َ 꼗V9]LRWUN|ex$Kb2%C338H*1fV;ώ%DE~ ,|nPKq.pF6=o :?|~QI@A<zL)tLv A0[u4vZN7B.&DFt|3msiӗDPLfz@-n\VMFԜDZRHЊ~ .wMNRNu?v X CƕUJ{yTs ~I޶ ˻@vb$F֬Tt,r`Ƀl(J 79_[ŻoA:u@kṿ|1 Q\M=ll cV[7{N@Q#`=US"D-rYrۊP85եә;>'xFE0Ŝ %5I> ĹbQ^LKS7A }H5<}O= |>50·ܒ3$%wja`G"?0< <7W!\a)O;<]L9_H t.{lA \uJ2gn?299^95~Kwu-B}^@wx;x9Y#|[+Mgcًim7*|DVtG*IFRɸ F 0_FЯ+PfX#n>AI y[aX.1K4!YčwO 1 ME 9/,KcD eHx se`kSd'#c,(gq";Є3Z8$nn) 6>_ǜ׵qLB/'i y>+]V|FfzCS"~YLs4YQ)F3*nCPYd9I5`8]hb+>0GݼI ouEn 2ֱB0L!*322ZS߀~ϩ81 `sB E2M* y搱}f_jɖL*RKb𬩊SftS0Ry9֧`sp6WfR{ ܣGtq?joCʕnd'5kv8W=ʦ{U8A%ouք 2x qՒDl|Ȱu=v2[-hWxmο\ g4FsԡRDݳ "~BC7N[bb]yRl b: 6IwHq$q?5Ӗ6ҨXru= QF1bn*_רƥʑYȂ}C]jJQ8z"iKǗ&+ret{2읣u1?l4ھM;#sښĒ'-ߦ x5J`*;\'-#{l\Qy@]Reql6iF,jj(W&kJd%NKJ~둟/JJb)$>VJyٷ{画+W<׏3*r=N9:!w-3{qH#{iw̔nK0+sI23N7KTݥ Ġre+L3f̡a64T6PiT(JaU`s1}6_٪4ߛQ|v^oljAӌ9*ĉ|1@(q ܤbK<"itƗ9Sx 8 *bc]&䘶<u?E|Ew Zi`+*hȧ~?NU]j2i%Xש,4V|2=,&۳5ɚҀSBN{وu8lde }^'!N)"0?GXԟ2 5\*%I`M| $'D>dN} #o˴xŪ5rpG0 Obfd /ԗ1 )mR#7`0dWZchriREbH-¹˞ƨԜU,GEg.Nf1wi'R9]lrPODZش6tc_  W  T]C"L +zCg"b $BaS3WW*d>gF{FL[=KuIx?6Ďg77F)a<-o=ah,(@++̃ILEtsʽtklJ[r|~UQ_MHGF5ѱ*Orw@V["fdl (+ _=@bF^J~7OZ͌Ν"^A_˿  g[FKp~"?MyWD` 66KP9tl2v _4J%%;O٭Ẍ́D͹@9l ^32&fX_-O1}-%'%W-~ӚE[V<*\׾n.Cccgoyޙ;żD:sfj9`0k P$r3K:5+z~ht0ҌÒSfAC_crҺg4W$ȞMo1kMA9Y r^-ևTő=zEQ_ףܣ]@А P\4h4I+l8~XkIB|C|!Z&`szB@i먓$^ƜO֮+>vYoIƾuEvO$A1&1Kw}nwalU ӝ]OYÅI|U*L`*So$ 罹|T>/GzEr)x *nvkGk,$+g Ϻ9^Adx(,U%B-$ oMC8MOl޹3iwe#@ ʹZjpֽn/%h؛4?З7}fk^l7ȵT_p0ojӣצǺ "r3>|,탹(9-;-Æ/G^.gq,Gc>`4P!&d5־7.KJ;*zěӫH*p((Cxh<殨b*,s1b`s&{x+aujPe B6>SB^RO5 >JGK/a=bٕn*w`ڜm)F Q"j ghkGq䷖/g &$2Oe@ß1 0sS$ߥ6N? 1i#e?y j@bHt.ߎ](E5. 6F,\Bޯz|w6*L9/ wQ5aZR"v2ZpyΈrvrhn8)IA#V2>ׄc*m !S=M}w#$`\!(wfek Mȟ@"e4.ΐ\0z4C%N֝yc+=m5"ia*TJՇH.S%uDzZ8)ەzz11Ä5 K? guJf6e3xR0g$J<+4W},Z*hR.g|Di)S?AV/UuBk`u 1̮2d_'m|0Jd;%m0Bi@G^WRyL{vo) ZٿS=AG+a/SVuAe>TCB- SeR"쁱q9 tn"?fP!<%n7oh䚝L0cy@^2yG<IW]eM[[PZ| E->Doۯ- ,h"Ysad7!nc.5a;ٍA^>t f+] +D[}T4$oPxiᷢدGmSR\Et>mJekq(b)^yI3h0;m|7+#&dO7OniVuґfbm>KmRpu mCgpS.CSޑRd>,fOWUxNnU0=-omavR&?`=5fTZeE$g8v]9PMdsK:G85%͟oպ=Y4?C|FTé!U08mB̤\%A3^DazFKD~ f=}.:rʖ.G*#Z^.oYJӪ8њ6p5FA*/W+ȼCrb&K?"^ KH1N:K,mqW輥6ݤKlz$#y-Yw=yTGsJQஸEЅ=߃F#KGA!qgѸ<]Ez6c9wWOWPѼ-,B2PS yA<. >uqr|MbZҺU ŌƓ%ߵ3U|,5د#PZ0 {!;Ҙ3dm*nC+5ɮ{R>~|+KÒpi̵:?Y MieZ6P ar.tT#cƮ'#І[[zxV\ dJz.P#0f}pU GJN!˿cd/+VЪ;|Gb4Ex{Տ1æpnLQ& p?dJ`c񯈩&FB_e>݈WgOX{LU=V{7 M8=C-E93Ƒ'RJt, ru,JA4AOsL `l- VN4ҽ*-{$Ն"% c%-[_zp+tϼJCJ©Jh*oSġuSx: +ɧ#BO!cAPj^fx·$BÇW5 ͫgesn\ϛ?_ iN9K[NߢF-)/#NT&;r!]%Z=qN$'؏cۋC|s_ yd=@  h9NRxnφ3fZ'V>0޹59PwLSaQw]` 5£83Yqo/5.9z׉ߥV% hq&{X)^GPx9CLgbbSKN\ ,3ڢICi6gtM({+f\r>Ώ>_@C:QUW̕ ۉq{cަƱaW/wD{R AɧP+]% ]Twʞ[әk/#k( @)zȍڄ6Xdz} 31hC'!Kp@F dF *V L?EEhf>XkԘg|x=r+rs3} TIP&8j wܨLE 7:nw0ˮ5}Q0rtWV _dt1)CZh]o9!3 U0vwshܻ\dcm^\X~/8 9"ё esuzNtd['tEh򳞪' }52ȌBKa|o&Z0w4- !iaƗ󘥝^`)m(h:&b{-H㡩H+M&XHWNƱ ζ5I?Ta,uSP#\&g)Fpd.Nb4U9;vE;&>炞,`s|6Ne#Ž)zI8l 07lOqI822v_9vjl_ IW8{lw*2i}P1WZˎ* ƫ[ jF?]QPK{ I,݀jn8鼎7q2ܰ;_\s&L$ K](J*Xh⸉}b|:SQ0ˇSC+a0ug|fbz@C:U-\K]=0q4.ڨ .3S5xgms%t| )a4`SF{a)Z# ʤ od˧DlMdQܖ:QCDxߋmQZ2'K'ķfzt6[G;n\5|E{29rev;Ɨ]q% #dx Rm9/m6O@ȱ5}5/(Lmtk`P^z,v#- 1/]obɽ(.j!!P4ѐ֟vտ:(RBǵ܏[Ȗf"ZEIwI.n"0i6jXu4~?ww^= ax(?; іm"#W{)7H>`<_m>b"-_|Y{IgʧXqE6p/gl \>?m@Ў[uP1_s!H1m`ӿM%zYꉈ Qҵ5DЁo0f.(ř5ڈB:|5.-{ c٦0{S 6gG룓앨-`%S(ڍP*3)m{WC;$lH*4۱+zǕޛ]2!;&pv y\f܇7ɋuF{JaqH^rۉzY|@j̕6W6^ T,8!ĭ[۹pb:ɸg.Z %腚C.,w:HUhOD%w@ ,58Dσ#j۴yr{rHCUU\Fg$NJιKYIAj]*#G2^2$0ü( fg|(z`c) {!{3=dtIǸu_2f4Ju8@iy$&(F.7khP/X>=xN\!)2-Mw/&,{/[`8zZ^@ZMvI0t sMq¶UwZWĻKk8)0vgkA>ʱa=`El5iȉ+u9iU]1 !2I30CNey{Rԇ\?e׏(v Lɠji.)υ0tM׷ .HqӬ僷!UoS*l Pu(48 o+cvυrWZōaj9ng:>o6{ }%%t!`U˅&Y_WBr`7OYdʤ(1f(nfhuŝIМ Ƶq}~dGwޜ OSL Lh[. }UtYSwn}ޑ~ h#),oL{[Fфqe=A)RsڙUV:wa]ѝ*m@uٷ6 ;~1hҔ7bc~)6Xxg;:?ǐ ܗ?1t7/J']5k~@0]rweDDO+ MxW9ڼ;h8$k/Zi0~_;Z X4}DPN$DDvWm%)L:iY"!lpxu;"q%A3(=uƇQ߷Ƒ.6Gr'~zrW+]QԦb(1p mGwa7Q-Y9\qPX -^"MJW("&? NFه3L 5<;f4uE95#Κy"A pM>5kvx'ʫѮ9Wm v`ѩu$ 4!(Wv9}C9ɊI0 ,&DwL]0[2NJs+M` gz/ U]2e^w|Iy՘:DhMj'22_ T6;z%8h=Mգ)H<ݭ[U@.hS:*#~ˌ!laJf)_staeܑYMdԮ"#L#oJsG:J%Ӵ,J s=:wlWU!O0DsâN0d(|P@]s,TuV4oxؑi Ӻ}mގ@HRLq/̿tlYXs+|?[p*X]KU`ּ:D`} M ߟCzQu2g/JqO G^-"܍%+},Jgyؐ2\}03, sy7KpD5HΖH93MLlnۤ~c^g=פC6P"c)5J1)MjSuÔ(sn>㘭RDaYNB0ue\x Gц%挅n4. )T F je|3҆DFK8+I\lX}=[aR!hX6k[$Iept]xn:! (1rd}jRdbMD#2gz]E_7ap5⑍>8Sb؉(gAe 2KFqV9g>*҉@HǽZ_É3*-E͛2BD!®wа㦷޸}߈ڋ(#6Q6G~ 1 ud3Z3$`U,olI OA]Τ2{SMGX@!xIde:Ϸp'Հ}:3iXT~ gm5vZnsVAY |t>bf)l$Eh|M0Z4C<nJg`Z#EuGq,mPfU+?:QxV=O \j͍wBA4sM~T"fKp^K%2# 2rz&6*u-ëu7)&/D?kѸI1f<MF&F@lrR |2혾:#= D߫6<E~G5m''{QU)RY4i2QK&3rݳpr4sgcƮFz Ǜb*XlZ/bi]fqUhdሣlDЙFՆUQIg)|gul,KWLbo[k)lz ')q^ Hqg Fmγ&JЌ)XlwN '[obX3( !+'>{^z OS5쬨bcPK|0<*TO&9@M{4mKN΂页  ?O.{Y~6s<쯟;pU.%.7XQvIxѿ\$<+mm#A!"GH6pp[a=tHd+&WS'FcVXtyAkdt|Ό<@~8Cd;ϫmt^HWpǒsXpp'0IP 7Ixz <,33v/,B6v_Xl]t'ID{j:ċ{G|bgYtx-iUj)7*Wq^]`7³G<@ÖԞU˟h8;%rN7ܪ" ԫ58QFjWo!;Za#3ݦb;Щ(#eu",گf ({}5j|2IObj*ORd*5՛ppbvW=75Q`ve#u@.zi_M<9bƫudBW@ؘ>X#i>p6Ɓ0ՙ.M'GxAQqPӶ'Uqn,e@p#.d\,"Jke-=h`蕊Jm C2+*n SP&yx_{fY3<Ydf*}@&ݫ;|a`G NSR= !`3 %߉$촗_~;ݩ 1Ccy(ioj"cvUvyHe oCb'f!nTvl'vqOw~p ΍Igy 4 N2or64Yq`u 5!xm*qVbmL-^Pm, +ֽK@p6f+DDk-؜yg-G+}j|{0m0qXQi2>޵,HL'E<ڊT_FU&cMCCa*–-ׁ${Qڵ,ZVEӮJbam8ҁ⋡-">AT-M?LtcDGřFLL!;Q 4>>)c E.@;.AY!Eê:Kt5*:d K68KQv*%F5} Wr>4T(^&=Bc Ԯ,M̛ӭlT㍡٪ymX~3uMEAtV4eP'&uf+~4"7W$1:%J 햓t];FL ~<JdN~WzTYAH­Buoaeƴ ~Op{zIPe. W'#ZFCGfZ2BG/M I-m3nY\brL+9=ڝLjBgr̾yH榡a9<ڛR9m}9o1vk/AFM޷_\ּeYUR7Jýʗgu3WBc.#a0u)okO0s2 [W#'4Y&E|>gaJP C跗xS MB2ފqx00GhȮާD8n"ۋC)6Cdcjx<>~4~u Wi.3C$} 'QA^d]Fo:nr# XծI)sڐ8&4lYe_9k8SX~6 tL[ܐ7偼kE!WPBėF|'A~<{~|ؾ-\_ϺeȲ^uY^so}>{:r>;CFVs>2͍4z"9_JDQ7Գ5hg5;I4ojIuy#?bP:0FTk/㮸H\oCSYlRrc[>> sOLFy=RٲQʯq &GDd+ndƉ?j@ @6<tJAj[&tw &l 7a#R޿07ͤ]S|`э=/0?-/ R-+mxC#f&'ݯr֞Vݲ\s(4aeau:YU^ { NR+s^ ϒ~xFoi c"Ż@h:,iiN0D΀KEV&ea}-@,k0/wTc\.3 -DF"!, | Q׈EIE_72ǡ~:BLly_ 5t\HJJʇ`k꾸^[,UJnad{-yxZaTna~lxǘLկ.w>F,S׸LȪI"!=4wy]SAOHDl1c&^*%+87jxоJ)-jy%$M < l6V}ɤ]nfHg;K5NhWG+ :;/ Jg:fʌs5C ? *me)DwGˏI=r'H90 OLr=5%J4sI.}õe|?\eGb;'/\m*܎]ʝ}Ҝ=a0pmDZP%a"x8I޲U=S!? no*[Li7}M5<ӊY)φN –Yb@XEό"VA@\obO1ᱼG ?;Hd<=Ewjt_.c EHx|=A7 )LfЍȄg[js՚ZE.pZ,! PjNprAGVG;VԒ@ThIklOAx^e}?X"cl974B.^*48Lby|0RN7YGڵB4Yt/^{kX@7Ui>Ңc2UW?ۍΤ*}3w>/h" Е{w=p31NU Y|?. r]z~&.w!}L"ȦXob]gmKǀx7\(5ɝGCSݫ?dH4BL Sdǝ>(mW :5CG?ki!h_RRQ̪FW 3\T4nT5l]#,ܚܿԉ:} SVgwT7^%%|cS {I|L:M"/;ोDz1}"GTO-4#Kf!AK6"۟nw KB#O1pjD31*uRUenNOR1;_$;YVg&SN]h ;kS?eR{݄KgAjpST|3*z!B[C e莰!o17rUYR v,nt{J)#8+8dRƖ-`ᩰ-IY*5]Γ CYCϙ^}b pi3 sOK!RbbEP]q .NFru eV|ṕUF(TNChm?ʵ;t;FɘȞCfh'AU.ꖏ=#""kPg爘mML,ewUlJkauثퟋa>q<ݠ`,ݲi3@UWԞjM!-Ad;V#|Daai4'A q"S}dN2 O.6,P^QߛL7&z&~h1~,EăGmԘ  Aw!a'`޳lq2Zבo5;םX-in ` N%ᦀi{Y 7sv^ xeM4;gʙ:~wO'˚ArdUL`ݦPʸɶylsы?PNaAXτd({YU70J.`52-mM辆bP㏎`AXL^0z7@G@siN5+umƒsT!'cz IP*DS|O%y=/kӈDJvXo# ~I5YU9{gpI0U`-~l*jNOTFOW8 - E䲲S̸{yz|pgQ9ld}h6T ::1ﱵ_϶p JԇD5 5ݚ%ҿ%R  cNtة/ƻ T8M.ͲU.312O\Ćx#uz);.lcDUb1;`~%cH,QӽgnX xo^f."Ί|Bي@)knN!֛H j֓8(xȞ3=x|۞ a)fd EY Ļ(4F]5quiE$;uj$f|Ŧ5 NъSa.ZAМS~8a41 F5M]"ށFo3ia={/[B)%3j'F/MF 4] /Yps݇٭A" ˝)ނHN7N%jjGY{y F98;>B\~RXݓ??ZNsO8=C+`d hH`l Ʃڤoj{-A,$=DD Z Cp0~`(wf"N+$ӛO5bs$ _]PmƚNz4jm!:U6[[W/Թ=:۔2/Dzy}.:wy%i٤p:_y Ԙ u)K +0<d<ǩi[(t[Nt9j\挙ߵj2Q'*Ń ̨TЊ‰  y/YIvQNߥAwMIbU]pII֪KўTu*YE(x_wqn& u</HHRbPСra"ZeYVno@ˁC ú6n\Ԁⓥ9=֛($\Xoї0Pă S d'3WXgtBĠq2ҒBG]?<1hF8Ra7;݀=v&MTT>jBəmHˆA)PQ%.El)F!ӂsBRԟG:;Z76Fų~.>نNp愀kq;y0OL>_[0j9uLt YЄ`ag8?xNĤߊ<@'sX3 $%Jlhw*|蓗~H_^q$Vؠ"i8$2hѝrm٠N7&PLb|OF9>tQ-UNC|F[ˆ.rٸv0fd w_ jv!JEW‘7uΣYoi?A pd;9dOO}н%<8wcʲ T RaL38%HSe_{ʍQ.A%\y6 -ٜcM{ 0XSDgLB?i7"}Br'c Ĝ8*P7kkJX2/^퉡IbG9E| 2b!XI!U!O$ F tuzz3G4z{f,nq1-w}^FjZ6 Ѭ7D٨cR8U[R+o>K\hY bjJمZT)|Isajz&lnP?qޯaw1vYjX~xbTBg:e\?(oз/&G괺U^1$#,#&ѤD]zj#p.pc)KtE/XqE#mE&̸qRBl=]EC_~)g Gbsnoșbg7xS"B0ZY-sՄ%dش;i1ޤbpynW;]LF۪f5uFL*ho뾶 #4{=^gIp3ly~*pKTͳA = BʹZ"6OkRqtm>Td9^>2;l7H|뎋&{:,YET6dĭ9Ώ2ĕyNs8d6J%5Tx7/J~!Ev+7nĞ9ev*F4CVA$Dվ~4ʌd4/&sZ|(2THx'T$G [m>Ƕ$rמk d^.TEq ]+{տC-HR.eL$&%2f;'s&y wrj ~`XqS4#M%gUDtђOY?27޼_c_˿ `Pj(宯\Wrok?<_#` ?Ϫl+"m-CyeFm9It:#61rr$AJR>F `:X)1ݮ*kAizMO,w E'.0ns|S@7Feg0ኞ <&t3: i$kT(gbiWg*>KD@ }c?OMj}؞+bjHEء8& 5p 6iD4;5.MU$szՖoͿ-0o;NRpqEBۧ֫?SZ\ʊ>MAUB? Tup4nA5Kbo2|VTR'+ nEo1ܯhäJ::tdG==JlzXZTs2836:~7@ixGgA_ÆPa2#6b㕂*!?ԴZis cV0GxXyE{E2skbGf=C ִ6gw4:*[Ay{yj?<|?y7Fa4?AV18akL>P aAwa&oqBL^!YF:.bUei).!J%h YX'Jֆ69c.3-_~MROW1C%o/GyWiURUq<|{ ݚSd-"K}A2"BǢ 9#F'8߃E^Ɨk4ꠉ?R!`ެj cɸ{'D]nA, ,XpLKiDu@6$\]QDs̄g1e=J֊G\;e4M`l7S7m+W"/iMH4Hl&_ꍅ@MH*y:g,y,-)rAt/W*.]'}Io)\%~/xrlgòw4 E?m~(6եD)G=Ut9LUNzIr)iM+Ld,>B@T{A3Zߎ}X7~'<ؐ1f`wK@isˌO$bsƓqDorF@bsK۳t@(eB#6"Ub+z,@~ X[n"!8UJOOysX@Ni\?,dO}wյAz/%Te|\粟|۝H7ӹ4Ŏ,/%UL_5RGln.d88bIŢ$ ]Ž94\;5sww5+8C4>|UJjj=;_i˨1:7͇[]rIXeʰ4%$@/||޷X8,W1*xЁuMăcKo (Gal +o@ >Ms-dSL7yUǿ$ l}Ք鮳0'x)7rZEt SHHD)yѶ[) +̓$n( xGa׎|Wfh`']8L(d]Z ̕<3ǫw/dHiԟ{۶Bd ʑ{Hh_F8~MBVhg"KSKst"E_]!1[.Y=k͎kd.$Ͷpo2-}%*2Ͼe)Rx-55y_@fb"ECנnll0զ+*Kzɏ=o/ε/G{sQ?j ρeh &$_33C!*?9mqT.'đNF},iW#b luW6YbۤJI'*W~3{6pSxTdCz]@Gs\F =;Gf@ 3%)׆ 'zD,;BEm(#ħ5[DzڄD VL{ȭy^oZ Ԩgvc# v6דe:4Սo(sRk[@tM,t0U pC7ɽO |ճ4њV~e)wۉetħh'K#qٷa/,a$4(9-U Y)X= F F|;y0>_yt0~g x`Nm][yעޑf )&T=Uiy6Z8 yʋ]2^L>c.fŅ)j?&tT\u30-;0v,ʗ0h祦%als*8Am%:uw J]*}y_~W-s&ܐ6u})QV`$TtpQ#s{}5zy*C!Xd/:,=i[fQWv- јԒfDIn, Nt(A,iE9=Ydb$nP-~-⥄%l^1:0[GoB|0kro9+ X \<\)I{ϼ|et鞬KeM_DqqFk^OR2KjvDZZIjsQ3E8gF"/xEK4/'-YJ/x ƵvzCPaDꩳ_i rI ׂ~&u\Qx>:b;ȯhWmm%@v.(҆`m#/3kȿ~i' vpg:iwXΥ2{5"ͨ.>1~xuB)Jɯ;e(v h :N&؀# h?K``Z?qY^u$~|pqS "tYߌN&Hʣ_"R{W:0D[Mdm (ns9K6Z*%jTGjw(2/$㿋4˭EGG ׫ T}o"0:U/+us]\_KͲODH?xh EV lT6I}cȵ)KݶEvt! aᄖǖHHWjZB=mZÕ _ μG\ ҿS!>H=Q^{%6CmGPGGNw< <XoDI_-+?gq-Eܓ@!7 dZWkJ'Km)WK/Y7ʃ Tz#/pFd #8z?ׁ2.bkiU՞, ]42[a6o{ƇJ _X\`֧[M5k2 `n)`>3hN]Jit=Ȭv?xz x]0% =^d]"J:ɁD۰x$i{$?K?<- r]e9#ΔZ.A/,*z23p8k2(WyefѪFGiDt0T߽49kVI =xrkq)6L UKݛxh !WO+-(:)թF)/dobQ`opr/b?b L®+l@h0Fh;:fe* coeFn>S/ 'Í[?]WGWpol {UEGʕ%ITC{L,qiKE1wQI,i#C|7N7E^E >1Z[O'P0~F]xܛګΤBk$\[;}wF{*Y`X?ضM3, dsr4\o,HR5~xIo|(aiePEib. pwM"2t% Rȸ[cB~A\hkgu _gK$@uie6/4.wCNݢ*^MU΢csC"qBM$/1wDcu H,&,5FY S;1ZL ˆ<UNJ E`;1D_ϝM_”Y,[YPf6 G$<Gc0GT;X`* +‹h+U#IDWr"/_H St  r2Mzd'el2E* XJPD/tDZOVƈallަ˘ *eE1PKƢpuy# l=Ԃ41 &B,8 ė_f{!dh 57& tlUB֪?xOl*Qd7::naG[E5@I Q,wjBRP66x\~j2oWVR9ǰfX9!}g\1q?| M혋/&(.?M԰9_UFriG'F?~ ӑN1?T+4e:JyTj#}adE>}'돠l&y^ \") In>,[]A̖T4A0) Qa/W=ϰ_xmg]c-B0aiC^\)jL;Z)rg^@*/fݜ +b4 }(h %Vg[yW $vRZUa.GV#Kwr 1couWNmO\8Ns'I^*neSf9aRJ#㡂cE$$1Fo'b2 r##pl mh.غjtFN!3kW+7 PFgď[!)A}ƞˆe%;uTJK} izR0_*G?ybP|C=\1Q3H^Cˏ&|K 9<?3Q;Jto Nf7+*YUf,nPz DÚ)Cc+LBI/B{U2R0|9|cj2baH ۡ8s/(]͂MoSv}"r ABcR|(^g]cdCx gNAW)E^*pISMK]B> Vx<,ݒPئ}26[:2D j;EJs&a~l1zA:c&Gnw@^/~4b*U۝i] *"_ԏeDvT Kͮm87mѿ/_9FBxvI`7&ND 7T"y&>ݞEzsZ~q?qۈ[QʡVDϏ3 W^)b+`M? ٢M, s%em$Rn슔OO=܎[-h=8,IVCE\ث^# v9KJ31& εqGўu?iFäc1R" Z'ϭ LqߍPRd 0(7H lfpao߇t4BG\-O!ɱMy:TU|.t1TkMV%bJAY6IKwg餵kaC$,4m%'~ǥ'+D"vHV 7lwMŗ@H)1lo7TZr~g85wX"_ ጧwM)"\(p=o,A;]gc[.dm9dU)bDsvm&8BnKYf{]V,3Zcy&|!: {We(E *{Zyi>OS؎(ymP J(-xv5KoD%kJBJ -wֳ%iWD=p0 J6e ̈́E\c!VoLⰢ;ҭu5qר~P~;jtw/Lί+4yUʅF|tRz걵I&E}{,V)+qÊ\S-W'*n -i.gq*}1]*:~@D>(6VU>jQߒ z+|*>xj;@ʈ%zD$EKW(s \fL-Zn 1ZfJӓOjGv˫D♈CLCD<:UEXʽvWԼ;2s[y~F vMPBt HOwk)&u#ҝG:~U8ox֕mǗ7dhΥmȝmtʛ@S;?2GyU?_ gT|@y@'@y-[2m-@A`f :/Wq'¯eQ?ckuǞ<*쒢fȎ7txFiBB Q.bߡq>BD*vƍ4fB M쌨%+4γO?ڞ%6?)1۞q|8O-Gj#cGO gŵf;hHW[N\J-;qFYV!/j^ܫ:L麅 =eQC;bh H@F mviNU$bM7O Fl,M'| 1OƒssY ɱ~o2^Qf6{f({x Ad_K3{xrM>7 颹jq-;mt$ p31޳OW_P劌xg0zu XO/\ľ XQe^ yL>{?+ahs$-¯Yc' 40"AM<㍴Ib1+S!up?{*^mS'x&DJ%/3BBe^e/Aq W ]3PZۻ#0d4Jɾ>$guG) 64?rؙBʃl.{;M5ׄI+f3E9pw(Q3aδyGf?dhq 3FRwne j%{ b2È,Q?ZR}\`%"uZVAB/6]W享2Zqm \|*gFm줤h?N^^rIW+d߯CCM;ǃ4of8P|CoLF%n/. :bx !fИiJt'~<.CeEd$U%\LT &P^n7*x XAl߰t,gmʎYkuŚ,9ׅD}>u( K +{+Q,U+_^b1>ɬo{J;[>ٮl)Ɖl C0ϣhYCЍHk,R %b96VWIM7GUՁ*rB`c|j5#Xv٭DBWr+pReV,z)^^?nEa}Z Ct@āglq54 ó:(zsf:FFUU0K {3GR[ lӁg3"|@nŤ=}.$.% r `N=X+_/F\y!0dN@_J^rPZ Umoh|٬{yVY 5"v.&.U,~O'05`3]weSg_s]$f6Oμ掕4+RDsE~`*{p+RGBduIw]% b^tV&Ѻ9HG6 |:$zK%h 㞝"Oh4m܇?QrGy#k2h.2~Ru4`B %~C;4>nWX/M! 3hFԌ2Bv!,.mVZ Ysȇtc~Rư?zb!D[Ei_EFOB O9t/\'萙ؔQ>`ei'2oR!ryľ `E\5Aϋ8 3J>+ ʐ8$˚PfN}j|TH߼GxmlF(+/U3z(z5pql^bK͌!z=DC juwms݇2)f7lrS3"<0FXY5;W!])jfӄBaZ<-*k7.kB<;˹%@7L!m%ܧW9s}4[n jZ5I$ 5c?. hOk{6ΗԆ'=!WM*,nPsj wwU^B!#i$[Bh4a#\(eaQ?-sg<p+\n1A/!]lt8 ('[J|C)" ?_ x&v "azN)0`ÿJ JQ#HoMyZҀAg)hgVϪ"^+v͇O VT܄634<ڞM?!xTi䴚ҳ2GeL(Cg9rdan%h1./k|vGG{*pFL8GPޑv +gc$[FC%4i4Y< 6Tʨ\o5dRFRTͩ4.:5E2Cl ebRh>#zb^{a(6-&"y&| E 6@raQG^ıM/{IӨ)I~ !ORJwD^dHS`.PVqtPtێ /pR`F]/KxD +㕧2T#^p0a&["ttm[b [/JNZ@ ")`Һl8[Tx- 3 LL˼8[u&0Ҍf%\|͇ij*:F̄3 V_緸逻H4(9DowڟJ{Mq){˼vBFgW¤"iFhZu C$!VL# Dþ5,)> 濛0JM: x~4⅗مzjݶ[>,0?$kp6"ٯUЁ\N,o>@iiBmUf1֟:'48V%8빃O#`Nx0L0Ot^TٕxDBZ?v}/1$.4913\1yNM^hC0~Ae( $`Pׯ9m$aCt.@T]x2c<i$h&A?Y}ƅn7vkh{/7$˟(R <4mͺ4bG9ד/'IK! 4Ç%MVԃ>v5_bk3x񖿨z>i|uJbG) 捌-ë 1bX6xki"vHsU9mÏUEIc֝@XңnlC"]6[;X_˻_:WM5(Y؝#t̫CS`'vkn/m1JuJlےg}8s)x,'9[aV+4~{p1_ƌ|g_bATm,=`/j}d fZNC$Ok$I xO%$?v 7rmq~'챭Rp^7j~Q3!uC_8: +Q_`q];:g//,߷P8M&:xR߭˟TR:` }͔HvgJx8+},+;ZAq;xϵd%vP;y 0f X%|lBS ګ Sy$ǕC>ƃHKё1:e4Psh4s`..E=K{6ĝg(=UB$Z@>M(Xd$ sSNFؓT*eV ' 0|FH͹sQ%!'WzvFsՃ$ЙYz`5VhJ56gޗzUjL]rYhF$5ݨGDx͘K*'ИVn(}Ou+8EͷanPMoDws^WZp鈑2?bros5ٚpxstE%}Zyu*.xׄw5>)%M^Jո)32MP %Fs͐# hc7s]c!H8G(- BgYKŷVgR][V" ϦCg:Uj"ooT + 0HE$F?/@aJݯB(ۺ~#YMPt0pӝvhxKۤxjNx¢vǿ`wUC`ٯ_{;o=A'Qh9RN)o6B#q&;f`Ft,7vuvUY 0rT"k&)nfp7kpJ!r4!C0>L 0->+)6Fx6 ח^Rab'6*?1h4ʵޔlc.}F=Qx@HOdUF|Ec{`jC yija'ūNvJ\݀YӣkϹ-:SS.Vw;`$PAV ʭ hH.MƳpxHHgHE3(ΟVY8jٰ;.mpT c "9b.㦆w̷W.ܕuz[dChR^Z!no4<AV p'̍N`!|n%(TM{bPvLt?LaAm$3Oo`y[J*[kǃR&tQQo#^LPV$n&F@a%ju?)òd# |e?`P+Q8*&st8 l ^7Bٯ>%^9M DFKMNJt˖@I9.Ug!QfD28(wxJG@ &(FjDR|b$`x#mWvEًmia&Vɉ!Faȶ_!Ƴܷ2eYEZjRsknɽ\5F%O╻r>Ż 8*[g8Ba1='>b|7cL0;XK% AsoMa:|Dj %|"? P-G /lt,{gd :Xf/oB3fPI 0ke p(D)mU 9ʊ{CO$Ewꄜ(iay=BǓ+N!f`-K+M)W׏jqT!\(_dMv )>0ED8UfSLgG&g>*nqg BC'|Uixns;F 86>g>fF Ҧkֳ$#Kw<=K9V"ìZe4ch@?EJ"Z;b即;8d !09rœhKo(fCF/Pwy* lˋN9"A8k 3Hb94QX WI+j>И6dڋ`"ȏؒTe_>92ͰYOw)9j͹0_&"9=t">bҜiL>(f/)/&Q-W0ͻ](R`v-iN9PSO4ڧp,]2>VS-4׈6=+J'A^QЦRyo$R7[0%O7JDB1wI+lIn=/S,*!k)C2B) cb5T](H}Vy4-]lT&Ƿ4>%0c_en~bӭs Z wA[lHBCM(J&2#h 莳Ih/(IK:/rxd^;适 'Cvg9p(L6~|iG1=TI4E$yj?3`ET W䒄905ɬ%D뾊Bߝ<\#4ĭ2rHFq1O;JxȘ 9•kJ#:B% r9féNU A3𢳳2|7ScknhQ/UBUCdPoqGP1۱UEë>P";+d|hl㻪qsnAIܥF`/P7ҴFcZ{ԂC!^%CÀ[x snHt; a\z˳DPju!{tW}iԠZ@w˸,x^ZY&3kJR Ade SFBwdIa=iā Gp~a.Zvb.9ԃ[S;hcUZT%=Gz0٘309 Xmo"4r+I XQ3C!a弥CkFu#qES!kfI5ۚL^Upz?$a_msQ uK wz\v@ @HEļ] E. Ԛ'\}aR IZ(ٍkFIYj2ܷ |y0H"Mo8lۼml'5Ik8rt'P~w4Y"1!7 ?<`8iE 'gRLBUO^RLBe dfx2+1>G}Ґy$[u_ti.VHQlse./O?Ff\(GW/rWtp8H+oUF7ӘX:؟4e7zC;fVG0`!fˢU 'k{ǃ 8Go ˂ad2D&# I=) 83rz5}o%{%B/I'$tٓ`/7md>.SfH~LSkEL^mizqKҏ'b Rl,n9`Mڹ [ .RQ9DM- Y~ M0ϭ!l2pC<M5q&MB}³ŬnIe؁ǰG.ObN ZElO(^VR(څeլU,W㾮wwynu]2Ey`.[}￶aV?[f0A"l?eDCBj*FWYi`fZ.*# dWkP~g7)\р[KMWoC`D ؒr[SLRGeD}o\wøF)'X"W=ϧE SdÛ& 4\tΕN+yĜhva?4 }ykN( xȴ3q Jf,xE-@mtߊ5xNwLIʹ|6<} 9X%2q9D(n;7/H$tMýu%JҸAr+AIxq,ζ|D4y#=Nz)$xm'<{u3 j`{dknC OA +KY>8>l*bIg4vn7O O DžGC@oIvZ\Cb5񍰎MPT-UvF2hn}3$Fz ku+?~vo=K':a٠S@!TV?q%r^uc32l9%MK. 0QbHU~` jTٱiDG5ڰRCsfI i RĻ>zqıf<zƉV$tgcIY@% `%ԭc@;P6/N߳1xJ [bi/'*Yfi_qy1_(%{٠XX77rp̫,Nq"Z̞% '~a\MzT .%f Gҳ `,TϨ3xiT@4 E|NS|WI/Q}TMmy孈`dß0u΍&119&@Ҵ3  $u r3pƷ0(gBj?; V3Uua>.qvl,},07y!* `([=/Nsv1cigI.h?DLYFSUttMPMo<,Ǧ%&q뺆wX43 Y .xeRfLkT5hnaFBPk⤴$q7BJ$ESQew}KOOz8RHFhB1EK[7<̀ j#+<3(84+3BNoN-Y9q-%7Y.oxj2g kFtU4q {3]$9W*/f@'ۜtkZiWsf]WN8[z頿4ܽ@:V+Ⅷ:_{@賄_GZ fql z Jf= 1liy"BbZtĜ~R+uܟ:$*:X8^'Iu5db:MCIa5^';(2KȜ5۾HΟ~D ) LqKPpGdЮlg[؎%9 ~3 =6bA̰}cSzcFϢTKr LǠЅCv]g8|7Q\ǼVp"3JҞUYN鰆84g3?~u(dÌz?Ke7O29P`,,̜nD\ ғ4|l[P{!Ph^QO_,Ac1Q} (EFP0LS*O5׊ڽ}P{d̮qWyGja3)cA$\ek s2X ZrH02 #jdi!Z))z:3b'D5]Mbr.ϼkHr}^f^WC̵-|h:;3,u8s]j$pأ-p"Az`tXMUki:RQK<!lt"< v2! Z퇨ʜG3V\[(, !xj iKjVtKYY iZe/ 乤8b6B[2~aZz]Y+ HzLI 0Se Ü>>8M$7mϱoo1"~Q C\(y++%[i~0Cc?Y[l=yD)0^8)O*._X\(44WEQ$J& -hR#/{~*}`(7IK&6` ns*tTCڸ2(I-$zsq:]D]<.PRRfIeoc [}sϏ!HՍӺY]in}(%  wGGn ((=UH*/8 q :+e_4vwm(X114$a*?Wْ'^G=.3LifALhyE MBÖv^^MZ52df! a?4.:̾_Sx\%|zݝ&keˊCI nN+HY:߄(ؓBM9JE4ִtD%+\Ѓygx-e 4l2rUM]@3#9. ߶,+ır~z|#rɉNuhÀ'y&J(dC+_d8>;S jU,g~!MP$yI?Sqo̞ n=ICn&X`ӬU wHz<+#5 X{29[W*j۫`AӀlE/=ΤU Զ_ !*Y;u يP]JԌLە" l.b4!ӍpbIj{iq-JPF_ז,dpd:&RmпWQϫ%WI|mpv E%\>={;R3`+ҿ},[XBY[xdC!NĹc估UE(I8 }Q!G%4nȥ$M :2%\"fƑ>~<41udUp(N6rev.w M$RN<Gr2 顿&b~jط°O"&3S+vn\mSF {d>G}PG,A'\m釺'+f~I5۳S4r(߲@ϝWLpEhuX$M0aZviV) $5s4D4Ôn=WY{90/  \EoumO|M1h)IP:" [ZDO]ݾ@J5ceX"bU<`Mm$ňX፰_TϾYv LO`[c&KEXRmVaY3bMT%#hѻ03R 4SswMFl7$X{-mjU;%ᬅJ+uDx{/X'BT%Al|gIyr{,ĎZ/Y lpQQ$&i8'):liA(w39 xCCH`3y"HGF6/`*#ܢ6! "NhNE:[biX (_ZNa99TruO" dqVa?PICSQRXMX lP fiB{Ԇ~*he%R[ dEqޯC4X )2FpDŽ"vnG'\KOXA<瀟J[ma@m$/v'=J?;6Cݬm56C[Sc ]!VÑ(uD;ᒐ+򥀋-ȗD6?IuFSOTH@P~]r/C OB'-]kzV,B[eۯ4l:EC/Ƀ 8Y1<,㪄?J{,{yuzSBhu-X7\PNx\ęۮ1 J#Hh;} _:  olC:t3{[,xxĦDNf"JjfT%,P1LS"e)`aGN.eQb*wt3!-xz!#o7fñ]Õ=.Sqg>Y||[Yܬ!p蝖&93qu6(+r{s,wV?T.@\f`u;yI &psz`7ƠZj4PS}#%oɌ'4Q! ;ڛdruNfŹ\@'&e -ShDG /<߮.jjc f|zk/rV0Zw]jRAs5 lƭ-Bߑ {g찊X*nߜ<]3EҚY0x bzgp߸VΟʉXR2 OvPɃ4qad8pL#CoE[`5텛Pb&(K̦'&0U`.Q@,%lxzNt*Y6zK}8j<}ZK~< 6U]dQazsO^zy< -<}݄! `aL:~9(iFKmˆ34(Tw]W^琵?[$C2XK`ۧ_AۄP(O&4ypAHf1=K9Swus(N5TtKz6* E$5A`a [XpCCԷK)r5Cxm& EG/1 aK z4Ou#Rp &/ k^HJIY5ǩ6,Tԉf! -ŇSwJZ$qT}ʯSRp-MIݳLG-ap)GᎌG8AXEl&HH'$"76|`VzbqŶ%Zh$&9oD۶`OL LwtBx,8(Kɲ_U uDndPلEQYCЙhplk4dԢ:Qrd~1#Q 9vZv+T'71PZfV.ϟY]f^?!ⰙQB0D,Q]D-YdW0F+Gи"\0${yd Gڸ Z*6ⳡ$kkhh,leH׹[vvN;YF+ LKGj=E"f0ڱJ ˪+3RYZ ]1UOJ(ea3'kЂmGd>7(<9B9?T3Du Q $.$ڳ}! c~C`;we~Iܖo/cUE@-*170R/~o^Xh*eb`@}ǎ Ti`"N5Cڜ*FoIN6k#zd3M}Jkz9DFJ{y3'rÎn"&EWHc3~;ʓcrmѡO4:LNېB{;pȻ mM;|Rё&S>>4i U7K 4|IEU;Dfh,C|Ȍ`3((FR /CwvTq`N*Zl!wCGQ)lU)9ȡ驺%!QY (cXPxx%\nqݕwNj?X#(|\y)șҿqBقi ~,._s\#lPHknO tl=*dbnF8ɡihpV %ycOFF9 cC5`jeC\iL 7OE]9B0f9&B28Pkk[J|7e%870굇7*Ih㚤`f8Olݛ.kJ=}VDz$FnHoAheɦI*d1[`#^eqm !KE\$}\JcU`"Y[KԟIתF-։Z,玐lOcK0;x o!f0`zC6ϯHv5s ?u%Fҋ4! >hh.w']8A! v* /@IIhW)Ebh%JIP/sTXԯS\[w+097uXL91>H½#\a3mVD Z f:3+eʞ-0rgyygj!OrĽk]#]/"\عeE+/Z+o ߏubc5'BwPŮErb#dydu{c@sƩ|cd{i?_j!XrPF[GrwӾaܡucşVqAV-{ $_ R/q4vג ͶI˂ecK19]78v-TA3E(6D֑5Qsu4Oo:p0"xŠ 3CS\Ƴob`l=Q -5'5]1p˺D?G1ۦwׅ HUGRD@Jgh&|z~a1_pBCw{Gb\6wDTuK  Veejfcm8"oQkk ceTO!.}3ţ8ITV /,:!c9 2I $+ k j[._zb r}+8ǭ^YEha quaoK }.e9ytY*p_3Hz_(Rľ BgwIC`Cole`N60T H`؝W0%#OaBw>P2W5 vY GȓaE%ǁ]9ą3H"OIBC` CG)EOq0gR½w=ikn5tߑr@q*#Q/ȅJ7#q3)t+Lag4+Ω!!{52\_zV'd0}|ϜOlB>9 n g6v*Ky`1zp8]^&O_T'o0LqP|rovv<~ijzmh30:=>HoPv-VTJ=ѤmfU}&n ڙbR _*RU YVoX]Hu+Ќ GEiMGNLҁv/`'!:\g N5~%l"hdgiװliIAJS‹88<QChA&g\s(%'%`$P/3RK 2_m8-LxX!>Lǁ1% ?MK~2x3i,MN!!ܿܖ:(SPRwBQuë+j?-FKkcSIRCfGol= >_,OH.⮝wݑnÖ9ƂeelA1G%ҭ*Dip; w2B8ͅ]{ȥj1#; l\ɞdC]>"4Koɳn?ƐyX;y)(F K ´ 6Do7%@iQx͔\nڷ*wGM4 g(-PVlXxt~ا~4ޤjR샸,*x&k :=΁x}x>4dA!UKtD5740x_Oy 2[D,Az"ڻ FZg5F*E7J\rLp5Pٚ|/HpOaI/]4 ܫ *UkX nW$qoU1^GZ(aL[)2_wfA(7d}ސg^s""YG&B6Gļy_;hsꁛ8Ѣ1,yzz\M$hl7ͻ9Ҡ,B:&"2U0ˣqq7xN?k9KɃgIQGX#ހ=2 ;8ZAn!dBe8%(~ S궾]<9W;TA. I Sz- Z>_G.bw ňh3Z]))F۱EU](g,꘮rXV[f<qMǐ鸱~\;E3Xm> ,EOݥN&XODPuŲ?Cz9u-Ywd Wt:Y,3P+\9⌬(4#uq`fǍXO!mEqsaXqJ% + z^~MЅӹVֵ1%lV8RJ^ץ[P\Fq\R ~< !|xE0.`U}GBti$ȍ(9'7z}]_,=kS^ө|kM{Zj 4Db`=_k N`0۾f'UH+w\8&IN2|$=Փ&t)xGI9D풂a~jpu|L5E]huU.݄xed(F(b"[kl_Qk8?[i*ji =U^pXag߰v Dc#R=HzԻ\" zq"qW؃R>N^>RDﱻN~ 1( {c8x=oNˆz[?|h8s4K7Lt+ԇDv0瑷le0FH9X%fz9о|:SsPrWd [Ңqç *ˬ6c˫.c!=R>K_#Y̟B`9o7G,X @ҤEIqf> Id|őKDP|T|h ڿ31 ʃ$xd;x?jqՂg2BI1 N;S%Wu_s3dz,Aśm(1tٙwaDɦ| qAl(Xn@+ W޴H`.f-N (gx.j? /*" ?mY> e*/v[$˺o4 ztjڤ920Bc()D8; 6SGUd}`vT[w.W~ q\ ''j;9?A2Ƿ9ڨр.@0v?.Sh,rQA3s' "=_tirue 8gR~ᴘHyG(Q)7>~KwI/ ߜ@r̄S \i3tPꎟ!4Aޓn(R=jʓ -;}eKs@6H9Z~KDY[p#} 9Dz7m5?PrI'J:>lǓTLm-9T-mKFJc1h!oI A@M%7w[60-kڍV_;FtN A}3)::EYq#qW]4Q"RJڶ*OT^~h˙FQlJ Tva~g w[!41mrm);[P,VJ)AXTcȭM{$]vl]ӄ^2z)4uqNX,P9Rf(v5,zO7T?[v қ=Y^ +mde{V:Æg_Z;wzqt=SvhS;¨ׅ&g ;f@rU 4qp^y4*& ke])&d. I@I ECKvSqr1-QcW![jONy5v*& o80qW-cj1Wz3K!YXPq>\Aп1 F~~W\]@k5ZQ51u58%<[\&bWDIđ7uh0UxwZjc߅}iQkfYyZea影x"o%>J.4s' {/ߞ2\VUtz_mqCu2f2}rlqdl7?f$g`Vgx텍xK|:\"y3h1U1/3zׄeAzj}2>Y'hh\ S[yFy!TC!34 Rs/#[BE%Ne$va`f+Ow]Tn2mQ? +xt ?Q*__'²{ 2y샀HOnFjeWG[ۢ`a} jÔںgH"\߸ \-gEPC @o@ucL3-(c.5P^Ͳwxdt:惉BgIegִַrQ kR"**2%lpQ,75i^K"b5b=?2O-ڍZӬi!7)T5b}$w{MejYD)ռ)ʂY';D5G(mBm"03搟ٞT_2 g6䴶WS?CEK2;ƜgB^E#?Hi߁ ٰwc▓W,Ʃ$xS 豈MWo>iК9-ZWtMvU}(x$&+Ho8%C:/9;nK|ǿ2SKSEP! +^(]-D솬؆.NgqNYŅ;_ K|qFlɁ=]/ɑv}zbЊ(_r׿R*.xc| gVBg/k/2xʶc?DotIYsBۿ tGgbh5f}-7S,$ht+KHܨ}1zr"ASJ;g@`'Ȫڵ?3"MsܔY^,g R=IɯŲQUq׌ ؅'u+^ͫASVǺ+nDj[P>A>,)1jy%5"ly6Pu*Rz")_&ׁz^Y*7JrLL 'v>!BO7Ts K荂oXޅʆ*ۥcʢ+mKgs86唉՚DY1ZHy[.FE磱[sLhXMXP _L??eR5~E<ӷ,#6g3")y1q?ˑ#H5fUZz5H|ګ/ *d!٨]9@ޗ' t?u\G&YSJ5jKm"*aW]<> M/MZ;i O@ɶ. 4^p0|"ẾjZP70R Z`:'*%+MfM?\1g3wC8-ԥM*v6@IvB<"9[H;a1]*>b3У\ipOm[Kܸǖw6rp9N:!`ۣNKÛ\iX4E1DMλK0b]" WPHo1%ÖZGzm%=YxĆoĜnRVpݥkCETw~3]=/M98C;N,oR !=W0RhsLJ#bM ;3xa'=0$Fj{ϠBp)fӥh1pr=1R3@@m|XYXV6,f2wڇY^}{IQq--]@BR?j 4Irm;oM+A{ޱF>`4ɽQӠ*9-(kn9k$-&Ik[sMSiY2Pi`2IMR7@ K0>P*:h[7SⒺ$N){݊h/Z'h@=R?:|8 (HO.>@b[kw’jb`|q^l3A ,Da<0QI{1(D{$䜜0)lo Ӷ,Qկd:٨`PFJ=3:XZGÊB6,D_6YI /hwB:۲߽AA yb[w+i 9(m9gP܄SJ,z@S,>\HH4q1P4^B6 uh!P>,Ngi}@WftRŕj.ǡ_Xޭ4 \-$zi2viiN.Mwԗ}!&ڂ }ҹ$cm lS=c}hQJ0賋$%GQ|W':Y豭ˬ2rҢyE5\ɛ-i}Z|cPaͣ$eΨ&Q) rOyU( 9v1TPh Ak9<$zc,E ;taX.7-6>E8PkJ0W)}O2BA8?.2zԵ"Z#$Y⤋8S^FcϓDi\{O$x~ʻ= qAѵo$͉˞⛦c}N`Q "l /{k`Ϸj_a!pc\2)38ԅUG&VР<)}:/1 gȡvd]RDD ˌ4RZ8T%[-pILJ x/gs~A˳n&% %v牽wTv EkdeU:6P槯\WNip)o %j~f=h⃋/Q@|Bc]{PF; f(ΕjXR8Xѝq1+Z?_%B۳&R{E-Rg[];@`;8 7f8`?tcbFx g8@BN m " TU (G_IcSU_&L4Nd4]9VUGTVg{5!h~1Zʝ%|yN]F!bae∳|Xl-`,ͺD*Z? X=Bf@W6B rB,eNYJħ_xPތT e3E? ]lIsP$@ExJM}8zS6Pl{ڲO 6=v#/7SjÚFL5ҡ4`Mjd{d+&pp5E UϮOOW\U-/ 9Ƃ =RV2LD(|rxX?Zv2A?4Ҧz1 E`Lu\Lbrƨj=;\pg$.`G1d+;aDe Say"Hl3٢Dy#$r9M"DI[ssIJ@2)UG|ˬ%Ԥ>drM:,9h|#*jo!&ϫ^̚aB0 y~?UJ*7r%XS3o`:a,#cч@|lgĪ $kM_ȩ$!^,Qڏ1JrL)5 ,+#(p"tZ[f@}>4Aq4.pLnDDY?'~EM;8X15YdИtcFΧa9"ER{u?enMt`#RlM”ICHN6i)%Y\hiy Ab(X:}XJz$~c(@[; ʕ,Med~T,rPx ZĎgz)ytKP4,''Oj}~t5w?S6:A08Ӆ2h㚹e+nωepR~6f 0戔Aj(8݈1h 7\Q 8Nj0",s|} bADȠ|$ciA|N+sbfbWku%`\{7?fcr&zk[yNR]n|s_®z$/UM#E?x=ZO[?̊nwUӬ\8ZRz,  ~Ev3ƅe̕u Al]'0YI?$XNɯHgoߐ27?>s EȭkRk{ϸ>m#Uc iH_yăwePsjqx'.p_62 y+Q;>?x,Z>[8ꬮ@xQf{L8TMvt <<~'͑+Yt;_3ڮsWGa> UɅ`:F S(+,Ӈ4*fZ:5k]6pHY}o ܖVپG ,FMKmpᰦFhN)8TNvYw@pQ$R[HlSj_nx! 3b.]#u o?I\rSE(qQls!cÉEGp,Tb$W-~*~g btmP˖<- AQz aT[ĝחZTy)}|7P%^_2 ݰƲ* ꂏ͚F⯱,2 ɡl#R1k/w[`pٱo[,ƺR (xA`gd?>هn3h2d$DlkIҒwTMK'tֿ-J BKzp4H0qȟ9'9T[Q-#"^RGӺCL.u}I\ǭRyKd'F<̘ͨoEN541%EƂQX?jU] JU >C%Mw"Y-$ʭ̏STE/(Ewr%q,^A7eUM!=}5&+|TS7t"z( lo_rJgeÖVW)qv9l+Mf%zm2D52]Z'-UN5 ref+dmI⬻ L0(<9MN6GEcellx" l8X]jjHw1vUǕIsCI[]*/FAd`"e p ݏC`VW$]&#[ࡀS*0u{pg,K-]bev6V`@_C|qV!? ruLdzg Rp,n9*qH,zjНs12"9BF~m-(f+`T`lYiPrJQ?dFcEއXƼ_^-UtWȻ+iT7h\UOE9bFFPr[+9@ǮДwiY)ƶ2+mk^1[Aw f QX+.p?˝lþm؟!,/IR6Mz,Ȃv> moTb\^|: {FHj~Oz iϹ%.VKT[z[f[?ݍW@xG]CDA) Μ$L|Tlf oXU* o ]dg:H:UbA6@V*-連ⲠrA?92<`SAsϛ/6C ^$v,Lu`m圭Wsf^鄊F$X}]wĀ*Xp+>i#;LsVIOQdyNݕĹa<'nkxF'$/RRo:ucZJ⿖+i2L6B*2ITfJ`´άitU*415~5V ga@2P:F iu",Yb~;yE2NUҐl9a=(FU5B`eLNFUV$(zm nI#BjF|GtxS6!9昤u zy~f 9ޖE?ZSW2Po;2<.FRh+j=3c@\+Id%a]LJ |)Q B-}mUQfX:'A>ھqeNqB*xF!R lP\u6ATeU)+@y8ER}2a5I&7@p;aNԆ,PRm[mud?L%v3+5Z* ҟV(O #ly^my++  3CgIDíd;D?b~;ZT'w-S[ }&zz?$׷H`Ba Jܸ=)fѢ51IƌfdJ x}@|GsEI;fs‰W@T졩s {SE>%5&.hٷ󡱐 !Y7O j3܁gl M.,\ $|Y|,aW,"gz\ eŭ(_ʮ}ׅXXn1YO"8S9eZhaqO<6[oZ+%M-V/%ϋ:Y5e/aO[L,$3KU8͖SH{b^mǮ6p $|XJ ֏9Gu3׌>hp rb*qm T(eEܕǔrКJbeyY&bBitg NZ흑jꆭs )q@9ųtj@*ߥK&Ћ,4H0;vxo)z'=$\xץ> ̙OtCҵ-7蒅 lF&'DR|7EGfW6;͈+ 'J…+ځ ;զ kmZ") 溺3oJ{B7$ۼl _EQKf-8ӾR.vg#+zMZVʱe޺#t+@pDgu|E7\ bVHuf,(-O=dDRzaw8ݐu- Cni5)}i]oM!\k,RvGoWÔOjxܷ;~G+$fbC Ab '6G[ }xݽֆkJ+z #n)Nӳud{60,%Y+m<,1|xq|I>W8P ;+s)}Io'GRi|(0j 25t}KWVl,dV E"\RenGЃ=<~mŵ GArBoٶmޅ0Jsi{N|/^ @P®] .W9w\픱Łٺۮ多Q2 Zzvf3JЬP| u@?;pȾ3mo35QWrW9RuvoLj =|?k$E"MiuCC*Yk9 Ww?KRErL*-Rm#^!v&:;n? M7jyx3fu'۔ols(*d*2"oU*=^XĘO<`^Ix,%^ f;s%XT=h}b`z |KҭSǀ3u͖!*%~0_TODꉸxlPzRm"[r-  &YCLynQW3O>de9V0+D$wȝPT$}q²@-$mˁpS dS5_fXD^yKh2 so'qWFd[LX=S"tXjX^E/Aq.X×k)X;0 8M4 ^T}WHh?!”R)h&͍u1> d"Ov;aF E Q sR@QTr*?1zgW[i9MfHdu.. +BԱ LPZ"BNlgbQ)od%/O(WhEJ}>:jdj>S"@DUY<9|(8 P-+„ "$a0igȱH «;.jdUsBCzZHZJd @.$v~sGLhXۚj߬ 7NpMLzvA+l&@:2x,3VT>/c/Ɓx Z;$i3T0ݜ22VqoAJ7,pM,?)RG %mtam3:@-/M6wɠox06 {c;~=KdT0HM*'A.jP$?503.^m˸А`I@bH$2qJQ^g5:ؓwey Y],2q6a{5 *(vpBo$ ebn>U4g"4`-cb}}:n~!6oP5%1l~&g%ɂ@B"ZjqXZW϶bBOG5;Jj$!M6WrM9AUov`cD߃S(eQ{E_S4@Sn=q"76SS>@,ꫭA"u #P'Cjdb 3N̷'SjQU7! KjЈ12o,紺㴔[!0y)V'HG7_خWy{7E†oH+7Α8Yrԉ5jowj;3[pa#kmU,U棰;k\̤ ۋ;ʯ]G荡@\'9<XRRh8Y Hwh5Ѩ05CϳN2dPtb03BV"F4[e s!ZP)4'`:DkEG=:MC”SphTc3ߝй.l$͉2-:vͽdߧλ2Y;F^ iYf52Wݠ.V+,HJ"nP>S'q펍['WGZdzAO1q^10ҷJK-19[}Rmp\ra7qDktNjX~kבuwy&.<.[` Z _JOĮHA"jC^RΤG va34b]V[KvTbn9sYխ ֜4 ^b "ِ@ =SQ(l3dv(n}YS(OTK oc>#KIpJX9XdGqCZ{YX1n8 d)?apN:5F+( ^183 N߽D7e# )i\HL͜8Kfe Yzg(v[פ):% x^jSR6|6Pdd#[iݢ6ڶMG郗#qӳn9t$}Jt'z 1Bc%sWÛ*S5lSyJH_"Rk J1Α&SL\(i?SrS6ڡ \ l IP,Wqt2r9 +EP)._1+<VaN5(U&vV\ȢC6Y9Bno(& y =œa/_s :|e CJ 㿡P _vB|cBSOQz2*d±ՠEry @'h7>),\E)ۛEڮ!\UBMYͬk#i;d6 m쬢U!Z kL|03'A EMH7㼬> GUymgr )*uؼ:: sS%*dlK))0G/QzZ(DCm`)rA Q%^\uޱ%z3&RoT`rA섩&5〪s睂?FX!:U:g+== jQJQ:z .Ƥ1xA2U3 ǥlv0 ~~4pATT XecHDDNE҅9DXXErJ?cl__9GA1xtg*j:Ow i>6>]ҋgJvfxB̝w +E abhp.:t #of\< S@"?9w"HL1v<*>ԾKu+6IlO8KM-< 4r]X H6z"?('ڎAR?U/p e [YN!Լjz*SWi[96*4F%(2 [3?y'YrP09 iRcFkQ8&nD0g`[h}З\+,^Km,VWllX씜\ DεUgr=BXs1 -M3oBz5Cb٥[0D:-[2 r O"5G|Hg_@+42_EGxIFxDsx!O>!˂S\mOΪEUD/!'2I z}e ys}ˡ~UnQjvi+~KZ4MfZXĪ(h`^b-sA-/-A=]a9(س%6~oލ>ЄMj(=NwQ ٛOdrBNBV='G؋6A06C0Tw!׌d.O?h œ&XoauJ(KF()G 1Nbp0,y#wٓ y gqѨodICۅQqUV.,v٤MgN/YXJ3k~1ANHX0CՖ!DL;[Pnva tZQ<I n$0ɒ#σ9O' c}sob9@|w)Ua!2vv)fj׾qX<6mw [|i^%e>ȃkIILf[ĝvǯD *SY@$xU՘&o5hRwzklʟy$OCK<ׇӘӥn8Ї3eJ/J̺)m#`A֑5K> -h/O<|Qe.WC>%_3},zJ Jd|9v'9(teUv˲ƾ HM/;s~r;&lB3b٘fyH(Wc@$mBcvD\XcVZx/-!+כa .DoPr$yV? j!~ӅևU~c\3ymΆ.Xjn){P1B`M(Ĺ5YU`%4|sc^ŗ"P1o{YnrN ϔU%n;x>l/Vt3Uzn"\iHc)V4x&2O~Y-=SvDҨ^]0]v>gQ-.L8Q—C AV?륰.j}faK;h|))aM)|$Zv(z>4)HDtcOy8gt&e"HVC*#Ƌ",]^ <[, j#RNm?=z!#;Z$t~3ƜQ2,d^ʛ ۏ3_DW]>c Ob--=~-IytSGW2ݴp>I&d 8hJzo\F\oMEf呛Q݋Xs<'/7t*kCt0IK.\ JLG oN[eLq!Uy=96|h)FD1̀kǝmjqjBL?1Ҋ *M遏fdlm텿dǶne3+=_SXPtB8˦PL ӌ KY8_f{-~۴G1SaU+st'o4 +h^/ɝO.j!Hߗ)64Kd i;H^qv]+ipnǖf+Z7z1t\~O derB\3QN߸q_X I]<{ɏ.fd^ (&M J ).]0٣s_s\YzQvE 0w!Z|brH^qxC\wk,%ƫ0/t;0I?Nت(h 6&X[[{^<4s֒*-/ZY})ׇjPz#H=|E\MNZ@9_/|n5rIfr>;O\UY7r0o.4Jj9W>o9뫳~GY*Iߵ3kaYg8d JH0cm unY)?i~0fD@0 Ur_KKng6;:xQMrB|fPfu4s1e+vÀΔ0RkIMҳ,yǜ4jE~ǍI#Av^ēAko6k Lun btZƍv;s5YIY&:ʬ4ǟPA<"w$}z.]z^ac3+x eGZܽbg*B%i,*#/ ؇r}>u 8H>aMO%#'´c!R~t{E- HXyti䠤A0E䈷E-m5u¡w^[+*Umٿ.nv_:E`tL*՚ 8[lF㻑Cc8ARES+Zaz :y^si:RG.R!cWR<#Q{*Bg!lT}YrgY -``¡^#m *Ƣvz%" 4\=6ң4Cn]kjo2M4ŷHViC:UVzI RP4h$ cNEp)0ID˂! GVφ{>^#34ul5ޱJ}L&]w _pYҦip) Z-* IJ;M$O{TAp\Tb&Ӕf~7%`^~ ̻I Ooj10Ofvv'e9s(azΌ_" 2={ҋa!7RPx컉Q CsΈ;Io]7,6E_s(g'*AYӂ|~)ڴ\V]B΃f j:WR#?)*Bmv_$i~*l 5SPue=dYtozԈwB:C.)^]ZEt$,R3Qx//^~+zy{02l龯r MLOb;M赂-ΪFbs1'ܘ]2;%&z %U/vG5oA?rˌ"OUci'Y >iZd鼥^OO;oo 61"AނqQ0y.ez˂dAѺLO!|%vd<9Dbw>:9ۊnoAl>@N5Md,W{fML?]Ga|^^d~W⊿7!sKӤ|iQEuW)>NϤ1Qi+G` V8G{;EYIOst?אr{ dQÂ9XI3Xñ-3AH KlN+ǃr,}81Û|@0ΤO)zٺݽFFXLv lk%&C z;O5t š is=XMΝTwf24ʅ\?~~s)ZbY'-dzHrqwWυ5(nwzwͩ |TRexn.ewz\3)Ti8}ACC3ww"6Bx]q_`tu~`nM`ز\Fͦ|ed/4ћWw',} lA۾lkCHE=BMv"Ȯ2ugkڛ!9_KkC׸@SSɔI =A,+88btL,(*A ?ŵ3pľ1O,'N5A%]6i†w5gm , X<[=u(4yaY..xw#+tяT.xoCή3*Lo8 ƒ0'zUc%uu l;VRm,H-Kh-pX4kM { <ߔ}T&fXofr>(?dJ+.DJjB]rPT{^ 24ԟ!XkP:/no&2*Efq%Ax13ߜMXO«(id?<OK7l_;9wӹ"_;vG8*ڋ>|j}9W "o;W 1@foRn痛*!^ gU^6IUT L8O蓼#/?"F 6ZJ,/JY8+RahjW.G/x[x,N6tk#aۢ%^<% JuER̷/iR3H;nYBQ:@yYcd, Mwۗb]~`T?ȉfH9[]nO=`MsÃVT2cK(mܣ!gP4E*PK',}nbދΛQ]R ߛnY6|AXE y$Z Y j~)o{ J*{2`u4D|Ҫ&1=K>թ4|mؼ #uW^4T:cLun"/^R|"B[FC+>aϬ.)G/O"ЌUCe'!PȖy08{)) bcUgk乮Q$e;SC/-6+ҞVm#}<r#`{B+[7%QĊPikXDEK`TV:@p@7{ #-J["SuPTFfQ#LwqvӶ9'c7_^v)~vhP!{2JJ4RE&Zt$n9^yΐr~*?p? FPoY/#mCӕH9Ѻ&tF V`NU1}a7W_"D&;[/0LgnPxZ#M1oQX`s;yPR>8ܤw'd '`TJM<!\eXvfZ>W~Q&ԁ>dIZ>" 8BC}B!'hn.2ģ%NSn+l9_E]ϹcS?IrG[z@)bP;R{0tPe#r!& 5ʸmٵ'YqơVWb 4%}?J-*kyz6M e`maV^1?uN0u<{\Q3i+Bmј.8Q_ \wһ=s4HCE >?|[Cǣ .sjݹD]=a& =%txCb-b,J 4O {єpe'Z{ е#4pF0), QjFYǏæ@LWщ'B4=k~c>NB_Zc)r䉧65*}OG Ed{fhGL _ތ!-QI~wUc萉UWtӚsF@'R}?pzk01^Fg\R-cA4H:r8\/u>JbF >bo>n~&䃞*! ->")›ɹJC+s.)!',_!ۃ|^Ovq_+3.vhov V"D/$\fP|M壺+IM78γ`,/% Uu3!cH˝)fӤ@Cv~%>/>YXJ7x [aE&.Ňݨ- z7ŗebY¨qHU~jߏSS)-ITז[ ◟{@HtSIv<œ ]Hlx0 (&8tޗ!?Z|EG` }t#帘iQatK+ټ5Z@uN8[Ťn& :}GUSn[]e%>G?10"h`cD=jW̡W #_/e"3L#wLu|kE6v<yx9SR׮Dty$̫=X WHuS-j&] `nQ.J[ct!zrݮBp CZ(n~2 × >B82bP%8]OTkm#Dm.k_Oh&oDcƺG;(UH)@Hi; =m-ҪkM`iڰ)sڐrUʙ@~!Zbf3hLt`?սjgUV(M=Zs"_w( 4W[YY|D6PhIJUGGVǬ{߭AGPL`Tw[p:**2M2 z u@73o#u)UsD1c^fJbGbWDNl/ yjV#S8,?XI丌`L2o } ˭ȸ<==`uEte*zY"\ lӗVֿ5Pn򲿲~Qy aXNm~bݡP?liW t*Uԕx¥,nvĺ C5VI#|yvbcղsS}q!#)^[`[I Mtnpzh&NyeHE3eˤ Jj`7QvAz,+ @UAſ'Ơ(ȨuJ >]{R"10@fP-Mp=N;A8ۀ&= кomg$LZ(qHzp-ص<w|gx6yq.3Jk/rƠu>QZh,.6`am +ǫJo<+c{77KP(O`Lϋf͸=/%'Hy1 b e ;"j{l6DYs+(7֟>w0?'25֌[# _p7q3M&YFrbn+u|dЯQW7L)K5=I9ArsHQ$QQ01?ޫ.W}Mp1Y(; 75E0"Hnfs.Y ʚP!"P y^x9R +#;yLN o91j f]= xK('ya+JFp*|$њq~?CWϭ 3YU?sf]u;LSKRZ⸂g ܂UkKo-H8_c ;1d . UH&nڻq+ ڒYF)gFz1(kC0)y1.r sTkM^$頞s+K>L0Ox4ʪ6f͖JkTZ:CGyu_Kʉsj;[B-VCrx陧Ϡ/ċptZ3l!cNX @WV-%@ϻ(&bʔݳq"2&U{\"ZwX1_{yO^O* tZwFش0B|SQs"5r 홊Y麙RxÉĐZjV٦||3j.RSjN mhu{a?ɥK$LNC9o=ky( N%H_ܐ}0^0{E͈F #+i}PC@΀;Bq"e]z#(l69g@f++|xY!T5@*K0}5Jjoi٫8<[pG4)ZQ^⍭b0|Ȗ_7aD)l(X7M8*05p\>K)q]&ߛCzH6ӹtFI~fC恃SӹIP@~3GK AcZ& 7=um~ qg[:* `SwJQk+pv~e=NHLX3R'ՠX!?FJi$s.>^`w:UmcU$XRE 0r vGC2fS~H;&.)ryle[Ǭ;l6WvetƮg`F6r$B+v?N x뱫3:)d~`n p3*9*Ɂ:fm Mpe[6CJ,{6uDHؖ ]:0H1eot6nCUӵw>$knK vb9㧤bh!]{Z>~/e}pvv)A҃::sFQJʹphp]I(UX̩agVWoţFm)[*ESJQ*VeЩzz\|(gt|7Ha#_̾P֤xqcڝ~^/?9gRN9؍T? 94fp(ㆤ0[[cEBEl٢E(!?d܆c}eqn(Y63[:FPu~EAAn9su&TdYUY r{]"ɨ<2zO[Y+'Ԁ  xKcs(ovNVhe05mLE6 飔H }ফ!~J8.LH{|%':gj7۾|E\PWp3NR^3yR YfDͯ.Cx4}t!@=ɿ;aQzIlKqD}+)Qe|\ "/{?sKx4uk}JFځbQLJXBА05:`!9 16  FȵC?*Z.w4J"u hHK>)Nh6>+.kp@.2@=n0M;QcM;r'4,uF{Zo璄s\Z6p-h;X3vJL;` t<ߞE QtR}B2fwJwPIcFEgNa6٣NYkfD+Jo=( . MD7?ؤƢwIz{3@h|v@њD+4fbEqĭ& O.q 5oah^/N} oz*#&a @;rcIύv6!LAH2QB?WЌ7BP)SpMݜ |t2}\Y"Ci&_5룤uR-NH(H \rjO:4+?+ c^vꀲÊJM˓FvM\;Iu1j;XeuHUѬ6dJC|6p˪'KuB{hj,`KY:e5>95zy&U/֒-p+N!r-~բS fK-عi$#LsX?A_+vCX).ia8ާϊHHZaHCA%@aC\H Ѽ&LJÙ9ף/_!o ꓣ7s-(4W@ '7Y8hzZv:wZJum1W!F44ѡC # G \ >rt8N5f΄]bS5b%r'K!×CDѼZ†qu ҭUaO\Z\"c"I.Y e(:2%zAmf^~w[V!{Hz@Z|C"sRФdqm d*a/@Mo]ovE6K믤4q̕`  эrk- hU5hQy9gHPwC5Qҽ4!,*{}?ulN*f ?Kk1~aY[9Mt vEz\kșXBOb"ᣂfOƖ{j;BNv/W,;IY]}tJ h0mYK./lօ7~ف({:YB*'UېW`e$"X8'UR=֤FXuMPguli_tdOhX:X;h>mб; oX?7Yj[z1"Zәppiv#1 ԁ!ݏP# #VAݜ_&SNJ=h&k 0@L>f m$WDXtHτSls"Olgd6fӮLR\90 OOlGgg W-TŶ7*r#{(Co~4GIF(Dt;$.;/?%mAKSL-+u0ν@m%[e 걷ӻ v9SGmG'F{PwGmWE\Amhlx#JX"[*7Xҝh>/ZCRNa8GM$y Licn {j@ڝD#S&g]lo®7%Җ0qs^6њѴnqQNO3s Xra[QKwwqS1̱PᴐVH0M,!1\J]d&0.I~acօ= eB__?H"2G 9f'REٺ:.ĿY3p~#_1H\Ŏ nN߆oj^hS' D@Q`Dq cGJv;iqƯLJuӆ-K3pfJYR:Qn,=QCx' gð.DHU<վqkU܈eH9Ķ*k_7讅2,cvRHa<8|M&.$zYԋ yb5OOٟPa5{nm,C"tmp_#%#67'f4Ju[`ٸaDp"V܈70,Fժx'Jqn"~O`\~۶t9zǙ~M?x4ê4ww\С4ւ8%|>O wdm@s̳.[ m38򼌜r|lX& b ໸*B,[3,Q@@DZlzۑ]`! ~$mҽj1@eخ ҷd^Sj*4\xgLlG% ,xٱHN#/;} U40BK]}p(1D:=Gn ꧀jf]H;  MaУ{v\ U3Z;h$ǣ-+GL̎)cjHRLwuKD_m1ӻN;y$|&]22M:H뿚oqQj4ү.%VK3$X90SI"q=Nrvϵ-F;;epߝt~p '$+ މ\1k .kM5]>Xr/Gbai TǣX|дiOmnm(v>3HpR fX-wEV|yYElɬy`2لևU%2mnmXگXr=CwU~Sa$e6)7ا0bt~ae{ G*\woT$D)$;0W+, 3yȯP/Ӊ*eۆH,]_Ur]놄2&Eq  ]_=Zc*#(|i;P2 X'k]b/׊ef@ez/lP,aUxJT+nGFUAӀ=9G(hj==kh ~5B|qfa ]9.׵GJ b (h묠yf+_Pջ/^J3 TNK8uG^R̘:2" ;ćs*d(9iDŽe? N+ۧ;Tr ZCC *lճ,Ʀ-GP^? BCD VbցcD2}- bN{FJ\QeKg\i|!7$0qzY#HW?>Ә m=/~/z\ժ3q't@ )W -3U1;QC6K^5*ej؝NR]Z9ҭ{?3l԰Ab\@A苏s T_CuE|›wc&HpIwZNI&bC[9M댢EMJ̼k{7J)8󓷐liQ~8:lNBY8ZtT.U{hNzs?H̗P]h@(@#`e<9p/ @'ؽ~XڥHī v폾Z,iw75?DF|Ou5"lY|Kn.3Tm"IFr ͚y} jQp y6oMډ)qH@dEd ;}ij=樳#xV_]0H&{8b|9c&BG/;i:Kz(=A;CAO_kTwR9+Mj4(t랞?fj#Si6{'?N_-p1;B/c*zM.7V.'ly>< KsYM`/\d;V?qB({Ò1qo g U3j57rXx2\/4q&:o\UO {]~ *?nի'-e99$V&KfdKu}"?qNN15(1X1lY[ t[7xĖ`ebTQ%X=& s|Z ⸕\.y@2'ss,+E94V@6D]S?9?՚?F>>Grמsב0Oi7'W0Qc'Q<|u.w6".tOKƘ>avE/g7E&$.g/}'ƛ~A`;50+iPix+נ!%)Y~SuD"1V/jp5xdf=*`̵+)lҴ(}ꑯPQDss7n#4pyic-+%,M<⥝j`н<93Yg|7+#>(wk߿Vm1z`Tƣ[.Y}UЬ3V9P3 `q!*Ц*h(8K>9Bv걼,e{4rz3Eoj}Xlٚen x>yJ4g1Pd{Z"qWQ8l-L6dZr;̳_ Q:IH )2NME>G3GSDt8T`KkG؋?JEolV$PhR˯0gKg IƐ xĤgUmY49ښ/Jz "_U~ˠkk@ߋmZ{2^mR0-T2 *|EZ<\wBTHrC.QH_;D@g'.SXI{uXlٸ=8?oi4h.W^ S@C(¬<U#N8- !aHWH;?wOjғCd\!5>3닀n=6'F}R9`c5 $dс&94G]S%\udb[${[:?c;45UzMl2&oUKW`[K#k*JRC7tG !~+)\lP o|^RF( Yx qmQpNA Rp X_@A^ /'@PENCkifٵOn$(d[2=ӳ;^bi` LKtBB3 ql;J$sP芓XI9z:,b!$!W4d4\0*/E: `y,F~ GR1IEHR.c+3X(MiF([lݓd4A>IodʡrJ+jUnկxg^2,ki؅^}v,omt2ptk0%\ne[.JgI( )oJE$L/2P6El)(Ξon#m"CYZ||3ǵcIapT夰:U7$FV;;ktoH"(q/ַg GCϠJ[2<"W N uPi/CT&s'ewT8gmG {+3:=°Ki#B_&7bS\-=VUU$K-u!{Kջ;fp;qS|'7~p=gzKP:qLRWp^ #1tX%Ac-o(Wne- xor#'QpeoX<N'nq7dh:%P $,Z%\2P)`waLgNO$# C\aH)d^&-HCBntj{_eMNXDLgJVVWrU{v q{wg{jYHV6xx3f:j2b-יּѼ0ָ7)^X ,:?!c(FПnB[ v3NYDZǜ%|.AkZ?\JلXv,D Ȥ\\!,+0sO 4k_&+eB;dR58H] ~oQ7AWsfʶkSOah(D;\.Gn"da'gE0+Y>7")ެ{ƛvS1tҀYPgll S~rLՉe2$[l=t][= f4uLkcLr -AiY}UrM$q-Z:q4!B"ܩڰ6lv'ַnF0gIPP$`Uq^WlV?Id3nmJ}ϨtF_v1`\@0ZM[\VPc찡V#m"W b S:O>S뢻D %q]\$@9|1I셽"/}aZrvT|R˺!kj3ݪ`۞#9@2tQ]0/{%\J<4T`k~I;_ M>\Ϋc~]%7Y,P&6& fv'C.rxzyJE}LgZ )絧S-ؙ>:%-GG3py Ll߀.jst)O%f}PExϒb aC髟XG%OqxK#M u75s+r YʑLrh[նz5 {1p3wO6 z xf*}j&r a?3 '38vVp*  UT5Bp|N[>Lj}d(]T5 .ÍJ6@]9F)!/ +{B,-YXieIT$Ode걆<]EcKY@Lon󳷼"Rx3]wgT }ɪM-Ⓑ$0L]ʗ<`8pQ˗.{8ֆ#rbVEfK7t6Gg+gՍfp;άkS0i)ZGly?Yn2ieӦio` X ضre'{bCL^6<_)J^RܞPʊ QM¶ v#n?K4?M)/16׎*/eD*G'Fطtwj[(+C8nE&zvx$cy⃖ʻkLAXV6jy#f cNFLCtdxcci)rp/ccuC~&L$%i;e6ݗ ܷq0L'y0ىy~`{oBl5e2ዉNTQ8Oߖ޽HE`\s׌Bu`uFjvm JWF$l#syGjU$yPGݖ6\ђ%s8+owO+߶eΥ14T^S nE$Kנ~ڟn(Ooy-Ƽ!:-zQ0m`‚Nz{a2^v#RJjP8- [Q=l!ݐp8E((Ot=G,Jy`)WpH/Z.`Ȝ>}vA{8B=ٳx@&w]= F \3[aq0M0BzN w`  |{@ӕ|_C;BR˕nIeW/;u#}>5F6IxJt;_O,z9}n2bPMoh}gB=LU>Kf Wu3oO߱ǣs'het-7z^>)8B}{6]\ 5ͭ>":%Ȧ`kA[rVN+gO۷*cpvHyTv T-rND %8}j_P>T@nf9eI1Kd{]LV:e!=9,F =^0* [T}ɶ=ɢ5g.9*2ܒO0 ?⃕yԲd׊8.wf<'ΐ>_ h(xY T.R7|g0.m8m:O-S?V|HHU˄R,xT[/ BJzëZͮ`|?t=(;5_Wx#Tn{qTZ =OGe c,O&y_p -3 ޠ̬`t%,X'd-Y<n6(!^ɍu\_|MҺw)^_w&hcD.NzI~a6Bwni[!gpBb8yOҴTQ>(=o #uj#SlE?x*O]p.$k ׃'[`FC-+|8 ?s*+ĺȡq!J^ tpS>cDp(ZC̲]XFI2>Jk-n c_>Ĉim!(ti3LztwITG+(a1fϐeX# x󃆧h4QĒaFXɣȪ27G!lp':A+5n%>0wr4!!I-{WW!_zGH>/49QWT1f։ RsS:Ihя;jhOfl֯ {w|䑌.iiz}\0Y<+a[Cv|Ŕ>3nwA^&Gn-Ji_vT%)*)%G(e{eʹ?0 쯩,yɩ?A?[TN+lX)y8܁ @`"ALvV5So4xS9Է4վ{ EoAME&?Z\3N-6T S5,.?BJUC.c*ϝ)eDuԀRZtb>0S$0 хB@7'4p~\4IDGb usGX{z Ww&;hLhW 4 CjDdc2";=GvA)I (BIu?:b6p Doî)Nἀ^gQdYl]ar//%IY 7gmP0--[?iãP60]'º+[cs!?XS-- [*~v&g3&G"=2z2gH 0$+ %ˋ}mfl:Iꏕ| GY>D52 8?9B ."Ň=k [,BNβ6-^?^DB[ܽA.ďom(T'2-?ӹ |HLNa8|!@:q+4WY`b2DGYE%`ᾥRe \PoBS{Lu!iuS]fYf¢fRgM[fݙDAg(}ɘ$-4")v9*g]F$uBEW:KڃNy1+y,1aHҔn#cwJ^Wy_4bn@'bJ`e(V8EkJ)`ZC߃h{WRԴĨKEED/!>#H P@C ;[p:ؓ^k\ZWQ wf~ _/9ZP#χݦp_yֈb%58鍮#J hɍ$NZɪYj u`y0hQE_/)>=,<|(0 $0k@x3U,KTRJUvijBvj#ESWҵ*F:kvl(K \Ȅc&@9 cgnzb8*Y2D[qbDLF',15t䥪IO% CqX' wu .ܳ<"#r)"3_"|1YA>EߕT$}K ffl¥Y!=bx٤7Lvϒ1 rib " dR֍Zki,VzsL%xy'Bƌ\X:` mTXv4rNi6ͅ'Q4(2#) \du;n[&T}kev@3?_rB62L_YtPgq!@Il|DօU{аތe""=*WmXkGZ  ft -[u^-0Ơ4]]&ejXs^4aoޟhHnj۳QɧD}cv6Qi8Uq`͎lE[Bt,[əd>TPvn&B`w^ ZVݔWc70--Wގh倅]ph b8.NgY;Z4"|g=RonVxֶZgrto?me0[e"NA&~&Q{A}=ۻ |9׷t1nuvaZ-tل W/ǽ6PSxK9J[]u@}`L;dK83#I耟s I=-8-w/B#}X``+}?& e0!d Ao hr$>{vA{6.vǼivv(@ RU_\ rmₒ7u%SjYx}[%ۈ4αhQowEEHg(0xVyLBy? ^7Ĭ%efOa'9"c|U ճD(ϔr􌣩34b|Ϋ$ּoM.;eS@X/oZcZԦma,X: -B~zs?6WrʫS;wzMPKLz]Dlfoe}{D|a򻂴Zq<'ݕԿ+Ɣl=@KͦZcfKc:{Ti6!Ȅf5&0 :ʣ KOO\,%hX}TP>E>w< |\*mAqR,~5rXξ#q3|kR?(K<@Y/k(쳽2"G|pGzRt*V٥Ӈ6~ > `Jqv&-!y/M6}rÍֵbO~E>GՊ50M.5. '|'U B';˪9RTxGYa^0̷GʙhCfO/32[[fڀe!V'A*1ԊUH1pbq1 i]WCf(8q;N/af^ Y9VKJ'54@-v&GzoG-xSB E}l[ibi! &!FT.Dn_uw'u) %,oӔV+dv4ALgACH2.\#$4xm:ɤJMGk&A=pML+sDB>!t , :XܖdP}0>O~w1f%/Pk4S7o:+ǀMS5l{cS5FfFn])yn{Y.s$;sJ'jDu?"\vLY%m5)t-^H(c5QӾۮ%H܈`jTwe(߳Ga3q[WpsxeyE@2-2'۝IIl oA+PCD0y)4[ro=cgQ\t ,uB3V@)tR Sڻ2d5䬲fqsps-}wP/{=;=z%2*RI:. WpcG悩}/]_5}IxΘ]ȍisDNN 5A4~gZSpKP(?Ym7f }(qR*IWOf >YˏT.KsXT*?lrJ FrHSx^ͪ%ŰC (QۯM ZXN<̑ZodDxp8N2M9lִgq]ZN+Fٷ[GP29RӖDCe?;=r8ph7 UK#`Zxf|XTw4hu-?g<P5SVnK IlyNV tM3' \ <3Z 6F{1[@?bIHc(Ә&F%,oQ:o֑* -v6#|@|C0@9\v,Pa_|@R>/|;ow;!z@8GjQ8oNxj oM7Ӳ5DH.8Vku sz^("[*(e>@)":0OR⤡^1 ;@S'ٮz=WAvҡ ; K*sekjNb_c׫ )HD\RA~X<0||:SuJ|9ڽ"cB):qOqy֧kxM8/XP }e9zqg#Xz(9- M!`zozg? ]ϓI=7-^&,rc-!K6eWlڈtHcSJ]#[ZV!@v(A O[yą(aSƟA`bmOy,nϕJ1ҋƸQnlO܊I,kΞ99u !Tm4G{ bRُ6#M:_l-s T0FH)</`8u;\dZҍ5C̞%M4/zbMG2ι|s_PgD\blCNTJ#F4{Njp'X$S8xwj8 JgE[͍tie@J$k}8_aύJZ 2$uB B"?e=7R SǝcR(jo:RLjZSRjFGu1hʪr\"lubOu*Йԭ,u3s({Wa-m[lEHHvO=CrU\pmL\˜K]{"q$=bvAnఌxA/E}31xg@HA5s%4$'=% !PIՖG1yq{z,;`Zusn̵hZMLL~Kl 2tTNaƯ:4><<8ڡmx3@ eF~\7nIVY\>6pd'R6٤Qf`\dqfG}- ^l 6o^al L%[MJlCtVFḻfʶ^*6Zt4Y<%oj/@-zT{P`f L̥F%'RK\ս3+| ےej98uo.vj{sR QaI*mVWz~ܹx%x.\N"ׇ-f[O}qA u6wLi 2 hzrCPoN۫nԾ0:A@ ?tB'1l[Z=g]/{[kظ6hK&f?(Y֧V>m6)fx璅/%]9"~ kT;<(G|Gf҆OH_a;lO8ƴcoɒ.G;7.QHJaHlW)ʜ[g@4$|:$q0@La8< bE7JJf`"F&0Q7n vKrx@]a}D7ȥj(-,ATװ ;){Eq;jY1gUF/]pK*7[iv?AucY5(Q*AV̏TTxj,z(f'@AҎRrWڄyqOO7LM姖;k#N yRBʟyଲ YU|MJt@O[q 98 b];c1%6v+ L0 xpCeto%,X~Cxo2h8pOʟ +`ȔtF#(ԗlYeȢW&ez}8?5ks"8Na`DMSĆwA=EOxNz~|m:''vz/r# -B,I2`؎f+糫6^]iϳMd(4_j T.ӱl=<;$5ig.nɹLyuoar =ADƌ^C&UwV2 S)7ĵ @&a̫諱i /^$U|YF,9 aJM;ܘdpk3qG*"`6N TOarٱ}-n]T;([:`Q]rQ]j˙vfa9wnYma}_Q|dvzjqWZH9gC ?N?'Z k5:Lhkw2IYrSbzeiǟSWs7(J/s3qO㖥sx+B*lo" ?kP_#r930PXF4Pu8t @H@Qrt*Sy=_j FB"*NZ\%'pBb ݴ,~Z8ֽ yv pݭO6N\tf? rYQL Տ EDNL7#ƀ Idk$^L72ׯ=cf'//-hvgpjj_;3l%hSD|x4EhIoQO$jc 1^OY #@TW^Ml}_ U%`qXm<6?2'5dž"6E&w үVx{_ހuk*Z,raM'9GTS}b%UGU@z7ܝL/WNS'.O!7PB&Vg}7{_#=$3Sm"AJUWZd)QKݞOm|!bF9UЀ >!},>u?fO01Lyc0;AvϹ.mUrYUn:b=<r!Y1b]8<V]WY!=:Oݸ^mg&T}ذ'lWI[Og2Ԩ$XGK̂>xQX8w޽qfplڑ6=BN*5:_ܟMimZ;&N:wyzI˿o)xiRw03:RQ83њrVta5 #%{2gO! G],`OO427iїe-/[m%:ltR "ńLT̓EAS|1XUGzV8g"#dDQ%Y^Dhx$ [d˼ BGG:Gw+kPKT |ln27Dv5fX&2oFlZRVn^fҷ0fF^vu4!F]*>1 r|YȦ:;d̩jAxo y-Ru/Qma1^[lG<2VwSE!SBU]Ćx\;Y0jSQ,sn.:iڳ?>jJӟG46l}hT1ۻRPf>h]dذ Y*SKvr/eds=؞/փ@V/s kی.l)dS\ &YJhj83 49ñv!7^TNNyq>g?kM44640<K1ʄ? 38>׬0_S; Zd7:0%rNtϟ1_GE<( j:ǣ/K<ٚh;. r0Zd!|]t 1`YGdK};+{.#/@^D81;+(%#N3H ^?W+!]o!ПIUf3hO-z'D'f&1aM<|I!W%=͸g{ɹ[vm"tuEﰊv X7l zS#ȸd3ReO5K ?$Uґ 'Gyjal:c*awZLL(aȨ|rt{YkZ[M>2 #Fߴa4+ fP(fh=)?RE(ƒM_d**77H_߿rH1ZYmMxe|9ZG8'FdEڟo QIQ'2V$eey^~d~"8أCDŽ/W"O"sD=Ոۤ NTdQͮP Xdᮁeem9YCؠNy,LV#!FN׶:t?Ƅh0_~~F?qŽD|oLAA S}ǼiYabK%bPL6S!_#.KpLˠf8tÛO4)8VxYMܥP~%Ԫk9*>=Kxp>;o5/$D,&I9)Lg ( ,&4V.\pѥn戜)U{ y%(M`m[a6oHZ`̢Bۧ(Jv@k EXkh=h=n/ޗ O)Qu`O[=#F/k\iN91 VAh> MjIGT 7.F?XYJ0K: +~&l3´{;9&O@e9 `eU[Q(eu4mg8X`? I_X+K{'Ԉ S{@ȢbKjob$RzܥDxӾVI⑀޽{"|oy1Oe˾V~4|{G?UgEWq'uZ q5r-1DE=&~tgŕMAT@D 3[:?Ws{puwVU)Cӈ4MbrO_%%Չæ)$n 3ߑ-Af` xrui"5"\6kjr[LkګܔtP6XC+(}3{*Z_h2߾SɲH O8' _ѕ4t#n#ŜnҨ79U WFJ\QG~ʉ f4^f1"8ɃgLl0FvcyITux#K+C*`e˃QFKds gqtQ\D[N&`;$9xuo_ԕv8V7m%~0G)BY GFzfb{1?&&gɋ+96dkc?az L~g }͛ ­$pN0?4m]|- ٮUY9LA@u%,|a.߼k?Or&ܜ>B>v*,uN[+ÎOUѫ߅fLL@֗rCQD ^{sdֲ;G)e! lP6P4_j<&Ә[39\?MLlTl[](LF~B ZǕBM!HFmvqGF4ihuVr&.q/i̾ѫuWE _ Pk jikB4\р 95cc-H'=54QR"vԮ(H3ҭE]>kTG}+^ Hqe0l!lZلWȈo`$4:Z6kRmaLeCeAםZ[teԋeX8<+M.WmvMsXަ4T=*dMc z a9(}9zYYCX]?In :ef"jijzN9Q/Dʯ:%ӣSa~X'R83[0? @l"|ў|'.%E!K”P3 ZT%|4z;w+L B=ggrm IݹZ=#[*8˚q#+/8h12~ƐKrVݽ[e%e/<!a5*6}ک`k(H'%!'h0I+&!xBNVJe#J֥Н*LV2mbt+خ.}kqΐRɾxeHA?H|0KcezL+s1t8 T@Sv,]qz=),ˍND 59@orn,]ʁAn, VjL~d+EV؆…dNfh-ݧ2qϫ,FNpU32Ҁ(e\t'SHEze]RvZ6Lj*xbEr=Ѳ q-A1Hh8euZ79,L5lJdjX P@l'(;}%<]S"Vog >a\ɧ@J?Y4 1@ W\ ozE(B7e1aΠji\pH=E~n/Bg;j%s+Pp^ Ϧ6WK#gkwrYk@d+jn\<~r&]jAG}!4TjdNfݱZE.Lc@_۪|sOOl5sH)áfysȪD䲉erP jl,L ã3X~$;2vnq-^*,;=ݰ9`ӿ}Sm) L6]{um~?Dj+$PDjOTԱ LELל лΗNZ%=LxSQ[Qƙ(fl!՗QZ1yuWk5A7uKiRKΆVe@9pA]w[hOa_yYUдTlWݟSEwC7_y噮~]&nkHR\y2h`jp02>q!c~XeŁ`׫*1cHbPƨs#ͬKϜ .n%Z,.`jKk2dna*鰐b)&k~4I^ħ)WV̬ vUX]K#Ӿ2e%3TB&GZ;zF#7z5TkC(,CcO";uN@ $ن:?7>}P&OZp]-ҹH^LWFJſ`\\غ }13zdF>ZmuܙOXHP v`/jjM-ʿoBP>8^/Iʅ^[j_ ;aO4Lkj($}^\GՎ Tα\0❄Nzҥkd7)rDYҳSogN~w+=m7CqEӺmeH7 -o15 utE%aft4| ,!'= A8=e?tbHextsDz_jzOn jрֳZUV[N2H)Z )|zv  U-\ޒ-ms*U0矙'Sd`ޑLj0[>'+ů8*u OUMM=Bﯪ(35] Ѽ&MXJezhv,Jᱎ6&: X/1rm-hځa9&Avۧ&σsZIp>bv)feڛ$n: 2[ϕ0p(Eis)cB1Dsz!}L5Rb7 'Q])tR"Nѯ+aМ~Ȇc[{0\z]ukj3bw,%}98} ?}XuH%NN|-sf*̝ZL }W6ш*dfGHI͙87z5ibKu"'@D>ϒV)e͛6Q_:T*zh#,XQ^@ .u{]#:bOs=2y %dNSeNWT;*Ejxgnl g4%1q2%%S Nwv, ]*-<|cxGư(- s*ajy cf`%X2LݮC<٧=`mAs.UNm֌CQkX_jgA7"=BOkR:|u:Wb>Bg5Uwa؃Up0#{#$Z$3{ftpδkDc`-C8 msJsOB62F9 gN!; RJ+H%*t #y[Z @~/qUVR~ʍZ$nxΔk57PgVZ߿v( Y6n2` c5$S쯦);'Q@@J8 GGMm%Gھb&hz^-mƩZ=:1UN,W2p>Eàa/?Edu =UceRQ*RWrr43'\%tうPjY0@NjwN~2 G8TZZp#ޮIK i HI&7αHAʅD!KIBD)a-4@-H|UVK L.7L8-c3yaml_$Mب.fv#` no?i{Kf:S:!ˑg s*mg_z(8Ze$ey}F"X$PCb>l;1RQk^mrem7@ !5r1^c8 ̃;/XR252GKYZ7Hg c?3FDg!-&,MБwA~2J{V]ir9[u[=Z1f}k ơ< DI2[9L5OdT@=& +1*'…%\I;RF!6vTo)Ul U 9o Ǟқ/X@[Hˇ%~!%4c׈v@m &N8o tv6._UjQzyLCXgn 62-@G<#-!8@SzLpR%Y 'ڪE}nG"T;Y ht^ 4;U8n:{m6SaKd5:WNS4m@ffO,=@́>D%@37[78k ?I-MMNi (1_MgCC@Axö GGV5wD$ɳ8) SHqf=DGx5[2n,/,䘐E h_3e~~;0%Vd[CGՓ22wq-;)AEoȋYxӝiq8:ϣvgªvhXK21\KF)~`;e@`'=ˏs|#ꬆD5)NC}+sG{"w CD%:xT~9rjqJB8tA~&>O JA٢ *Sc*">c85mfA'Q+Hh%hU# #`oh͢ w7 ޵ސ2K$8]8_amtӻ-Lt7{-%D4YyMܡ:4zQܽwqp2oG}`grn# |iEwFÍM~(߉y'Ւ0`Օ11[%KJM&eXHF Ք3#/q>)W&U6'N+{B'70%b btEw` ""VK{.ƋQ1` 'Vcep7,+r. JcC"OS/ 4[h  c̫!o0@P݃ݹ\%Khq<{R`Gs|L}S|25[e":"@1qZ-:Y0 U;VКg$_W#!ʞ-tW]Х*؟o^1~lWd|wtxI!&j/Yܣ]VhW+=BT}T\P9? qtR"{C6/X*\F c?7[[ Z􍎮=H/[ ڍF0AWܣlȗH5iIKg PG%Z/09Xo0c^1;˿ʝ'y@|^'e* IδlAkm 2A,qa)2̸\R\H3C $bq+We}:;Qi=E[UM [דXtimeQ^J@ oۿnEoåeG9ug.mڌONQb'̣@^ҚUVg% ~m%nާRS(:ҦQ96lwpfvjkj#Out.MC<mDQx`\vvrU:=z"y T@='ָ ǃA8 AAB!gucm| m%lJm򞬮DǙcFquO(!*&B&=K-b2qX_M:L#/m'p1p1?ϛݔŕ@O/ifR%B!P}`LniehbARcHpM\XѨ%DfS¼77 wT_%xG:k' }.eN/e, 0 3H\B0R>KxQgթw%:+˚S i+ ЧlC)̓и7Hu p#9F[!d 5&ci !(4KGRZ"o*jWOapPo޵FX0J%Y}}k}"]k,ܛV8:踽3: 8= 8ފ*-kHA[=_}5q`vɂ**~Qfd4(~7lh,1C5bD2o9)Rw"[:ssEtמoaEeG$VR^aU vo?X=x akb|.vr O#z]G5f z ONE-T,-?@WŦ(.7XE34ה(c~'2VKhY yoxOx χFlu8E1g͢ADx\+m$gjh|ao#3LFlS]3Ȓw;i{\EpawKE3vrܡvc4=nG`?̨i]}?FJ#IhFt\Ԋt?H30S-5Dx_6ęAIh0*H;ݛ0ٙ=ל9)TW&eP{ܯF_aXSY ;|ICjaA,wZMz>Z{Y;Touj>9AmzM=en7&FsG`^%ت}ͩc0BNvaO_t~BBT) jGK2&4܊0$H\Px^EaV>G88ČjlzE_K&]Ucg$*>i_x|%噣]ZGIz"EFYT07sVzU\~8!KUvY)"S,^t}y ?l? G{!}擔.9(Т|Oь>>%Lv zxcWqKS@B\+۽neobmš>Y+ q[㓷1_5]V4 'tdcm/lf$ybf{#92=ȫ#b?kgac@YֳjQa͸ۓ!uf=D]UPJ܄cw{}AoK&3KšɣSoNBY:ȂvrMR b`w &4K0\ۑdSB@g9S..6j)Ϫ6:K752\(t su }`0<Oj&8){ MM]{$R8vߕ1bܬ*dM YÜFisd*dri)gC Qj+)w礪AɛGq XwO$5 伜E"Kg֬jtF360o4ML{?(_^M:qN$;O؁-iv\QVh\"ٰiylS?ݯ9'0 '7*:d4T%-p)S4 Ȭ6/d*j!u+,o,nW}yN9r/\4=_ K=;_s#b}oB/_sUNo Տ-3C/&&\ Q GJ ncD~ǕRO3˻{lĭ]<9-g5>0FAwuF Hgp43U"ѳr^#M'3u\Ajআ^BgsבZIN?br]Y !$'n3좗UثQS&k跗+8Bn9~CFQMLySOK7=Gy_*3$/X7D(Zz4RljEB xvdմ_$Vg[㢷Q m}:L$^FIolwfрN`pEZeVoFP H„_xyF5Sg>L@Ak_ܨ^,E&z־x&?Tt9^:1{Xtd2Y) gyPmg8twRܬkpc/8RbXW|'Ņl1X;8 7֔k+(M}!A#d[ĺwX޿^.dY4% 1ҾEĭ2gK05;)\_mg\LYN<$=^FjYeS~=A,-닳҈}EaEMt\A01UP|5,<R:Gk\JLGAUKJHx%nS;]MeEjfγ BxPrUo{7zg Ϟ(CzR{ ڎz^(6rS^TH9am7/x{YG7i:;8쓥7/Cyj>L{󺃧}dK:7 ZS yG,6~Ӵv֩-|vѨ u$R>8BÂ#=y'Pl;JĞotsi<9+!H&I:zoX:rխQ}e ^R5dtE47f%=w/7sWb O5嶽ZNσ1@߾4a>dpT[),n g˱Q]obC8)d> )uSїwYë]59!uJ AEU:96lc @d[0VvO=9^H&](O刘AwIٛy'YNL@zӦ xSC1SU Y<x5F2N4@Z:ѽ'+ԟ5 F"Ji'zf;WotڐUPѐKnj"ĵ_=񏼧<&NC,S3}`M!s(ί匋Ң#WAAe6X?,{HiY 5pICN!e.%ɒRyP6ivIӤ '9 đ+SANMGrJN1Ja?"G PM@s /D)=+?RjR>y#uoЩ('ylHXW ^eU ksVjNFY]EU7wnl8IpJ>MތEayQeͻ篬V/NI5{g:'ZpH'1#Zz;/dXU_bjOyx)Y6VfK@BP9)RO,4Pv,@H\EzнQi+ ߁4Ur#d^2ʺgg% =3P=|3&ePFEWK~7(l,HT)4Fؠ \7G?}=ξhtmB_n ւ-BFl)l2Fn+MlRݲc(I&` vRR+it̮;2Hz :qQw*yg"Q6ۥr^lAgJ,Yw1vY sj6z>'ٙ\R1̖ ]3!w{X^3p#Z/8WTuK-zAHɏ5$U3r-KeasֵLMY#ȓ>H)3Ƹa`%yq`mF$ehӣYg5×?>nG'7w,%o[\)qsP?d9ʷrVv0Zzۤ}4s}$$yh3޻>Y3YNH8@;_HBYuz}Ь*L$kltv{`#44%v r_.x0+BV/ܑxColafܠmRj~4wá0J^R˸`y dJW~OՋsNUn"ɷu;۔e9#K -4 yYIJ\:H[{*yF1>Na/$jͱz8xbPtM/x1@wU=n2zPSrr`kC볅9B!BwuA{W}VӭH2Zμ {ej>Q:qӌZDzk Ԇ̈^Wݥ͕ȜM k4m٣pd8In$ "Q|7mU \Frǯ:^b#|kSGҹɊ|_ΐ0v5_i,VYlIaZpB}-7aKmӮeH\*v YdS=ha )tt3wͽS2Tė{[r-=#,Rv}9^fs{`t*r ?iVS9v4N{ۂ`{dÓpDnU"X`IZ6,d֙H`a<}\mYl#)(ƴAD|͘Fw'ďNџMtF'Ua75RɏпW<6S+[I]XM 'DyЮO*, %\+פt[yxpDC{ó5ӊw30&V(gؒJ^Wɿ()̫IEDPhh8KhFͳ;EFA@,T_{|G=4qшJK 6}`3TBZHsIiua8Kĥ?L[ްsɃ#'fi"8:ѨRn.qp_K y L%gҹU8,v̷ͣT9)X HxQZFO$fvua"u2 'KTqT :iB 5wďuYЕjyNkkl, jZzc$t@|qZډ * vK ZreS k8rM|m)syo>R,0 v1w'9siX ↡xZZJe l~!H&2iRKCrˈ *pi˨VL >Mo/qHPG[4I";dI٭P#~F^xw$q9LQ*6n5| aTDe'}/0! _KS1廛sݯH]Gg?NȘu29^'5l qͅAXm 5KެN^cJ=MGۃZP -%}}5C>UV6gbt8`NC I~K*-ʱDcd :@B@x 3H\ ,#ݴ WJOs+2|8W9Du=8xg%N⸰t(0zʹ6}|jq@9i/Įt}UȠeR/4y@²*7̂?[NWcƷhݶXGlKV^;,.L'4@wVުs}\Hu?^8Ng Fӝ|o+e&eZ j|n+#KCKմZQ+v$ϭV%\F9IdLpzf+Ɩv9YhJpsXp$`Q*NiF;֯8x{&3=@NRґԼho.J++֋Y8_ NB: hXpz- p@_JrJz׃8;7a l _A/vr`´"[~oUteFU%6 ٜHЯS9lԻwc|>_1_b!]fq FΘb  );vv7kpg!r 4mHP\) _HPgJɺgOSJ/ݑ4tB/tya/;f` q7mx0uv9֎`NQU)aOB$*w*FXn7ed`BL 4#ᑒfNaYH)\ҖNхvΝf]iX#Fzi|5.'nkwU|}B9 r̿xe{9'T4hVk/L3 y6Do37D{ ZuiiטR]3>꓁Oד`k4:xI 4SܙIT!;u %PoGk}xH.[ ',⸸wIq[Lm[hgc7<7*7| cϫ1YiSi5bM>ɖ?8lJG2G<< :P±욟IZ۝"K|4wjlJ~//,zo?Nd> ]/[J~#dmmct%<%GgC#x63bF33$MS'Q6>?r^I#^(\y'82?%( ^)DԳ`J"/1œ2.RV"x Ύo ׋ϏG"~_4'+Ӥ<[=<4Nl* )E3"'{ q0(<.8X1.ĉ`lE<3 XGcYoFv`U ]js }t!t;˶fwԖ ĭ  Z«/23]eiowo tѴ(0uL9"J?MTb?lTt3Aw"a7"#=Ky & et?~i? ;x51/t*n( Ä: ߇ .( bk]]6rmTZ9T (+fK37uJRWc=7=Nr=V.f64CEx`MFܨTY'gr] :~MYT S.՞j;{}OO\Iz7^] p1!mXk|ۏY 6gXdpÓb o&@\=S *B!J*c@;-' yMyLpotAx*#`YrC]{a7Tz<])I? rR3_bDņV5 1XYTlhv .bRQҁɂl<$˚i7rv|ѝ+sC"u/՚΅L$(H%$wTňN =Z'@!ed:C EA BI Y[Hj,{:  DolG]fҬfcEm|J\챒{`/ƹOrלTڔGGNx wUqp^!Ń:g_`M"2^@?<6>]rU-L>rVm SbsE#絛'}0»;XWB6xB6y uη IVt(`rMC@?b'4Ee$cT;Vj"iϕ%3BEX}fmHhS$J^H0#-R@oA &{k7"E3@VEUiyIGafTOvĺ{lDUn:U x)i`##x|X"v?1 i`w#j‘HC<? -;+zLW|rz ދ 5WΩϲ{ZbNV S`w1HSrʁryGag,93| @'rM̶'UaʎLמTdf'<6è]eRl%-b:y .&=kk -#aKZt{b MmfTC Y:ݏ nJPB מY9Ϥ۶E;F]/ԜD6ʇPnλ( 뿹kl1{Gz/񘊱\O}'4Vc,`7G8i02R@{Ƈ<i󀞂G=C*"Op 誴w|X̦7b{5^ry f[Q]hxwB.I.j ԴUfOczuWqf~0;F@%iOa^ Fy@ief.t vo~^)Ñc Ǿv[ ͷ(im:ǛWMڝM \-v[ʗa+"0lz^!>Q+~=_3T,F(#VNb]7yd?/{u|+;ҙKODϷqN&`gJ;rB̅>wL|KJ`\hA<ָȃwcH}-!&[7_?['Z}ѱw 5XٕgԘgxU Uu>˫ u4s8G)XRpW. vGvRbIxFFZ3g)Ƕ(O!L WQHEZ$8^@)-9 E`?kaKd=uZ6S ]b_UVN߳ÿ88VBRiCa[S\=)+AU1Ja?6R({ԕLc8cWΊS^ER5+]7(J}R1B0M}WH'N}8phW@ 9哋p&v g,COg89 tj_5~Wˈ* X&-cd*h ʐøvǕs=YDR -w\9R?ԵQrKU_U[C76), X(6>$TEԬv:MaCxZ/ ~WT`s0|Q$}]m MqK#9!M qR7ҁ+7x* %-e>AWS5~:צZHxj$er|l+SVF umw&8{=ؕC_S %oPXh/#ߢVv}uVVP܆vA=w7[?BI.糇W̴).dǻl%U oF=á+;kGr0轱` |n{lҺţ.J6R7eO9 IVF!ell0fF9>7-Oݚk<uiF8 q*">=mH_ꝕ/v@ι(bɴ~}g7x[yZgaUGv"&g`*G Ȍ[) yԍ'ic;0*DEgci "OAQͳ92$vAz_M']#UЛ_ŶGw#H\Ʈ8R_xBVcbo'CjϿN5 _e.y]Y6xC#t/vkj.A`=l$М#6$j끣llyޒ.@#C8+j3A<V jG\L?]vmVsoy530BɨB}nG> ]N,+ȟd\_?RJ4b[6Fhm[uM|W0I}$Bia"r nCI?+ F/*@`<-}e .pwЪj@t53JzMdA$kn2  (P)bޮgpsF4iut=0y0t4WM`ۤyfm[BT[N作 _ko/| %$j O6ahs+*#աe [tq@~f'0=<^JC X⽷zE B yAA2xt]K d5P9 F=!"dz9pHS\Vyn9 -w#@x[vMӰm ӊUJ|GH"A;RgD`Q B2^E+ntkLvPP '_$sH[chG+mjZ֤AcfFPT'U?| o_%tzgME8̧C]IdrUԃ?kjI q~ *x0ܺnV.AcR,gA=cϹa5ͬ Sl[@њxY_’1SjmoXsSk|>" 䁿eI++ *u_)Ž"9mnw[?ͅy! VWV-#hW}z {wا cez'Y]q\^mc(i-S.4( p_ebg^iGM$&Rtݥ"[#N|14uTao] +qk2e?;CZTȧ`@`w0wS Ӓ6SZtj? TI7c?jxyCœ'[{ %N@ 鼑ߵ* nЈ4Q|e c 1J195e^Ӿ<ߟ%1(KKVdGbK~'1>X;XL•5/6oJMKț&>j'Y>X1{3FJ&,>+._ lTFiB"$ǡnW5`QGF5POky[QJY>/PkhokJAB>jJRj6D[68_2{|REV>F !W;5>|?؅Eh@T肸@y@"׎ Dvxl9 ڇw]䴐6"X#p NYL EQ YJ8Mo|7U-cg$ Q[odY4kA6Do,< B Xm$‡KG?>y¹0Lwni oB^KU'_ix1M9\T#zlI#.IӴs$w]~K׋ jQ-2LC_!<֢ 42!8eU)*@߯WO 9j VO4g ֽʵ @ѢE0aevսSS"hiET' ͂4فI z:zXĺxp^gaJU_.J=^A#]c LFS髣;N1"nI c'lL0 e/=rI ;簄C($ZZ.Xvi/:p+xGG=rrHR}iX[ՏwD..wgNfEvcXU6F= _:!vmDCtH58N60@xrDk"b}eT o8|{QzŽwֳ%4kHo-8O\]ODrؾWӓ`Rk!W;N{B(2p[ab$dۍ2+H8eJ7[CyA\PgliNSvc1]Tc-N $t@R, NI rtn'Erx̠yt vxv c-T5@137j$fiqݧ}C&gYJH/(jU*?U#^&]O75qF(u:/ 91 \Xfm۪+׻OÂץ:Fթ@Ҹ{qWcTs.Ǫ\u;OUr?dt"bs,t|E1ܹ&>t)O(:ƍ;Qf~/yK_)Ԉa($—P mpl?Tv-zg>@=[U&/񆎯QJЖpzeϗ[?s']2:TZ `VwOX~ ~#cI;O ա:)Y?Kl)a}rc±0w@;ֱHt?`(dxaoǹ߿ Q)aRPF/q{|G~g}-BHI2'k0Xns9NdP}kf]ۄKtmˊyZsK$Z Ix) waREզY Pe}SyKQVb"=p908,'i,b= |ƴXD@:e&R| $._W;tZ#3QL:"P KeMwJ1Ӻq箇=ط1s ?s,yD&)GcɂC1^ 'us,K^c Qj;gŗSmIcP"-ˮ*\q!vr8#T@9蛄G5n F͗-"c*// kF xLĘb\tk‡uG4&f'J P1pA 5ߍHNA5%t ܝ4gȘ4OdWKQt4Gi==tUDyP ܙ_PD)ٮı0ItCa(`L<|ADSt<F db;] x<Ʉr$}gg>eiGa+&!I&ict,[j> l~\P:~c~HuX7]F~sQ^7#91p.| 0KyU4uDa(WcK\۴Fdvo}RzqvQ00Tf {Sؽ%;' Gh*ELaƵ]|^z~Z_)}Ky=o4̇?xaaA-beʸ)umRe]1nBɾ~,!rƽy4&Zu.JSzp/2G ѷ2#m~JCkB(Kjw_GTQx$'ǃA{׬/1̜Q[|{i79G*M֧ h(kz׹E$V|&^|gju;> 2:B~{=xRyLE("WݙbH:z2=s.hT&0i5+>W Րouip3dE$2V-لACf+200IJ`Gp(!@w^R ozOR 31-Y \NFQs3LXaۡOi?~x{δRKZ^F9[oQ|7J7ӄ[#K vo<)HxBwoO|HHGB,iXDxOBfiBp+rA#3cMqa~)yѽhbMR(4copc¸!C ʏcW帝\6p{Ω!?NXHqm3a9/EJK,d⊮W읃1;vYdk'vM-pM V7)E 3 PuUY(/a3J-I9'I/únlUU99˻mf|u)utܧ䥰5n*BVql)C=6"Ai{E^|E8no$\B8/ OKL{^g\c=%eL09M+Zv((RizN>,/ʁ-cza[l&ZN *rB;tVh7@q:0d"M^!+tƂL;it5$V34[mQ0 1WN0E$94([a>rxK-;p|8 5~pp*ȁwnQUl2ol;%zw:.u Q]NdKPIg]NR$Pljk(G`bT ŝ6TNc kxELF+D}D8I(_^ȒQǸCy='B1  DcMzG&|)`Y ޺z_B/IN nhD(}hAݮ9f>C֛p\t[GnlEQ~OK s*[7c''}hMnr|} R4#n] =\KKnϧQ$`$cZVoܾ[g0Ff1mB(V3 *zVD&'Gw>,_ yE;cO~1{'yIj2W܍IsH4M]0xd;æR@c\qM]f=I#CO#7]+?='턐*]0UJP?$\sn"dYF\Z 3"D,mӞR->67X]Z:MK󊋃ڌX .τ_T"XEG(\TΫkxks.bb3A<NfYh?׺ҋzX{bN.p:o=Hk3Nrge?$]gz F_&mR/gA>B, y[xK[JeiԴ{Nn\|܊;: 8imtY$u3pA{へp9H k';5Eg  ʡ= XB++AP:C.&\ EtUt>%&T,_y3ʷ)\N,#Tq8f e(VZ:%>0Oֲ%s GTsch.57]䅤ağ EkkidYaM*EV㆙ 3 'w0j*d*1IeL SKa mٿlfJDBưNK.ifgvSAmi3- 擗m:4X]p'[9>[gUۼL0xb)T)DBi0fGſ@b2rnQ]ǫto64ix f aA*(QPZ~L+5RJhCLzo<#tQ"PuZŐ3dE+)Lcl5|X0 *JbU$8Gq=PEeaT@(%҂;fneGO(沃;]"4~07a _%& 2T\LnAs@HVkڗ@|& I=(Ha2mIN;Q$VS#H wYW敦 HٖI-U[Y?sLQ2?Jf21$l͇LEbD2%94S-;(>avYr -X́Ũan)ik z:u:iiqZ*Xa ?CĎl:{;AȬpj\TxI4g^d%%@ȑYCtqx,)&hwZE&Ė'uEmn|kisAشY.d1WdOS7FvyVH݊5 -Vw"3H <͝s4 6\6Z%0]{՘4]EXl& ;~\U-U/^4eg [JG"–C x5^E U/>t<hTE2=p^*rN2#e;YpmɲVCxsi>3>K1rnuŴUɋJk5{TC>J,\ )C.S|"p$ݫTfGyz:?Z<26ڧjHG^Bn1Zr6-抄[Nu,v1@Lxj{0 9yf9s^)L^p}9jtEK/Ba *y`P:;!u+@^O]+fy5><5 ZU4CS%\ ͉'d\ܣ@jDjhM\9b7 *^i%cqB\SeGr^QJҐ\dHىz:]^v";Ro{AR#M;ـݧVq%G?6]*E=֘5n݁Afl1Y'}8@dN8kfX~j@ϮV5d)^8P,B2?ձ#~~?Z ?+&5QmsmEK90/ŒY>wamVbnBMa]^bAҩ8A$pWϚ1lŸ\K6 YQ٬Aa19mlJGYd ay#$YEOW"]CFC)P\LH:JYc,xRѡk&unaVޜm86)!cqk'q8tg\0x qEutwLFEVt NP?@6e԰m*\?sv~7-vR+^8\%e $? ̝>;dy=)$ BLj%cYD֓xBl 3ZگÖ9/K=TFzBqᕡ#"Gb0A #xV8twb d{⮆b1x6prܿbp!":}oI 23T n$JuA]g60L o91O*px,p.cӌ39ҵV8@?a֣=uR S#Ǹnz0O ,أ>6;XUm]p!gD9(QQNh({F\lq ,wn9C?yO)ϤzݣJJ{` =5'LE6/9-BlkLb;X>ę >Yw6 I8|DȚSھog7|J"!,@-\J70sNC+3%~w= a/g Ǣ;]׆m`7nu#= d~ǹIcʽփWG O;&-P|,qqMNә7QG:6ޔ>$ӊYҌDu™$1 N~alOwW: gnOV+1_vjbY"? oCe݊ɍǽ#S#&؉8JbgH}y,s3|vCWLʩ#ZCYW79aw*.5\Y0ggNH{͇m&yd5_@Qhh0ȃyzӸszBmY J<{PZHVo3ཥ__߂Pt ?K/_KDؐ:\5걐-,V{O$} |a0J~mGHK'0'F+k_߇!>wLlh98hڡbEO3Pt0`;&qEYi9;+Ŷ˱P\X"a%V;5C`-۪f*ͬEd^z*/ ; 2&g`ݡw,I*S䝟q5F%#JDm-NsrtS'[ݠc_L^ RnE)AImp$fɵaĞ)6!}*LV^#؟e CFΒ:k|g)-*f =&7bԼQ/BCjsb2-C|مZ'G>omUS sr>2ԅ{Ll~cluk)9;j7<QhH Hg~\MH:U=s~ߦf %z!`)FeQ}mJʷ[y ItƬQ[Qbt 1᯼ߥ1) 0 =]SoB{ʆcVekY RWaagFNo?/.D3oL|Z)Cs.vੰB MMN`\~?\F-G`ʏDzlM3zY9c* Z7QcL^^9]ץ)GyhZ4H]& a?#G`u1qʊ>me%QNҒ3 4N`4|?”| G&`Q`:)]x_ GZ,]2F4b>F6@|`\瑚>YSQcmSگB/ ܗq#-ٔqӢ f]bc;zeU` d"p-2O!cBdžMƐ1Оɴ=2 #wJŠ )`SM_eLK@A9 >^FxMߴ@BX8lȲ&׽|+}16C)96T`'-7~І [WqйemJ+oR"fz.t컙|G2xc-3o}R xF8r-Dz)'YdZh%ZCBoA0 ldY^O vXأptuDO+Tٲ{>m]~悤1EfatIBQ[ S8w;wϟs`ݭ( q(McP59(v'{a?͛OI3E)kyh^bZl-N "Opu<*eF5.LGub VLl<kؖs&wkEj9Bپw=v@_Dm"A:ӯb%)fC "' >iݩ;n䫓0;q mv_o9 #XJ<}A1$R|t> D;\nkbO_KcVtK]G4'a&uxQ'f^ ^EA27x5;;Xa jerر s7כTgrt+eBCK/,pͅ(Ue6NT@3V.m$%Z'OZi",mUJ,-5! =b%BbAf@:mlf]l.ZM^VtAH}/P9Ly1M? `FB%][6`6G^tD\ǰ07O@bFv07t f,Ii[o&]DžHޠR%WoNuI̞NFVZ&sGi!EeMi4+=E~՗"ЩJ[899kSIL$._ڗU#|뜴@Qo yT$=>{DCW o5xhs" iPH'U 3q񘺆Mn郠& T^35 d,ԓrFջ؟"J*NV$&SfD[wq mqn[.s);۞# zk@84Mɾݏr%6|wr388"@0Cy{DӝײoɶAuh9)V03gw"~~nr.dG\-/UiY~:ke}~JF,A _ci ĺO$6JZa0 RbDOJm8`s'^eyd'2P<DN 5=(3e3cԉKLI{<t8*z4g [wJ;MՠvͲSR8*tewpԔڝAMrh##`k|{s Id=u#,q[5wa-SZЫH l 0; H:q9OU`.Tх$qSM7 ᪄R}e~?[S{pq6}EEHPRm-yNB_p7y޼WƸd2_MۼzbnxE5ʂ tT6tW=U lsydQ}5vYMȪ8GnS賉L?޸3zHdS7`ؾNݓS_z w#wqi Q /n1"L%! _o>g.t0 3HmM*"-AZm&EFN_I/|t4e$SK\"5]a ؚ2NqU11ulg- ivVhnxczʅ 5xl˽K%kaFh'˲i:S,3EL;,~ΰݛTMd4ة(+ʳ3*]!MM^"t͵-y5mћrWք2ZlӾ}@ ^pe~3*4An/[|5 {,u!Ajz~_T9m^]CF ~PqYo n T p;{[_sb"2A/I|>H݂Ϸ;nBsI9 3a1?zpB_u-' !bIT^A" M/ɷH,ma+\y$qs^kj*NK^HO*Ӈ?QE};<~UvؔrhzhC}^ڱq z)B8)Vg5JP~vP6,>yr+LjiTPI_",ۭ|7ԉ/3qqC 'J_yh(㬺E\0u(vGJ2lVe}q6,ʞ7}(2I=%|Svh1Jn siAe|׮a <a R{B.(CMG]ZcEr돤6|"w[|]ɵN~QYbx_߻ s"T%$KPPqp >v&ӲK@#( ֹ(3o}/^0E+LT*bYGclPՍ|˶3Ϛ9 u3{j^HVUG |@ E|K+S ަt;!fw%N(K(m9G;LFpohpYQ J$W^v8㢸R>TnH6Ky5[ OT9_9G`_ә5_WƫR]+EL[Jnx!6Y}z{C(7_{33BWJdiRܟA՟2Y!aP"*ik3p(؅[%-C$~bN0-smO{|{ G' ]I[|5)l~טjn?]I 6E(|3 zɌC&m#'Q-7E=c2r3yFD^hL 1i7Uz*Nzx6 J֯vh/=nN.*H ,4% H*u(av~pß<1ci.CJ9YT&;&\ƉHk! HN?]׸h1зA0nI)o%;-=VR"9C"خt?!Y|-L{6BПL G"|K𖱤dɮ lLR{ym8'A QXٟVj2MJu=nK0. lx,=r,WO%1F?U 5ͼ`Ő}%oʶiܓHU抬i)/SV .!-DzǼN1C !@27CN4DkTkqVu@z^س_7ct#R@e3cUt6<e<,<ԏɄ O5_ߖ \e Qڣe9+њE8Y~ZRSae"@0#5JR6*g6I`YI! տ{8b?nJd#m )ce2{豳eƘce{p9?M{HnA!I VњE*6ԑm1SMUuё"XGU\3(5/$X lEcNznA!R;$u_m+>O˟3j]}:i[FLIpm o %CgJ|,u>7X!"<3g1xZj;}O_yKtyWƬ}*?To4~#rƊ #_BƝ5p5]ثFM8DCA;r?ᭀiI<|/ Lfkpͅ2ҍd Σ|T:!>mNJE7W'ypOFC}R惻J_ LBYJi4='YxH@-V4ۦo{cx@_vP$GL̞"On6zGEFQ ;4Uj?e wGhlzUT|b˦FsWX9&@+.t͟wRKݢKgW j Je*Қd,wz葴,,EÒ{\BG兂(iۓCP'ltԣvzl8$&dJ &Ÿv~a"8cEK50$ #T,)ny7cL]x\#]J^.}StKuvWgd8]!yx dXB)zН<+ŒIan`kz@}j-ia+G68+ TNcWr*˅f`Qt H鰣zɌ_<+~6-T?߹8ƜB9nt~{h h31,hY#-La`0.0Q/.l./GD-_\wls\KA d"'ؿ%l%w[7P؏헺8533)0WۆRBXЯz H<]RB[z3##>pq617?l8x^z%p:xr;('kcy7V?'5Ar# @[ӌ5wJ&JD*[L J1l&% PFi}z^3(wn0++O뮮X3fgmTU /6E%SMe 8/*o$s?ࠄ0BYF =#ֳTtRs1qd5)pn:2.Z>Fhr:KEvwη$l1.[S_Q Y! U9[q ]qm9LxR[ix6CT{Q|ʹ=%6E)8 #btČUɃKH-,W)r˜0ʢ{( t}J*^re"ěYy5YC$?XrQGw@+dVv&-||DMoA)HT.hxx~ 0XVd =If ='˵xПGbWs}5΄'ҹe3Lx"ʮVpHB9,?M1>^eyBMu} y3PTV|@W:,;15͒>hm\4[$JZ)2\2'^( (S["USW#z:B5BI̫ہ.QtπqEIb6"(8yUi¾lDi#ŗS1N :TK7mixxy!Lc r*v_`xUtzQRtڴ5HJ$0[oR=d츱ϰO'=J¦` 3u*ZYՊėBչN蟞h}ż|؄Ťɋӿ`hc#"4!\UfM G;ְ}(l!%u1xu0/g$B1uL,חngnϪ $>\uoj\wdfj{(҈H .̓BunxkXg-mjv ֿeLfšIoǬa.LfM1  e҃mKӝBN{z>`niZM][_Uó*yWn)(lRnQ7Rn6F2J14[r:?Fqpg~iEH7qŰrTHWI)]~qIJDKۣoIF5};!2 U aɡ/hk<y6L,G!&V`ÐOj!``-1mO"J^w{ vLF`jdƶƍ.j=Fh1,wl),(<o`7USi1`*P,'&*gbGH&ۧi#.^A'jgW O놤e|&c i5 Xb()$4"(K=T   tVWOgYH^uHm<}ge~o:%qu_P5^ O 4U_ 6%aC39(f;?h$S}50&[)xm 4Kp~@jRj~#7,:`G.YUvb5A$~W "lurݭxяՈRw dt(Xa> fc_cfݜ[̦2zE/u!_EYT%;b`Ci1yl 0K-. PʄS_skxGϚNBtk3 %$Zn[&+bu?1s0{-QrNaʜJ;(vk(V--Zvs[ATgsuǁ>j_`%& PD]C{O͎yUY.EL)Jyy2#Z Pפ-O|pe|$JZ`@[f71!c]Fy"KpoC9 ű?& ~u7VXwB42= $T2~H^"wHI׎]2K#j$ ꙗBYⷽH28on؅H eCUaS澒 ȣTZQ}^{o/Jݽ㮸BVQ6h(V"9;mjl4e6 *`SRhVA ,bh!ncO(8yo@:jm?!$ t~8nufj2l] Ds1~+_{ow}H0?{zhu/]OtBV&5s1ٰK游ʺ|񓎩LN/A½ݺCaXf~73t |@ix9 ^3<ҔWlݴ]ӞL"/b)X>}1O"d1R D Y'%lQKs]j}0bY}fM\ :$DyŨ`8_ddK!}HR0IбJ|GZ=Ȏ?gcaZ4 O}Kz;YE4Ai O2 XcpRiQo̩m0%# hub nlH!6.h7bϽ2N2fM ?#-7~e&Nĺ2[R#9(F|OهrZ-`ly]lfC_!pF apޕ%?J찍m-ұZtڣjȱʞ?oj[Ё*)?҈yWs+G xR!"G ?|}7Rid6*aJv_b?ՠ4 "F!( }6Au)<CjU=A0  a/6 x)'RX1B]hᛕ Rrv{gm5u9Acc*2ܟP4 +ͩ>fBuTƔdӛ,R`ϥO˱yzC>qi X⫫iTA 6+ .2 TFΐSt֠Ymw̮ o*jKx NL£擻WfXz w g`RC$0=Q+Cƭ[1UlN' ͵/ޡ|+8?0qhpFLdS.C+'ZZ@Z}i;^*#DlF'‰#3;,J3hTGH&m9:ww~Z|RrPH!ZzWCno4}8ri_|T/ l#Q^W^x,i2Ü!f#inkj!()d ^L#ucsnA/!Y48eLtt4'#MQ*_ {holڟuOsOpႽ6OK["|d`!!eCBNB# 7?\Odox )\ <0vԍlMC83vړ2"Y,X|vkd *uR|Ytw0-o"5 %Er(B0VS@IG>52}0hvaN˼<u9LSt1 xBh!^¤o-{_)cΊnVtyuލIJgnk>>(=8*#ZFi.J{;`HI& s%g< @]mbcዼ|e>ULQ{X)˪z_?D$V 8<VˏV˅ŋI[r\膻( H7늎Yk&L ؘ;~X,јJ`ۙ#&pA= t6]#jgR@hN '6.W3 (j>Qnd Ԝ`2 +{i뀳I59(xȽ7+#ck7 0) woƻa O;}ޭp?Z{0 i'7= g:YY Ђ(˟+@T̹7n]zJ ݹOUB oW*nG =|EW"Y$) |IghŧE~ ryk6v (e>nGQ{ Q̱C>9}YO E0ƯrK׶& Ly1[D.8DQ0sҔKU25Glrg* v, jJB{}l[Tmg?3tNqz 2Ur?.r{7Drk9r]1"vW (hvPņ(Oh ?%OM#,'oF66*S&P'|6 UA]/%k#A].e. >VNjR$]y:9UO{V[B͸:(]k 8%j<ӧ)z;[cj|1lyp4 *(̸4)՗t#>G=jDۣnH#5 0;CeU^k9jnnr&g)[JMLE]BȓT i~0:_ *6"Īy{gq -b3'g:" @srNW}x{I8[ DSiCRwl7RoՐ&KdX鐥B=fdaBvȢ9$MHͶPR: 9BT-v.uCgp^ ~n† D ZI#AYm䣫C}gâ(7)^drh)c_tk.<,÷(dVO~jWd25kX.#y}GyCJiȔbP0קa5G"Ƽdr~H^ AiAUWbQ lK/$+N<7KHPTl>VY :U^GcssҔv0',D -w& rŅK3f0I*2(*SMHHRH7J$ xjAֈg3.i7g!%BO/M3l6 P=ͷ5Hi$EKQεg`QE+mU}o.\ʠ0z}9Oz?).zwE 鹔w 0(z-!aJ̼Rr3PUYܩ%Pu+h&,I肀D`Lz& $ imk1ȵ]!̑{^χ(O4BQOI-{ըvАE ~VV>1nŤb HT~vk8ڱ^F烪rCSfK вCGCn)ŽiVˍ\/^!*ｽex?BhaL}9ޛ2! SQ_;t AKB:*/ ;(R<2>}hb>$gqjJ{5sRLM\UrC+|v,m/+#[hy0x!= kJ?^{d"—Ƶ:86-7L1X9I-89\3y볺(m$ NRHnۓuʇɹv켕 %cByrՀD@ œYcAҰ >&gd/B!׋6p+7gBC+\$pWxGb7H:vL :hFYhqϱ?+L4.2 ⚨2Z=9@u,x/t< n:- L˽}BbQ)CnQ{L놬aja!ʻFKߗ)jK7%$pB5zwW%>_uD)BPg"H+/7G>炻V[!)m]6\8CJL , `LS)kE9@>SnPf-[ⷝo3yWvam,)1bv?tnQ M0Z11;}Dy|Uk!M;RGL0Yt5 $Т0zJ}H#ekIz3ZG &q1a2T!Y0FZ !9t間Z\+> au%ZUOb316˛U)CE@%Vx*z<N7; -Bڀ ie~lg~?/,}?'ieD3Ns~ (+;jON aM%ir'|FPnں;,X٬&~Eer}>z\'JBw&%N4_ī~]ȯVܶf㜌‡}-J69H$T)Cn&onma/:ip7V1?m⡔!s `&z5k=dA@未Uko `;Nlzx?Oa BOkDԇ]% Ǣ#{ YXokvI|6m̙./5w}nn^Lwlݠf;P{R{ajɞ\6u6NiTeHmeZv)RU&)JRgiKXkPdZjz'$DJ\¦m}DjY®f0wT]~D֟spr8(wyF?*;1sbh4hJ;nk 42/B>gIOBz5]@Һ&<(Qqj]̏ԉk[*(2#zk4y7a_ | ϓR!4%Ì>FWEiP]Q+:|;O`8$23ZP&$gwly.F=96oxr>wD*-(z7BޑOޤJ$]%z|&".~Q̲"^ e½ΗE_2"u~ſ/il[HۢU(T|sM)B*JP.k?AFS~Rk֑gY}c;DS]YRO5@-hKJUP xo@[:hװ+;.X>{i:x0M+Y}.(APF Okf/+h6w("{{AT<9<۵%g H z4sL3:.rRxBFe&VZw͂vzp? džCV) >v miIJ6 Dvh;:ſZYgA<_^^S 4݋юQ7(;}Ϗx#,>%hHdG(}/ݴN|%AwSI={Z:T7H;s#C6|qօ9{$wnj$k@,_ \2uR.0-= x{dnx\ͺn@kzw 73%gv|w-`i *%L(So%dfK!z`y$jt`)oח? ϐv@qjIN$*y+Pq~*f\nU zĔ67,~eqf/Ao" hLY3xߙ=έS:R-M흯ގK+[@6~:Ґk̽j|ox?}J.N/޾kTn.fn.ϲ>h~ y,\T s$L6s0e6nLJjA6iBPibO,eKW~3bi8xXmo%#sl'.6"Zm%I> PEfl /PXxSp֮76 !4]ظ̡1-wtCZysPm#Ljuŭ,#5C=E2%~R\ޅBW؛EO9:9=ZD"sG>iD;*!m_[}qFͻQ+pctO#ek<ї ;-bl}J gy |9| S~뫀jI? K/o[z@F+$CpÍILp}F>Oj $;֡^uDOq$'-5"XL&  r?dn : z$b7uY:ZkY͹ $BLGc{էOMʥ@GntYwVs%ͥ}&i>3:_s^9 'e#l%̸#9r'%{1GpbD}ᓭ#Sf= ͘ 2˯׸_fK(0x*g:*D8cvvxqq[)чj*(8V`dBcAz@]QR{#ǣe;} zJyGDXivw] yBҥRB&]C ?,Xd{{5ŖHX#c]W,>\5{kYf 9fԵjSI6 )ARƖ OH z@ɷ[-ؔdd3h3x@?o9BM}BMEŬA|Z\!˟h%)V8m>ef,k?O(Ѡmy17R )zririj1_llMF} n(w\HS,Gd*`Hs1HM6aPZ!0>$Js?X~€S %*ǨX|R|0zŁ-9=a6tٵ.gSjJ5D)4n.&+ZLc;:dCZǥXTw'B3N97[1[&dQߴv'P1ynP$T ڜsDk͓Wi#>v.ع`jě d@ABA;<1pݶL'DfcNuʜNՋ_ utkKԶ~G{(܃._ ԛ5a!R6hp\}Zo1ب6xm6Pym2>2ΧI:|AE~2`E:J1hPzѕZy=ӅL+pYK2!3ul,OZ) jseGB$@]Xoj4+pNR',E:\t56\JO^ʋGZh9etXˊ6Qn*ǘK{Nl~b෽FC=){ً2C6l4b2~S.GG.bu$9]ɒϞ=v@ **S~[!#گl-\ͥq֢82t}]"JEf7^m}$ԑ5.O]hSVn{\κ93?>p*S62g`=mml I[1/&Sy; TO[An5KJQN?ռٕ 6_@yXxSOI69=k ]Gܷ9umx!gLQXMN$橫Q~ak)^SA?MI^f,S\q-Fx?pC )N,1Pz%w6l1Ϝ_Xqj-O7 H /XC Z~~O6a6Q2uՒ4dJ!s 6[w<dC1_I+\;RK+HjVf GV+P=ųX?:[ɺx,VwjWuYG=vaΔ6ȟEtv^mGEO|sI}th 0d3e \qj2Ko<+7O~Ax991Zb66sgCDk9˲Ѭ9mn%a^Ӭ9u´o v8JKf; T /ګӼH/ *ڇ}yt-(QJůq%v}NSU(:!ܖJQOY#a͡.WCdBG5(^9MI- 75dJ41"pԚ;<3^q "eO@^K x8Og ri5kJpfR%CpWz= :cOR.skqrg4/#M1 fX!/K<5޽5go` Ж6jQ] 7oZ ϵQB@mf¤5JBSh伧EaGˌței9ӗVh,Q)eTj 1VbyARʃk_KVO-}ʡԺ1 T>b6KcPv2Gɫ_@%dG5h7ԲQ8!*8"g(];F56ӄh5&oQ9إ^1x)O6s>9\%2EXl mXk;AUe) iliZ. OngdrX[Dg|`$X7LRs|9Zs#h=5bhIuT@?cK W(6s^g DiiI%&}U57̮UB5Ԙ Rtu&ISkD]k24jM8X\`ZJ)eA629C0>8Aۗ"<s*Jt9 aiġyF !;ŹV$6fcYyѩ羧6 8Glt5=P9>^ vM$k t@%YȐtzuH lAC"ObPڟƯ#>)45Q<ңfHe 䐒ZIJ5؈TJm?>SD#t5L1O~c4\!5!lnUz?ɡ %o8\q5鷿I~l` \B MIDTUh.Ѵv2tצ^|eTU%P*s0QDS!:׬]ۣ|SȈkMp zkpS5D!ii3gG8c՞|)͋=o zVaR]RKz5h }2eW+ 7X!*zJ$xtEz3\U*ѠPUfW[_p|D 7xLKY$ef w dRZю )0FjVG£#%<}bK:D[AL2q ˠ@*ty %җF_̎"Oa qR!F P#,<`Oj {viߐ S"XR|#aqe+W*~2=[?2k9ȞCHHˢN{o2moBdm ]|ٖvXÕdHT`wtбQ@h7|h28T;OfKqDq߷ #h(f{;J&JWv$ Kݔ:(CL!adkV11YI)rgUn⍒B",BASrlwlo&˛HgD@ژ؇;Cqt{嚼|]+-e vfd/ڋl;pɋBx~*DHE7r{emov+Y;JӨph3 Ԭ)(:VE&0oeٽ"tqDd̔fo9!kO@pȨͣ5'!.j e7せ2$='麿> W5YsdqcፁɄ޶VLJAp%2Lk&F|' vbAdzJWkk*Կd±s]eQ ܥ_RhﳤOZ0H̅a8(ͭ[?0ͤ/".Ͳ(as' C'P&Hܝ8C㠧횟- ^@༡)OaMe!(Ni9sÅA*Q۔smϱuթ.%֓X3;!aCv%z(fW ml*dՎljp~_K(N ڢkSGkvD^k2) ),nu+<|ݟjmؔ-j:ζCꠦvג7F8nD~J{$G2aX>(:KK5ADo.;Nyٖ{"6z# o}tr~\>tQֆm^q9yAtjľڕNo gP}t=MLwhw`-䩊rȑcjKM>pU+(UȊjJ;5[M7ី" uȩg q"&i?0i9)T @0 X5s#@k~7} M})uqs\-VX Cik3uJ?n6F1)qXxT*]VĮ(vF+ HvDYVRFsiYCSIF/Φ,,Ck}y;_0lf!JaVJ-rNV"٭V~NOڂҩljYb9ryLF-ZeJFKlit!<'a-Q܉0wѲ։7LN:щtl]SM}1QS484YEœ=f`.?:3(I!:Sw;c)UҞ7 sBLR_y<&tR_ M&[{UܻAoyVHZRӌB[6gU"?+{we()L4Y:Uzw++<4Nld-oR Gák59(=7؅"$͆ Ia;'q*'z/`Ճ_+2&mvl-G񸨋,|`L&Q`nh>9a)ڡ+\pF|DBphSEH䢪ń<`q, a\ߡ&ﰭ:s}\ q b? DEK$(xDOVn"r2|d9٣SPmazgiF Mm+nZBXKKMz NkSvV[u-F;/ z_w_t~(4l_HUupmAi9+<ȷVfNDs"\3Ѻk|U Pݵ1)h@q69 DXOBٜ;y"X$=6K*t^ FWȀh&ޖtsxJ6.laMr:>r@u,PtC ]z4$=ϢZW!$D"'m<ըq6%,/<iI>=o͂㸤  ",,yuF% auLhLc 4dG[n<_-8tRYkAك}fZԡx0].A;~TSgXWd=l4| 3cۗ`[BOBk}*$aLBC\D'O"2o1Kݭ_/|쇙]tT'PϤt|!8n}Qa# "Ӽ!^!)5 [((RT<,::[źf.0rW_αNѨ#ic>PuG/Awk?Bp,X;~1O(&}eFT0f5]X 3]">2]HXgqE rzG g +N/!Ct;p]1m4V/X;(6*(\٠B7 ¥(ZH`omi5tcNơN45 XH~:.ٱ)(Hn0Ly>365xK)xUL i&"MZIܯ]yX+h3p B _;Tm?tDd._"uԞ.[ϜXL^ ^sjRQSwJ@ϐ:ߗTܰ!AJ6ix;㓺T }\O<s G2I&z7Pbf2:!s3ꛩxX )(HxYZUL̓0Jg{MaN!a c;o`o6a+/7U6?EdIIX_0g9"qFqSMJٜ0t-zw|h)W YF*5/i9lN8%A})O -z% J@ Yn3Y!=Q5bf&{h2⚀ps|]܉kmU29i <+;MSO`}_+j;2i:n_]/̯o}ֲ!zn4bT[kw'&Z0T^ #N82/Dw4!Aq֕fAt8s[ZÂOaԬ鮖ua/dh[gyIOB`TU$>أAu9*k:-=[T]\E6J CSOw?a_.H#*:9frQ~&29T'qV)(Z)*x_=FBGtA$M}+3|oway츀 63OEXTeT*2Є8ۖ3L'=|OP gKFO,?ϖ̴Ay0/R @nILg&B}-azS]!=ZAȧ\P| o۱ْ|WM=4{ֆm=Gsdl@mg>kt롭2J 6a)h(G>pv]KFI[@8dDi&*aOElb \8P?2!U! Szr-2NHS!~mu*& <: lB,IX G\<2&Nx5UcVtX>AtB4qƿ0fk7An>&sCnRF>f0efa;5y`}3~̯=e'AqI#Hתюnbv?s{Ki$5$nVɻ^;"d +yWzK)-WGAx)x5[62FYKgBt/٤6AP;&\&_r_7 MBJ3eAqTg弃=rR$ȸ)(=okNW k8PeT?;[MCXD"K ޒq»'Lf:K_Կ&:C(Ky(=thG9eI u9Ďi4V`0Gqaz|xOa_Yb.n#^f`̙>f L7ߨ`^jW5WiN}l"Ec8 ;g?hU.)j|$1yFiMtE= 7+ O6NE ^]c2i NOU1)wK UrXċ=΂/Sډ5-\Hn:" 6":A7RäM[sV4/!5.sREPn;Ou`hQkr^pdt;#G*[ -{75IjsQ+nxl+ʕ=G%Ltw۟Z/V:Ըp D yoC;Rqqc}JK軾qv)5e"` %7B.fQ.) xOA |͞ T{$uS^^aMȢ8^g28ִ.^/0L; oÒf~݄-I#(ch4ő 5+ӳ3/[M2W!U?=mPTn-Kqx^3tX§O}Pd;ާ;~C"صɍ]@[7B,[JڵXl"^.O9URJ5,){b_Iߑ[mx5*u~F2:K5x i(Х:xAU RD({4P9I$5?"\Æ$cܼ6|Y!]zC7(OqJط^CRk߂5^Gdݔ#Id]i0fӑmwa]6$N'_ ӔRhB5:;`Ox\ݏ=X wh)*㺋k1IwW)f!-q"Z[ge(F6)e*a劻ӷѻrr@*!4(jDG(ǂoUH:eچ]&XˊTmD>ybC7zGk3دjwfŻe\iFq}m<t1Vi\OiVpuxn9Ծ]%6; (pD.J=2HϒNK|L@&AAHfUL\/F\2lzb9WV@|Wr[MҼ OXkFM GޗkH\ңR¥ pŘMBJluWV&1.r . Y 5]7,ڪo{eV8xTpy:A<)+^V0,I{lHw3Яv6/6y!+00fNp1Z;]B GƷu_p~]]K9L !* Sm8A%-ϰdޅ-5P+;&^z $%~3nȃuW--@rq<|fX5\ޫ@5z@Ev |])Re/ L JDoTwiunڡ5\ hQڍt&wjjFyҖsvsEA@U99V0ɷt TỞo{4=pzGA2jGjb]R۸3O8oU4ZʶE&ϼRwj= %5Bhp(Xq[€{iGe^z3Q}uր J&Oi,!\175 j5Q! o姖7`롼C(Vё8V(I rF 5A6}tt9Q ͪ2нRde:a:Lt2h}#/3"qs6`'!'7NveiK Y[`02z{4*r&HX4[\瞪 (˓WósZ ] "f5u}Ĺ$% Їv\AK.yp{~]`/rFe٬~Bp]@"E6/'۞k]k<\L׷1iO/'l6~8J `7իN[HuIї֖Dߘ.?/%|h*1.DO5;;gn_ɽi#}hh]ӗϾtmp==1Jͱ RYMiCH!i绤"`G{'rK-Yäf(m:Z ˤRΆsI(y#.Ath/5 1*_I^NQ2 lK-ClJS?S- vOq6"pS:$E;R}:i7wǠ\A9y]BM]3yLz+>ѫ>OϿ?| 8 CkjxT{B|XQؐ%G èDWӤք'cs:@[a>qgL:"C-.o[  g6%S5x3J;y1< ={ i sH>ͶSJe?GW!u6\"P_؏M-r`ꦽ0F^*63Om:սK|t_ZLkϮvx7I=fOrP"6ߧKҩN)fKk x=ZHI/u|ToLNGI7,ˢmad2`GTfSedt(_k z~D x 6~;b0sCK*Cv:x5Ro{H# }*[Ma`Z1Vx]l2M/OιBrFyx~ߖru tv1ivGyȩ F@Dstq9(BǫJ4lp⌓YGtT!IPyueI щrzRO*uj"R?˕UgE~pRėRme3尧N\p`9"r@봶ؓB.a`NCx 95)@Hg\y/Yy`wT 69ei Hi04r}\ h F A<ꞇ׺M|d*,shZ [ǾRQ]GѩIg8 8T{ɕsh45|= d3-7cmk\Ùl#qVJg4͌^y~Z< DdRKDNWv"Fc\Gꌌ0.Wȯ*>w11BO֩/S2-0]ܥN*nBA; D Ɲvøh_]{K) oJN|dR ]S^Հ ARv0xoYI:$mIOe.uQtw hFV$>J|!Զa!"ȥݓd vxԔt`k\L39  O'2Z2A}U#C/4 & ęD ٗ1a|0fQ^ےle"ڼvτ'v,wh20!HH3 a4X._WcQ5)5Ѻ;^/J-Hҧ݁P5 喭G( tMz /my /![:0u\ >6nZ8I\g;%=އ2  jo5!RcSg=hVX_;cg7a7}tI}F>|fST8ecwo??|fM mqY&1թ&hIE~oLv4ċ66^\Box;YK M{j~zb.AjMkmUػQD8O :*ݩoCৡ˂We %!Spi)w>LQX>T${k?mu{EwЭ_WR#ߎY!޾NCOI(e+N?l_v3>QH{YT˽_EԚ8 rQ7@JSi]<0m0!V O5uy$M°ĕmC6ӒRl \aˏ؆w*!D|v3/8YYu c2VXc Լ;^ƴG 0'TT~@v?4)z1*R7#R#`DUnY%{vNvw)A WCj[hUm<רM\Pb9%U!UƘ\cDluy+fhP!0Ht2it9HqIeYkkFL[ %E&E /JH_=\I7Cy[E#d k.d$5~îEVV?^L(Pe3VӖa6td/#0 :rP~#fX;"+VmWҺWF{*cN9Kg^x}eNB?na ""y(`;ʠNuh+ ' ~~H͹7F5ah6ry`naYuMN[˄|vfE{.zDCy^ ];ł{6:;2Z){z >z|/yjH|FսVj.ݕW9!gwYh'gY'̰B61bTIFn2oқU,BB#5qESS+c`F醁sLViiMc۾E=ތS[;=̯AEEcB"3Z6F{lA!aKhu3Ltq/ ONxrs =s:0dhd6:}hhӃ&E}[jDORGcϧOMxH{DVs:R!w@rG:/)Ku|TFt6@ ^4Kd,KZlM&\b8%+HGθ"bYi86H wM_k:)w"ލ48dv,?W<1~f)=B]H,!C@gөc"_FW\6֒ECۧt)ϖ7U6Lq5chpPJ` !NRK}G+&zg9G suN?E"+[,҉p*7ocɘ{b2zr9DA+z- M ?n0SeR:saCd75#z<go4(a7gkMUo~T8> c$: f*ivV똨u,xD (z-hz+"ElW3e-X];2 N,Qśfm%, 2|B G5)rGT*xU٢iS3i*Mn.{R_#Mpw1t.q%cu"nW1* Xj7[VyJ>TeDj"=ЭmO]󍄎d\qFB.^rUK|Ȟs̴{{o2 U@4קoӯn# *DDT |hCVU kebAA0U"tJ0,?62J1 ѱۄfGټ -B%I>I4olꎅz!0 /؊O;k 0N7XAzWRc EJz5=M6bL׮zocURYr[ %,WysDQζq t'./.cR_Ly|ޡ*Ae*?:n Wtߑ$B[wAz;U~]?.;ԡ䙼p.@J45@f?xNbG , s(1W\Wœ%Z$QgA}`9pАH(\mjs w' 6cH#Ie/ 74ϐѨL/IDJZ0м`& PR_הi[tcQ>gNwfj5f0Nԉ UD}t4j#sG &C.FCtƛ {A P逳sX\Sr.5*ڙ!JR\=X S)#g7Ɖq+m @UT[!vXgLK^֤|u1 W5hc NZ= I\6Lrc:jj;za$рG_@؏!]5UH|4b+3Nt옆K0@Aa69MbkO.[K/>e "S%?b5$b\'Rq{ aιOXsNwgoՕeA.ǏMswEGZ^}Kj1%k}c?{v121 >g4Ybydc \>wgQMO)k|Hl]ŐCdD+gu\N+!6u3 ~IӚ5~OȀsY+vzzL*|t7,}Pz3RO םbcQcҺڧBwlctꥍkmG~N3+lѸK Ax_D^E5_}l8eH -64Ф%S #bbypr*t-4s]57Gy @/m`걖)3G s8}ZUK#kQ@ߎ-rX 0<BC?&\-9{ZJjϷa8@cCU]%zľ[)ՅD`3T}u-Ac2vtȪ0t팹% {CHZ6jI##1pPtN?k ݺWRj7%~*2s<"RfwJ lPܕd*ë{umI6XwTŁt+~wǃH(P7EU9&ADr&W v"gLj>XEYy/lsiK Q/kJd3=cPBy6m.ߏ>#Q=xri2" 4f"6# #6DУ@?LQ';/,xʏ)nަyZPTuCK&z+}D#._)ϸ!e].&(v74?gSTV3Ѷ/"-X6V'KF>0%TbJIs`1\<$C"FMj8kBOáR}ަY 2HpSH+nRc]7 ݃Qkk(厵 k&~{>Ѝ̗@_ QI''X> +6 :ǝΐ`NfԃIcWe{ nIv~͞:EȗF'ʸNwq ly)6{zI&f{_}bxC"D?3wo<7_z|/'hmc98h<#m3UxC-xP4UZ5h)t>) 78 qSRbc kX`#ağnrr&gih9uLTتDZ sOt-/hN"V{9^r ϗTM΂Cv,*1aÝgi+Ի x lFRg$[ͤJ6@v9i{v]4{7?< $E)[淵w[iܑ$a!66h^S" ܞ]8ma+dzg0|b G^ngƥr80J Gy܉ ֩+؏ ~ŏw]5KwA@We``6 =,n1I^Pj|4C?+~)ү-YAc?*jZXp|K6_[sC>_M2yzp sXK}X.=Kε~(&hܩDlDX@ڭLU}nf5)yDMlz|/}Ғۂٞ H-`xCs62'Sb] n ~ufBK)PJ *Vet)6M)}\0ıđ3>*@8Nol ; 7%yř ٽ*Z<;ç Dy#Wk'&n֑4?eɁh-[P9Ȗ\5^Ͻ0:)_l”Imyُy+UO*Amst|иoB~ƑMu-꿢j$8 Lpɾ2C8J@%) UkT 4L+LC9IQ$l xC]Fi|6t5x}/_ۀ6 I~;åfTᆇaZSb!MSna`z|bTn%T#,ٝ&j0,Moi\xwsv$dU^~4i ];ڈnʿ[1SDIu'(D,<L%+x4 7Q6Ꞹ |2+_6|G"|Y<k|QDc}Ն AgW`\zkI4Eb'݇L%Kf9V?;l>ŊC Sʣ۱7BNח=(y"6-m+,^R9=\_rϰz~S ǟK#!K3pm33\*%nGHn| 3oM(>*afO5Ԣ6MTD 3{rzZ`ex@n :h%3(qO@ MӚ8 4[ B G-fWW:$]9{Yo$LV  7)BTeE8<$[Vy=ϡ)s3Uiϊj8fU?rW6z84jigNmbԩKCMQyV磺dFl X; %+%}>H?rGUֱAd6'&rq={R? ;~SKOeHhqFe[ }颃(Z`@*@d d&1wwWnǦmcc0Ojũ{J;CRԤ-M^7b' hBpΗOzU7)/WS 󉉨kfyey6p Lo&E]z=(dt=T$N&l}3ZTڟ~|dM2ۍ[9^!(-!D0)͌YXibl6[C?otnZVb}WhBS!EChX Xz7qܾwkp"#5KI2?2cp+ܷqjŻ^#p&-/ Zd{F>[At 5ε^"PM UĞzZD1#0LQA\#!_p@}؊: 8;hEЗT&Kah&2r/F$]xYީ.ψƒ W?/G:Uz"@~72@3aUD!bNz1w-,Lzݼ8YܫŸ@M>PɟZ-fNԞr*tɲԱ[p,\613(I RP$?q.@ BAI-Oui-iuT7}=}2 :MQKա9J7&k5+zWf mWB28زI} ul| JE$M ~wĬ~dø8OZK4z=e_[dt.l#1m ]d܈fRa8$℁ݢN(aCj>s㊤#'<1&H:E * g}Iq?l땔rmb:a7]p_{/_.D3[jҌW6)k ߠic}9NRz/9&EU\#w?Icbq3R,m`?اu0vt-<4=x)Z'&5 Ṕ/۰=ob]O|25W׷= m>l{c5a W߅ %;6/]Ô0Z|̕IuOAmh/npGx]T 0u9!{__aQb|H1f7%Ctr~m=#soa`=:V`L"R=KV^?,kkmsR if#Z*D !$h>=}h͍  [4Ded;,fVX$C%}rvP!{>8R/S)HW3K#ͭNt?\3"aɒG G5*u_ͱ: .;Ϲ#sʟbֶ.IOD^ +aIBӥ~eX|]/qOdqaC͟N1DQGN ͧt[紏ӶŲqVJ(aS}osbTH/苩Rҭ!w+`ķfYź@ *mB 豠az;^.mߖ-y xf7m~ Q 6L&z&7ض΄ˉ#2z1C4 bwIz!WlUϷ]!_U?kf% pM(T4NXc^H1G}w4Jo ̥v)E,I0 BD|1{RS@J- `y˘s+{I(5+}><Eξk邲!7ipCm̀ H_nGa٪o{&UB9ӆufvDc;TЃGwA]?~a2M xv4 -_.tʮBk%r7H2eFIrS} 7J-ksg*ϼE 2)_ʤe[zߌc7~3ɏbinKZ yTH"QwIJ‚WԺ޳| ݘ t?0qJ.Y#6ab.{nǛ/-#6@}*"ֳ^](Zri_.j闪0ż2`D4k[# l1ɨIrn!|bWF̠o_8e0;xEk_kR׭9u6&͜x?rIfΏ>y0zhZҬX0YsR3f@iuP?13m`ߎekO]i#cer*AߙJwj(`@7#2񣻾P !F C=0 : ^ pGţ*MzЈKX:ӯW6 :ly9^BPY652ih-ipeA!pzj% vx=jbadVG|g/5Ue|}ڗHj[a6_UyVWۑ^ rW|;̷$ͽ[f$p)y+вG%!_U@]eˆ Ȥ, 0!B'xHn᧯`_$Q5%G: o?xS J6#,H9dod@ybIR}x&ub5.f]?*Ayӂ65 ޳qngKܾp kk 3J` #_oG CyAK$uVc`-'Z>׀@mun_F y %Z|IF%[t`|Zṕ؍u 6Q_|(rBZ$(a-j qk˘!VH f5p aoԞoEZ0`]:͇ 2;siqu @HB$40s~H%,L-IWm'j6rRwo G7Y;.VakgH{p 5.l9RTwTs/^Gnm%dC~V?8SǂwwP_<'X5ZNS lk[ꕱ8A-jUy[k'`ꡊC 8|dF(QWU' j&տ;?ZLF~;h:k-$rկ;daF N" ɻF%}pvIoMvClǍeR?ظMUPQLFW y2 4m[KQ'j5{Z|B}/ ӌm F~J<;;t0wurM#F*aRWbIe62wBpK"-עJَtkӻ6m'Ա$V&DyXPeJi>Y&0f[3!eb; y)nܛz.ס..$ ^GOq `(/f:]]19`>$$b ><2[Qys%FZC©gYK5c3Kvr.(偋9DD#-)zXWƖ7 l+W쒰Cfp.r+fpquM<^r{cL@"ej` dontz(hj_E᤯u9S(=,4-T3-CQ|x:O2Z+/׊eHe@r BtJk9Y7~ToI$0y%-Jja6QRf{cTF7PdQʶC^F2'<_9.mU*zhmF0lڜc:lCifsWn ~~7qTmUifJ]5/R .|E*4䟬@' 5Z_S&x\- ?BR_3H!P:!r&bV,RäjrAXժKcdG>$B#@'s_gˎhFnAr>qmz.v.?aX&Ԑ8e}ܐ ,zjM{yz'~ߕt,9:R "gNP zZe׍{} Ntޠ#j _zAAmmqmm /7<̓k^cֻ_X0_nhO82CԷkpąP/ˆgCy?~ލPcvcu$\Vab#nL! TK`RncBg ~sFĻUy-_|ldpE,H9=uC!EB)"{qֿ*{OX B HxNnHF [2'ʹhu ߘuV#ae zF^{0n9;o~ rW89;M,F-ٛ/.6"8[@VgyLJ0&>通wB;)A>3h7`V0X3Rc>d0XuZ䷝9hAʢ+5ܺ)q} pI:NU7ZvSmMFPZ#KMI/;D&)xGYuMlf~r?bQ{fQȀ(i@L]Мlär/u-vDvx$REoqLL+gDCX^PKU\Gw8:w V* zD3:qJ_dU[ >j/7}'ڛ -qDm??ןMݛ $Me`5qs4l?2( 0U|;iql_[ցʌv {}}Wn ܧ8fy >Ȉhy+#M0TTQvJ9re 񻨮\>:n r]fIJZttU {K. T\T鍂?ygk]@pjx>b<ψ7;Ycqn9>:[7\ V|\s0KM/lZd9!ȝgߤ9R6%bchP:1UPINpYa,xd x`bx60"8wý:;}sAcI@٤,Q,ڷoRŋ !qb Ro3|ns,y?BpqepǖQS7Cv;LY&qG<ߛ&pC8s@JT`US;-=R8B2irYKϵqKuẍw}X㯽պ(ڴɌh$6] ͮ1#qVh̾ï<99|n)XDVJP %D=˛X5,_ܩ@GifBLķ]TSj/`9m Xw J:E7a$zap:K^wp#/XϞ/dQ@Aex~BXɳ/&u'[ JZXɸBOIJDwgRּZM԰JKBH`臢j]ȳ$kgߊC޽#fU+ mngTp6 Z`_"djk`lF=瑱W6KPʞuqg>O߯cq5g#p p]"fcgS[kex::z= +F+G#Y̸Qs{)$*7|ux$>:r:Dk-ì}(+(!gI!(gsJRqW{&N{'+r\6C*} { 6AW+&x<5xN&!)|)$#;z|tN eWk>KSP0 ؼ\=rtx4[#6!I3]5E^9tb 3&zQ9ekm\u)yPxE$_.FIeMٽ(xE{Hj\,b|Qjz=iޯr*$A!)y&=m?Pu_= S"kM3 WR3<N'四A-It, )rF] qͨ P^os%Ġ"Bc!f!~ p5#Eq>PD[oa<Ȳub`6[FEsC"x[rJJҷ]@IHbG JShg'A2 {Qfbn3*؏#6 j-T9$:¦b m+x+ Aug j(G[#z6Jwon8.AC/OPbNXP+s5T\EYR>P̼Y|CD(}F>X ;Wǭ‚!wS(dpNUJ4_Wվj)D ,{պWȓqR&V=(}պy6&okj]ew4Lr_?й/QE + e] R>?ژ+|<}MKqbH c72(,Mlyќ;>..$O&=<ǬqؗX/E aom{c g+ypML8͊u$Iו_,m,v7qTDf k NqmctiH|,:Z!\B-N21MSJH ,xج6}{ItZ~ *NFfEJ&.|8:Mrc7DqLeƻ*E`pⶡk) &ݸCEֈI/@PVP*iCm rL@"MV4I䧗dx)=>=,%Yf2awDh0f][|7˜KFibQLvr0% Fn 6F&_)tx%Ys4 Ay %$12=4WᵶuU 3N[fT45@D`V]KTsrdD.2 cUcp#X b=7Ha:Ŋi3My`CA&M%C\#7@[:h+-\5 y[/? =P {c@P Ugd[߳NpSf֛.ud"ؔ\M(5'c mϞpaxG]{P"2lFf>kx4; anO`}+lj A*`9#rՎlH.\ C4v.DPUfM?LvRuiscڌV׸fl^eܬy|F3ٝx@D+X; cݣL5ЅO؍3m^RgH2D$@͎k\><󆚹 a͙yҟt/dO.JsIa^ta) l=!$%eYiuxP7qth#&SDd|U{}7([Z*ϛ\Kb[^Jijn['MpwW*ZIz? R5sJUy~N/-g/5`j@ ڧqRMR@j}DtF&)?s1YΟ+hڌl-P9,5dž14Bf%۫.y~G 7U*boL.u*CdV⟳:̺ӣ?`;ʗV)6cYNYPL8ͳ4ط0%"נ~QT20kj>@u3/E=u(غ@e!uZȰ_vĸ!h[tj@(\Ѫ^x|`J}qȃ-43=. ow LVz@30 WrKvDoT9;NA$lGaM w{˓$+BPZr)+6C9% 6NOEp4ߧ3q;&Y{G) لGK h+c~,]ó#\e69RsIQM^&|2@`J>03 : ̵;wYh&OBjuoS!B@x$R  -u2#T|cz nјRa0牛>,, u`n %3LRcnSHJ־/>4V0dt`rɛB^4' ޽ݎ?6bְtҹqUspbӕLF0٨Rrļ3vҨdΪb~H?k]~wĀ޽)#ԤɽJ[wu)\kɶEJU)~^#MejO4G$,y<^hHNge!;KN-@ei5%rA ^lW/q|Gp-Gjv(ửujsؼY3rCDq\؁<B?o;] ,?U,&dfVDډAN֒)^P !4,i>) 8rx 㤠OX:0S_ySqR%;i%C"I]B#u:I`v{m\%2D O~R9x7,.j){4_=<=\GlD'2v=2m9m ͤұ5ř,$'Ok'\쟻ϙZmkV؃ft\~'K J,<i,V#| H]!UzA#vm:3\=9v)?-\܀~+ J3쌐5GeyP6|PZ!dRrH(=!Ü;,(t`)/ӗZNuz+pT9~.1Ea9ȫ r\+wc`a24JB&$PVQ׍<6Ńg*A. M,ېMgd D,J4\-imEKotWwTp&`)E<xX|!c+b9urc59ɛXfj sn4%qMyA%0C(^ R:pāI*N\ڝnFƉ | H t'@9e]^^ fXPƢ"̧%Ց( w93aO7HUJ5[k^/ oqU"&T qOP e1[n;XMJRP3mei+\lv׺M(?B/WʼmN1FF ,WR<1B?1E@|U %O!zogŇxp熙7j\Ti`z)Dp9Y~4W&cEBR3IB\';jg$,g:*WuG3/z*N7p<_`j9kU1^o%$f"ߐŠ3>t^m*"MמOЀΰF_YFonhb%C=y?8 ?ͺ".u@$#Y~#69\coU[J`J 1~ˋ&ޙyN<Ң᐀I.ܬSsS?HMT(u%(6k>H^Nj!BNF(\_NVM̦7\C&F v͊5ѭ0+]H殂5 Ӌ 09I:ebU HWΉ(+NyF8[& >@\N0dTIMZ^<7U+;Ҷc7OqpoٖyKI2PUVZHہE[P\N6׶Bޓ|ٶǃ}TeJ%x7Q*x :$$9  ]r3Z !Cq:OI߬$E *_v\?mq~9@Z'0 4 c'`4@џ [!^ΣCC"o@֝vV(pj3!H(5'۶goJ'k9h ޺o(2R\b(Ž\sdXDô]ߊLז63>{LZ|Wݩ#ҘT wgMFL{)4j]cO5 /] <:.0jVOā _Υd<df!7%y܄AqkO3LC27B\hLN+ xs2;wq WgIzINNALL2~g_5Vj{ι!蠰Q" )'wdګ Egy - x6_vczT϶\jcP_{>LP Of/,g]`eQVWCá hcZ1SCA3=bO)*.]/Cv_ j"ޝԬ6A\x[)SpΈSȮᙚ~Ȏ;cՠlԨtU^΍RK<"2w9{(z|ϥCTrx'W<VE* Ȯsy;> a^' C'@"Hnzۙ/8.8;1k:E>Xʲ.u Y^}XMHݡ3!#RhLC?_.wdYZˇx22XI7.xXWӱ5v%Qgo`zS.&J+v2d:\h~lиZDҘE#ά:kbS a"zsB=kUfh=MB)!A鵶p>pRFU"%c3%7vK={Y;vj ԸxjZT7;ڸ#, Q4%RUbjz'0>sՇtS5A`eFzII]BV OH tUmI;g~RDQbA]Z?eltp1+<*{CF?UKuw`"o=á..r=^7Ev6w'$k|[A\PVIDO= 76/vɌX5c`d_c猃EEZۇS!5 DŽ Vʝ&AGa?<9 JpRipxE1&֥2#ЍKk0#35,N%~%Fc["ϛ e @*GW.e <ӫ[{)ֹ1AtBs BCs37v%K5۴@ػg{/" ,S_>5OP[/9ݜ?i ^R5 }̕iZpvR1{J>l bTP͑sYsLw)L<]q+.%q3avMeE.ԳPVH4P٦؈]jJjGryAO14/AvC0|S/\nluM74nQJ|fuMYtjGOU &|DU*>K~}yYKig ױ8%!_V|k aȵ/.rwNƱ~Mʞ\jh5ʵy§ wi8D`=4gO*}\Z:bopkz`P ŲEMjNt[[Rm:Q?! Q~aJhy_,03[DTp:du OxSPؼ(AEkss",S4ߡW<`Dz)u{ȭ?LJe}]GpwO`, T*c{l.>ޤjQ4p-[Gp?^ZПg ܿ( tYd5;K).rsXGn(Yeu6kPB1jˡOY3M"FPFrg2j3!}Gb =pن2CpCץ>A 9){?_^T< HPP8.ivN8r,yw7>Cw|lQă‡gy Lā0 7Mj*EknaPRbehU5Au}{eB$[aɋkb~ͱ[c} +ٓ.,ŵZ>+J, )2rI9*I$]"FDXtq@{ kE) ]طO1atŅ$aPvqb!ף$Y-Do's7{/1<̣[eŋ-8, ZE@[WW<4 W@OhjYzt$gةB*o1ڞ"ZϏ:lw.x?nԔ?TW)~dNƫ,-4?1m aؠdfk>9q2ɶZvE7kXMQBnjm:M/h >#I/pnrdtɃ ŽΛ ԝ (rve'\_nyJߡF]c>ĵXm&<\3W9QB5TNѮ&!}˼*ߦ~/\?sے4~|,A:a(<';AFGOqm_&ذ̧-hSc*ĊkIIn.gL 1Oc2kzt@E0D2By)m6zl\퓵m|Ve5}YZ  YB5lٳW%2[FH"}+zs֒2;od.g k. 4H]{ ijSp؎o3oA%<6Yx6r|nNt 8"3Jo(!y:UtXbkR1YDt׀yG{S΃E, u+MWT3.k'(25p5+siޛWu^b;:U.썕Ѹ(:EВU;O%^oDƫd1<8}okXO43lmJvf> %3Ye 5Va]T X4XyDHc0:XgJ3SRn0q2lEʸ/gezӒ`-thvM $# fdXG'/\XԴ'm"v kz1UM{D{qA<LG11K2q:RRdR#ie|IBX]jyCCb"CcV3j-@%ҎGm. 0JRu*|Iy9?Nw[b 5؊8/Z"&fPP5ؓC/IKչqԇ"Wk[[dwwFj #~X-x޿86 kN(ETW~q[|.zn=xFbp%H|7ʹ2vF宧s.1; I!i~?Gxz:LQ?/1:rIr~9u`*KO,_aĕs *U!aX" YFfu{kq}fPXѲzzc=K |ց oiOOrymv9:UN"ZFozb\V !C-n DzJ_!Hjx1oX-xY|][k*H&s]P:\Qu$o?d0({(:Csc@½ iBdžc^8sϣ_sdCNJwOT3:QzܪOpć)ji6ZߪfNdiVq 2 B~cI;2X'T{ZEu,b^87k ;$>}RA@&w^HlHNbk{5$t:am`PI$"+ؤ?*UU3oNc5Ĭ=Cdw.%"ܱ wFSS:ON,y'[~3K³#f{Qh'dTAK#M9) o`ImE@1kr⩇Eˣk9T6U **tG_W'c ggv͈W=Ԑ,$} 4>Sg0~[QbgoCI=p*APzdȚXZ <@"&c-# ޞԊ:mv+!X40x6:KfM8jJ!:5e ZG=U|Ng_ n035é?0q5[eaFkbͶ+dHuD3y ZmmʵW,Ѻ`Q,adB{O8T:qrէ Ar3"BЍGyUw$*Sh˔>(x!\sIKLlRXb U`ҔH-3.@KyZݚo+|٤ 7A7bC==[t0wͰY6L50@ɛRaSt.S%5FPW?D@i8+qBֵw4ߌej-Tf']5C|ݏ-sMSXI6!jZ}E߶/u %cT[qoF܈ٞ^UYE{.ݘzKc$g~7N488_)p-]0m+1Iǝ;p<{Mf:yIn#娼jvBO.Xq[9=P3OqH?yq}t iE9DiUuŢn1y0fX߳7t]";݄#-#]vPاcf&])vNaC3DP;upqmU3V< E&OγÞ}wǕvadV ǚ IGHyZZ?_WVIMb!z!=:R˷fur$o*X4z37?gPգ[n(/>%Sl V[1aI{Q|i6xT?DC 4;bd(m9g ML6Dp.-F:LKi=tp~阄A㗴>r,Q;9܎lr2fKyz i 2x/~Ž|6I&$fC|+1Gɲ.sW-7opv /T;2nIi _ATr{ߜ .$Y6&I+_toUΚygVBD}S)7OM̝_<־-S #Eʴ4b Ug ?wMXݛկN%6ϏZ $5sJ/J+{W{_6&}?plƥhPGA"FEbб*yTf:ʦb+ϕ|lue:}Ձo4E/W7S(&51Je6RuX&opye] ~"Iղfs:Cŝ@-Y.|carjWpӧ)}lh?FXONf ؊PW{&WĮ{.SQ*&C҈i׸"{AzіY@T3|s:A.6vzLHi Wىܶ'Z:|{\}Ic u۱RÉB CsH@TgȘ{4!  ,9v\ȷ Mګ ^T)Vc2Yl&ҭ|i*=%mEZfsꟁ2,25HK|,S/@݆4p7Y?pbPvr\:˫ҲSMO(,|$݆AAAk"_wej-wo_b{S TmJuNvg;=8)+j cPtAoi7IVU vu5'phq$<5^>Ws#h86tf["M;l?~{i ":dZ=gXTf YߨQ^×U֠1CRIa'1>PKˀS22,;^w2cA^5_}oPncK|CwïÉKXNШkW b z4FN)@R}*t4qXCQNYE}.F2g;[ѯDe9q,hmF!c_ :Ur ㏰XwLy5_kŒ!#H?wFejӨ +/־}ڐ g4X}:o0ouHKe:Û,ɛ{a}ކpKpPlKXoOak{@m͚"N9%l}`.[ u/N _1oDUoj!-RoڱOAV=F|N v{ߚ0yKӃo826g|!U&veL²5qLH byuZ4qF`_PxlED(19eEY8},jz'Z"\>6 e,Rt X]1 {?^AXHJ#"_&IX\1;(2lԅ ꭦs+FbW~h4#4Em+&ղ/%i֡K▊7=(%B'N9yEZde%EW0=f/lp?;)˜`?@U+&t"_ɻ\%}q'1Ì*DeT{K2OkOIU񞷔R6sg߫k7U" U뒆CO}t5#&wu$ 7z3cIjϳdkQ!U㰙?xo+^Rw0aAiؓ_ܖh^OM"{/UǞ#VXCO!ըl&pFp 󷾃}¡z`*'%pO\0KCƻ@6@q$&|:\ֹryZ_36o2%bLLpt!9diRj05U0 2jl2lU>ކBdUnV7 ǁ C}R"L}%N<D!NzTucDWa y%^;ƽ1\SKk>ېf؝1rC=RM, ovS%RPiwnfFIPj EG>֨"@`i* qE4J0?;/c'iG| ӷқmfIEILp%X0]e BbF+QA@l6K} "?ҥh"^8 f%M"WYq^NhӘߩ{!6MN 0 W=6nT jN_n)0xVg$mfH^aZ[eA] ,ifueۊX" =;=.b!䤥ܘK_r'6+~ 5}rW ɻ;iy7}ޱ*[J|<5F {sF:1u`a+x~/L#TzZÍkЇ=D/CE`«z&mz ^(~iʹL/JtVmGLjunJ58jM1ZlyOT4g#ZZiUO 2RRΤBY3ޘod W`CҖ^. r[*0.4wས>YLLARz_a&D J?ZW5j @hۧVŶբ@N7l@jS2,4-@r 8ì q \[+(|(Kj\՛=Usdr$113 05$!'se x7C7{' [ć;)- E@ ^)$2oΎv$<A?8ץXRoK+®Dj3IJ #>4/5/'S~$J& uAGɱi60%>y$tS^yWt.G0[>?sMlr ߘyxugs;rkm>gKs*f oSd[$'NQHq\+siC\Rp֕yd0UfN.QD;uTߐ]H"t4ֱl+CW~y0ŀᛵ7/4MJ1bW{&.^C1t '9 @DF}Ù䮁ڻ]|~T^FTG ݘ K]=uۤX*-m0M0k%k~3 '؀hNir,͉ ۄ$L*JOI3hrAFb!*qΝR+F?=W :8 OPRdNv <=t0CF Z=*fD1t,q  Osn#M|N723g@B*g hKZiNՍ(^*JٹdlNð*ϤB[Yì6t`Ma< y&xT?ջdײ%,yI}y83AK 9.M^#cK6@4HknMAjsD>#*镚Ov0"_Bϲ(C\h:`6s1N *xaTJi[>A1V; "GM4a9iH/ԪqۛhG }M M{GtF" _@rҵ?>כqbi92{yU^fbunMb)Uɷ~m"ꆑK5v;Ȫ'ŧjwk+Kҙ@]`$b曪E])nToggߊ'FLzϐZAm$I/ܙ/: V0=^ΛWH!5}:Ҹղ z0pgg0u%n ]Q%3V[(g±beVcࢊe. 8/IxIs fl#Ґ3_ɻ4}iŸ,žR^md3ňc=mΙ: ;qחU$rM~UġT=9/b[N'%h ?8 ޥYLL.=I,|lx lx^^BcF:jπ68bMhRg F݇d{l@-ڇN-h{r(sؠ'X@hԌwZF疭F-c;Y}@TNL>zP Fud .J>3Va%96S#wI?4}]NNtXoABt!nz Wg(u@e󮨫'?UDS9O9阁)0* KuCR' {_ 8=/Rm"P d#k { 64BƄgCri-֮@8y r-SڝFlIZ !,G-&v rȕZFǒ2t#glUm&(&e; 2|tр\>x8g kaomygY<{с6NP4.rkoӂ|\F.u|v}9lϼpU"C&k{;Aw13;LC>Y fS0 ЛpHE*$MpF ]VLQ,(ӆ{4t\2dQrμ7dWS<`y^<5x _-ZU3 */k+j`1TBDj daC@O1"1#AJS:SBfTC4<5SNTZWm͢w}fqV+WCHP0*K!rQʦ2e166bL o"O`#}uoum鎝YCC9ɞ : [e¼Ѥrhأ4n> $_a.leƜ3v)&8+bTݱکk 'oLĤ#fKyB3g>NG!K}% B0(p\DT%L3A: nB-pa*!IDyh`|>rlW W֐gy(Yk$`` .4Fܩg{ĻaM;]벃$WwY,0冊p :y0QFd̢3c\g@[zʔ"VFm4iC ՒtyߢENU_T~^H .0DQr<abT< jixi/Ow&bJLt mU&`Kn}c|s3="3 t_f-Z- 2 [12Cw h.z ΃pC/)Oya,=qoS"^F}eN"4[Z\$T]3@ Y`p2Lj-4ߩ Ѧ`Ng gGX3D[$ɇTl( g&$=zYhVvIXUך3N-.kS!~ɮ[yQl qI8YJv;E>*/,_gi!NƗ0J?:L\TcY蜜 rԧK;WLEY|=<9 bE| 8CJ ϗawXq[[ll3C;gsIE3ɣ,@KbE\a6$CL`Z?4RGU-[$崰MG?]|~m?I?fߕ'HnUE gI^Nee$giwp~moڠVڿ[S.)m/wD$6(,JyHٰo-a htfτmVϿgW=HU*KDY#|PWF~5V07\yyWEkүF^ZqsTϮu1d@!/K8sLY1lƾ`41[t^*>\ qZI ݑ?p515,=&et BF?BbOl{q{ig}4 Vt0z%pw]ėz6?~KG#od3,zRrFL՟dGT sgfwsF`XZ)JKcTtH{aBY x]-e\%Ф4"! *3RC<A7-Zf]3f(~yMcfǼȞx0[ltc.6iz}Ln\uC^<-`.>K@()SP8;d5 PJxb@N 4S;ܕ:kܴTZgy\Αym<kvr 7>sHD̑U&D"I s,FO M:4;} zf {yPĔ\RB5HsPִnLrhێD٧h] ph*y4Z&ߗ]At #* +#E{13w0@$R<2~Nk֫^fbR#g~#&2 MZ#\>R  F3C~,s{t^$KZ"w0 B&.xm[q|wLbRQ'AP?VOzgQm1yžjw J6z͔ 6(c妻}E-1xc՞VĜ0}b0l<4qs?$nռ+RXDÀFO|8O#^ H973||[H>r-Ќl~>bS3Ag$}seTUA;^ܘښیX;p@`4 춂&a4* N҉ } +^h TC}fU)X¶Qˀ2nQ?M6S̩**G+#u7ݎM>jfd_HlQ. fssN5h~ٙ- kb-pzq%Xa,>Иd؇8L_v,sJ&~Hd'*ɓUKq$7e$3\ošy>n $a%n(pm 4Z}'U(96} Q$vFpnr̮)C ݪ?eM>rG.h(ģu (0AОJ96jPSH@r\ RCʹ%ef938yQ2A_Y s:KU1&Ԁgz3z\BRq1m#[kB]* 8:rP1):Eڬ6;~)%Rօ^/uRaV~gҕ;']aN &ܽ |ۯs#6P W<ǻ{UQat6$^C@4/Qwa{aA\)M%a;ٕk\@8Jyw2uZ jStJL֫v8 lӞ)hguuLں[lΔ$=48,͎# xgaݝ?.%#W֡oF9ӡ~?人0/~O/*"Q1dUM9c[XxfZF}kpcKt.D-I Xᚃ'C爫"3|E";ov+:+ ZysOjCy`VEDL {5/|"K#w5wF\lĔC;u'All$|>v:K},@*6[oRz^xiz7k)ȲW0ψPQ{Xe:tpHhv7 ڵwiU1Q9&v4?Jh&6`{Dq[έ C{kWIc镴RA]>hw}DaGo /!_Gِ.NR).h*:yTZ 䯙unD?1Շ4Gb1#li S3f1bVuD(|0 Wc# ޼ԱQ&t-=h?@]2]cJY~68:6èngĨF?弝G谞~]4Ie(3CH^q\(w^- o i_Dr) @Ǝq^Z_;##k} +"Z5lz yE0$L vq(@[s՜q9^TB1X]_ѐԩ=dWd#O lݝr*pɣ.ݢOSM8mt,/mw Sά2.r,Vti~'u Ic룷'{êR# ~xԄ0W@\~>~ނ׃*EVzpJlianCE'%dWsioӋ=K/s"fw, n$ŤúIw_kOC* gզA=tM^)?2, 0OƾJ 7hx*18gC@m.XOgM][?xHC~ sw[T$B[=Bg%=kU5ALOrʝ1G<|-%O9{NwwnE6@3L@e;P rfJ]d*+;FLEm {MPC8LCAܯvXh8[ĕoM|="=]SI2@SnYjG j~:ixuA-O:pt-)xM^@ғ.sVߌ<КW@z=7o?gjdX K7#XMvLZŽA)+z$\Q9A~|T<~]{6XW-+_tWs.0e5hCJ".|NчՋLXd!3 '~Կ&[=s9R !/AW8TgSҟx7~&^Z %%뛡_$sU,֛Z}xׅA"@ 5E`o^B3Շ XN8M @jt|@ b?k铤kQ׈ GO;γz̘C[FMvɎDa$V|'ƚ9 o^/xD{6p:xdO07Em 91-WjoaOId)Юtw Oك䞙ńv<zbwYlLIu2)˲|EpkH1Zn>P{ް)DY LӍhܐxT 3zl_W*, n_lj9Ǒm %]ʷë֑Cb>eIA}^ȼnW="Yk<8t ~wӿXy;}[Q"`lb~ 8Ȫxsvx,jBrcj8YP^OG N+j+!d' LJI漄= ӃwMT'hGs45Ú:sBlvRa_˿x=,ƾs]$c4 C قp6<:" K |Nfvdɩ2 L=MҪ]Q0| ZS$<y8OWp]+I1J|;UPw,zd~ީo+I ;/|2ԁJ (tOòdOy0 ю i -)x_fՏ3T:AQj%78%yf$xHs:޲]_i/F̦xtÇ,D% 3DgZ@O5Z1,c1HΓi'?C UѕŎv~![ç%YϫeVsd, g"++ "xAƹa-wųbFoV1y&T1,{!\q)ב=o>V\SAUߡEc.6IU -63G@?L̟)m =`4VF"-38X6@hGP'}FkEshw%)An`N$bPC^3N_' NiYʰC1~ƍ:zQ'j*h:g%)7-+fIY,e̍s&-oi'LMfUE:q0lcC= muPu~LઇUᑷNM[cT^ #KrEˊeKTkUeX*oRnvUn0k&9J@*/_4 g4Є!7i_FĨGs8bbn|{N]0U5}&$=I~N ^?r!Q*݋8f/h)*jC9OʲÛimN7C~Cn-~P]HCsGŇ/Ao66]"`]Ba?ii@~2[҈גKnY܃+FaliIcY;HޚT*SlxZ >1 ^k jV󗉲DHi^Q;' ~WRtN I!͝Y%>;k%vDF ̹crf%?,2nBV׬.O?A9,!1s[+iŹwzm;j.#k*'Vi ciGGu{5QQ(@_>: vΫg-2cCIo7J>[]Yf}@ ?56]+T<,Q!l!BcJ6xW0PKI,x0ϳe.>n|a\E/Z` Ԣb\Bem:*~q+ϖ,g^X|ҧ oç(.!neTwg؜ZOSheo3gZJ%;3gMeNڶ# TN[":b !(U%*> d X%#behxﾟ)j%N7x 5- ~/"[=FQ'!a&tvsz( ugy3ᴒr^(м7w@ERMhsRXnKRr>¡*xum?9fBo,bkv/_rY';gZ~B# Hʆ9g"FJ:c +,ydDlc9+ I#J?XOʂSUSYy=_UV3 )k^ɛ8z-Fe.. GN+;AkYs҉[;xI7+#Q(n^DxofP_uo%I"FFMnQnʜ3|P Yfx*&ch,*v7j黅v}*Nw7!\#9/kљ%Yk"Dd2S%W SiTa)LX0Uc8E8~whP[l?S||y2 IdnDM jjtߛK5Dؐ{]j6>u!7^ڇap&}X`| n]$C[1Y|j߃Ʉ۰hakU:1 Y2}N ɣP.׏_N*gpaC!,bxҘwr+)I%Q$a3|tgT]ճN<(4!s?p3āKVf'Gp?}[7s_L11R`K`EEҬ;L -Zc@U[ Uth{"(b &AOpˢ)zՒtR>"Ż%P4)h#uG m h )rP?S6+zk)XÑP\co /R)v?hun[bYnFRL 6I3$4:Sb~ܟm$%|C솆ApC=&kt2o5!Х!׻=ǩxw9u![s"n##"ض`~aq9sUT. i{[ q(\`$_BsYh-BwQs o w #Ud#)2֖N.؄R?X'ۄibZaY{%Oڅ{NjL 6xA7l^e]p F[DQX /'A2 [13mG (AQ J88PIFX3 <&+"E\!ikxryApHuؔrۺ[@1.e>:`Szȕ.+Y׵<#D3-%mkׇgx /~m!3m<$7*qY.D iLg~vD۽)F %HPߍk eu-~<ܝ0f/_c lĴ5|ŷ(b)\ٍ:6*y"Ts,gE,Nhϙ徼 pKf#kIp K $哬>y!Ha۶jYJԥ>&e6b=LmhWẄ)TYd嵛bߊo/p?gqȨбH|:"Q(+dG>R_Ò $'Fa+b ;7't˦lDMtk y2:{ Y9{͵{icU:,Cfh1j(GiQBJy>B"2M-?bub[N" ;@g<8d'Z(R889|kz`Ny@'gDޜi(@E g}h+z5gf 7SOt rxl~I(kl?;2٭,.A%lw!` /g8 %Lz)IrAS4OQلgV W:AgX9u5ނ~ qtOKcxBaЕ|2{+)8SzYRM0\wKi:lf=p]t!E.({ht)

3(e&YwF<;G28S(e 1 巹aS7>v D@0 vʡ- e[ux p'p$6q6J#FJ-lcGTZR\ #|,vJfc=RRˤ +1?}ۄ~dhӮx\[XA"X!}|zAmwEXFRoEG*s2.Lb-ۈw.mfG>G@"CM~HoQ>ho F׃;ϸ[CQji$$TP0 (fZHisYlk?%1i\rSX(1&塕~ݶxjv$<%QԿ:_(cǞHF֦ex$rFkVJTk@N<❰&Z >lK3=8q L|a["pFET;%`Zߪ#Cሿ=o~);>|*t#$9[@4%1!7?7"0^8c~ƗiX4h 4W(u`X̊oo'|>҄{8,MGuA n]YwNAKkoJz?ByUNsy*g|{.(A~c:]w'm v.lWcVC^1]M mbJ7 bH=LH% f(ڞ> YHi;MoRO)+B`5ͫߛ#< E7y.y.jr2>?LmG܄H"H\:SF}뤞F6S(, !EΤyIٽ="۳PI=噵^byNh7|M>WRnxFDB!ɞKuc̶vSLքRph Of*JL.X+u5 Im~ъij"PGH#'/_|ї3li =ZZB!@5${5N9J2#bӍo5L=[ꠔ|FO5.@k%zeZp|"rgwTӨ1?[k>nO\b,l>Y9视.;` f3H"pz37f" }7q1c )<7|s&QY:Y!|E!$ p E!q&6 *% \mAƛ<\r1"y0|蚤&<)dTR7}5~nhB6@dNhؗ*C i'+$_TOS{ʄ^B*cA4̓019+<C~Zʹj1Iezf}eZwB*K>Uz5h}dMm :(R4\ M*ҮFE$y~vڍkw:w).)#FcUn{ȹM3oFT\E9@ glх]ٕ ;F/Buq|\Bdhp o2eSnw<|qXUkGc_K0,+КOPSp0yQ\1 %:&b|!b˦X_$DC.Y` Nįq<,IY$ J:={ !*n!(d(h+tt-g$&(3HyT\PP?Bt 'sJca. gm(\3OSԁ獎k|żGl.v 57F*˨ D _ +"_딩?'j)ވkp q|!W p;V{bL 9 iivu9JEP*r2aڈ>#ՉqlGɶ+C#V[4O B;xrXWvמzn\Ȓ`ߘ3}be|0-fc=*-p(E INU+gE ߙmj$#(s2ޯAͺePR!c͔(qָ)%zPi{hc66W;@o ֶBі*7ĒeoYŞsEgwXcq0M!p3XXr'ܣjQ܍8l6^Bdj-"#bж3bs:p]yl[ca@ sbUb:֊l-t:\GM~HH[7!t5RM0ypȵK``kzKq&3*Q =͠΄2¾nOeC;IIGlBX11%젃K/YR_6W|P !l rf-Ү;J'?4X!먢 HK9V7)i4YY{HAu){-7J{i vE6F]%uT4zYHHl#(;!zO9* أS yJ@4W@S'40ĈXj-{j$oGdD8g>E# Yb;O{ҡS6$`As=²/Qduⵕ?Vs<*fgc"V$7,ۙ_'k=/Yi Q4K]WN~VJAibc(t Q7\KR*X2B}4R\D="WO XgT8Ym:ǻB,vo1BCCAYO7-%%UW)d.\TŹι]GXi}\hJƒ#~s_pSOL(O"5PU 8eu40t${DE~q4'qӇDNŚF)HJ5p.4BZIS^e->%97yBPz08G!3su~ nvcƁɐ #ChNŤ vZBri߱E7n-!)-{V6R]]w0l)RK9=;w7?X.%mt"K°|ei_Q8x, X̡(WȾJA?XB/6n?sv f)１IL8N/+WnPyyd-~^ FD\w\d*G*[{yz[r)cN,OrUyhi*8pAOoFfTv% -FtFO,=G6EZcm@(Ż cKG \@EhX#UvdQ{ȄBzݗϿ_D5L̆0Q%3z$f+MBES jՠP{$z Sh 0gXc,NL~g3 fSzcS ļbrֽ۠џ.*Th$eyˊɠEWgoӦMdZ/ ~O8&>YΤO*SAR;/VvC#Go-(EJnٺ.7qEOZM,`;MH"A`8~EJ I]pH)ج^UЄqAЎ]^|]Z8zvɾ,nC>u$BYsAُɠ2  ]3{%ިLO#5r0BQ[[a[VVAޚ !tOoBP%~y |E TNyoW@4L}^2ߒX.lQ#Y(9NTpہ0j^yW eD'H:\ UQkUܳF1-ɐ$Or{&8&qOoI'FOuKw驝 \-z6>hof+W?we0İuLuE?焎9h0B|2[ca"Eb1G79& @d}RRANR]J ) r5@N$/Z5o|e&bL3. 74hB 'H_bj?F皂{KIY5Ɍ4_8l1ji jָHCQ3:ߟ%K1*S`''#mt4U@eރ`B.j|n<3֊ @e>0RNNl˵z@t<֞_tIbVˡ=g d'):x9"pkɢbyJ0O4qPr:",h > W^m -cv: ;b8)4cfa,-d{ )0[󜐴c0c!\Ya1PZooi`WZ?%6'Eu7&ϡͰ'2UHb; Gp4#<^aߋ7_8p%Ϩa \@OhM‰lSi{IRg(H=eʋv;Iѳ=ŘV*K oq(}KK!_#C~F4Ѩ5݋5@suRLcԑ5CpKi,o+n4(9#IdtC6\Q>aZB~ ɳe ^@]uHrEAˣZ|AiLa[8t+禁h ?N\Z+) @( V\tذWPgOxfbk s0:j>wi)R^ ݙՊ.:ퟂ jI3.]p*;nx Ե\8yYR+8- `gq4aAt30-ii Lnss+B C\]1\c]h;fW8f+rvbVy;s`zueۘ,آ[tnI` Nh@KmAǦTN'Pמ=%}z,U w:cVBߙƇ{f7,1!iҦX2\ 3>ʾO4$fINBAo&6崼isRl<۩?.t}4K8m)vs9+ubxvS>`PWHV;@ E=y|7d~;mD^P4DFx) 7ޯ\6OlQR- 0RJZpXDoz6ppvd ]P?U,q薞b2ɹ92C%9[.Hʮ_7>z =O{@{I(6.]ƿ7U! ~u.k6Q$Q֦3Q(C4gnEl Y]=GRPe;gATUEЊHE*{. x8,K1;@=O(q 8TGL24.u|b.ƴ>88lmb.͕׍_hwl$EW`LA٩?5t*AFs0cbdTϾ c9-BRLN=0y/4+ϲ£!Xusq% Km^=2q~iߡ ;tu %w]U}#Nρc)5Lp\j"]FuAq/R(M" Sn-%v)S1ߺ1՞xAwF)O+쎌 =cn|ZO9isqSs~zA.h SDGYX$ lu"leɺb 'Įd3}S+8]u>Q^aN}1;z3BY!+bTk{(IQ\;r&^d:‘!R*Y%eB"UptQ;>5i`1lʴ}!Db/+ZA݁hvȋ ÔJqd1NՀFr^=c/`J3n1Z!(mGka%ƑM-a!M`~^~Դ;0T{c FmXÅC8A@4"O5e_/^o0&zVUJp[T2Qf3!f5bUr~a )ן(z B"HgadBrgCQGNrz/}Bɦ>*E;O%T(-a\&2diP_ңrI'2܄P# 7F^%ڀXmb#z7H]E$Ll?plSB,Dz} :7ۈ{k蟅?^rY3s\/MD;C$oy(Eތ[7Fd0V}ojmEEA]kB%2lmЎyTl]VN t)k_k}+Pϴ1&|n!v%F*7"sXy[D+] (Z=" "ΓrqR8v,lG&Zz=@}Z7aܹ[</½_p.lߝ|BPr&ۭH ;suORճ8g ami2_(e+@0- ZBe֌e{HptMAgf$dT8ͻ,a61]=L #Gǟ7t._K<İ_ ,EdU{nWb񳴀ᢘMвx[ˉ 8 o3 2t;j͋Dı4DR"qiy_~_n8laz;1ɦcM -VsFI@ \z"^fWAoOJb>fY~!-kkVpLݹ~fby`e6QArf:G*8sX@0Niv탓zfcSb 1f"찎rC}ʬ>8C֕o ~}@L@:Qߗz!旖s_!_ZOQv ?<@drIJl`L6gbJ!iD5He ~Q1MW8y.\t[E%^Қa]CU VK(ɚ_\4vQ~άY2Ňf@$.mp4m/a_K8E~Em֑}E&l":RZ 0ǘ Yhc ˈg-8k\ˆA~)ݎCЖRߑ4wzÆ ֢gC_2.Sۀ,$,cȇZu&5_zZ}WDrHFj*{'{ 2<4Hڏ$Iy0i xp2}=`=+lK XJU~xr3؜Medgmy lPh{d {F~PuTh>cP)X!VbW+̧"2 GѯOlƾ/*S$m%sNEkrK:W7CȺɾG%-ۖoO0kpg?yb~,2l"T =<-hVZ0~Âл!4`s.acm2]%]|$Bb)G35L<_Vj`!n=H~c 6bL-FLV =0ъڕALYLJSDY)x/ӱ`(uqLhEZ 2R5khW7"GPTڤMdÌ"h6e(XQm/?n_7#)\{p+e<CE6v/R߭cIK)c-[\a^ G2bWR _W׌t. \ ;8. " r"]L78=)E5o}dO㻞zӓ\[8v⋔ZDj+ΚuEfg2k(o>.}g<[# 'whE<r9n:f6;A_O,QV ),7ط?ZM*/mzz^d1!;{w|s2.!!ɦ[kT۔" 7T6x܊)[ډħ${!ʚ$ UNW7Ê "xAeHGg/!JXt% QY`gF&]ʌɭA;KOXiYR('V|lcݓVN m@ik dqgrB;x֏iN?1/?7~<FS!BV2O0SˀXt`.9iyVȹM]IC#`C 3D/I_1#(b $6C$[SN#1#ϛ$?h*/pauH \ޅuGywsnr6s$S^=eVǗǸk,ȭ6Eʤ GQ둎lguTU>6߸;GNoY[uo]w_SqJN$i.z.q'>7=һ!PI:`ct}'0"PeǙNWeyH|+GּNOzBiQ5rmz 2e\˲ T݊;aτj1z0o)[Nn(UhP},X*c/_s ֳdR~]jcmypo%{/W bp(>kzM` yq+wV-$J](/pAMD ^ -+-8|=$6]NpJRXS^?B낐ܭ}Mq4LC\ eL+ ˆfnW/?xv}Rb֩cG=| odw~Nѽy!yR8ɬ{/ăIavB!vSoCv|0O+s\PƝ"a'̝ Ҙj5‹ %*'I~|S YzĻ̅K$ʥ;8db(l_?#/7!A5gF@sJ<>#CG> F_ꘐWyV H& ~ZuB!0;VkwsBM.2"%ɶwf5\ZSJ &?JӬ,lHQ/r_@Ac 8-|)mF\?aAcr<_A8c;O;Qxu\FIm\]7{3~Ӈ%-3bwsH2C]r/9aI g<؎6ޢ`.G@E6Ru&A÷T@Fk!z{B}+ aqxUuϛob!q4C~'|>Ufnp@m6 TS-5<_!IeN"&hwQ"OD0 .wwb` ͵[Hejۗ=%p*ld?6hdss$O`*!pYס3u^J[7OUe6"QWxw `D>bFuzZkLn"w]a†ÛP+%U{!uLt}N1Ĕi"?+R0p<kTǛV|*kU=#׮i~.(ƷVpP _pr+EotrY_Z 9ROI0*)*n.KG׎w!l8cr[|j$/CY^Å?f{ɦfMT[vtQ `j/ݩmaީa2\W#\w(g 1I*JI<g1sQµ_'9FZ7RT*ДlA/ݨ/W=53`LteJnTPm TL_''^Ia7 @2TvZ5TY @PTKDk3RPe"c dـpЩS^Z?7. P \S5عdi4bPqSu+眭w)K :y9ĀE:oK  EYFe5s*%Vr2Ƒ[ 6I1Ζ{S,Io}܆6V*XD)ZA֪{ս=7އ,U_QK9ˀ",IT?xF ;7*Wbr'd5])l'> +ح?ȁ\=K<:-;%@%\AJ6J]npPFk7.Kŝoqʂ_<S1UuzɆ̑?P" 9{tcFA}W8eb|LgxQcndtWRW6 MaƷW%!w\(E4]npˣ֗1M#+G/˓xG2co`ՄJ]k*eW2dQrlN?FzC|Vj$=j9͆mG:5,<ۓb*[* 18I(c  HxmZlT#8@Yêq;nÈWRsXq%fOMri{Ѐ8hL";'}e"f?>N 8G mz7]ÂY\Ii f pҨ# b4ZҤ!֒Jn&]C%CE6g!qCV|Ά1^$=a_t`39>=j  1׷b48I;r߮]_ 5a\brR#uibRAW1~Z@sko m+JKW˶I x2/f==r9 Q|.r^h,3p [D ؉DC۸­g_r;se "z v6,r± w;YA\|M2?ռjwb>a籃CLXv=,sd*/lu ktŮސcT Ri,krG#j!Vu'aڞyqwǯ4U ~?to(-Su*$w NF}6^y]@C[6yj$kKh;7lТ0 ɎxQ [hހmJĭp.jY;H3#K\Ǧ( Ԫr-}5z*pH(_ f69I`~~ǡSgs&3E,2Jʠ%}=)KU'Q|{}OޖG-P[s!#p56Ivfchkk heI~x3 qj)]u$XX7*1[c ^塓Xm$.o#]pM)=~15}mt!A~gr0:J1:ٺ07aB}Oj]q[mZeު[b@:ݜ$||1/?m{éxn]4h5ߝd$CωBpے)eJ}B2 ,|E-:|sDE.O7oZ`B~ͭ2/.`>Ktvզgr p+k*q-q'αc2׷&c+o_9D,稅MEDK蓕 \?\BCꪎ^ #OXelO]OrƵgנK ;\~ftꭶnCJVmD`Śn{&gq'K>7]U2 <϶\ˮ68tL5@+*t uf3tj=x}NzA"(1<paF;rTf3ܐ*ݤF9!u ֱ s"Tfvv5A8u?iJ[ /_ٷE__A,623Eo86ۖfNQ[SaC VyU²d"qI6Ix0'cZJ3ؤ9 Y~o9 GQ|N@*ؚ݉C/I7=}$ڄ20,ZLgI#|x`ǐhüϹ| 1R2åBu e6!6E>eUA=67UMSߕi5t9;<^+L_ d"(4a[Kvawn ~4$)(B v"MUܒ]ʕݓSP,Ow׀ws\T?qazDpR )_q4%ծ^@˒iE.D4xSWm*tQP9Fj3)Gߓ j7&uc+v,x:d RbkIAW'1uZʱ+)[ge۵j!㩓Cُp§0O|1s#"UxS{V!L-CΡe/P1B\@[pq%٨$R@"̈i p͜T?Tzh?hp =yE.i~2VT9!Hnzem_T;zYT- j߂,ao Yr/~o8DնeM oK˺_'m*xJXum~ڳxY෮ }Ǫ)yWM@1@PNsTFp椨zY˖ۨBX-I u`腀?bn 'u0'?D_SAS5ˆ?ȨNUCBUKuH.m\~{>0ՅJɠ $BFվ(.G􆰜cw Gjl/-U i3nP82I$$8vs=-טXEBu+MJ_6-,5_ '`SУI!J%U򛰌 Vy*Z\fJTa_1Np.Uk|fB1b*g6-jܓ30+t*F&y׵ۻ̈C(=Æ툰yʝ%<~eql>\vDmοh ;T*\Q2U\vb֍͙X=W;w6jNrmT)0b|=H #O.IȔX]\~wD du̗d7: 5aGmC>iy A4iM>NO#͒$,4P~sC{+ è$rpPU /6<7 -Xzժz<,0sPew^-D`XE> c'+AfҘıDDH~ijX΃1fAժC hk`դL14”%6%p1>ډvK#&* -h#3M/2'o΂-Z:pNE1q7z{h۞:',w{,v>=;/Xs=ETLa$0s*i.Y ʿ l_x%X-$|.T?=+C_G5A^ks'gڲc8爩AIh^X SAӈDHB.T;( qXLC}TRӖ) U7FUPY2VڣgF%s\é;Qc{}v ׎ ][uZ16FN *F◝^$]/O p>.c[iB/m(jc+[jjGJ#Y]S[$I`J2l\ 74.*ټ#C4m>}Z)90qYOb/,)D\4+8Άې}Swc+yI4R P;l.-sT-W3C Qmj\_z3zp@wJ'v`!ۂ\?K\Cr{ K9)N:%*CT&5^yI櫢:lIhT}y8ml^n> `?%@:s ׶'|JRbC{S.4k$4΍Gk q+ekdzwQEä?Æ2vI~D_ Gg@Z9henaȉ%UZ*x /1ܛ'I)3Tl ]qriY7nԏNUe+-&1N =^ulFc&}ҲjgRZph֤񜺜5U6+Ey㫞jOʉ-,Ril%*qK=BuCfoqTq_r!?ޤK'UN]Tyq鼾75aⱨl@vO#1gtJ1}8$|'9b+oOR ~=ۙ{u̒2|z*Q+<)&~W[7M70F3l~xd&;G%њ_O~Л&Yk#|?}>kc>/ Cf$3$DqaEɚ/R.~gCRGs/C 7Xſ/^p{Gxz!Iu{d*OrjTe'I80QZaoB91zX Q J$+N'FKiAd p";jw4 mĖE<Ҝ-ӞmYikSNwI{}&Lcr%J3~f<_&Ei$PK%e d(*CiTiwtVЏqJ ol9^ٌefVnՕD&XzYeB=S4~,+gBۻ-fW 'm\!ɋRXE !V Kxrv{)T%14K =Q+#1t\Fī7te~I,OlKSюT,xpR-9 DŽJ7q_ڑlk_Iy|$hP?qXS?] *a;NcWyy{_P +N?ͳV6zSsNL4mb} Ba0IV(0)oFmˬׅp lH*rC\)!eyO6Y@?f~~#*Pi);P!S&ɿ2K 6)T9C M<4Q]K29'dA5E#("m jzն,s1&?:MhPfpB\bA bW>Q^N9r8cbđТlod~I&,^xY%4{6`+f6a$yH>Ap|PmLX, {N]:)vsZmat¤NkhÝ`8I{$kqH`g,׃:#.B 31S(>U.![^Oˌ?HwY*GA .$eNVM;kr8twU*@&X/ DExfL3agM8ĄTT~뒜 !~$801θ]r#\r17;ew<*|\|r i n4gEMOG ,ޤRN0x](bntQB"5bb_^_yS Yr8. nw$wu~1"3X SXh &r6EcJ!2~^ud,;U_.µz\=rS mCZ͊,䧊x@*D` +^wI̕ƂMz{9bRL؊ӛ/~]Z WQ3 vٍn`ӱ(e5鐩 q҅6lyVG= }fm}R?p_NC:wRpq0/-yy Xd1>g&8N|7pȰ;.C3=chu3;d<22mᶿ 7?_^x^ o D( !qjh&._ b[_-'|/ .K;;ke+fTЄxO:oeOc'\Wm{6$VQ|2ITՂ-z2ɤFlmtCqF/DV wxqvʛq(qqw0k*OCZE}z2;>4Ğ-H`;=6es7H> Oxŀ'3&*Eu'ܵa|lfrnC^驢\Ŷģj2>N&<]1+fe ̝9z67Ȅ}?6ʠ֑BfgEes׻o8$KFµ^,vl{sJ}3 Dδ3zCM2ѡ{0<=,Dg'k9W23E/ p 1wAfCeiZ9 PSЪw|o{|FthN\ lә=#u"M8vP/sG΅@lt-#^(Q ov[R*qNIzK`;JEY14O!/})$d̘;rhXZ>[H++i.x~jC$ECZsG:m_* O"w.gWHs4$?USfK"4M A&Vhk6j8P?hZ2Ωqqk{- Mu(/L JLp>(0, *>-$!4^|R!%"Mr1"N&c,ZRTuw"=-m%s Fk{ 7!-quQ]|?RvϺ E$Gs[|&BUҔA}nrx\)̋J+~_h6tQ0uT'b.lNf=%Lk fqeȵ^s,SKA[YoT>QUNO],dHDnG/l X$괢a\߰?xg-PO<h1tNћTZ rfz@85*"_2lGըHWF:_9}-!!jR-tQCDljNJ*`]> Q=Dϼa2auWR #܆'M| `{՘KbE;UE?׳$AB& d_9Y0Fأy[9NrGN)(ÕB9.{% 5[Wv.!9X !7Jh =w\,ӷX#«!QÖ.^q |1Iׇ%\VT?]΍=K)tx/Jw nWR&RZkp%i^0qƑfqB<)b K&΢}]&~ 53c22v+1D\4(X5di6'{ ]KbKK7}P(!;2nGb&7XRcz; )LR{Z45 ۿC1k6``!+ }C==ʹl7Ch>'|=$\ a ˶=܄Xޙrtƫ9u Dx$I1Ae("I`PNUL>IXTEu h&r8`hA?[JǰϥK*ݖ4:(gV{C?y}TEznW~ASkO3P,:C5-Ӹ뤣.f"q+&t_?"z"̏Ġ'\L{sRjsu 4YE jc2&;ZI8"{VNc;*Z H(v4-LQvL25{EP*Ft^(Y7 o鵔zAa=E/OeLfN޿O_K)-7ƽ'SeڿVGIuxФy|Ԭw@$?p}8)t&'8l1-&,IeӘlo/N^3${'#ƽE4RSk6}GARW_)Wt U_9ii2Ohn3Q]}_Q PK_!g&thu#&u/ e-/m:k\7Fodކ[ D=0A;oN!oC ѽM(j۩*&UkZ\eaD21c!̼p:iPBD!Q|ե]~@HF'SE>':ػ._  ]YKœMo)PORëfEzsOCޢx_1cK Xf=z_ܝ ZNБ xs֫sKg/Cj連k"/Hml*);(]%0#˃wڹQӆlN.ܯEp~AQ۔h|je,F 7AlpP^}8MĨC™2zNXx?卤gcb0C |Ö|BrGf3z91al#݈Z{qNd-T`2MH9€-ڵtʞ`Q'eI ʐgY;s]izJARS5A̪=UD&A (&uO*đI}:dʶy" e*NPS Tz^[|77:r#r-ρdjUUz2mʧmO%7\c lꛍ xza8{hnxH-v {ܐ`umgCd137pɮm=ٜry|%R MWn-3Ôi*[յdduXA%_o\^'vgEF8T[eh'XMڼ,_"3w"gonrkN a:@tա-:o+@ު'G=\1 ϰr{;2JG\w-وjضu%Ā3(̑&"UO?$.%Q$GEږ[ZC^'J<|6J;'A | Ms!VȐrhOK+hzRmt`y3ܻY]bH:8 +UNHA}mz-o ;.'9j27n沁j LNwyhNp׃{OhJ O=,yqЬ!a?WΌ0?xJt3)v|ވڷTq Xr8MA"|ċX5w1ێW+ LO l$FCF˺*ԳK%|ڄ;jkVztP@`W2# #*(|!+[&gWhvrωߠv!~D^s_1EW- Ց]{x{.fK+/4\Xàr3KjJAs`PEi7,O'3\\Τu/O#lsM~W.ZLfI{14j5J"^˽֣Cu$ZG&%V] P-X@jÆʠ9>Ix&.9d088C~  mVԪKT'H,QDb`q9b@86 \v>uZ -or(*/zEhAIU@ eʍEfQ-o%d`z%5EW-.M(A[78LIh*Ơ!X _RH;k%y7j~]uŹ v h 2KKu!_ /U l }Z(dǝh3֙= kxl\J)P#D4~Dv/](ح%w5[]XioЊJ u`cjYlc1kJT.U ΃Hsl#:C+. |W꾞jDlC}j5,zE5ٝtZ{`>s;U و$5Yq&I]i{aR P_ʰd QKdܝ'#;D;t@&|HlQ6vt уiL: ‹b~k2d0񭣜3|,˫Emv PwtXUXo):tޓKsvf7*Jv[+}wL&oU mUѾ_]OpMN%2|m粋}u!n:R_Hκv8Zv}TK)]vJsOiTzE6ߢ7VEl3F5/T_dN'(az[KNJ×0KnE_JI ]x,#-=?2ѿBKc-DroOt8DP йCUO.dF}(-V/&^4VxM8O]s}[ȮX|Eu2{ı"adgpt# Z7; ;Htx;]RAT ՈS옼:{wݕBFW40j8o[u X<ʳn|w׶/؄dיɓ>2$,ڱ9 fyzk T֠U՛TjškVdc\yY"jAO %!^IXMv%[1Z _jԊ%ȁH?*hMŽ.0Wx=NXnKJenѕc0,de(䮮b8oS Ҕ,>"тknl5ӌC+đ sQ7vN )N>ng+,{1X cL@"ϫ,rfռBRB_.ַ ܻRyhJp3D>2:73+Yʸ*񏞜şJA6!yvqXy+ϝ=d{ocidaԿ3Y>~q)ƻ"2!D0}(9BjhrcvS89L=]JӆJ? R-_9:PF8^Lv~ ð|ѿ)2#IO]tuxG[5ɚQ*'2@A M4}*{gƼ8؊_,jvdX;? @Ẅ́|256ɗΘ u?n~+p 3ܛYnnSA8ymlwzE87mc 80L +_Z(DFoA/Hw7Xy:KYoE%S!ݷt0ۘdM?$} Օ ƀ>.Ts2>~9iV9QMG9eVwXHa[J*5dvy۶IR)OV(y#3\&O_ [ z38%f^qR<Z:@h\ONnAHWfnv:,qn8"Y{Ѕuq1mTd"Ŗ͵[~YnN߈]1jv2,INk{(`zkT> C͔>L#oxbQ\)KkQjHv Y}䚼^Xi>RPU V?п;t630Ԛ7?x9-AjRpx=űOc+P|c +Sgn2h(Kdsjɦ-q&&DLc?sNCpv6'-3;QkYQ.鬗kԩ+q'*dB\^'2'챁T,4gWi W$GRq:V\?OiSj$ڥuӈs|Eڮlu(+dL ,kyn6_=?c}2ˌ!1˯.SS$@ 0鴂I}PKu>ӊQ,q׌,iȱZײrJW߄c0ՈH!\q*z+Ajmt8MrvxN :݉WVSvfCrO&9T 2u?p gt Fs^lJWϺk`X]7n ]`u %'ÙBE`K, fۇ e@pZSOBUtVe$w KR+,ME,:hsݣ#T1RxrOĮI.3w_LϾ(Z%6)ΟAO7|]!L_b hx '9l(}ϹܫKsq P*@Kj[Cb)1FY5RF4=/u \ %0gf\|4EU8=k SN&5!5T-eg,kxfJ nbqۋ$Msw˥} ]dUso >zb{VU EKoU;q/v8j1 رzTw8(py[q(y7y'^;I/}3il!]]]>"2KZN[d,X]8#d̛n-PT$b68^vոb3Tkel\%;<.R1Qɪk;cL.aG-8jh$ +i??3Vf#@sr:r;8LGogt{+SnMq -Ap5o#mNTkeU( .AEiԖżc5uã9Ά0$1BB~(5h-Y "P{n jӍN-y@kNG4՚[  ˛|4? yj3EPx*<䍍fsK ھgd-$3XA>zR2ӄCT- H ho}H* X@}cE>ϊjn6}5լIi0<ܤ—wt$tݡBo&7Aժ:  UM@wYUw"Ka{q.JPK0R@$G O@HlɘU-AIF4GoDF'ykff|ᰬӹx>"S^0vZ׎} 64aw3te_n5za@6UvPVɾ%XvIFn;݂2byfx0̶lR+ ?Vcr8P{f`G!cYL@ 67ZZA埆U3crۛ=>mV`s>=sz pe%ٻ=0ǠCZf׵E1a9x1N];AأIP#4*ubn#ۦmP es nDZ׹VP{{u-rā a3p4?*ӓf nTʞ :RS߭CY@%KQbݙ&ӝ&jMx^*{k}$R$4'ihW2i'VZw)Ebw]t5ܭ]Ȩ/HPb#.PޱM+ r!}CpM^t劦^sJ~%K௬:^v&.u? BC.?#p`/4FUs;1Y#7iB؈,_n*J]Bu,lc2[`#)}dQ^ZYXטl@hHa{g-4f2qr_A %uj|on% wEu}<'P9 > Ng<3Nc z5FE,hk-uJ/r=݌F _Ǐv@0%Mt̯$lcgRh#GՃ֧e{⋈Hv,Oƕx Dv3OOs%8Hb`ɓZczayix"$QsAo\"s >PTBM esɐmarz /4oJ'j'2 d]tYb';'y*n{bEzdY5aYYTՌPaEˋ>0poJ763_*[k kPJoF?jr>AQKqp2W*ޅ-i?{!PISsڊz mZl?Cཛ'y{ }g{ǘ=G8kIe 7#'ͨtItcK+$Zt`|r9,25)F:/ j3(mMp% ].NDͶ@I" lTm2ґq܋ʓOk[2,UOw%1@B56`5J6rD4;l03ߊ&L ̛5 +knIW7YEA@0{K.$z#n^LӲğ/ l񡺐2 TUC'F]10 '|45A׽C֚fM,G/ƔbVgQfS+oFQ[@=0n/N*i2epRDɖ."^F 9 A>rִvMd4=A w1\8Z Glުz.L NFER{iu^zQJtǵVO04Ű߁ 濌"宍[URu04ܦB#Ye=/e I4ΉlL_#ܩ]m &ʄt|fJ Zv\v0s!Q[JO,=R}OLsűhoy& ZRlԪ#_iBjJnz k`v;\đ>q՗Wߤ1~=wwJ?2$>}̓!@T@TbUL59K#F|N)w7<`)dlʟ7+ I#/[ѼZLMc ä^ygS -!@@բUoeqz4})P;EC=X>/}ΙTW$vrYvi;0RH݊SK|(gławь~[z ( A |3v0=@@jHj%y8r>b̉sPw=W,o5%UH_ F@ j bE34ҧy/YUΌk+7qe ?gULcd^<xM1|'"G0o^CPZ)619bEUIٴ%̱iN:EG& 7Dzl\l >q lSC' [J5-ͩ o=eG]%A!=ŵyƅ߅͛QF;OCcN'y'&Tt)2g& L@ԻҨБ] 6g(-.R(P_Rn~ҳ +-U`zkal|{9NؙXsx3k\G'O1nAaϟm?TdžJ/}]Pː8\N2$:o.]֦+_Bi 9k.]g%|GxL}>_f;jisb '3n#ްn]RxW QsSB첓Co)7rL.n( p%ͫ}ۗ8xsSE˟ƫb~u hծJH%З~#$"EpCtUo\f]x`SCSn'k2C zWUH0W*^;y"AkN2zU2IM۫|-HfQt~Ȱr:T$M c"sF/xs!cK{*VGk* 3OE#I I)whmcONrFs_Ň6&ʃ7$^?)0D|8œE8VL疍- 2` ;_ϓ1P@X}$%-3:Jhl zA\m]w$nv1 Hu kP*}9 ↿s ~!-l>FIr;;o|V)W*=V*TߐPRsfgު1Baݣ˳>QY\sF?} j4=|LfL0~Rj/'+Y99 ]-k2ϩp\ȌIVP@Fmgi2vy aRx,> ;x.@?sc [,U5󞁆(y sCg@Sj LT(#A5!u" ӟCDR# V_$R {=ͫ% ͯٷ=`xY ˮ;Tj>-ϣ3_ßN&f*@7W{K.PV bJn .D7"8cra 1h;ś_iLʝ ]ͪWw{5`OGI$cdNcD+%+Kk^:CjaTVXxgM)trٿZtGsv /k{?2ޜ95.Ki$!v8U5"Boḛ1~bC9>{ 2;#{fwad¯aȱ!PBH|͸x21TףVe߶FsϿϥ9KAl$?,-7=PԼbK KKG17̦cs]ˇu2ȏ;gsϊϨI}s㜟<@P47` `A%D`"?{k $A}Kht#,s)E: `)g\GK)d C6%qNj18;IڊÃJA kEθsV6oG1W6W<aN/$:iחWI:I3)o&oNtmlnF.lp+IKn`N V*]S>U-Sx|MGkۻT\7&Vh>`7VJenMʮ_sex7̍Ob}>>Ih ̅ro}(>_˻P09Y곈yRMI#cB=M[dM̂4 $ɣ-Kx0"\ߙUrLK`zV)'1s,ݓ>iQ܉x7M#!ހ丄&N0Ej/e&8Qz@4wHdQ1 kS-jC`Cz (6Xb|xcp|lh|}ݏ SZzRԋ?X⽳شD 8stx.V-~j;Zsyޮ`ؓ#]{̂ ́whxXJ-a]5uŪ'0tgX{2%{:8Ij<yrmO I˂6XJWզ$"kηx"(|8+a%;bb| $3.6Ɔoj b $=FUh`7] /:=!uGZ%eh6E*)S۠+#eqStspncؤ*L% a +0fHK]=Wxň>/txIّm&薊bZst^@EC-AUgH{N+{J\7!d1nNS쟩î2lx8,,FDIZ0PO! 1X~`)46>{/M!bP 胰kEqyj95Cm0S~P,kG ,Ż71`е5N\8ZkҺk鸕<J+Έ੼>8Cͯ,9yZV>4uCMH}wr9d2G|x$y|m‫gk%R%l5wv;\u\nGC=EptN5RZ1eDcFAexf^$rc֤Si_[[Yx?Hf;:˭DSp,wk'`$ܾ kEH`Uϑ6cCaS1f@F >9[rj&C{[HΙHe/j'd~ EX4q0.2ܰHA3#0W(,xSPTm%K!l ;;_˄9} MWR]2MpciC4ck詉>}i!XlJ=w`xq%*3DiF0q3EWdK=>o](ii:J3f7 ;? L3T2Fԙ\[Dvx;u NF7([ijY%Hw@h=!y_[9bf6 Pt`h5yb؆ǫ_*WKkca [戫߆y^;!|~M>7iW)^(j:(chHMW+WF_6gL6=U z6bAwMrM hve ޿}>Fi)|ld|L*ICkĞø<}_={3% m0XTp,~ӁM-/Ro;#/w85FVw&-Ê#;R 9iG$&BqŚK_<:]0q5ś&ҿ%LgSfHriJ]ejʠ2fZ~20=. Q,lBm|5X鋓Fhj@pg[RV [~A˔$嫈M~>uwwNoBE˜/q+K6Emio|^s^hoY}->ߓ2*-^~*P`:u%dH)ّ1Z60|OUCIw68ee췛~% h`-Iڒ 6mD,Gi.>$Ķn 8,֐vwW[/7)J^ 0`<(jm;M_c5!e\Y84D ֜Qǃw{T!͝Zh% >JA=$A[2u- d04ѵ!hPIB{f&,κ.Q1~9&qkv0M;KY[M5D"M)S?P!vﻋÅ ϴ:FJ8 XpFQ` ?矯鎹uwsN$; b/Xxx FO/,qOc'U=p22PӉ8,P#7r2IX<]=:hyiQSӈI&Z:leGL1^{ c0OtFACJdӸW֘SJEH,"Bs3 svW3;EIkYw?i,Oh~2aY$N{?[$&Yט'a)J/mye>Vҍ}SOz%5Qj~A2JQ8ː~ sYCz]J2!=]B"C2Yb&{r yLK 4uޢHP qbhf:-NB ^j-f]+VS i1@7xHMv2nLBf+m\.(LbKcĺdi|o{Q"yHG҅j,ež8 2vỹM+"PZЛ,lZW_KdX_y$'8CV[;+u"E1uCHHk' sG-r D  -+rH9RcEk OiF aY.Wω7Ĩ. :|҂g-9Z-m푦7(u1wUe\·A>L6WV˳nO Zb!)ګg;ad9..Z3ߑ\>^.W,5nj;YIV=Ų/Nݸ3'x0}T'"]bC/VIF!k^,ު&sǣשĨYexc.L2< w`w!x=u |Z!gUہATM=f,"KW3*zbФcHemT?DxH0B}ZbB}5ෲg C]hLoC|NmCIP%뻓!X0SͱHʹHV2ێ w͗5k `4:<oTWoXY.2*5OKWg̒5Yug@粎Ԩl!/y-6 !]Bp_S_o?ݭW}4a/zڅ=DA>fUhvHx4pA>l^q3ϠHV.xU+`bSS yr4[E L_LP:hج x)> Q`f])ɢNm:LrtMԿ|iJ3ٛͬYZ>(vƂȨ.>+h0e @V@3.9EBkCaKO~+XywJ@Qҕj#zO߷ĠeI+=U[͑[HN3{>'F.Cr(RLW=΀.:T\]ܒ4Ы-[δU wS7kKR,kr3y26eTշ3Jv]]T "]^N$!D`(A}Mg+jk D:A&VbkK)} BƁkYR[MU8~wDU؉3gZf;ZX'E+ *;1(Iͯ@T4w|dp*'wB״B 6PMhm CGV3eVM ?%/U(`q2_^}njSi*xޙ1 {բc@y͓HD6Y~Q[lqB e=Y#/]Di|v]t"JL&}e//Zw{p/G&_+=ONBwk&ndT4שPIP&gA.rrhc kfE7E1<]뻥{R37 kxyaEgoiGyH*nA'̦FWM g|{$Ahol;$:3Jv¶ >79Y`1f0TlN&Wj ΰ&x[{w$<1ĪCmN䞔P4˫,\a&'Jk~0j̜cb]1 /Mm; eΫ a9d<9<)*ܸadj->e]vvhү#0gVg!cr&%-uK~6J,GGa>/gJcG7 Ѷ9^?Bl4.\C נO*E f\A {ed`w'YrszTq"pD\XiX$cIwV| ΣLxapkzyA-Tw[5j}\ OM*C LdO5x7tl/Xd|zF&if..Swnu $BdՍqK\ekg6 ӟ΅R7>i%D9g kK6S٭zv`m}@CK*֨c=?E{%@jOB7#7P/($kґaɱ)Oree-0͇ >>yD惡0tz4ru*wgGcOx]-Sθqku)5a~"z4CȞ'kRم<[1%tݟaҕ7dv+L2w^u@Jr/ʪ[Or˄$FA7qI#XvFk0RYԝ½,8#ۺ1WoRlJM:wP]I>]u%ZK(fޤ`EΩg4s53e]~YcrU#{6jIlN?]p ;G EMޚ΃bt%z32H^ce&SƎImtHxS4GLܡBg / S;m.Ӣ%f!7ⴥ,nI._ :mk]3{Tu.@(xoutG4"<^z&/i\3%=0i|c8LJvRȿ!ͮ]{Z5>Ǣ'Rt'ڪuY0Ϡ%(#H EӈJ6[N-o,ϐmg431}"ಎԉ9 wRNWy|Q4tj+_ѱpέmRM+RWs u?D "c÷OWxӻ`> xvܩGeaew>xڀ0jd{0y T~&t;\A}nRsW7 /ۅ` /b%̪}iq;Խas<O toDV`[y(U0T $Vwl 8!.JI aۭw>j- ?* ax7Ab}NRK.W~~%O̦fpz KDF}L;p[8Г*B2xT fkssye yNh @DICW #$JH}@)ڢ0q^qZ3Kf}"W"lћzqs~.u K?ZO*Vi,Ɋ%E&^-!w ߖ*oIf y%UZW;̽;T_9jnR7۳&w128z:_k<2W7VcHz ;rMZPU͔a}@<S3ܛgKIWh4h8Cv({ӞL 1Wĩq +Es^Ld4aFi D.^&al=pg1WaK_sq<2$ۃjsUNj,je)'h&ps#'M3$e!Dxc}/ ٛ&/5>]5V/wUt6ppnau㣢xMM%3{x4D5_q)S‹'(!)=A 4Mג0tIo<\~t,Zq5-Sdd0,TE=NIR/8K,T?`N6{ )(31n,_g%¯VtNpvD1d$:T^ŅxUd*m@{_k+3jLƯOzaúprӆAnnzY6zS-7xÜs 2z"'ն[ɹ E *k\Z䇱@uuDXUUF/W'LڄDܠ_"d9a,GrauM꾎,~] :ZAf\gժ}ލ["}OkBv5 S"1Ϡ &I]!" Nư7YU$je`B>#}ǖ볆̷t;#Y~AH-_\he5hEb'ι!Tr%5Scw WP93.:uĈZ•"6 Wp.Z]_d70 cY0#-!_r{4 bXpDߧ=,FT,`&pV517?b M 5qxyw}ݡn:sB?M? <%Nr@0̧xv_+ڨ ;b!<:p,Vs>]Ze6 髥^&oCnDo$zR$q}ĦIfk2T40(.>Zke!ȷ/^9 H4@ uǕp\=Ӄy2mmPxll )P+oSvla#z5=ۣoDey쓙nj_/cFVg`T]3߆V; ! &0(aj*P2 w[K_$=ߛ0b`+t"jmM3?柺^WͲѹ[߮,ƇRe?w&pEgzu0C% pxjM? zZx`0.ZqtM53 p\*ŵJs)r# t (>TW{nThXP:\QtGJWְRUX"E5Eč<鑖-a2);X=9qJzErQuݨxyt3+bnhLLC򘲝m|0_}T=@|j/*SFWoۣG*fX+q8e_Hsxm5ϝhʹBF3c42 -DǷmzD y]i_ 9SieIȼSVzlu*9䃵,mmIHƘ|hFevNyf7tQ,NhT+!BnOEG:4)bW'tuoxXCIB$K:/eܱHR7C1T+owsfՕ%  YE#UD!THzAG H@y3!oo"Ū"Mat~۟Zڦܠ!6A"=Dd0dTU|: BYƯ_*=*ἼbIHb uOW{q=.[GiJK1Sw=y@=&>tphYO mؔ. >oUx6Q4ϼjXW4 M/l)V-M5'ؽm[qoh|VЇ9P 6@AJG7SFx: q%n2Z5U* l^DѰ^vOT21E'ib <( ԇо qKPN+oM[v"ߊ!3`v\]}Pl`^9jVWub2N8pL߂I$okqGFg$_12}KM$xpѸų#6V+_5Li8PP'Kh:N[Ci6Ushn$s%Y;Ʊ[7@,lL }BʑoĐ2%2 @™#0JF?l7 p d p-~]ꩀpѳq֤hHͫIw}nk7cohrp dd<|%>`.N5Ȁ y~ M^‚s9- 13:]RnUmg?\GyIoS\fr2ˤ27O GO6ٲ|% ef-zXHc#*MihJ-$YuŊz @GC$cvE2L (]hs ΅nF #w cY|IF0PmFXvfǧV"ʁ{UD-$ǧ?lb22u%S";JjbhF٫B[Y:GTThz٘NS]T&8H4޻ j%4 ]. xE8v']1㚝ُif !>:.K16&QJpI:Єto`8ք*ͷvxK"JG cg \2طf )ƬFE9ONjwWa36v}NWKZ EԀT9]%wg!ӵ O7 [ n2\* eSR:ϖxxGs0bF~1H H&Z34ȆH 8=Z Oր48ف"NEifpǙuFu2 ]Xj'fH:0)X!2G.sJF96ZtFHy wpg,k.H t oII~Mp> 2LT/*n=ū`DSCkgvJ}:3 4*] ȋCZz.]X7r-Dno(i?im^yXJO3Y-HԾƨ\6IqUe0?IAcK$XCIZNzB6!H .Yhy#>xdC?fI}膪3?Ҭ\q%]"FZ3gj"qgCn?H$k][HuYK:d Hwq*8 l*z%d¢9fiupH`vKqq~KPC{lc70n{!( ĩm;BmZHlgqeY@,4yF[0Qz$ ٫}R4-~D<|)FX3k+Wѩ 5H4>; ,qX2ׇK_@o#I|&wjI47qJ# +Wjd^2  \oIbvY 7Cdaf W(uh ͨv+OכDt gEGIg nJ7R⑍k`Tr7@X|Iu$~K.2Qн ܺaĩ.M[iB=Tn5.PvYDaT[p1=f#v%UG R74ݧnGL@sϕòF+=!>~ +-b:үphi-3V@Vy@cgk! \ #L>QЫ9{o ȁ֍4'=QA C= ;27X[/V;ߡG۫ЙƬZAojϸD5;"$_~fp<9wtxhijHt["kJVi޾*br$ƾ$U1"61n1R8-H262,@9!xz p$w Tɹw JGBݽ2A2J{_z2J2]bNl͋L0k`/;ƃlAV󈤢hh]\ DtuIwV!ZE9ָmNHeʜ"]~3ee  xH.8ioB$wH6 %n!*%C5Cs7j%ZJ5aKΙe?/T]ե-S֌M+#J\94#݈I]07J6&Ȇ&z)b?qI}{juVP׮5 E4"4"J-"wE8eXIPy\C2 hAr;Y\B7g#C28#yYءq,NG$ߑ" ZkF┑$OaGa[|!)|vb W%4cU%Rbhrrc-S *)'m~*8_։Jb'tMA2P1I))e0ް<Ǥz nZD6PDv{[`~pńxЈ9'%EyBbÖ7pI&C fKaCV-TX[|EN u.j_ 6F\#3b2q - Z<&MPؔ81r/ރZӏ]h7.L2ZC~0PB՞ŷ :ӐwyS.5RR" ¼Hr_svj wb >Ts~`~Z@;* W=8 s wM&SF}WrV^qZ^]WI1E0Ja.X,[k<㞎F5jK!vmY ) )A#n(-Pa[((6ѾSZʑS.*Gm4Tg,j3ΤdH~uc4727lkL'$Ghlm<4eQ\'AX R._[b+.}UK}JY&"![~RY^I4OW- p'q-o4eo18ز63h/Dj!8r)4!1]W<c)?Uړڼ(NVH_SK{3O0[[AD)>)luowfZS^:.U#!t.<ɐ(=vD- ,ISfOA95L$ގ;ki唿^ee 葝1!mm!e5Op hiKUl01_5m8ܘm0Q?"~ׂ+-5vL2@q_= B=}L#=Zf ֖h;ưiaF |4'N >vе%2 `w%wdSm@\:=_h?kvc+ Mf 0Wsw0N _)>ǃclX`o[diiL>ӸGcMf|Z[776yX&vsٓvD.~1;QF8ؖ䁯~mo5 jf1or9S':hzP4Y2Pi겫Vl湼>~퉳2|N5lvD~X c1pI+R $/ʒy^<Ĺ, Vsv # ذDw7 bv^:&;ېF;9{4h/($2捑Zu}聚0Sʺ;g|؛nVL)OYXFeZspF7qSfdP#c٫d=hFDF+;* |5@X ̟h9'6s;r^nM2&g)o{z;HX1}.xM/rcW7.tث0; jnjTrҟlpm zGע(!P1Xhb1*^I,?&'{ YLYh*d&o}#glNns^(C#+j5r-6H2N4j-X] 5oewNAvU?C; grO>v1L.L?c)Wȋٿorz `HoM]r'Mf: {rE_J˼nZFP68E9y%#PWE- "~ϧQ Ϣ3wR514V4lSi|.YJߟ/%EAۿ(Yڼdq/HW "2>ai1C% Э yV ,/dXr:Tٹ-Ew:ÕA'nߴH` 'y`Ʊn}z~S5}t%,F9%yw-B%9q2$AyqcH0C;u:u/hsD^zQ:ɞ|?P3?eIu*ҫ7%c%:վZn:gGGy8A+Gn:7R "Me6A_e_62:M|tr`F % D&[=^}$$»yyW827Rp.\+/δ*J`- 4" h MPoo% <}>m#xY:j 8[\1M1K%5`{Z{9ʧ&*}DM/ %#κx\9r{薡8 THm=4e…yAz#-}=BY n1_tH_!OӅb0$˅&{ %AI<ݐ*;,VQ/׿CVY-+PtDCL^]Z ;Ҕh`y`㻬4T A:zh @j8.` ~_j%IPTPtȔ]JVx,KZ|q4gjW^7=̋ r|% H7a7#1Puٵ"If6D?drNHR=)jUu*PhQ^})Zy @mYVmCvK=~>tZX;&2keљjݷ]M /0٠b`n+΄Oa8αS U?̧όd "Lcq@))a ٫CGύ{WF@e2SE$4#+c} \,|4FWٛbò}Vpo{y+ yosJ497TO4SkmYeVKb2%@,= z 'Ga*qېٴ 7i.(_++&[m'B|:avKb"PK5?a2if(Vs_x(PO WX8v ^pO8Ĩᜅ3k[{G8:P2w+-ː8TA ly w5)fzu^ q΢(\y(Giy1n9`)<`YL|q6? F[@&ulxJ_gKڀӳLc4;Sa{۫ "V̽֎ %Ĕsjq:Z {w _h¦-FF< my_f_VNJ%nKR'32z[ٓ9UY$MHQI8d)Wg@*n@߷A.we5bQ ->c4U]3ŗrTT#<^0rܣώ冁2u|IG!(1e+Hѹ|F}3&V] ^l=ʒjßQi۸r3:_>'_ A=p=5s&2jvU߯.E?=λ|@[M:Ai_vO: y?fQS:$(܎ꭤQ{+)ix-Eٙh[*1O+R.3+I 5e}2hB~ޱOapp@D\3^ڻ[L&kxŐQB} ֦#jo9DN>֝lO1m&S"5 ]8#VV'ˀg_Q`ce4~zt͚I^a>w%.t(fn]\qvp¯@b^~1V*n(t*3 Ɛ#k;!_:llEB;Z8Od!c[V5ᐑg b6;W{6}6-y7V!1yEGtq!fi},zEۃjFW%VbڣiJ1faV״L.W?ӲM|N3} So(d4_axF5O,.n%Q{PPO>ClFA/#=p57uMݔ_sG -+oT3u%Ľ 83|*>*De̒.=7(lݩ4Ǚ22ٶ5JX4E9O!T8"0*ѡUƼx3xGXlqLsSSEkMe\\܅6}oSʧ[qK C1}k> -'g +%swjRru,X{MN3%9o:wNXKPax,[&L̹[jaDE9aw),cwEAqeJJfcGFWѦL pOKeZ5d-jkDLF@>d\?0ɃU`gn!^.-0.sIyLbu n5 KW{=7Dna.&*wYD4uвvI=: \VEZl(Z) ;!Lu'De8=5F7 L]&y  RL?<uf柳 `\z\l jjlY.Z N˰"щdzk\.uh@`!ʆaqdt3IL@f8 2UtB T J nʤVCU眺Aٱ92a ZĒu iWC1ΕW5#Fr!/׾Kω0VA.@QPu%g] T\SmLdE:/vn՝DY9˄8GXRէ(/fmŤl蛴;Nqr07 cNU7Ȯ\T,G7a8wM6͹icN#@`Jf<,||b#wgA?y,AJ"8c[3ERaR#j#ky($?ݐ\Y|,_'\t u(ҵז*$8-jp </NT(  TԈffȆen?c S*sHhŌBTɉ#bI0"H/TNU;LƁΡkzTPk}qk~ALnm+>KpE,vi[&Ӭthʡ9) /Q8{+&E]lpZ%,2^wUH3IӮ)I. DҾ=OeP=^Y|] uKY0vv$yZi;۟5 '1A^v˸É;VFy D|] L*9K"<IkXa-vU}l{G Kqq *DUc7V-bGdx1^'#aB~p&8Ҕ|89piy?Y6NA dW D,x*&VI{D{n.] U Tݖ[ِT8derX p58{Eg^Rt|Bsg8_M᲎!)_d*ȁeT{Fa}Wy%&B x"l{b*sn-=ui [wc!h XJ`Ry|:aݒO~#{v1P\3vg3Mn8+ڳ+d0XIiŎc)-t =u"0j g I߸.IۈkٍsCGk >4OEo)JLbNTX P8QQ`]HXF][ [>ӶL(/ CgiTXu.׀-C=}ǐ(,S^Ga5az62̚ӢD]o:>Wz(gޑ˭;b 4YDrH )?! ^x$SVPx/_V{UߢD Oo7Iac2ue^GpcI mA.4&t q"bΕQ1 |~:ȶ6D:OĬ );V.'aLkGxg=9!,pCc^jG(D8w@FN=@mW0f ds 8DrO nGS~>U2FUu@=Ʊ/Mqܮ%#p!6sm3j>φ >b˧5o4SO$L@ĉy}&C[XREq7 5 _*y}Zd{ǺMyacjQQl2Y&y"?BXJF?bu Gnk U8&}>aB`zTST&LJ,P-rr_ o(x&e9Ϸȱ[TǝVƵḁhf(zckկܢU?bQbQ84DR]OIͲYjyxX t-Vi وGS&~Pl{;D^* V]֓gVT4`~a øoX(ƅ hx4G/AX&k!vf 'V̤Crw(+K"Ql仚 6=yb4S+Ќ^l%;a7Ju J-O]'Gw.-۱:Y9D` pl]HOj%Lkp׶~녀={o25,&qF a̐AyոC%CC#ucMU] wb=KFOkޥtX7AYnǞXer|L(cIIT$GJDwoeD9P\\'E Lke@?ںǾEcF{y xun wb*N늽۳[kuDMO&0iNKO5.B[bye4ii Ň tԃ P A: 8 wg8P0S :eqd;ժ)yJk]d 2F CVJI:,6R~\o;X˟6A*?i\Tk@P+#Oܔe8L5y;Ф8ZZʜy5ᛉ>JwTjl+)#Ӆc}o}s!PeRt Ԇn DJ&(5+q_އdȇ-|Gq3=Y2SZ0kqb3q)I)#S m+Q3] 0c]|jmS mG\谕yP@Sz{EKLd趐S@3$v3T\^vߝ*PP\sÄZLo\ީO+t}K_U4ٯR#HesdMpS7d&6Ҭucڱ F'+J⽠~Q>bFZ皻l"7qwT[V `*>2a_#?Ss P'oiE5B=چ@P͇0Q5 ,wM1>M㇜}_ ?qP|4xd4m ,{@ "eכdGPEcz|̛\ڠ+Vpgk9V;*❽p:F|K>ki'" Idzr͊~VO*0 + 3(`6Rj4?>- )CXjY}uG7!孹t)hRQo("sm]mebM F!zvzWlPZ{>A ^㯤UHsl'Ruzv]X4CLATx`?ƇSdO 5"C< "g_9 G4n-wԮo(1>uQ 0&ΥPg0?3=z>h& yW\⌣g LN()Kc{m鲆~ԄyUK͢6*A ԣ./i(md?v%0O%)IWP+ d64 2]&"-PM|\wozw$)m38Kҷ}y6eC9u;/DO:)nK9)qj \gKG|/b.( Jj$;18iy<ѠwW wu&*w':ķ54[Oul"tLPhea\<\騥et kߦYjGӯ9/h4.p7 ~dX3s]fռ) T%2o{ :bpxZq5P3ig=;}url='?>Nk¡x!AJxzePY=_gv:z^"'间T>@sC &>-]ZdM W63؛W+VqŁ%Dg#τ(2(|P] >ٝyyIm%yUVb갗"T .Oƥ tHQ;l#gzh-&'9l/Lj߼,}/\,Κ8؀m}[LʆFFr(bew=zN䞃/l {a9 }Uy|=?w]2RO#0ʹ)W8~IpDl~!A8OCrHմu>l)XgC< V3nÅ>X^Vtk&+m/3Oqt~ʤF F#2-ӽV*W]=X׿mRʄ \49z8J׳4D^rwvuꂣS^L2ȧ n}yJ>V\2?A 5IG,@p=8%MT?c^ͮ“)],WķhY2Wþ*~>չmD*=h@X<ߤSFѣzP}j6#,?~EPmvhbvq;6ߒQlE6a_VI&ؙ}15KG_v9 RpFJD2sJ/;Hj-L: ʮW]A8#$ V=WSJUjA45HBu@XMdBbT+*aT|AA.%--<|Q@:tWkOs!Aأ&t6w)'X_ e??Ľ(ks( =e244b3%GeGs&opzSZkTU}?fwPnw0'BndTJ Ti]Z ,%+Ӕ]ʫxL3F#I]wӺ%ROwF88&uJd5UC.Uun|Gk; ;wLsDVam돨$ `Ecx%CWpmqFQ2 Ur,cˇ*| 1I).C"m!R0yi"'t[7I)^ӸV|\\* fEպ&!r%etM.gH/σC;:s `ByC3Q%vWoAہ& @5NWfGaqUÒ_j:f3׀tGG#BBI9ȥn\PFtݰ:Oq>=Bӷ$:pv͟be2F1e6wVl6D YS/E=Nj@*Lqm~+T:8Ɏ)‹:H2 Aѹ|Υ|B94̵uנ| KiP'#)b77[2B5p?־ͯ3zq^W~)1m[G֚?<NSt.Vk4*{dć$zEƊ²nG` 7h1ZP:nAl+ݣ$j[1KOQΒBbj^q>eV/ dhbȔ<Ce %+cv3]38KT\*`t?F<$~)k$ brד]mYQx4_iN2f@o/l+8#QW|EʡPQEg=d7]W45#qܓp֟Ycr3_iyvy;qn@gXƿQ_RD#0鬒 o(1_Lv>ͬb8 Wya|#gMOQT'4XL`-_ҐZ[k&&(K~9}N_o".p7JN];cT;*]Vt$k7AY _G0y>b=+k?so57+ VBKtp=hFj^y6Ω8ʐ{qIK@Kl`A$,@9o@`Q.+cM(At;-` vq{e,bk7P{)EYKHoIi=?n,7hh_'wMXȊRչp1qQjj35x*tGXaQXnb+-XR|HʬUmF!L;[GlP0@-ӏ) 1%dR !%|}MA1f2Qy#TM<:HsI"Nf?"kUϓ60]'B aI6u'ؿJr55n1P*lޒE@IEJ,[kIr ;gɴјxr Cs:a]ePƗ`PQhQb)skjI!0< Us15#ͪ=7ĉC!#0>,J<'ϜQSheYz"$ٳ2_ u~th6|?NQ122貞\"-*F =l .W+nAtax;zu["Iw)t`_gy˽\t, Sm F~eP؍ךּ֠<~ԏݿ% d5eHz'LʹeȈVk_Р2b@8s;v׿R]T*8SEpG;*M͹P#g0^[SZ|N]"M ZhV }aU6p,P"̤g]6[ܔiD_$}DO903U,DNo28 &4 =*7U+M l&U;lD Ljg͗:6sE6H߫mm9t&ֽu]f6ْj>E;+$FU 4熆d>O'jZj<ǡ0FTix-_3(B0?g֟v=lMu덑IMx4z@l(6`)rgov6Igx{cRka BtqLk!:yC_R(f>#|qrJiweLRqDpѲπZ_CϓS@~lL,us"'uk[)0mֺh/9 =m:uċ"߱O⧅1ʻeai(Q+,|^6 ѹ#n+=/@rxC_k)fc*-L^E}1.OgΐsF pχ?[-iZ&0y|SQn//ܶ vV]q$pKP-ȼ]O1~>5.1PNe_O-t~l_eq[M+clfW 供"(*ѡZJQ` S"MAtb&T˺Ch8E_5QHv(7nE/ )㘞 !X8p&iΑ7םyJBc<&(rZ SC~ N0-:JI=mp|YQ]ל5#A[Z m1A,hm۟.Y) e0Τ'OP_b*"+O7E,A-y>l{Ayz*T++)ix.e/a2 I 6gf(^lm?SA"k 甒V`鶯Bdh6+qN9XHG%-##W}}/Psbh0t4RA1:u'"׈ipCo#ˇ`Z\FPǓ[e#a+4/Ý:Oר8Lu /T %*/da9 C_8MlrIg81| XfCwP$!l֤7?L[FITۏL/op1R7}fAQ5<ьD7ȧK򄀅 1s2oFOmvY24&qLd v=uQЉ4`b;^QEJrE/U9` mu(7E8VPyߠHr0%,w?}yIc)+ Ƃ:QFɋ~S2TnY/-6Ye@‹{d.#_ M ZXp[ YSR>,Ars’"IoTV@K]3R (ܮ3I,:ʅ|.p l*mow:^FOZlEZE@8&P`x>$E !@QNa k]2o͢XKE!ZDK,ptin?-˜ WR,&0cpQ}lRQKdR}CW<3r$y xMǩw(>78vWœ bS yS* tJ@RSSC{Ԛ9ecS.YsS?vgE-ۋd>3U N>*^qgyuWqBLn LWRB'W4'yN@ı;Vɍ21n ǣćgubpFUtέ 蘾˼D bs ; O@!dP R6c5.(+ཤ- ->&R'SHdac*f`u`2 z qY)沂#}Ya\0vtGj"pH!2YQr` R1:3LNly{,w$'}}J ǿ>v `^,[ QLɱn٭_PPzr=U^%K)ՂY0CjT$R5AU8Ң?5xfpxSL,h}*3CKc^3>Y ZbĊf9{ϮH`D1*屒FzV1[|4a9A>VZ&^A`z1:t܈4+&ff:bT4}vG .+y FT i۾PtJ&$ ۷e-Tv,"U>#;EAPZאK)e PDJ=Z:sLd?g>=)V$QG3$Y#pp:%+7BLNH1`s'>X1 L"ϸI)dbOHci!u6NBxֽ| juAd$amAΘ呻twdskwGeI%sՃ}-s-m*ne],4tӋxt+q{@HyL E=TN'(->;j*SnCgN<n-@߲©j`dr?` SVsf/{۷lDE_Ⲗ",2G|L??3l k5=B^^&­sMNHd[_lm,PʹxN&V^Jb8v=tN1upwV&Dt>W3 L~ 8Q`9/=tAW0W0`N/Pư73¾+TVȶuYCuvgۤk3`9y wiû  .GLN훐m[-vm@[\Zd?|2V]pc.n=v*|*oIvG5{oS J@l{|JJj'F]?rr=! 3LYQT 3յr݀v4́ymi&(KpoFHô*jDQ#p0A% %WC~gh>ËF&a ' #8Pxea"?p7֋>(}Y8y)<]f, GZL#ܵ*usxz/6olAW0Jҍ27!)׆>وl1~)O?Nd-Q%c,0f)`%kHqLd` #rGn+"/;pjd^q{O"1 ƊDoYT,XnEQ*Y8+;?Og\^}:Ro̗ᢌKtO@`9VS0 ڡ5*J>SHM^f?lD,6Swwt\$EH opR0fM}5S|hA F75a;WlO.nb0txQ!gj+j 9ؙʟ˪6>TdV(|ᆺ}{Rnox"9SQTh"fgoENY%Csч`> ,o'R6Iqu.jl]#dvZqbÏkCqUEAGumU⨵"9urM͎ ዜvHRlD~5 `;g,Q/rBV^.6'8fXUG2R2 "wLV' +| Sn$2 c0JU*87<2~Lbmoh87>MtFmU' v):XQ@ֶ>U":`kΞ/:_xCK!UK0-Oqiڵ1Qjϡ]^Tq}n,ɼqS(?a4쭵AM){8,Ittxb4=ba8`7PrԎXۆB=ea}&u |'&Cz E!Qtʕac<AfZ}!{c-Dog׃v64H/T`Zj\F8&ԈpBжd$ТGM:=.DKʶ@򁏎XeQD1+dzFN!!ї>.fT>[k8Zjhtd7N/m&:FxSj%1j楨$gFGoX 8Z-yiEHw6O,A,f'xc.>bQ-Vj2HfX߽lO?v;[c*Κ6]܆ĸvĥҗb❘8"$ ojAW%e~3ݸFQ/GFuAnօE7%K7D|W1mh ')坠dsrDKZXޢ w×Df$u>zpJ(F15Pe:ѦK bQ pcg*5ose]myj](be 2D6y>%M&c?OyHy׿W> ٯ 8ke'שSW㸵U2dP/h!ou+@d4|fTR [s0FQFڣ J'\t$ PD%i2]O4| J Kk- xY殢pZA)>͘3u#RwS0v/~NW~֠UVАѥ04V]Juz "&sk4jy: hy32ojpDwtBJP<-ry;-LU&YTJ=3UQ{"Cu:!:W} U{GHI9g_b6$1hz=ϛYkQI=dBZq87 |74 ?M?UAoJy}Wd'{E FtE]/,eh0{]L7W7.nsB'A@%DE;} @"M\Ԩ=x2*6?Bu`agyW=ljRhXAWqt(~_@NWÂϴ|M] ࡰSs N@^'K:v>wyz貔N6uB}VuBF8-$hQ@~lVȬ-e\~~MuLXXԳº}g V+f;g},B >Y#;Öc<>:ịlGNYQ!M|UtTs6] FU MUjReuJh|E܈ * {o]=5;vX]d|8K =6]EM>,EV:ꌻv)PRb·^DBQ_,iV |1xNnDEq %L(lPc= 6@/QGup4*n:sD׀/Bh>#|j11@+,VڗW,cB$ E/I};=fN4ޚN=$7OxCYu-:4&4,S"!1sX]2V]Ȏu'?{(\خHl<"_Zt.I1O*=mƺvH 0pyN-=]~Qm@[N'"UOVң2ր [pL[5J|ez߱:MTFz;g!3do&Y}kcBV 7d5^匼o9q\]lS?y)hPcW$UIѪ:'飿"/w{s*}W,VgWJI"*(|G^5 9J沛],t:ݓS[D8r7ND-Nej3_ΪObz~9f)dd}}M}ՕL[=7QߑOz/%tzS}Hvt#\g .bb\Gҫ[l=HxGF8unXܗZD)3n SXPCtJMHHs=ncԿ15 =8a߭8VS7>V"N,l`(|DyiO "Z&ODz|3,& DuTlwG9}[1BrU`n1.MEQ J[# :SA.Mg^&y(^.\1\^ӣ ޝLM9Bf۵ysLSoAЭF[4X{d*_A[~Q ҥbCv*v.u.J آ΁v>y`ڶ7h#khh*Z@.R9\.C+'TTb _sH ygwSIb4=43WO!g:\ξV5M4j5Z-~z.әu!*Y,ph1WCSw;&_'>L~4j+v1 S_iV J!sշNzhKŗz3hsO~'Qvu_i#btd)$+9ba_=@R >^:ס& 'Ս7*Io%cPQr#n"lϱ^Vq;2}g /GG}ڵb.TsWs[@۫/2"vcMuVney6jjoatgHȟ"9{ib>Jo^,Ivt)ʔ*U&yN\3̐Vs7[qOT;)?ׂfV*fwq1,Sz}.TD} D ?S}cSmԩJ&sD2TfU 䆵T*˲o5,eS: O~;WZ%0yu#1JQMa5sS'hL3H,&)" *SvgwiE{nYlūѕ, E6 Rj;AN=D|) wo "сg}XVR@^YgĉۮZ2k#֒=bTO??z`Ŗ'iCYMe$"B\` rkf|~z<$֊?q ~Qxq_; r WX>:+ I]$J-sAWW~/d[]j'Na+ _`+kzz<=w}m70SvEL_V]<`M24Dr wixNKMz%r-fkAYƇ-OՓ[g(|Vt4z?@jw+c, ja]͒,maa/r'l}xb~Ǩr$f$!i Sm_DJ ߾pRC!Ca4Q?`!3fFWqłr#u S)'E!)q3`z]t̡?^9݇LjU>S Ұ i&![C&PjTdYW', wt :'4r@9R9ψS|Q2[4['q D Y#HU?i8odN7%Ifn]4G}`7k @h2PߢܝWfB :3^D1&/ΉhJ/]4RQwݸC"NTn )D52C$8:O+5:jX(\ I؋H,hm;ܳOn];SnIcWF}?em]bF6hP֍  롏)n2Du~!dRs(,jNm#̯/Kqd ^X m~|J1 W *|鐃~sZP!3f7s_-B2A=ݤ?d6pw aNyǩX֡12cIddiDkwȵHpfTڌ?YV9g,DOU"FWĮYbJp<@o`!+_$ 9_Jdlk&'oWM8VoO0Ru SBIa/`[ L\j/f.i2r;2SVU4ŭ%ͧ#}EVsȂ\R2:q#;رf89:O+`Я@p*s3ZUo吞lÔap$|ӟ2sYҟwvQg+mK꣩F2ō_rg=A ԃl~r-exz ̥4,3)->Eh'"p3&`\ NL2"ЫyS#|D?8x(`JBs>rJ|CG<˖kg\6rIrEGQ{G1Pgy9Rȝ7~]jC.Z䴔K; X\NKIny.`8xXXmw`Yl/~n߭ xJ$X]'&,up/.1tSx'vh5ub9bX5L|?˲*P5~Yuܛ]Э4.in3 Dk*lXF6^PcBU? kh@w` pVkTD'!£sQ'*P"t% ) aMH_Ąw SU-!oA~T:OB H˜ҁ~q`:/^x<==A@Z5c{t@Qmˍa>^n-\_gzGmc L@Q81*guO:i:\ؖHy4 7EZV~MS{bN]x!A\,R7Iw4Kր-eU7~`bޕO[HgK1r=G'8=%|!G͚v-n :0ϞR_HŖXU0ɫt`N%(P̝0+qsfSh8@[XZ/ДgfzܠLKgDn7M"U8-hVmS2RUΒ xk㠍\Mxp;i5IKI4Gnzi{9F6Uפnx?kx iaҠ}zy`N [BFR_56뼋BsDH[ ~akxP.2cc5ħ4l٩)-q5#j_*#[Db1ܤ0ﺊ+h=lC@W\?+BD0P.oI3,z +&wb- Cbu,;J2~0ڻJ*~Oyͼx\8XǴ\YZ.ڀby9ڤ y_cK&NLNxR35ai Մ^{mk] [R?_xZg_O(MA`<~\?=BpM#GHܩu|}eYCrǀdI]RmV(OV}S9*U00>/Qb[F{pT7thBIhnCepOEAI#샔~ ۸5ud=v,:zȀ?(xFǘ_tF^ܨ{'/gPvSy51'M<Ʈ̫#zi1O;ڪ^#ThTF>PKz5 T1|=fSr +I:m4eOm9ߧN< {'C Zj*330}(_݃Zg&#-MNU95cP v&|9nԠZY'Luw'3 @6d 7ŏl`+h¥~C~?7o 8$dͬ"VJȎEv!(d:QqCZ]fՊ-nd^/*,4('F,O)H[Lm寒YR Y-`2 k[$$ jAߕ'#JEh|'.h;]_I B49z*mtw>n@)-KK5tp'{+ች9ԓz__x iyH-%k\mr?UeQjPwq%"3XP#`XcKU^8fI9b.m=n־$y AtyHA@T{ڎ2 1Q 9SY]H5g|}T/"z8 Ty;lׅ)m-,\9+=fu^$US N߫ eod^Rr}^,kp?٫WmRdh!giDƂ=^3pT 3ךLsng𢫾TNa (XQ<,Hʧ ZҠ\1*4RRȤ}4ԝ*#Um4+93cgfn&z{q"O|L5~{e`#GF*([`7-qD̙2#Y~ܮ'  ުOԑ 4Y !ȘT4A!PNf]erL2N6gI I"Eu`)g]ATTNpmI Y=aC_SpGcmeVyoM_ t-ϸv&%XKRҼYc4V 8:_`I"#V·SqUW{?I25w;{=|f^q a#<E'`0_7?W(< Vmw?EMii(ޮ0a:;RkWZK+G  L+we@n'[E&A+źFv ~.{9E%e&TKX-zOD /am#ۂ6 q,LF^SOggKnbth} яZ؅@iX`Φog5ӷXȅ4'+V-M](#~  *ʲߵz*lv;7Jgx&!J/H^{), <ryv'Jh!v{N|5!NC[b|rp 宮]^ݥ  ʥoTrرb$$< 櫂"x5`f*v4-H-ym738uLJH*DqX1fmVvd307uĘ!+>u5HOA_z z}؉>2D:$|5!0%#i6fXqL eeU891H\\ 0DƘ./rad8^P*/ q\uBs~L"e׫d0nJ;Jq$8윓5耻:.w\슟ZoGo"_gd+\kRhD/MmVy"T ,W>׊Y$7,~ɔ̵Yt'3QxFa%WQi -SbL˜.oj ާ㧨hd`0cSsu$+:t̡x+$DS .%.1Ӻd;!͐JHbw -xJ6/䭡ωoTc"ͳx-TjUq'N,4=o h(!3?tK6Վ;|M"U͟*e2(q$-CMdekT,! pjD.'Xy'N3Z{؊gĺNU0&9?Th<{6-^{E:5c7=.; 'Dה9˫udufKӨ|M7}]b+vKrc]AhEnd/>߹<p߰2;gP:*1c7/ou Eac$Ċ@Ku^lgs|!]9 e«? LHGnhWzWJ'&qslh&g6xsRbtfs:Sl'xlY,rR.CY){vKjvtXP9/S,f]LBm)}=X9P)_ ?ʱbV45c\_$LCQ\8x ez,Ut08q{9Pv첈fz&JQ}ն  ZzA@5&<͍ n Ϭs Hfߤvgh#c%kv,0UDZ#< ΄s'$߰qg0B ؍eboVUL#O!ᡫ>쑝ͼ JQdpaI2.%KwOZe:aaZN$C[֕H1 ʰr}+dCWɀaoEɋ؜$Gd[o^Q'(_hp0-~fmP,i@f*3x&b`8#킊c J[flPSSR eY%sAkvJRZ F [/͇U.Y#`ZYuJ봂C'u+=@lN?G=eOw wXd-eeg^ [DLe16EƊ&-k&kڄE<kg"⺷myh&*ь?|g"H:Y2'c>=u nmPG:c11e 9tF OaDvpQ2u:NZ3BW85cUne_&̭3Yma$nf ;l-$SaK$xՏR&)":PSL:ئzDU7uɑ>$yt2@z΍nqj,߅1HtNEt9nRnR7]Gh~a{ty/_PבܛC򱹑[ ŇXjhohDq2mbgѵu|۠\%(7j-y]V+YIF_|4]֒25``G`0 7S "Lb֋N=5xǮzaTmkZFwMe~aQzTs(7<`$rS]d؅P1,2FHD:A{ bCi`{@ߞa?:qDUrK$+fJ>9O8& LQ:#CBʼn29#\ <&/LЍBꏀڎ'm7 0̠ߊ7J(:0zUf'%"*y ǞT<~ݣ$-[$إ$xdR~V~;5z] 6(עͺl/`󟋠lFU`_fQW7 ]7n̨~q,1mf_o~rd̽̃)WS@Wgԛ~W/~Uw:LH)/vSmb}*4k:Ojut@yiI\m@S(៯MbY5t֞EBH#A׺VwD~9|2gjdծ +mN|((h> i6\L=3DMʒ-$m)je v,Yu "w^ܱ-80Ĺ2\wUJ.D= 7íB3S@C fKZ]fM!šoE)63bM#rp[)nux n`AɄHtyls "GN#lc 騕1LU*2& sPݫٖ//JxΟ)Q@ !8rKψJY^[`KwhJÁZ@^+3 y[O9fl$f:`RCE^ĿǨb@o!?hQ:7?VAeiY$y6#*+ԵX9@ )چT> zg.yԥ5i2Ёr8dˊDir}G/s:a4LKljx-wyeŜe:q V}@Hq9!sL6NKR;~,P^0y{5-{;d3z+ΝK[ү#+Å453eoXB1aGEspyLUm(ڇIe'=VA =ahm̦y0 bJDja]$T\M9|ݳ.J+'-S.`Cti#+!,BTMwU _1ٲ舖F9R5t|JyYɞ@a8羌 I,ǟU0gC]䐞d&)$y8ِcOh6-\.y9 t^oV Kwh)]h.r``5>Z<ڳh뮅+ քѪ$JodN\osEdFl3m/E3"C(atl5uiI1%5@)eTp]~.28^5y l*x?tRġGqɣkDh!!HFW ^3N 5y&V0u!9Gy4cu::rai{T]ng\}=4ũ4ڼA.BanP_ ePb쮍Z㼋歔"%0J2T Zi~Ѷ B;k fm 2%Vcb`ɭ?H0 KGqX>d ȥ/ʶ3-8?] &|{'SvzCV"IL]8n'HEԐcm^oNL31,6Od~bAE$`L-K AzqQa$th@#93pv{qU3@]`}14bko[b ` _Go?jAőA-[b=0Xk`N%zq x3,,ϠE2 N=7U[jiW1 -]{/&[ף~C uy^ZK#[ kCⴇ/N  1s2=Z#?@'L΁{#0 2=|CÉ #Cet,|13ZןQGBP l}JMhy a'l=WPq O"E3+Zq#N:4x7񲏡:7V<9`f>bp(@wϝy^C<ߴ%G8)#n/L*XzOBW[Պ!poM8?Fkw#6~wHGz&pei˚yQ,kAєe'|NpfQe`|eLdPo{ҿO+-ru0BoMq}).LxE~ m1+V2qR"},>%CGgÆ@dExQ̏Nf12ct9(hͤ8Ib|EԠ%d켏QFtEMՉ SU&;A"2D`XXw@/&[1쵄ݢxf<)|MFbY~3qeVR+YwY(n ] n?҂ v€͠X19 h`X*ɀRڐ٣:S% Dwc.f{Zϕ:#W!K܆MqSBNZ,{Wzݫ7U$v=92S,cb.vy!> yYnB06WkuqxȭY馿m ;,,;G/J>5z_P_61z.Q1& ?c~QqpW)u-C4ռ)3ʭtc=%qMn1܅"rxh/@:oҐE7&|E TM5բ[`,z`A?f?Q},m)QJv!5Lk3f}Ѕf uFĔzZJ Bh? Ƹ^~^{H tHY P$sZ?PRRBlf$7*_m1gy98? ;;0 HH5.àdp,wwmtj´Lv_PEݧU#,kjs\uh[DJwKԓe}xa1@y{{`e# @/Ʌ56MX)z9 aeQb[r^xDgy'tPEx _#9pGQW3~9Rky{' aVzI՞t SS*vd-s1|oG=, Էq=ׁ4{ ;ӊM4Yڱ| cb1ZmEw>-w_<_ŦWRvWcP,^N[)YhV л(yjp "9-P0Qo%GkLg.Bw'Ա}6j~:M"5&ŸkLi3C2 _΅L?|?WXEE*Kb5!y/\: bɑS0\Z`R0q3 ByH{I!$FZv o~F]PoGaʳ1l1C]][gqEpDV&e6&+ эz/FY}xEZ'e\_y\g4r1|2F A+'"(єRv?o/#t_d22XQLyUr3x|okwn0W44}|PGgI6r2N`WjUԃ΀&.-`V"M, xƨg>}wRfgE#j7ԣina7.f*8ܯ[H<{`V$?QpD/w;sPPHllDTofo:XtfD￫ҹH_->JV1ew!L $g揑yJp*~4vjP{1Hep5ܲ UX Gr&R|m֏ ^^Ni?&9U01Pvf5m Q#jB&P0j{*}{)&V]*2W7.2U:U)kuZf3(m٨nҩiak";Mw0Sy@z`IM} ıţlxD}Z.+#x൤b_qN4}~B?Aߩmg;nmLac~ :(t,/u'β*5=y9ӀK /-cjsohQRcIRm&(lZXDZ)22F(ߎ̺MfxoU<0!E"󭄿uB[8,Q%^Mؖni 'Hh]Tsʠjx/]gR-.LR~K ƶErZ?vbS}>e: wX'_xWƿbZ'!>3_dFJZ%Ի.k$ ;?X'Mlr;2 AM(0yt4yK~QUUc%P7˨;`Ig\.!2mf G*^;r\7F"*7]4CU&֖p}61J5Ȉ]sWwڳ~HFEG?? sʸtI?c}G&?|Y(Cw 0K kv`rai^']XX~,aAV/Py9Ɓ\#gt5()nwJw\M I&eB J݀U\UN1R2L^ sA.D'ܻ۷1qOR~Ce f$9_"1iSw[ Tok"m/{<Y'e Hq$M¨ڳ+r07iM04LAg/ue5\bK#*\y{_-B/߃ EI8Z8w9:bbRdOyӾ%sDw:"|l|!\[er)inYL-4l{?6G>@h䫃-*JP chz6~ߝ.n>fX9)"M+ֵml`.2ztbPA;V;lKGwٲt X%vek`6B4[vZ)ܛC}?Ȑ&o<{Ϧ4F%nMC 'DΆ̴L.ed]|L_ّ5NThw,9F`+0 Hj2x.hcc@,:p3pԍB*TYޣR7Un(W1)%ӝ1̴#_V]]C6wvGڤl'9덊G G/Uĵ1NWUbl 1ֽɣq$c抳K?7gQ}~Qm(iHv(WḼ6c}g(Dx'^3ry EvT 1vs͹b i.FoF#f/h,$ u4PEJ Cl;¶EÐ^s+ Un-wf:4 b %{>DM7VswƿDw#Bn{^bdNiHbm7J.cntnhPrq^5J=\f'<ǼZm+^{*5D_)7\ݍK NXug%۴B2s-6\d(͘ F&5/z@'Emd#; ⢯}=Ա30LzrUW=2H6/h'Ãh;cYc 8( eʛw \kSpWw{1%`F>ǂf&#MzQg}c31NJh;?͛fY{!Xi%{zO +dЬݱO/6uVM앆<a ØiN:U5'A;: &uٶ02vi+㔾ρj^$i(#ocA`Ψ*c8oJ+馃7w)mݤURvXR%ӷ-5-;~!~`9[?ie~&sb!Q]qˋ?]vG1vvJmf-gKoڣ@hEp /"ԋ v* yA"ePIadCJvԴh!Se7D~d>WBpMI6W&8Taϙ!-|myOxU̸!GiRgB'_~Tl:_cjo"{9\<ڢ}lu}T [_AfǗ;Wn+wt.%SlkR> g脯_vޢ";HsRBTqqkڢ0 l?"͉mKs6R$o&`G=/8 k1D? *:FRP(v$`@i~LPGS= ?ѻ3ギ~$90kůT|"Y1WH%!qdK@+BCFZb.c:"Rκ"?nC/׬aʫQ mHNxxڡ+VZ`쐇@p3\:@r *i_K2ʜzRzfyV2w8_Y8޲ձ7:뀒T|SSKJtt },TpDK>4#"!(f(_D/`֖ɔ4'A|01g駫BQ.xv^,y4tZ[@ sociI3W] SU/ uvs*zncHxʧ B1 Ye{]HrIN ݪ}ۻyr*Mwe/%;v򠧟 l|0Z!|ߘGhgIKh?X?7ᓿ37 X+,܅tBq5D:} @狅Sa8q_(_}ɝ+iFs-$;[>E1|i wG ku,m7u~qlQ$@Ib$E˼H325IW"-:r Z4$3ɉUšBtlW'9 Qd`_kV,Nq~~,Z/#u~愞}dd2\thL}7(Uq2U*BVL, OX΅g$4~qu`NPL{Q¿GNu :MݫY<D8O1FZpΞ@Flq P)ಅ^7VG\%_8#d8'2"ͭh,n\]3(9h-I؀1x[Nu}|AdYEq/aZjoau=pN݂\ug}Qܐ9ERawjʅV~\WflVvBB?XYlP\2 e%Z[pB1]:LMA+1z7>5+*M'L#t/MdK/$H4O!Ƒ#xQko鯽[FB;aK5-rI)ikŎS$m8F rHQ"N6ut# ?J1y)sByMd;Vg%.<8\|I_IߋQok1\f~=" lB^V\[p+HB`ro -D/3"RXdFOo@Kq1Cf5!dGrAUy_{d͂|5F4Ww}*eROV%Q2_ 84wlD -l8Wrm0(ߢR|w2B@pDHh kc :IE˅^1-L;)2ciÈar2>uBD٧ fܡV V$<].IKE>f#t na "/4?]>ߐ޶Ę/F7{'hdl8ڃFsr+8PB.f7KE"cbPԎFoI_5fs~Դx⩴p8,t.|{pl,٨ϯ7)tj cD U+%߂l_Wba_ EÖbm[٠晄Y1QFڼh(ؗAB*G[o2Rߔ"J*gg]4Y&- ڎ|+aK$!0p:@d[Cm}҅ZUWc<+c$3KB~}j7}gգH +exePDW{{x9Ug+{dy^|fI ѧfrǚWn$vXcN+B9FJQg?u26ɀ\RTlFNSQ [sc}Û/UyxTv TYApRW{n%~y_]WéX%o^&rĴvJ@E\yoFZe#Ձ_!GvU5\xI7M;" =foY )#:ЩVs ap"Duuwf/lRM?Tӎ5`D VwXO`k09Q j:!m?tyN`\v]nZı`޹Z]jzRNs(82߻iUe^NCB RUK*,mfRcpת<M7P'V`Ҷ\ O3o g_('Z %M:oUV"T;JӂwRE<@>%jX`bL?>A'Z*i]ʛ +؎vbw w0~"I%`ߎ paui;ة*'+};wYWlJD',iA\|_TBAu.{5[o~&5Х(ɠmC,HAt.Yk PJ[c\sQDV?$a 9jH5h$wh& !cމ<%LedisD@* 6̟.ǁ\kN:PbLT)Lǝ Wog:-{mTmn4َkuTj8(kA}kHLtB|'-nhfՄw%ʯK@D:$Nt59hTR7կ&oTn?OYw 1-˸ǷqzY &xl$ϪBޱ 2pi&{5!̻if&ޚN f8u>Bfmu4 v绒Z9_56u:F[\Ϝ[pɎnyXH/kng~?04ބ66FxbnWZ, =0i0Aa/xmk!(D'IB&l/_?~~M#17G2? 3 EK a>L\#)DlX}X|ŏ3ŠXdȃ}nALrԌ9ìGCSX ~d]5P]WYre|iYLgf|k`_e8,e88 |D@+ϰ"±bDT}ݷ3#GuRD0l݁zQi%RuA~q n]X8t6 Ё2d/bG]l_T>BA{qњIJrd57hk Z6{ظq,ȉVgny7GɊJTm ] zѣ_Јm[茩4&6v뭜7:F6kU/*A,ȫ!O5  9ｒ[HT,(%|$AT89+/@ tVṘ/yrA>ƮX9#=QFo{w%. 1*` jhrI;ԊїRWR=a]&dw }NOY]aGd XyV!"pPPP{Y14TjH`1D3c:Ao.i$T9hG4 "S}n`F(ҼRgVqRC-⠍LS#k|gIJ\,)/\"yl&avNaCw8| /F~ruλ<2t]ok;\ǽJ gփ7‰ jҾ8 3GQX^ukàB]b `^^>53Hi1+ӼdxYI&w}UT2yLmDlKWXI10݁<\1|V?>8a?Iq.4yցc.<{崜]qnDIg7z'1QP\!?!/>qYd`H\ƶy;+\5 Xvg64[axd /{fbų┱CZ^L\d(xw|Գ:+]w(UXQ,'0w~pDNQ2UCpNJr&#T SF1#_-HwYu[$Ӂ-XTǴm 9bva]E 8x"v¼j0exֶ$epQ2U# ``>HiΡfc5 [ |Ns]7Kv@U{^Tƃ{R3W p]/9M$Zo5^rdKe oڗm{%ƻU}|0Zx| Ll77ۻ3/ j@n  7p/P'Ԇ:Vs{ g}fTi0Y%kpsNLrg8%I );!\cÚ$cu~lƒ}2$,M).;N^"v#DE"E@kڦ wU!@\vyo,~ rV@R VvƟz L+*oÂA3Sh.K\}}|<)#L4A<O\("N: R>}Re޺KGrnuMɭƈxΪꐺx86k| +8,_3<˯~^HCȕkbS|Pu\gt^ڥ&6҈]*Bi"$3)Sp+GT*|I\ӐDaqQ$.1[&votCC$aaGM~NRh S v,^eP1-tes•c ǥgRz6+ǭV:sa;ǃ*cE^Mcb^]D'P>eH6EC/r,,`@}02ﰂ( )[2kـ.T;-[io(0Drkv3N,]B]wv]ABMU5sȨ05x5X,+0ayHR/79+KW=nY ڛ^"DwR,5_c0m]m7tYWj xc,?FCȠg KĪm>p&)߭07Į!ZGm$ :wPhU)&SV8..^^<頫{3 7Dh]n] pð [=/SZ]b详)Fg/mYa&c]t@Y2wq_$x TzEx ֧F=Ov ˗]Y~'Mg`l*1!CK@ N ((6ёy2mˑ͵eƺޫžGP9!P4o2hw: MH\}hqfkÁgm8v?r>Rag[cX>yܖŅc9XUǗS3XKR,;M.J:"jzmُ1:_AyK9$OZ%Di=zQn-b5Okhao \(|T0.,en>EsNxUJ'ݷnӯ_n$n~01 c폡=o^Hk̴Q[x>f Ì .Gi',d_<}=`j`%g''[=rC-A3L  RMiٿZU3tѠԡk"uS"v|jY-e7`- X:|Qdld6&M/BWl 9$lT'13 VOn|{,lЎx1(z i95mSC_XjU1pPqZD`ya 88@ '=ao=y`ISKrBFnPb0]M3<>'q74C7*``ZGr sv>2WWJYidYY oZ`>k5o-RӗQ*G;BmpVuM7m˳ɏo01C @\t9W^Ata&4>dPd訠FH/~ T@Bf=j@6$!nA P0D?aPb}T l?S;<@}梓5qgήE / mO"Kp؉BG i࡙ħ= b߫ Dg^k}ianS fH:gCm_pϭ/RSQU0|eLL0Mh0ҩK$FrGuMvn%vD*ѯJHHWA UwLvL΢k䥂je?Yk\~]Kd^CӺnM*Yp;Rĕi0íB&﹎QKEtLis+>psm' ZteI.߿^Z*n.CsK _GGQ)6G\㨗O TBrt2àtxS#|Mwu?ɲCs8[PS/ bIfxg1ϸ)>Gs9A3r]q*?«ookt6zFv2'U&)SHmvU -ѯan-?̀9;8VgS7ߣXU4@e9}lȌ x&Pr-i "xM[(/}twt=nqj2s慔Q^)qE<9Eg)EO ]3u $ݵoeHj41k0w8A\T}6;JQy){&Ɨk,mf XYZS1ໞϨXdŸ9* .nj7}ƃ𾢱Zejly4 .˰%xV\Sbkoޝٟ=JB@^)"vGdMqҟKam&ο0buZ/X6UB,^zJ04wq2qq$ W^cX3 |ݪz;Za^#S}s7zwʲK_d=?6J[_ֶǀY 6yjd)iI_PJMYYT /'U|vv\O(Ҟ 쀶+~WMp0wŽT Pw+,7^UاwPi!JT{B|c%KxGlM;l$t:?6l/ٹl {`Bx!LǝKCoBxyc$ 8`0'g5(Un8.JZ8} ~ S7bEx%X8@CUE2@G'A.=ƊcL~Y܋D%ʿ7t/8ܺl gGLGvus7ߧ,G%2-(٬s3f%kħfAi0'G@ )/ = KHd!NbФLU>@Bif`'`&: gv(6s,q/N\;T'Z }%a\ D~sԉ+A@JVJ Y#kf'ѣȑ.#Z]{^k4YN : qj7`f:HSK,1"T:D_pMeT@TPlQ"ƾLY!n^2<8^<&?nT,nWk&"';e9=Lwð$xޙ۾Bo~2]W a=X:ͷ 9"UO 8" Z4naG޳&hR&OO8Jr״2i-t@{b_bswguWŷR*xSR/@U8ׅ]:Al8G)e,'@st<,IFf)+Ns|xt4,NtVOߐCPbu)ԯ}Zeg}9@/@X(H? Zr7Tqkl ?riy{1=O5@ѥtۧS(E@p~+y'Fz҃u}\SA6!9v*bSQ;k*> 1_ݤky6ى H,W{s4krs7/QY dw%oN87 ,וd_6OKlḣ7L )E'YL+U{u?S@ZڷscӒ[¹;sA%p1q /`_DT=w' U 0 +ߘm@Kw# "fnNrz$O[eIC(4d 5D*W_-3 WU"Gn`DT׈Ԝ&SyTƄW1W:D9q@/.p5Ў**Q@v*/7~LsVS6d̤Q -pCB!F_ʔCeW@TtpxG' z4>eM3_)na~;R)ځsax"¬4.. 5Y&^OGPwc0u1xPYo,ZFZ!_PI1*.cngC[Ʊ-f~#]Ϊ/'hZ x3[XGjIQO#D<9lK@9/$1je͡ҚQ^t1U{\DNSЌݘˆ3O0H+fY"P߽ZSZYg ,W~1{"d*ﭝ<] 5S # X*԰B "_P[0%&0b~uPag:>~ŗtw~t![䘞gbυ<Oi۱-kch%*\ӐHk97XvW~}:i62]Ѷ_;l`n ʜw+MAc 8c4!n/nft|"E/C(K$~o\ɗ`c!,;ȈKc[%t $cOF+oݒG3NoƋ(H+tY!yt}{oC6f+{Ǚk\W_$gLiou%{}@}8_% )IE7ςA\f38^I܅p4[bxyw_'cjIsXe*\u71C ?#zp~H=)BeMR[˜FSZC6;wmMW έ WJg•o#7r:07FɎLȮɱ"R% D }õP{ Qg5\Nt4%hF1iR fB!y-| T٘(:hՋ{WS;δʀ")y<'M9y9UL!j:y%@~sڵ8pLs4]n#$l eGy2^_ɡD<╦3QoxN|cwh%W;)ءX] PQ#V3n .X)kUZĘ ZsEJ GˀG;8X;5'R01[a Q5Pl!f@Ee/9 O8.?|li t7<쐋esD7 K6^F$]t~GL76L#0TőC'k|CIV]{yY;EjO6Sq?NU.'0d kj's2ڄ n,D0=xdNEB1q_;u>kEz i)x.h JL[_av1ݺET^,.h dcgܘ*sg77aU1KswTrOc(Hiv$:9^b0̌m۷^.ۡDj;*'7~bzj2_DQTF=@_`&;Es? LM)qB59wjp_7mhGn ]-*ucc)S"lsJNju %hDd5ٗ7˳ ]= m۶àt;xh ~PV5y&ִ'hΈ=~#g*yγIdB23ˊif"ݕf_ې1%90l{0E*)QIwtXqz`Y<Έ96Γ~It}KI ߔ!rZyw 6-1v?om4㩅m;"LGm}db Y4Vy t:2꣌`=:kI |]Z3@=ä!d>ZSx[,|͛ u䩜kF{T^ZCO/ wI F@Ny •pȞ<; O8Y#ٷű#Pi1ӽ(>0lnزG!S|HGD\UxXj$ ݣPGjeXzAl˜&$ T9j^8\YV٧:.4[#UbF * ,o.8ޑGQ̞ٴ* 9:\ԥfb%⊄(wC&fƛIl7[u ,I0aϾD9EJN RbG%VhPw}D(Ae ',t66"ׁG@ 76Dz<\4K'3y_? צϠ*e3'-^]h'`k(;A^V2[7SxͭH'xJD1k^(wh"B3`I Al}Ma6a!1xOڔU:Ҍ1=gTg I<R35v8$`6:nYg $5x-BOHu .'*&Uwcp ˟$lA-=`H,#FqȬ3GΙ bAsID:AfhRfXg(fOW NퟹDGd{ig( bqw5#U|44|o\\*Jqo.:ZIw̳*Kh9Ǿ1)} ?Ж<&ۄK' }.C-K7\b403b9O$poQЈ?+P7<ɵV t@J1wDqaUGP7fR2Uݖ/$U>z&Vw}g 0&<ա%57:%/`ҙ l(j(O`ۓ|DζuZKdEk\ZH3gA[Mn9!R`8.? }Z/ӟ/+8H M\nx[9|'^N/>% .{ZzXEb31 aל੺۲E(?'UgTK7,i1qX$6['R 1ϰݎ7bT.^}}tX$)SD?0r2h>1{2 A=ȔN7$.-ɛ|r䱽 k5fE F2*m!KZF4n̤l!t81B$de$|c]ecgVxU ;P^Qd{s@QoΚWKw l{$GgeiG \CzbZQ(=dzǪB诜7^P=8 `Fj4Nj Z =*E3uɉ' XsYMϸSCAի6{>]^{4<}&鬏FwJz'>n*cz7h~>`ԁoY_ 0'<9Jlr H:7ԖkPO$ %?P~ѤƔND$=bc`c7J1(Yxѷ=pħmϭE2 ƒq?nkCj5(EbnJ {dO\Ͱ-(8Z%+2B̅g}|AtW4FzB!cH~c>y!(ŧK6',Uv懄&oQH,8Vde#dS˻ `e2/{vE:>')\hV~q/:?'0NKmCds_3jP%!EzvF*m%  u IX-ɫU*O{jc4i֫{M|QB.|04m#o" З#5jB(Iz8.oBfD ~%׎'Ԇ-IHyPDpr~:0|sp=4D <4 N G^1hwy{j&WuϦ׳92857ʎ6aRJ8$~+^Q[AN BuX̢| |[X_ÃO9?eQ ~.GUocz%aC&bQgF/Θx{"a`jѧ~? S cVlz|/RaZUլg"ΩZQL"H_~%_dϛt2{88' 0XmVq/t\G-[!^MAh[*Lаh#y<"ٯBG(K;(#<.q@ZvKՐ]ZFW ")BAV7֓;#xF*Bie9hIʜh C_ YV,gnv.aY_Hx1zajwʀa1z<ٰC{0aw ޺R0z'8n?iQI+fmtuSTn)na wO>L輡@UFͪ3f49Y17 +BEY2X3Ù # WPR~}{e&Hғg@ pf ~O,$m(AxlBL5N-_YAtǐcieUmcY}r~؀n ~$uHP"|Tu$ÄԊf1ECNti9X]/."Xle,l}0ߴD}ACe wADX]mxѬ<:ʂSqto!+%i~E;X49a[͓/1yT`vOnct0A)S^:ё U ʃ%!@;Z`BJgy%.Vs]h<=.5&V1oTZq·!)Tڅj|*>s{&!̭ήwbi.P%D[\+AHO' mIoпevFl7YcrWK#^NOm@uZ̏^o8uxj͒ GX)*V0~2BL}ESys/gcoBҔ"4O{JHiZL{#YiN9{c̒>}!y?cRC~qDBOYLn6ŭE1hMNeL,wPAUbӉ&FΪA7)8栚ҡ!:4ATy#-A mD)rym'CxΌKݺ_tf,^=OEv)2q+r:53qMʂn'0Y뢎_cWI9_ ?(]RE.jnk;_2 N4 4o n˴3 K1I[I! nH%ՓK`\+AZQ\"f%݈䈲NݼÉifR,@8rc3qvxѓ+'RUul32F 0nzVm"00/6ĄeW%(q&(y]:.Ш1r/i3qiKT#ۚb|H s8ARO[7ShYhH9 Qߤb0l2wm!j1=##BlXxl񘻀~3Mh[gk)leX1`L3 Y^c;(To?LBR˵ ½8d.TPu|"#WC ~V_;Cƛy0&09JT=BMl&ɂH:%҃2-x_V?:D6kyJب (xƦeTÏE׫. amT%R:#C]?~3>Kxmcy~3+2*(C&4cZ JIlo^^u-]xej]C#|IV V"KeΜ=/#P,'=!"a Rv+,R osCc-0(T- %z?<)aWT$|=xO)k7L4ёI"0T(Uy!}սHN@'MbHOױ|)燙q,V+0˅n!BsV FF =CX b͉["_2+Mdv;QYE$cpHi@s,ca뀴w u`|җ#r(Cd|s-F÷]Ex:+I.e1+< 5y1y]"g0$X=zIž^mC ETpF>M1WIjؚ1zð52]lHK\!xn} iʟ# 7F8FZ~Z3^'A?8M O9q~@L\|dT-]O+5#MmG{n|F[N/B!+k0>Ȓ?x5_s5[9lT9}厢 # )X,i gXGGNW3RI *!D~k=1E|kmHΒc6MyZ_F+[͐;a≦=Ě];-}w^^|&a>3qfsdpM8WUe#vǡ:P;;6wBhPH%nX]=J} YKccBoc=0E#|7EſVTӮ<;VwdHo] g>G C K-ҩ!I;Cc/ZR_I CBPJ*K~T|U$G-)[#F^ Fr5C;r&.%d,KaNPX2G;WJ|HpY[|)estv.HA%җQe IrA 0J7-7A۾I)G`ukn̚bYH8BC g=W)aidne~c7(d}b%H iz#nJ$LolIϖ%e=Bc≣u@uUknS%A4qH [_WtR4*4^ ;r- ?]iUSdo.u`PXH$ bR4^JVH!>ę GLudShyJsj˔"q2MG1k%}QȔk](t3EɟN[+eUNKveкLLo{sމo礦#3OQPgGz^FfO:>Hܜ܇^ȑr1 M00\1w F%c$Q#!Oc/fF|qxv\ Z0Xډd) W>ȳt ISvTES`7Ii証t350AB0idt,EB'a;}.\1A1]i{E i8*3 ':W90P]UB9Tthtu1Ag0%gf9H:q7g.2C8u63!ϔ L%.|)o"D9tjS>mwH>:3e%PJjmH#DǟJxE0EOہj&ISz0׶C v9nAUـnގ>hlj%y5Nl%g+J'F #?Fr'ŏj ص C;qߺ bN +.g?X W4⤲ʐKY%~ #iemmo 4#nl8]tF4ݳdOk3nMgtpoM)G5t$E}1ieǒqB,Or#dB*pɅqPfKM6y }X,퉬9e/b@IDr\Bg  pW_}i2 xnU;ZJ>"@Y?.8Tʙ~]*ʈ)1B=sXcMpOeNtލ^3+d;Otdć$na,I\%*D)=mO_%_9J¢+SD=+:F: Hl)GU WՕi|2Q>Hph$3uAk;9L*LbҢ_o˘D8bs͊ՓIX-7v|~,>+Ŀ,4غWv,T+WP VQP{×KÞ|Bii1$E.u[$\X_Qj2S{1 熂px=tw.id6,آ,')iԁ 툫M讓 ێ ݠj{.;2^m0b0 ɏq%!5Wqי]}4-݄N3;S3E.YZ8V$k{s6cH:59Q`}yN,Fj~o+=ˎƦϷ/0 ;j0{le# ޯ{VON4':8@ 8>]p)9Y'7 k.G{;EgK?{s&?orCgJKZ``;'o֡$xV|5F+Aq:e. B7EirpL ^ fW.]ϩ#8_H׋do炳7mΖf:=SJ-eO1x"|ƱŨXJfzx;}al^k~LZT !!tD܉uS@[ٕReY65MO Cs9Mޅ\8psݝzEwzߕ ?t8YgB8acp .y"8[';bGL(T7ҫ{^}W; g K.y>Jdt1,ǯ+B7y 1ѵ`gfj Xu5*w݆u׫EfZJϹ1BrH"ڜ7Tv/m?2'6&~b Up0W *~I"L9K;tKb3Xi \+VRP pU* F/gg-jِ^JOѕavC%]3PUȞ;nqͼnB|]ۦ'sfoz$LY n;b4Ӫ!j'_,hrؕffwx4PddEIG'ꐞߟ#$FԿ{zszr$8a9ܪ'F^}&,A@EP)yԕ[T_loo\|YpxVj%9kO@qNu&nI?AR^&?+oq vcU"bʵNusv&3Fve/dQ,+DݢJ3` iBr'ܶA^BZP~Q{\;V1 {⒨|j{8}/?A=[kϑr{N_8i;k6mcw:$-'&鲅4}=z43}mϨco|.MT僱wP)zD>5J{/5e* D5߃kr+\U]dI5Gc>Go} GŜQB7IF.2D~6BзO}02py^Byŭ'vd*$ie VN%1F':e ՄɹL7ػOP <DMqc;|S͝*RXu5`P,㕆Mh| elAS݀=>>I]۔#ƎOGڝٳa4o|V 8EX Cۄb DfxS wn5g?]Rtש=*_)\{2=E {IͶm/jKI1%36F\+Ae;v ahi\bV_MU68TVnT;EU%T $8V\::J6/TQF B30!7$Y+۟@L T6SaB*$4gf2"ssQóy(9{W:a4 X=uHp%GH?b:BQaBL-MxSk;H[wX_J ur͛'Gm;@9'4T^A{g3R RD6g^@hCs#pb&OIvx.#z hQa5ii:º.?ED0|&1"`8qq^f]n4);8-/g&pAUpN%&ƕ8ġs;&GbPmQ9}<(1S|mu8dt-x`e: Anx5N6-Ӕy(϶V۰ ;&Qrbs6퓓p0?nV8NK01*c1HFl.$ȧ6i (,>= ^@IU?UBō2GXFH"q-gu\_N@k)usb>p5Bz #^Un]vͅ_ 1e˾%e -G?'agF{>p#W8Nt >+k#1񪝴(\d'J3*6k]m҂V䕞j02SˡpqS ,'ǀ9#כA)D-.ϕ_\Y27>(o  {T>.g8)@wFl"_cݖ2qjM ˿D[91W/ aI Δ4 ~d)y(3A9e'o,8sq_w_0@^^RN4AǽܫrPX(?Mt\Dm?Nh=/,9FVO.Lxp8=,_+hI{aҩOwӞ< kv :;{ SLNxx)b;қ$h9VYJ]"[c[zw# _B{fw'k;P _Vb\tlrkQeeMO@Xx1CCAXvI_}-+ Rw62 'd> |7W w |`dVBLXT{h fǃB c~0!mp41bJW9=c2> {Ze桜p[M_oD:s~Gsn:܅㠾\NЀ\~ 5LBGRu mvc,}00*9W(xf6I]RȿA qŧrc2[Y DĭO\T954z3לU!6ϥ8%ϓp!ח0+A&Ka\5[[NxcGl:0LIfAHB~ȶf/b;q8`dۺiǺ6~;oYN\'Р+|-'tyԇjhSUc$.zD ]ݕ MHyhʏ_ž/#MHUppEH(q(vK+}Ȗ ϵ% ⠭_&|*C!,K^HW_wR9s*y&ZNz@)W]8焗n?4{>O;$Qmh{*xR:acWqv: H4HnhUVZ {!*ICA;gŹTsI^S(>hg(yc1,Es~2"f $[Z?bm#4>n}vx Gީˋ$UM5Kiдw`@9 톘>dmf몴ONT`RH'*b86fZtֽLysx\++qi2ӊoX)ȼƒK>vqTΝ 'z9-|TXLxv\ =4C%0EHIcȣ^8~`7$PCíI;֯ |6q}.Og $Bˬ?"tM@w' D'|M|#E?P@KrUׇAtAeC}

OL7x&2Jɕgshu3qG!Kkq<,Գ=N+b8dF.&j}/E2#(2F ɖtc vG8X.Ƅҵ$W{H*O *JxzLUi/g_l^{ _$ .]j<#wv&~.1~ (kWŽ{%Ia" 5 G6 ?Amӵx# zdK}KO/ Q9G|]?f$XJXA ;fI^S'Xz}? O'꫌€7Ub 5XrqDtf,(N4ɑ(kOk ێn%wȷ m-of.Ŭ},>{ￆ8G6@\CqBX?9&\E׳'ƩГ59<"rD] ' 4 Ux+*ocrf za >e82ߘH&ZS*9D(tK1NaM]*e~Tv)) $?;F|ˤqĂ6Pde=ZB =V=GY0u 2G3tqD%@͜dFf5[,ѫOZfGtZ<7!Pm+\5ꂅ@(-A@} hZes 57h^qC ~~~7+Ԏ L&4hG9^bܷq.+7PkGb(]ѩ 6.nJ3X+%dd,_j Vݗ)o$ jlLtq2'Ԍuc#TXpDZDG"Tr-{0?*r,7yϨɮ2b 5rfӗ3h 8-wy/I.$G!~~c.)M"|WM25UP@/SԾkXi5| K .lEz[lWZ1dߴ*>)$t#}zh7wWd)I|g,l敁= UeNqSpۙ0ȮfWlI|j /+&l.U8hO{jԆ A@2/'j:oT,##oywUOeC,?p|{L3WN%%"Oy~=[lHk/G;ïڭ1D۩l^RRM#cIV0A<~]k09E>kP)BeUIۏ7yɠkr/aL4S@JN:ͲHNҲCPӦ,oJ% $(Xie,*SCMڮ3MRhivFFo[fu$h DZ+^0zx%ڃ1ol$ ,֦IKo-U.^DR;{zF.R2p3I *svIaҊ_4'l2Bb fN)q)])<`N~& Soƒ -nJ k !!蔺z[vWlc8g0,^bʬWŢp+WY.Y\P+˸ e]TdDD$Zn`;?\ )ԣIm%fZo WaLΤ''(,H޷T"rY09o;=qתNʸ*t.A(W(\0U9|5{z8iu=HcqS =ۊc]-L[Mf7Ndc >?1}Twۀ$EJV.C,R@o2+oǼ;־p坝]<`&]\_|lR gl"k`XR/4m!ڛǷ9dմN$v߫k31nk0@)e^~{M QQs:.s~#pCҶ1@;i\ܲqv{T߅޸q. Ca~)F^cTXd#.ql8g@N䉫w^&5KKas&,h 26 ַM@蓖fO H.5msU1 N>WB"(\!Tr82|ٞVhk6PL c'@"Y$ ppʇc+m0>H$Mi>_{&UIO2<Ir0~ئX<2&#Kdaa|mˊ- H FoNpJ>ZE=),wv{y)nnb CxӀЇ2Uԑgi_뷝>"ɂ$0*(4T=AE2oc-y<LZ.yO\iV;9|gSľj  CꪍdM!5+:#,GE%G])na#~&-9[]?R@)=\Is[?>$]u#$+')nӺG"ڵL ƥ)cw__ .Y޿D'^ӄj_><V _WÛ~{'0rwHn Hh;^1 SmyAhBٵ)hf`/c^=.5ZAU?˂US6NˌJū1Oxi@X񷮣j[j$jd4ƈrS?E+8ܥ҉(ðun#Pűea(QPO*G8Mv8jcK􅔥>d靱%It!9$yJ_$<+{ n8{DPXfZ'͐"Kh&X̳ڏ +߭ǹ?c16P?|X8gRt=Q# MKedbƻ̚.3ybֲlŎPZE⠚i;G wTӸL}urb"JoRJrli"1| o$LƋt2ZA)ڍIrN6'+϶o]x߰5`Xӟ>Y ^1j :C4.S0kfgz,1!zGmscFAx"(pzu9K8d^ 5꿉rdZעm$2řNx7_~ %gnԩ#9MfX~eU].HJR``UBώoǂ;!&c#sOEx<B>i_'&'S ?iPƒGKIg*˧{Gvn s/ҹi1zg`!*`$qћ=ȻaQRGPAB>%~=GW;.[a)uMkf,Q bz\!}7#Kk5 S ~I8( [R"-%_xRK<4P=|9'p0~( GCs~_drCiф'<%N*숓 EQ)IUNhc5YW?$L VK1\x WsX&ާ3$77"3Xkv*jZOG;*@G"4j%&P,y!1V;&蜥qd~ne\aUg$~PMV6 ~O% W^ֽ;N>ϘD0ˑ?]Ck&Pnhhleˋf(%+JcZDO9 {C/vALۺSɶ(Rej#x(a)"qp/F@%" |h/6]2?bzRsSn`I-s6 <:t*`<:pl› A 8o~W,B^K\K*4x`i~xN,Gtl} E?hp|d1? ѥ +b.Ix)G(^!|pcf,{Yt4oݲ K[ݷĠ X,Hi7+;ܭ8#2o?L*=&&Y)G_ZZm~-9\.2;3_ XƧy(Pv봻iܷR\GI$Vb?QF8$ ּjQy3ES)ğ ;17u%/GtGʂtJQºq,2^Zoaf"(¢(3ތ xZcMGr^܍xܤ8UשfRg U<(,6!Y*L\;]v"\S(SRQF [ :uDENV <&& 3xS›5a$ J,#sO1p_T`SF(Ǵ]&YJ&Qc]v]6`PdP= *Q7DUrW. YMw[E%_$]6 0ev㐢TmLx L0Xtt0!mq"dqӯҳ5R惵$0Bb#'OW"o!DlLhKF<ׅs[ԿivBk8s3GtZS =Xc3}أ̜{u T#`s'ޚ}R\vmv'Bx b%pm/,ROW=_E4/wψB]坐jaT[g(sk<$lN-^]Hj߯Mo [B7=bEpijV~NM?7U7(YZ}[x)wNvO%,0ȴ=#d$wsW$ -1ׁFbxϚ̕x΅gHnRs( /=Qث^_eٽ.ٙ} b h)6 eKRoS[쇨bΨ-{{^[jh>%7<3?0JeR@?y,p nGb"#~q׸JrTGDdj+YOKsU;4#,:g+D#^3onMnFDܟxT gǪx,AŷV@)/2[ gB5%VbG2џ15 u,^pԫ~C%$ūFkIC$o20s1?k[Mż:1{ՕbʓJ(W)$h"hY9T\70F$AFn;E8pg!5CMwIT/dܘ*JPK1Ѥ ]X3!69yH5k߱jo.qFXHgxTe%g}l%j7XȪ ܚykXk}nÙFFΦ2xG:cFV'BM|uŒuzʑ֑ E>Zp_)̦}8Д7Ivgg}, P 6 ߱1<\Qb`yNC#_?-Kam0vWlFu&8!]/E *07 ?ɩ]F+3COK璆|x@Ke;&O%aocqQ= 6um"5FNM-J|*#ˆnGC$G%E$A,Y6/zdlE;m8`(v\| hBX*.$zRN#Vcp,D5:aw-ȧRN9kM@ʼܔIyLa!H 6WDwe~Ë\8B^sB>2+]YI(fBN×fÆߐ) Hir@UQ!gYMz1w&8ܵB7Fa"Jb{y%JwoL =k8Y;}bmK[-OǸF HT oķɧ7@|UĭОc˹ɫdumoOw5`> Bintzjw~jbcn pqqLoHɔַOu( D߿yTGGGhZ CHېhg>9+"bLFSؕf5k\{S\1dFի''UPs}C="KWn[Wѫ/0Vq^ی6w5\?%,z+wÂ9Q֊B.)3d"Kyf|w1Ys oZGrJPFx`Y =D%v}sag%]t\ Z,l5 'ͮr[#Cm^1% 'b+r_xWvqm .!My$^섬BD JtHUJq\%kR_6m)jy3k_"oOJAE[ڀc"i<)z<*`Ājϻ· Cbn$=dؿ@@FsM%-@fŦ{N{,8 vܣ#OV SiU)~Gczv*XN^kvMíapLW_ʕn;rV.k~r{P_up (8yh^Bh ¤RBHyDgDӭ<Ɩ?Dzd BRTz =8Ӏ2(H ҜÖ F;y_YnIM4(cGcuc5^M&XL $4 (M;j*h)D(XO :I߳\뷓z#P zmTf!;)fs I`UjB<2 ԋ3z3"Ө55ßn4ކ3q̸jP]: vo}B; Z!NA35<~x6֏.jdaֽ ŵ2X] /PYRj1ߨʠ̤oD~r؎gW.Ge4Qq%>X+hW8ؗ#Z۫=ys6G$Wn4k] 7%avzr#i"+"%:'hj~nV6Npi0(9Wg%PNSϓGd8(fK!'XhrTۅd5_q w.EH`+D%/0&+@RUu^X%.vy_5ߵrDKsX=]ua44x*kV 44~|+Q盼-lc-Qq1R֫M{cI,E_dtx'! 3l?S/DߧuhLR\&b1JOy3vA,bg|?!mL5r^nE?tM-++o hj͹&,KI~߽Ïq& iy-\MLU64Dkzzn7 AK7$1K??-j7f_])?/b,UJQ;' g w7Oh8`nJ)a8<{{ 0X3jWqSDȫ 1eIBC!cӞe{R@S9 |j~G`;\G:Px9٘%:TiGsC캎~=̍ -E?aD'<ԧ5 F2]&,=(yD&0"aX qwm&/Io? y$* d?_}2ԏ$2 Vxa+/I"2?]2M0;aou 90.lpp7&翚ϧۜfGi_*Χ8 00ԃ&c l8O\6#@˾}F >rqwsXeh %f̅eyxA@ډds~pn/fpquuo)_WEکdoۤ\'YVס'4{ץb65Ac9e9Q}Bk =$Zav2%p~^Pm?Baon]G2Q^CX =VGXpfq,nYŶ.vqvǞB_yD!xEۍQÔ/y$)+6w3ƒZDM{%Ch2BsO?.wy<-vk3N\؞ȢT3Ki!.CךW9 7B5ݵ\t` 8X|xE bIgV&mPʴ 8X `jARlY F/g >n;$lT t(T )I`Ziϥbk82 3٦M {4S` rч!ɉP}r9v||3oEt?5@5&)bt|ʽp{)RS'gCɐ(bYG''ikXwBe4Qw.YglswVo-創j' q)My3– b3@`(-4ċ7-p[C?hwID g,C af= qQ`@G^ݚV'd˹0QM3)?I0a똽o=f0R5sd\rl8A;=ar?~"PCF9{l6uE]97Hp1:`+c;E-}+$^,>Y;^7n~EշJ)`]#E Ěݎ1 D'$oޕT@֤O;WzKٞs;_1ϵGfo[I]_lbf?v.bOiI]7\+5 >U8 AW>kK$|]Ve7Tw:ȎL\M2qBHAwlF_Fjb סi4"V|LI dTO!\&3VyFMF*o ;}#_9X:Un'7 .`: \=KHPL!FOa7TvW멈[#=3 EȂ -s1ꂂ}1 ޕ362D`lM_я 9/Fۗ+QG0-xd!Xjq?@i̇ZCҙ~+T9O8w+җsZ0oް֔s?{SE2l&HZ(@z>OKwy/'ѷ4|ygڈ,({{O^XtVw-zE%f]֙ۜخ'+w yi(?<KRn*z~dYZ>5|!3 *vχ/*f}Ȣ KT+|f|re.OLe*Qsӯ(Cv@0)̋bOK~ׯͲbi~fVG a|q~rQ`o" ~[#>,bpA:gu;jNXyVk2m7++`ntr|.\6Zo?x Ge=|=仔%'RړzuI0 rMNvm=!jokl!+a%rsU'?ͻֈD3Z_ңuk&y:Zmzh"=*i۠?t/]1|Pj!Lb Gh=iZn@O2 |ƣ+%ǖ_4za6GfДl1O\D˯'z5_rw}4)|m.ፔ .z͟4-.}ަG;F 2NT*$J5t4U. :'S>|U߬PѨI!YL~BnlR> 0T2luNI3qU?ƫ|E ܧW*[߶\֨sڱxnN1B4ݐsNUpqඣ 3ƺ/g%BCoB<'6kUmglT([!e<\XE~B῵үw]]ZvK,ex~g(mIk<VDٗՁ:ZxrNd.Z 1ni9;ëDHEu~1ԑHnz݌5DSq4dvY1mJ 1ȭF+'zRv^Zqw?^PL\Ŋӣ*r蠊",DbIA.n=cR9M,ކΖqoQ @b8kO@DKN Ξ!?"MV#VPqSw8osZ+b@@a@,rkHH:Htb 4 r-a;;nQc٬fHHhEP^(X~A}!|VJᆽ+˚2BPU-;Z>ڴ!daNΆ+Þ}Ÿ[ˢu|7^`EbT(e(:}Y+ &њRkҚ*CZ+3ĐyJ͚c~k^x1X$~6y ׉ĝW;lx 5>u 4gFn-e8i+ût8D4QO"Pg҂1ܴ[\;b׵𷒵jE٨DdC4#&זYN##) QHLJwq۪yWi%⚺%îp&f^vOc#:OHJ7Sx'-n @w89qY1/# Cp CoZFӊd(HT3l_G:*i+tysH+ cPMw\A'ϖOkCp8eLXg}NBU_g"bֲ\mz3L  r;Z&#^eJ~N8Re|f$14b6:ݕ;( <*>`|CjabNwu5> /9fk|o)3Wς4۳ W ʏ Va!}%p)ۇ7H̔ZW.kO *w%-8 j[W;B|;WǛ%͓rYKFV`˒iYS>i|B:LJ9a& i;DBFV L?&@7DTft&*!>mHuoBYPnՈ/ޒ>-6/XjlCjg[w ӼgR>`ǩlNG吜#st7INhC-MTne&zgweLy#*ִ@0,Z2WU_NRi7iKEY5N)T1 LVGUYH3f@'Vܺ0Y3(儦y>xGyRNa\r?^Ud5>S :W~9_mvGsZ`uk׶ /%) )@S]fAYDيr+sbF?G b+/{z`DD>Ҥnz˸3ԿG9)"bгIi r;qѓ,6T"H\q}wv9bwxm0g-? ڱҿUdٛob((r@VTGֿ"8TdR5gͷN"wLᐉ_,/23d07:fH2+R֝ (q:p}]ˋNn1NТbC$=_(|>ڡSU/}_q~@tV!CB|#C6)S۱+Η-@l||vTv'/1o|;fE*2vM86*#t{3FCoE}MA& 8z򰗻CMRr -LlD?1^7KYjl$W?Wv&!t}eGwWI]fF&x`V`2Ǖxou: ; ;6Fb%ϓ%姁stdRd>$]EͅSUޱN 4M[(Ret>b7qόOMWM7y&Vf ]pkbۘV'NOYfD,G.{DS!sGrWyFD k*:Lf! )+_ܑοB5z΢ g}O"0WѸr =Iz XtCM dw4!SP%vJ5o#%zv<U[J-L?ӣ[xY9VT$NY;$O'[¸- svN(B?>˯k_0P#-\&5 FkDhlmD>A|A@[c>)hAYj @\SXS T-wM~#O!nu kSK(Eb6>WS4™UCb4R漐|jpdDjVFYF8 3s}\ SM)v81׈^ ]H65a(ɾsNr<}]1vqϸHYzydd\ǑǛ럩2A9.4ŏmKoƙm-2CCVBMZF FIDǎ;rWu?lضN6'i^Z}] CO-cD֣˔l2f۰(EzDSȗHP('mv4b$5^|! xtX\Fl_aPEi\Lr=QiM6#aKa%|-0b4n 7\rr'I3 $y]4^)Y'h?j #jhJni0("NC=Hz$?r(s*ι;//B6 Oi{Xۡ:qt* ?5;"[U X:DR`% "80BWǹ*9&jucd+=(w6D佣ͦ5F]LaGGq8N &I@BùX}Ft.XVҍAGIhicg&X%\۟Ix=:YV b7,J+ ^#^I)*h5!Ypā$‘҇Ԓ['VdBM-&|`/Y+} yYb%-I]򸤓4[bNP|uɸfO)]k#=4 vME =K8-HxMƮYd1 xDos,Ul3(5L.D(R_$=إT/9xzDҕt]Ud1v" TF^$eJvL#$,Wt/ME4- :ȰY܅yVO m9;=OI{`z8񍒷jv)-!eƣ0@UDY?X*UzK78Eqk3!A;D0ݞ}\9Xe)R x(ˇ4NiAT^SȎO lL*BhqFLW x9H䓝1íñI&&k/]Q؅)r@鷦hݵ9&"wSgd*5M2꒡7zV*΍22G t`dzbha ĝO:RせgK'Gf Rh1l߮!; nƥ;+! Znxw{_ dQ"0%B BQzNwI&.x[pmQ0t|Loӭ56m1+!$h A)HsP^DXlB"eg"lֺ =QWf]@•Q3¿[۴-I ([Z*dsQYWJs0PJ6:٦;,,3P̡e5חA\]$9lVS,AZ)NSH$X">r L؛2.z{wC'v&@+t7yE|l^h$"/Ә/JV4^o*(fd:wr}tE@_Y&[AQ͵M>*Z$4e_Z*gPE8xMrY{6!G=3tq}ߌQwt=AU noXvl F/)()ǎ 65Z\ {dFd%aB޲j URPZM/릝hbcm"t(h29.'|ܗ+' >-s(jP1v)~vUҢ֦ 2(*5=J)= 3W.Zjw}'x+r0 uv!1|N_6Mm W! -15ÚS!ɻϒ!>ƽ@A4Mj"ȎNĿ7Li)B+%N30j3+%Pfqm5P3\Hq%k'gX /ZKwj˳Ojy҂S!tm0 5C8ͺzBz>.Ρ8a+Fu4seS9:"#@&DOk㗱$ F®mBv֥!-~)#=gͷÚPepťfj@OTJ2T]B) ,(sc[`i]mɜhG4{^FX]!?M[kO5y7Qя m'-ݮ* Pcç_N{P!&[׈jR+&n-fiY!0%bU-j?K.9\띇\k>\f mb>w|LN@Ej>4AC_J -vblE C?,XQj/BSi;cjo({U[`}TwQa(xF(58pƃdYnRCiqh rf~Zi!'qT~ dfj/%"<7g*" \q7<n#E]w.Dt#p1 *[v:53W㹭O2 Zky.#&w qܺ jSDȑ5ݝu_ؓ@s2eZsH7tlfjܫg7Xڳ.=\mV!%8_Y8ѧ#9so$GP2pȞ3iMmO{d_a׆j"D!RB!ɔ'+v. Djfkkꛞ6SdM=f_I,`n~}c\*aǨMiqo-]$v,MihH}rs=-IGH#29sI?:.oOszkoP-\Lw(~L<@w7#8kzKCϏj%b@KÁ%9d h>xZl!VNܭKG Z8C/䕗ϗj״[wue9 {#ʸ Rer,n7 xv|j*I;SY<#ŘL; h.]*Ѐ]<.ï2ӉAqP8,`#Z1% R¾#=x"O 4C":cLjT=;BIoTqC⎚ 8f?W sz7xnvn~Ȩ|&A SEK8_{Xۗe-pMdtT?$:ӈt5KBU7rB mcs8HXWkq;8ƂkƿɋL t l4sSzɕݰc) Q }b2rvU=!1_?<:` fdddIPlH '"E.и5ܮ C#JqeY&W0$k_K66[|-L%8FKH>O1iEGFu<D\=)"Ye>j=Zxv`^ihVO w!O}NAtKɫmkҜ o#%`[d4U'wW4!_{tY9ptѻqpf⍝W") pJrm7ܦ!\8 臾7@*2tŭ̜!e(2Dh{?aQR ւ ;qΒe,Khd1(Cn|)m-RHj5!F.>iŌ,*̥gl$4 ·uxWt$rηc2gmdOW7@ 3!YI k1ZåkGXl? >hpsXc&qty_\yJlQԁ  #dO\ݵrk' ~GQJ!{ ,j FZy']߱$fb> Gs<-|ˊ&Ⱦ$.C)#C}\9 4d:ނTV(Fӣ"E7 }GpW/*!`Yr<' TˆfYac:\2l31o1 ˃ S@3K }̢t8?<;ۣRlG E5VW(mNBu(H*OCuy'JKN&\cژ-Sd taF e,Pl9WѸ:\*"#j W_-HkQT2O. 64.$eyCx&a=5oXI wfXwQieɑUZXQ¤S[{3[UհO&Nj3,L_>vh@hԸҠH`*,Co,XJ܆@* ܅w7$ 0\hEۓ%{(#A7+ihL=jX\\+@ "̏.K WmmT!qB I2C`(0p0jVM=YF87/@*l`B5"qp7{Z;H֏Ɖ^"(Tj I[Y+gFijJcs0R#A0P~H8{S =ˇCRwz 66/Vd-~3[mÐ _᤯~yz;k4d.ZFzmXL$<:or-2&o{1^?-Q]V~0\: 9cЩǬ dBào0VzaGXǴS-iT_iL/iAj:dB|դXrn?ҒQG"7~.7V]}34*loԄF ,1 z[IJ #ꁂm~Y Wwa^,4]Uat?GȖV/'-0p|L1pJ⹤dhkSCNf4BmPi2l]dR? ՙ\,J>'7$ _gtO+0X_vg(׸̄ GvI]*[QZ+PT@Q1i$Ӛ-&Y'w-0?wz_(Av H$G7޼Kbr  ĭ1ЕCcI<iюcCQѡƄ=aKS1viD۩xdXS5A,ٝ\|- ɣ*DөXuHo+B|W`9KD }-uY_ Z_}"em+3e<[>x.mG/L:B7\Y\0.V*{t 8@tiioUReÅn60K"Gmkz.$eL tݪP*P;o/H.gnZPTX>@la:ڀ…톖 %UhSG˺@]0W*ZO !~V>m-`N뮉y5QqP@lK75y [:&|uz!pjP"!&ryָCeNkW 52fVM8AGt)r`/Md0#RnuמXĜj)I.5l?W1? G痓ɲ4֋ ꀜ³Ė zK` +Fr/ 4ZK~^R9jJtg( ~!Zc C 3Δղ YA'эF c~vG(٤u !mi߬A)R~=0*!d$lZE~CgQ~Eohw5 +=DQڝ^]ÓmGg1nZ>Sc2i?IFOa_$yu NnŎT7ٚϴpDlo_"7%:/H$H3tieSQ׻tg^q]_lU=j>^sg w ;_y|Ql43׾'k%3]bCI=_ H>dN ۟܎QϱpRգv /E*țd ʲ.fa Ȁ'. dOqcsr"vLUP!S]n7O#{?DNi H2`͉%3*rEW55RH.-hX+ CJ6sKe5M|1u]={K AG&7j}3 uu==g- XcJ3BmU\%բ5w7Q56l6ptjr]NG__!qkK'CJ6h1C}q(a_rd"CMHu+\ZYi׃'l9Os.)tɻGm85GJNaR̫@?o>PٲPÉ Nݛ_zFM1[t94ʼBڄfH7#C?:vI'"Fam~2O+a.8(HʸB֛:['L'F:d(zq89~i-t+-*(7fUm"'J\խg4}=NQt0kY 5@F<ǵ ]2@PQFhs#.ɉCjGVWnN7S΢9[yYa24FJ6xQRBqC#qk;AHwpa,^x ferK.MvqX7uHi 3σґ|88~i.c5}kK';2ErEOc(FܾI֪:itȞ~4uDˠ8<- r%(Z>^I$xj/jI?.B2Lػ_c᥮Į9Md6%:bM'!JU,Dp+'_$ޡ.\Ub9 ᔅ[+.k\W0,@!u侑Br ݃--WANhˌ^>tRa 9Z+i%~NBN7&*1:_~}7* eإ X)FP;ezmrTШ 1WPy3yzdeL04}{hTUgoLӎ6o^{'bVn[({͘q }1˖9ڊ9h4ΈGURZA'MOL>RMynRit*սzܑ܄m!X: 6EQ\DXE9,5'\< ;:\45R+cc>l]sKzYj;yKKP6O|ՎzL(b714BN+gKa? G[z5C[IƾͧKp+4f$x`ىRF0,M^Ї12EN).TӔbl9b+!V3iEؔ[Lؠ  tͻGw|dž x!{Ie@pIX^.z;śSjK=©G1M0m+Mϟ)yG5b1~HJpQ yu[5C~Ƶ>M [!_ ho[\0k҃[kݏ{pM d\ s89yK3!|aPV'?!)C*R|]8 w,V&&N6 Qˎ5@,[lwuVK_0qUxBAvolZ>TqpM[Z94[`8gwZq[ /#o|AԠ\.Hfք nj0KPY|qf'/N GQk%Cp^u_Wg,kE )C u ؓ!#1'lwGiZ?]ha3k R#qvC TڃLuo=;j|J3wυcXeF ;oh1vsO\D59k/׍u=^ {T<4x`tVis{ Ymf#):A[9N cD}gIH.oq%:H^9X#)4"`O p@?x'~Sg{K/'өԬ(~[30iz &o,?G>gWěz h:Ɠ*n{Fy@uxgzB/!Me%`I@"ϴ^ϡX`W1ͬx\#2?k;pgY,o1']NR(l jB58-OG*zTƎifIhA2Z?yIGD\4M,H, C؜ǽ.faUԽ;lKvcaݽo< [J#}8pS=P; {u/FIqˍ=¶Z.bS%eoLOvc[ŋ5|z11 TUbO5ji}EkYUԑ|zxVnEo0j ;T[gܱ}2vo5[c!\4+pjcǬW6Pv%y՜|^7j"yB_5x@z"v*m>YV{1F~Ns^CkY2'ԁ<1 G걚͑Bw6 qe,itƭ ҔdT_!S#$-]0#i9>DkT-2'>^}ǀ^.[y VQDX]f*@#i'elFd3G(}{NSQq<",` c߬%De>z< 5_tDHӡt`.&@ XBSJa\J'HSR矬itMzYVσ( iI_1T0K<51/i6mM )+?F18S;7c,^wk$\u>k>gXQXr-jeqFb$[TgE% ך@x !ot'CsӠ-` 2V0>(w SA w{JG*.ƢE R3=OEZ,7O+FN,hN.DGY4>ɶ6[vh,:-VDog!"mkqaZ @M%†DHQH֮`} pJ@ [R4j=$ M QNvğ4d%Y3n'x.mɎTlu2_"Ixk8vt==*kDBl.A|+^+O>WMC1Q򓔾)nd=Oҝ< /Jr7e--\!8wNmma!*J".n*9ovuE-xtRjԌ4liQdLI/EY%' T``5  ՃhOٌ˽b@> \COT ɩ$ͣwE#˓|(N3?_IQ(۹x72#mм_r%9 8 JSS^F1*j Nh@ w~ i9h=9M?sZeoU|_eۯo hx↖yXN+c+^>[ZD#YJװwoj\>Ys-3zAgS'XOw, .ȭb l&+-WO05Uk8EDN1RW}S0Xa̤tT*P"n93@EѦ,Mgÿ н \[,% SgCa^³VkwX3G~4t6qh aMT4Ro'oSp=A-fo~F¸=Y+7tC,Vڻ'Ԏg^ lK& ,K@jodg:WWol0$E+/;B؂a:"1@ҫ6iUCU@G¦5HaZÇp`KX lysYLwx=_QⴴBFmWS%0k2w"fB…9:hޚB2үz&HɯUV6mqp~4^Ҹ - w Mr/2!*{Ө3u1Ce\Owk]eqD 5uU]4r7| qldau/ z}pmZN~g0^d&nR6SM5ԃ15/1҃Dݨ,Ffρa*yù@#^ &*٬@8XTa@)_W$2i5;\;$Y4}f0^לkEa\+.bݴUʙ]j S͓2@(VZN+8b@/yTEunDy7/D}5|H'w!sb}' beCȽхۈ"ЩnxvvP(}L<%D1z+.?ߪ( {(Z\@qPn)ï{E5>xc2p|-S,<ЪihB(u %e)fχH׹` 0݆VdyDϩ8ERO[z~̹6zs~7*%c G=ň<9'rvp2.JjmzS۰W<+蜭 I_"}AKROX;AcEF=<z0Gtwl<ӽ.ON\6*}Y;+@%`-m%9 oTܩH A4CA]'SgSZfHWl{iu"JxSR&l&bGGj&qmG7G1"gPD9[&KK>ܔд5׾ILqT ;EʳxY$?"Zǜ*rk;GTY F.0XO".NFh}Ϲy~VƱ߬gaTweiǘi35 %4T+;?DFʆmACs79ܗ# $#t7,0=*6ҳ ?l-~V{Nb\4ML!Ru.wX0+!: cfoA=׏ad e8‚mF''uhzł{M JUӅTrW{SgV7*0>np_QU* })uH r )0#tO4IQ xq_)Iגӣ]n fn(VUq`Ԓ_##R>e0 B^֧y~^`0Ш}jUp; ^w 6: ШN 0l!_4dGhˬ2D\v=4ȫ„z2(i0 r۫>h/6Z~[kpp7Vi(&sRHv]~PYcؾUsoQ='*~nظp)M',Z-A59ް>XcGQ s%)L%*\)9] BFdusPQDOK/egVM,L6YPET7+ZGإG{^4T½gϛѢY:-C0ޅQ\5˻M~ Ii3o*,2ASZa=Cz8ĥ jfGH~s]ǪH.Al__]gsa%xHG M>[Jgs6C,lKւчT!q-Ի4z@ X`=j2Ւ䮲/!!Uj@D13S;DTB~~"*l%E2Kt_4##ƕn2[XpcV+{sW/.9z2.O yסRլ@ ?淘uV5s =0;,<;")G!OTfXdžܙXN1m{?jl4 31>{UqVX&VDe2; )/W0eynVi &5E49Y"b2(`A܉1L@3!>e|7>uD&_.D-t".e,e:5&,"7I[/|fEoo(%{H WWBm#MXY!>gʷ+LIZ~oLvCgFS3Q曲0r=X ''jXRg#e_KAԵ 9Ba8 ةhp1lrWhVNaYN낛֪QRHFީluYTbVDs\?%>KǰoBLTUЋ$XC+^B-:KC 8kPaሏ ,7Ȍ2DT֌|l)@߄=Iiuo9BD?51{ke/vT8p`3芐tTH BlS[Kז"^74sAُu2P ![dDN[շ_4aA^{k#v0ǩS(/~wBDR%&Dzڌ^"dx!$Jfah0zO 9;ϖgG@bq!ƿqqA>b Ć֬MP3 "Ac}ۏcNԎwj_敗lSzV8W;^?k i/t:9@g[E@,S|@.-2͒Μsip)SEbI d J\.%l2##Ӿ"*}vY_hAfg VsBj#dlcAɔ%Go,@4*X.=KMcY\X. #{ZГav^(2Jwֲ6 BwǟV>Ȇ_8IF +c24n ~ǬxnֿQ~|WJ`UC&A$I5jRӐeZ͂aBOHvcR mtz"h6YϮM}*7Ž%O{8D=0})9 ?[[̩ Lx1!`ŠMh'~}h9j%KGoLyHPOEyQ[;gٍy-K1I4=S.axgGsg;Z$j:MD*)Rcrد\5oJFJpx^1kk0}ORH&-XJ,lZ HqLh.YE%'g)U4 ';#A! ;6M7V6`]7}| =tQlwj>qRxce)Ѫ[Kk ['-{s*s `IJeNm!+4D2,iCnv{ 2j4[u7 GO-j¢q-GlkŶ9Cm ;_V~j-1Vܧ]G?-FM}:Xde ]ӓߦ] ԯpi#ٸa.筣̍^~G%/-6MӮ#orvɂ$/y HU}&$ 8^s5xx`pl|MސTi(R$f\]je]OjE~h>?ܻ18_F縐98gqzo%>wC|f54W|et|͞`Q0ē%5#r-;Ӟep 6xt|bM=$O@]As>jc*OrsD );.ֲ]Ȃv_S2^S&y) VbʰqdMݧ8#\w*u-zXbKhB@Ք@_[R-hWc ~Na|+ā+E:saދ E)\ECIϤuڃCH<ʝ=`r\[FgM/MSTPUGS0Nk)+p>m +^8CVp`ScX{کߗ:L6/xؗxCwԓ=\xh]UeVR4fT`(3s~mTY>d%pkM*1{AHuQxVQ;eGsEӓ΍n6TqS"w_}&ˢp#$FЪ`o6ߪ3o|$q֒)DWqB[2ٛ/*͓n4C} J%$WıqsRՄF^8~Wp!ַH*)ݢ9r CɉmcVfؔh6H|VwH푌Iy;6X>IN4R΍0B.E".YD`>DaMŝP2Q$/z_o6X*)R4ǷZk"[*/m DK)սҗˆGVB\+*k]oyzCmxߔ䖖=,$@*/P w3;Mx Om2t !S+oT:~~hdP&x>g}L8xJ1ѻJh;cf GY馿8^T2?:up_1b_ZVq%{\UJuNGB@*}!2U*{ 3i6~+2T~xZR,KRz@UO $|KG#qƥJ2:i+:7e~?;r¼S.@;\{tHQ#0/CoǶiI^ھ:Uf ovz^V9nR9ZR. *xLiqPnp 6 GgX饘I(a .Я~žO5VwnxF%I7ֹo*fĖN hsR~}=}\#qewLjG(mM[깡ߦ<%lQ㈳>̷Y:X4xgM+ӴҢ |d]@kS{.NmcY\;GEWL^d6207RI3}?_cvz]!DUzBI\yCć6 ӹ"vlyar&xisL#W]'p<'EORsʲIWW-ZNboIsA]JlXBt=n\ޕ WR.{˺:' y zgf\ԴaA㛶rAyH6Pax_RF>լ OII(P~mgo9K=w9Ey"y|"d?66N S1l~kjsX{&:o:S#>hrLVؿ4|l-$>.F4IE h|RpA,떖賙/|QU5 oS| /M/&ߋSSa"~]vbFh/RKPqBNjhʍ]/²6LfيdmX!۳}Xn6xss %*͋pRא6+Uòk{-36R5WbU/~cX?b"O$B*Ս(y,@!TG:#b a`ru8^ x}HI{QX Ղ?EvuX-ܨ̺ȅfj9Z"2zMhO $~&jv81hcɠumTZsh|k\ BafD-Tf%G!򟽇#AR\/hp\H3/HNk|ح?VЩbfL|YJc cVL,6de‚kE.%.E9p M ʇb? {tK?Z %dcPK.7TWv}S˯҂Q,ǰ8 /ZdO;">Zn ~A1#;J$"1(y(cS,Nqs=t"+ U iuOn5&ߔ `CV|) Q,V_K` X 6\;9HXh{w_䄨&;m.J.R$m)'% R"ywdqMX,62lFJ)C7Td^pr ^"FA a7uK%ubBOP&! R@]ʣ%4?0nj>ӎhj*ِT!wɆ03\Tb6_2 :Fd(XAi-!և' 6 kS+b{"ऍxd{ILUYߵ.La.t tֈA3o)U,v昮oaHk!H,qUq<'!bP˶ũ-YwϭDB?$YM* CK[5YMJHˤ%g@"RMo$K>i%4G*YVmN1\qYwr -PGS*e`0Kh Ќ@>3Wkx(OCǠHi}D-?By˭? ?|#8UOCVr跃ve }-1li{̹u;cn6D_zN,o=m:;:)5|OC/cZM$j\U_BFb)w 16}݂m'K6Xh0ۉ )p̳5(Wl[/UZ()*VfqtrXlzM6)裎0&Wc6G Fm93x}hazC r]$!iy—~^;λs;S<#Bβk֢ᳱ#XvD'L}aSA.&T4&Y;E +trcz(G=2ߏ>J??qjM?4'HS$x}QB@Q9Ĵ0_AôIaÇ} gpƉr[} t(z, 0NW@횰X +Hm8?!yJ?Y{ӵLYtI-y9YSyO!{U7S^=Kp̢-\bI6Ֆ_(}`_BP"4\VyXZi"jK10TOzMwaD8]<{KI?oL$+Fpu:`H®p:Foz>X=X#4A22-BO0]Xl#B%wrwzƣS&c 0M`P֍P9^9E$L0mMxavd GkY7__*DոV͜9t߾^0 bɊpj@Ew'g& 6kCO:MgF&}9˖Hmk۠ij nEH]kW3sEP)>U%t+ʜ'u_64 {Iѫj t$A ՛eOd9eEH[|qMTL=hŘ~5wg0" !xpq nvs, ^Xi@y Cݺb PzxVL3 X s,/hE0r0\ehM"jYi9'ժ!t`o ʼYem;.$6_B`L#gZΙ3F7iZg~^>Nl4M͖ۂN!NX:]h]a7y֬~v1qdT%6WBQU`EVJg$}n6&*~oqL2㌴5(DʨZV&} KW5^:nůT6tl[뗊,q~ 9`y]Mbz@@׺_)Q΢s)kYa#/LuǴKC+%3CCdU\1 |Z91z՝"Y>@Q?3wbA%pVR 1eLw!sW(P[µO 1`%p rvЛԖK\aw߷GH<b>`);퍀 ^+X0<؝Dr=7T6,A)0?xqP[)NcU=qЉm[WBgϲ|9q(XX1Loxvw a8E P^*1=r@Hkymlv2< і30Wq >;v=+]~/0j5 y ӰwRq] i}Pa77ۢ1X@yw)fxItY{Rfșu3n@LƜ8E)#PԮBSfzY[v0f%$uj9̅Bx&Ae 5AbeN$ϋ@x 8I}8SLfF뵭vg GMi{Htduucq(#hhR GDq1kpTa==N0o2e7ܕ)S|6, qIΘYFM PM5Kx 3No; W(x=Idǥ"kPOZ1@Eպ!4  ͭYD@1l(X1Ӕ0Ԟ"mW/;%$Uc2[!B]h)ԍA,k Tڟr;4i=^`vkXns4cyc-lMQq"ǫ EAvl5FڼIl´ѻZ :8|`qbۛT$["tjS19reǖrGB)`h+}d ˔g%-LklLWɩ4"PWKDਝG.gS MqΜRf\f 1%炞'ڴ`|\x~me._~fYUo%6 keXУI6XXF9JFUV/$%rDz݉WS5j`{^߰E\g,U{,Kě1?E4/F, wXImuQC61#jeۣY/vg;!yR-HRhYtg #ꥵm+g. ̡P*_v j mD9e2q{wsaYPIVxh xL]lCԑ5|?3KDW\3CQ.HfqskP]IVpmBO5Knoy{Iip^cݥurӠ,R ?6K2hl y`x:GߐMا@eE˔ZwkL LP"-i8c 7 R9lwSqXnz6<5ڟ''KϫogH{f.RfQ房t,[t;#JtE o}&BXpM. D)6 )@ <#^Yvyz&X? _=}q *B+yl4$GhHVٌҡL'%S#@]\8mU2741(a,Q\Z1ؓ؛eSގ^'qI$T4껗AJ -w HjH>cybM29%%7VOX!&m$*}]"/CN%IO^OH Iվo jt a7s,PզGLX }1Pp}KD"59s h9\ lr *Wq!&[Nhx+cuE=Uq8>zWY+EH~q*w$>-\? d}O8Oph5?WJC6b6{^V@C6ZӖ劆 A(ʴC eĝaua̬gj͕2~hy)'0L|l"M0`8ξ{4RM(vZ넖eUN*f_Jل=|XGjtӢD~)TTNgD༞>S5lԍaC IgG.ma>yE @ P=o\ Fgh[Z b?*Tٛjg.#,M~="MlvũaA%ksqp4ZWZ3fg[?*+?4e +De`Z=&tGƺ08w-jp8IX Hqurdlw%Θ޹ A.E|fOcߋK*[aAR>TF z"eOXk)2Mڈ'Goa;0׸QR$p 7orO3(3;Ṇ_O/ɗn쀙n+|ۀž(Vޝ5Q#1V0]׳ynNcCO;4`e[jH9e $)r$l>Wu:5h-!`~#%-4=X}7?l iP1q~sϬ鍱k`Sbe""8Q=R}Zq0Q:e$4Q30h_o .}>s*J-J[~ぶMV\ l$i3D/1j3peCi@6d-?o&N*eV'h=Lb:m }U>J #0x`k8 x#oV(ɤ\맅E\n!0.!ןq%i,s#Fd'ej8ܳ0|#ɽW2MF!Z/1 򈩧 Pd GJ턴\lwewTȃp`YD?#i}+Cc5%J74gu-]i*!iJ?s8a]rMibesjvT|^ALu{ \&O**vBer>b<^Jy."b`FQ .Ipa+,AhD#c9!G4Yu݆AE<s8Zܳ:p0&IdbR8ʩN єdF qzOb\C# /ƶY N0~HPoBY {N![0= MW6vn)V16<)‰L ' [xg 9} ĉ^g1yLi8>)s <:p)9$(ՄA~&wfWr沕WY9AcAANJH| JR[Ii+hơdq,ChZ G'B=z*a%~3?粴-`85qӷRRALb z u$ȕиB1=^$G3ρBK4ZWo=4SDlW% 8U%L6+y1A4ܟ'tµƗ=)ԍS9xl 6N_G# ށ(]4o'N=@{}J}\P'OuA LaՈmE:p=0r{Z!9Dn=HC}H ;I]"`}/&-xjҹKŖBywOi-#*,%)"UbL̄tJkRpZ9 ˁϪ7S&'٪Zv'+T71M'wRՖK] U~zY-KWfN8.vb1 (~ĉ23pK$S`1)X/+*p Nh<#ǟ‹umVC^THeubd9#%KPIiۑNW0k#!}A"Za"9&~ #][$idE9B[2ʠ(_7NJ8-7ɲNX,8H -V~l[z㯏KYm[JVSJoVG?y#;AUxFÀYibMse0Paeym8K2 LL/śG'Yؘ20540:.G,&Fq(0$*Ohssijb5Q兤֊UO<~^R՜QN z5_>Kv# (|8[#bStb&rr}kaks1oϿ{)z7@0 S=uA8!|YxpVnܠucr](ч:CЕܔ9!-&օ Ѳ( ֭Z7?$J">O/cNv[Hm-Hj&$P*CjLVtR`=+iYäHq'O!Aȷ.—k'v&lvf 5봪Y`T) 1+}UBrwܺ,e*4-ֻPu* wg4NȠt[آ ݿV_ES fduh\,),GM)@.F?);WpA1x/dx$Cb9R.m54aѩ 3:N&خC Q ZNoWll;#5icҼ mL;/q?T[̀-z8/˦مZ" rI(e3gfG`1c\@|5kMmuFn Y =o_#Q2L2E)x!i;iԙ*PVɯÀƵj0+qW6鳋9jW o,EO{<'dMyH[/\WA#Qʧi2~7L ,],c|}O(+L\hdJ fiwe9_͈QΑ=?=CXu<#PxZ6H8;C?PPGbg듔3SxиG{dD26kv_݊}}dImS8-8؃mZ&Bl #^eE^h0| 8)TAT?-MEٖ]-j <>hj~u_ġ}7XٲLv㽲=$xz9T5 *~ae&Xw*DT})&E 1g:+|կ~( G;x57W#LE[ 䋂!5 o[t`s9a"C]"#^ lt/s$/D&@BUY$z*t1 ak :&Kx`b6`~ NݛTvHV'\cYxxPųɟtcU ڰbSKcG$y~xK6 u#6ipGXڲk;V>Zy yQokvfkV}Xq TZUx+fı%&PTl.e=;^ª\GY[a6b /5N lI~l%Š tJi٣sĚHU/5/1~cD5s- \Nkk{N#lޜq+jSjԌnB~3DQFC^I ğ yK_G&[F$k|Q4MlxN3aN3+>x^_xMoձa5xx%^|y.xC#GKVPxy?xOnVo_d0qr*1۸aP/`7Xe.wVWMР~*ݼ;" ɥȝŃ~Poj"u=gPA_-4 lD/޻ԇ!Rcu T}e;! nxt>dHZY[2$_qUJT2?j>=Yga.h4曥{isg0R pS`3hv{g0QTuMO]$<,bCuQI/ U%AA}_} ~ɆA/Y؎|JR&Nmv(4-u/TӼ> t 0_')J6UDM#a#XJ" 7 n&0LsC/s lL"Bp*nlvT`(EâO ROh(?*3@qrbCu}oxWvO?/ EJKq+ç,VOeG5HfIɢ_K{+]r&jGM ?`CYmw!9gdq-e EU=&7)Gf:ޫ%@3X#dì 3 e?qY YoΊyn4B2=?.e'[-529ÛZ|k#Om_"/+@8mBF"Pc7|^1EcsNâ~+,2,R rtf5 V6xv$F^asKxCRAVbqkdXXrp#DɾloJ=im1@VTt7JU_l܊A& >hyK U  <â%ڤϚF\2._ 0HuNx_uUx $ˈ.(NC|J-ON ȲshpN1gIz>#a C BK׊Q7'x[`H?vVmyt@bL§dOw~:ZGpKd]pK3twB9>jK8UAܷ?,2g2SWQ-yH;s:\E<1Ni}CD?{/zATK<e&Gk4>26bl Ԇc)ݱ"E(t\ǩM %IC3}샤Ka?<u_9U攀_" 7[([sgl䦶I:w[d]+g|WNjn&K,: &&k,o>nVr+nƩٸx/HZs3Dύid_rXS(gmd<7eV'[{.]l*|Jm hm@bjsJ 3B> 2b˂#@IHZ>B-RFgOً̫ɧy74NBC3IhayN6SqYM WTT>YɵR9RsVW5xd\vE\l/XKx`yK2A]A(_0(/T:!Df7d@%~Z;qr+ujD6A_GdW.I|&ʊVlڪ(|8lދ1H( qr"CL|% 2/HˈulQȞۘr /[VʉY p47@+6xAA<5:\Ko/k tprlbeA=w a g("'R H7'>##(i oRX"+ٍ'4iՃ̬{zt3u|j5r(U[#m 'Ss_8Ʌ~3@cxǪz׍8`i/[#kѻOFoqy xA^pC&>X GKPτCKAux"5EiOLr+Mn 轡 ,&ޜ갹<.G?ػԛtETv)J8~f(BnPu P :v{z\KEJp4m#r[Hx=uϢ:DGfPM!,u#f8=Q_bf)i(9mj<>p4h,ذXBT1KDu(7eZV̗DDĠ(h,U{v4OP>CCN^, ^ew :"NN-*[{]9ыzVT߭>J[Y= }4pU>>*8id؁ c⮉LZLwJrk#7ob ~Mxm H|1:r]5'ٝk3#lΙp`բCA0Vq Cor[j٪T. vUh:T@_$JԇSɎ#Fw!@e}ӰX6B k%J|UaØu,Ft3XiS聻U^&_DlSv5KW9sѳ@֕ƿ.qwOkVC,sy(j.joeϛ.s{ÄsLޤieDptd~pD^M!,3!Pco^@f]ÈG*3S4R&,Ybj|"jD /4L[R/]p,T sQG#3ӑsE9(<`2*h)3"b#fa?GN:&iHZ#zzt寂M_`5W%mΙ~dɔ%;WEx#々?kHn0}RZ+hT$%,U9`a K^TVcDݽSz(Lgy\dae?h-ѷHtչj49cc 68Djƣu QbĨs xd@W-߲k > ~479nE @p@z]3H.%غ" G(& wws; ~љ⅐LZIP*J!N$ª[fԭyIxgs ?=Q ):a%vP6L^[LL_ݐ5onyMQ?@gkĠ89e h j]HGn_BU\Hzr[c<)QbM$ETٚ3B5躅꫙QE mzp3ߺk KI=l?qcLDm!tj4Ҋ5V>jM/\'۵۟ Q}Sa4U;\wU13hRO0hX\XZ-ԋ({Z_m+.E*\g/{?kcԴ;8=׭:ԅ?Eї7?`n->#l1FJlo,B:]Kb"z"R7UbD5n0͘7![ZC5EYUo aT!MSvl5L aq085(ߑ z?25Wж߮M#/*xdWmiΝ>.zۏ7HrT:1Fوs^2xп%lMⳊ^w0c";q_t+?REW:2oI#X(4,0 Mo@eUf31ϳ\(>i-G~d6 |kl24 P8y`dsucKۆG a⚭B}RtN;LOiBH_{pe;s)Ԝ)^AKo_|D]`ECޮh3K6TQ=cCyZӷ~cKu7z0pW֦Pqa{E=\Qd$/C;YjڛCd 7+q ɏ҂o >O~1t&"4L8f]*b#N )6fa/CoH<PCȉrF/tbڔGڗ< xODLv䌬~3_1-jemPH魦9]:Y]qa ;>LC/d#MbOzj˒C;f`RVBmOz|qDY-]k>KfYB"`F&x&$C<AY*Yʊ(~${\-}ZaI 02%^򶽭 C:?Xͽ=XǞzzuPMg'o7vڥB \U`<8F8iq Zպvd-kl|-[\T0qGEZ-++/ًŧ"/O J4Զ8[Pm7i- Sh;FUg^Mt P%N2"`(dėuaS,KhZ9<*q93lTAN-Sތ*j)"lꛨ0C>-dQ;ݮ{WҍBn/.Ɉ4KƈD#G5a|5g\W*_Fs[\Q1"֢ tw /ʿ(K1U^۳8n6hg玷3`2 _N󌦔S}1j3WsksYi 5!a9>JCFs80ܹ&P|:64)L&zz b7hkfc _ЂBG׏sP o%b)wkM8$#z7;ѮqW(-2E "iy׻P|"U;<~`/AAEQwF9EP#I^jBݥevEfv cӺTái7-xfFf?OըQ~޸?G'uT|׳x$%~>\h2T** gNyMU.WLA|5%HDyS C+zy4Z|AB^p1- W)V7*qm {#iQ/w>21I䘰y8rwGz mM/Kj4%z'-@eoB]fnIPJ,{:z5* L)abriNUKm܉"WsZBj7v;ij3-DJ֖UaE.} d63[7#ٺ3xVn٫^nB܎WkŸ-˽ F)J jz=LؘU୺|Qӝp" Tq6QLEC-?0L$&'gYKDIO '؉'A $GĞs})"84~\|\@ >]Q'@)IMep7[Q{\5H3uW\kP 9-M _X3b;{ȼ'-Tlt- кkmY [(Ģ _M;j08|uAڬZ<;9e>:"tSfpp ʇ~ %^Hw3[-5~C'w7/?EK_7% *R1 rArVPv,h/R\$~_ϟ:X[8!/ŗ{i{oȨ~Ci`i0=PKtU肚u=]25bhk˸Op?i_%خGd>*%q1>1=ɒ >.憳 3Qͤzf@)f!"f+ۄgúpB 9dНzAEL'{Jv Aݲ[p]:دӬ4jhxzI'F:}c('^oeG#ˆ!sL1CXQ_]Sϒ)ܶ>i y0kF5J 3~/`gO~rZvc-=5Gz9FoL˄JHnDİs SpnMd~1 1YB {~jJ=Z~t0{i;3.>cqڦ):X:rF{G!W>0jG]}w'ַT$a+aX*Oe`. \iLkq;+ﻨ#9 kg P)>7w)، >&k Dho^ҞKt- $j&c[d]/C36اayNJ>lg2"f2q nĄoX"ƛN_dq%jVgf6f\M+b$z*Kkzdg!"(`̊`ZGosk3 W#MΝx07|+03<Ȟvsˏwы y:{!@LsEq*%&rĸ7*Vb앭HC[_Kf yWWPTxQe:T_I_(JleNC^vh.EkҁJCg ;/'('|XB)N.!nd-PsY`ElO$[#m/\O2]%q$t1tunf"c(p`oKbw9bjhGlaUWCe 놅y z92UlɫQWy; _~ztO/| V'FKL.h2=GiIqAB{%S .:.U6)NӥH~M[>.jield5eIesQ \ύ8ԯboPGMGg#%IW{ _r1.uK [ "\Lp{-͂!*AB%v6'v%(ě1vĤG\ 1W$߼ ̏GJ C&, Y^~9?izJ#G S~I^l.QoWzJB<3p h3hQ'oUhb|ֿ*Ƌ-Fǀ^t.Q^&vc7's'-5ޝ%^Fg%m_h<: ut~J{;wiki0UO&i:atlDxX`r[\۰l\95v|O,?=l"r+,?r6%x!_9 n)m5D hQ_m f8ҧ/>%AJ!TN KD`@irQ`Gb>%rfތ/9pE UcP=~}(㌔Fp9o׽(ߌgK2hHa4+A8^ zm ;3z|HC;0hQT .j ݘ0k-ΡT]_o`Qp)KЛL5kB&\nQ"djk#j6{S/486&u~U!A x0۪,0,4 C" NkJv-zta6+/ȶ5cbQC:[f!1KFt9;ZO8M4DkAXb2b?aƍXmnԻK+/ lW;@zvٓ$f;s2)eYGFDSwirߜ%p#1c֠$Í/xoC"? ڗ#6' )-37:i/YQ[lJ2C6urwg']۔nn>׬Xy\"J:_@kWau!!]7֊ܖL$KK<(Y7J8y=~"(yaM1F}c"wuh5-C^@TyBAmv ;Y;༣ $m,nzj-rLCbL}SUPGl=>ڌgb#@r{_}B 5~rga|j_D&O6at1nAVo)S~!/~A?ٹI 4X&FԦ}}k${ʖyx%/ݧ|KHuJE Nn&o֑='| 믫_O߆'FȤCj8Iw@"U5q'w,.PG2d[SVDcaoZ ڦU3̇-g_$ЩZZm{FڗbG^ 1; Iw|͢'x +_ƙg`a Aܝ.1nTȣ|\4!3fj֟`(^3P4 FGߋgR:CAJ:ՇfǝLw:e_6 ȡI~ JH"[" T)#A8T726 -W8]5uhsI}?XNbÔ2#OGۧ+|7˘=t ]VW,=w=n8240V$K@Yp~-k07+[WRwU6|XAKHL!aňʅ]i)$qW,=.FOۙvxBg ?(F )bc$H@;r^QLǸ\9X@ۖ>_a籖,OѶij -!cQ1nK =X%`VL)]h# "-69elBy)I`:rgLdZ@ʝh5ʨvĪ`sd5Nym"zYS4|ݡ*GʠûR_v)'ܬٲ7cX25[*3&9$'*_?K7wB*lVٕ`bGz ,* _/|A0"Նɤl|߽2H6?v8~w^#+D2yD+\ RӰVC aa]PSѲ* d V 3 g/,Ts,OoWgc2B6G'e2 1=rԠh[(%10ƌ:v ̞Ն|emI9[_xމ۵ɏ, \"m@)lTaw74~#YG=#6lf웒0S:_[[?IDo2 I335DKW)m)Frꠑ^ K3P[Y$' ?m %%ߩ%Cz+㈘$!)aٜ(>h"-jϵLX u@9aKm{>|3iC+tIZEL5 tt2̡ʏȉ drjsbOwTN8?x"`&r{~7/6۬TEiFDJ5X VHOmI%mG6j;`: vCJۇ{'9vFJvdo:^|<*w_ R)hAtX.o"10y~ǖY`.|)TY܌9J<-nOY +`̮t/9UcKkofvjVZHoVx' _h.:w{v{ ^nncd?^ܷTG/ŝZe16`my9`R#$})?-֫{f[Z;_y~ Ccfzϓ291 xYI? NϖP"0ISWZx1=]}(k&2w'|+֕ɱޠ]l;{e}P;ssgU 0xcAkQz>`͂i`zZ&8f3kE5u[ 1HOz6?PIq@n^\8/gc -3ACZBq?a/PCWlR]׷9;Ґ5cFo'VegC2Vl'2g yDlI<4f(՞a]Uѫ~.!C֭; bEps4G6)7 2T.+Mhm3 &c`߂ca;WٕeGEfW:sIc qܐ]G<& e)k B7Cx -X*n_L+Rw: .ySY ^-:}튆`|遐5*H!搁-՗.Qޓ3b>Cmr%XBERYbPjk $-C?:τ$BS9|jW1,b*p=Ky<bcmm PZ\%H:0 ]iq;xސ?S6T=NqDv/^AJ~Zbf5gjv0?Ό$}qJ&ښ*ێ-wk bS@m-*r_VG1naNKiG67pD&7eC,P g7~\k/^J)=HP5%տ`0"%\sA@ak=2г}N~{qaEt3b_Qxٞ{*uT LAi^ _в.^{"?!,2ͺT jX_n>yȯ>>g?ĈPRv:Fv܎GRKY3SZXis3ZX@U8?28 7e-QGYX"I|ו- uաjDL@S1o&DcעJ9Ox*#{z'i%o] P*1:m&$yFG`9Ֆ_)ֳ&Me5m9ټ9s2d}O©Ydư,dq4ӟA'1n?"%#IEi@(mG7X꨽>/ɠVPD=,-|j'Ä/m]d\W3 dJ(1f@a%(eNIrc18e /\P|Y S$2mqrJWsLQ!ff>dZp&m.@< }tHC?Oh4t#ygWi1qܩf> <\ nTfwF>R?T0W %w_FuҀ1)H%\lf^OBrż ړYݞE [tR;J)WXB*t ƺmGHb@l#͡x暓2"PNg1RwE:tl<,(Ot@3q=NH=[MKWxrݰkH(H mP#CϞ'voE*JTYnp9/_O9r|;k$GZ u=f=d_tyc Aiq`L_N'@aeֆAukZVvAdޠJEF kv93bS}#3@bbNrUW,n6~ܜ-8) j:ӝh,I1 xs 2{:v>^j,3[xUdVJ^#oluxx{ lRS:, ]*6\1lJٶ@lJIr+'87[F#R%bQӢNʿp ' O~l KBKAn=qcy[+gw*^b:&i96k>vr֜(+pX x3Q,聇LZؤHޏ~?USf!'9#9/QIR3ِ1a=sGwxʛvMj=HʉZ IOPL ^J"/?pdy ?dGJ?kIoP1{ 8S oY`,+"[VM!Dktckf .j7\ZS:clWl/І~Y胷Q#<\6.zrŪ%Ph3"#[hqVaZB\7Lu~{zVb*Em=0Pڮ7Y;~U^*léru0hwyR=ܧ%Gy1KFudq3XVfz9LsegӀ[EVG~-ȂW<YUaf`ҡ ׭3:zJzy~@^TMߍmClRܫQC aG)݉t'v>\A!({AZnV] @Y~4U }_Cݼc OMގ|a{v;̲>XGԫD<đYǼ-3mHשL"xrxF[U_hzN >Ge,5|M />.da:s:G':P7miţy$ѱ֥o Ƀ`N:WI A Hh0063_osp1=+X5FsIS [ߓ?D5(gs؝3ebj6F5S 74,93,NmE\V#BAu}u&)5:c^<m Q\[Ew I|+H3B;,bA G;e@Qf6:V6Ͳz>t?#tp+m}C H%kT(Ce>R| uRH$ᆶ:fگ*Kd?չܨ/VҴ wt߫T{,<@_.IuOWu2ޚ?(UOb@'Ru45 p|]طߡZq m rg$\(b@KH4=r)b̵qև/[-$gM3Ձ(W/˲:T%#ĠLfв\ ] sb6-\fM79Qܰڠ ]QX9qNF֜^Z=Bz%N$J㌤0*"{-B1X=sv!68O!\o{ Cghkd:'}e(Xa~gy}Q*b=) Pr'ad _i&r 3,*ThG {ےWi8YTֶh$bDf\stP .sd14M1٤.iN{䧸{&&$Jt(_|1GxDrp,74OhG 5b"g$K9*ϭ 5&u( ٽ# ]V,n̰ [KWCf xd5^]ቜJam2cޱnp^J>@B'7a$} M/{׭y'Cݫ?;v.[O4pn{r~m<&oFT^R6|„ N4 ҧw' |nt413 ;t݂|x{8k+!ʡ}_%aėh*̑43X.SR*.5JR1<:#*_GvDsš鲩7_@Uf t~@x؝RUmi`1)CT .0ob[_q-YBF 9ʦȒ7_`wLcsX XŹ%׍$.Ķݯ`nۑXN5kJZ<)u@綾LnKt= [wٽ4}ee[0/:-`3Je~9':]xf+Xo|Bw~og^A@(v.*VƏtA_<{!u.M;kw!d0"Աn5I-Kf\ e~aZ -}ɶWFh6ʄA5-2}b>\n7un'wa/i'uƙ⯦ wNBDbUbؤG,3j nuw(pwadpna{P:fՎ3}TPAzew4y_NJ#茤R'5q HX+ WNM?TuH"'AÕi]\2jRY1/\)D2y :kD%xsT[&Q Ȝ|X5zF6\^I_k?ʽo|ŝ J6_( հ}e&~Z!u7Q &NϬXh״ӳT 1n|L$s畷kplL k3b? ˷H%E\6`˪Yλqȧ\ԖAĤ]ck LN`}+h\ԡј~m(OCx&i'ی,nuۃ.@^`Cuگ_hmj{:x>~8O>$JzmvM<{M N@8=ߢd8T/;,461.$[z"B Lf:YhMcPk^rVW;{<33}v<cҍdj):@⎞~^<QQMeÌIh#}ihJCsKpK׌6G213O{7~X>ZƤRѿ>%%\ژsg $zxcUȽ0Zem5uȧ ,]l?M/iLamWpKכb;5v߳ @yZ#ed҂G5Swfj H`0e aPޱK~%/ɇYNʐ{iFp Gy,#`"ENt*!g! p$KɊc[i-H) 5{F&(? ϒk ~W+3rL9COnd. $?˷*+;6΂磻 njpAh%P%V7)Z௣Z cO%S@z@R!`AҶEƄT )=0qT"vB ꅓۓEupq֓e7 ѭc VnSF/?s̟n'wKT6/^HaeW:M?8rkO#Lw ٟop!> B!vr˗ht]h'3". =#B_$V]D+@]iiHl^?\J`R5&LɶmL¥;J1<ߖk&ʔPC? ;8;y·-th=Ssj*4ԩzcl/1rHRڡh}ʁ}c5[m+\tgG=q4CLB˖/[NJ>̈6y'׼-(ӎϯ7#{15/JyHesVr  '(;j jt%=4D=QRvTؙeam4bLT]N#[=G6fcn>hKg̪P71}ȃzσ{ߢ/P}8c(A9 r՟/7AvJ/!Y!lGzdL2@ ,w=#(@2.L1?jT?(߼ӏeEx}KCPYV"`nB#^)9Z$ܱ~l\ ~ήa껏"@OJw諪HdO UYpe5o*Ý8tM=TsQq12ԵbE;@CWA8Q϶ Ngw'pS0+%dկ\[[6`[%% 6뭜-;뼅 Ok6oc)t${I 巢r\iEX]%rp1L R0iMVqȮfj)y=*keQ 15X  0jh@'G,)@3RV!4&f,(׭t6C8IgL*#3a0l_xq\] =E$L{mZ_5T&̽~V2lf[{vm q)Ȣ=[cp,6l;O#'VFV+ʺy2m0nxEh*+eB4t`^@V9zj! m74Z &EG !eY-;vڶ>m1azo8…;Eܣ` 9˾ҥD~뚙}l*4yoתrn| "Hu,QwXesJ(ŦCXuvƔ^.-k))й{aD !KnjWx/&$`dQ.hQ`cf pɡגRshGð%!s5u0FJѷDuҎ^t\ɽ2gDjkg6)A a)fAQew/5rSLys̄{VCzxyKykG]繱ojVN\"6 44t k#1sFYwiB/E3cbs$?Sv8HzkߎkL_=KV0O9'Psr}Եfl`N, *3@6WjP\Y1`L2*QG*Ȧ<o˯0+#]$<0GK{Wgo^pBsԺ,ð+;3dI hg45oCp\3@CwYp;}ZaDبP-w"y~}C~7[fRa%d60 YHPu>(bC܊5{ž%Dvבv,蛜 ߏ{Qlk3J5LgGOe::AyN^Xbeq?2iND4DZJlw-TW<e_u F XD`ï%01j,.lwLuUET臘n.=JRƶ#X3tY"_߆bBQq}V='q& UCZ`O)g_qyh3;WzU=:8rUMS'MRE6QJ<(̹⑬Xo.7`bl𢥡OV*HS%گ<;f{>BQg"wmk) i} ffKL#Q!;Hp<_}wYjえiC/5~'sa N [A(@ ʈo+hfO 6!ʅv]5W}rUk۩xydJ{fv)buKa5/sVXU1-8ĂocpTV;l;TQ${E2B%epE'`ncp KXrc8;ضA4Bȯ< HtoaZեdV\M޾r# (pvXׅ9/@9^&rp~nm9owŴ& .ᝧ\\o?.e897#L69I%uG 8Rl(yr8)~*|cbJ@MD!s 7m+kjSEnq>I)Օ!")۸FgZ)H!W~#n~`QQA磧V>9LMU'%&F0\X06/C2NPexeL&΂|tg̛v`"S~p4<{]|pBЃ=Gm*{QV& Q| kr}똋XTf&|, JCMXB~0UnЪ1E.u}I<'1b; k0w 5A7 /DG+ N=ȟs*_CM7'[D&ĺ{W5 G#9Ԓ̘V+pS9k^Dbp EA\bc ڦZ}E9Jh'sћ.暳 yyK85 9 ,W_KHyH!l9qBW^Q\\bTD7nr&|5)=K*2N+sU^I '5#nܝ l1~:E[vp[D Y5M`"TO}&ɌBpH$Y#U`lxEg`tWf|"K)Aǡ=-^kĭ ~P$u%Zǃ)9Gc8UVl@^56*>OR['CYk(kS´woZ#R + Çj[d\zq{KG:}B >o3_6?wna2r ;<ۮʽ |Ϯ-Xp\c$aU])M_w. fvس;1aU66v{ԶR(- O2 o %.`,pM+_Є +K1! V轶 7 e 0,E-sg;=$NX|b#}HW6쐑$cnZrYѣ4/ue3:mEe.<{ZPtU `W?Nw2=/cJq c}y&-%'%-ŸJ/:v2[R**wjNv|ro`@gQ>_^Cѥfcmv_U?6iP},Z.^cRDyN-c!~](7'#pգd{InB@/=2) b+Èxf' x!n to5,ŇrT G=TG/ild^QE@&^ebػW6H3 ]z;"T"~611$=e0(T'j^MMjwH X5auoB5ijDHc;E$p5ĚrAE0'/?Ʃ;+AW.5u:} ;{E̱Dccd2ؠ!|>j"p˞~{旹P=9ޅC~6l#0A_Ue3 ?(Q&-  \%%+,zw.~oݜƘf?0Z#˚lU#s;ڝ ~  ~x ձa# -^V`\QϝnU;=یCqzՎuB3Ѓ@)+&ΐhUi kjYnVBi1sN1vz|auFӀۗ7wwiC)Lzd@@cX fmcʲi(39gm&'!1Kԥ("\tʫj6Exs*-k}A`)} (>2\(>up҆_ izѕE*o,D ZL]eB1z\~p^οDS (޸Esesxt|ۅ5ܜ4d$kJ=$HIVFqit`"Uy -VCس9۳-~K|V Ch:1 pS˨7\6}ZкSYsfgNvA0u(ow̘ l!>rJnUl7JEΗ!+ k'H󰭢qvl 5'Q^y(ajUy4(J+1̇8jB",\}zɹK:0пGf,:\!b"Dv_1f˓ZG1UfSRAcV| \i7HCԘ8o}w{O7hIGOk݇-_ >}O:65@~I@W8cZ+21iYGg>gg$[p.}j0 < RQ"`6㌲Byks3dV<{psn["k8zxפLW_JE.ˁcZLOiSc&Ϩ<,ТtJPh#8(حꓩG\G(V@{%'o aDž5-cCX>(=jXʖ ⎪r3)Ãj^GZ4Z19 \"tHP=yHy5Qas {ｯ MBѻ}5ohX"J_ %Wd+`\h GR-zFK/5W>H VƓ'I1sS<#kړ<+{HɅFu@P >'P$E*SK |/jH?\7WJlbgb,)_fմmE+ s]o6_W 汒cE-ć/Ni<׃ፆ)lc-c%#R=D} 12!٭uW=AQk]+|ˆ-\QmdLR_AruNr,XG2M]R=ݯv G s]φ.×LGr-PvC~:ʋ @m(>S C|ЖS7ЈBS3$hK:;n/m50(K~ R^{8G)C~Rrd|vq|$syYbu9o}j['? Ղؘ.{#~mEqlZ1\NVnMTmNj7ϭy~PYw YN˓e)ZP 8  NgVO-z`]{դp5gd?KsXD_I l PnKQ1:н 5[?`hW-#]"ľ &f])DukYQ mڨxcx/i.8ODMڹ&w8zf^Ɏ~ҁfI֯۾qA"!2C y@ }u뇸[PU"E`Ÿ҉AΫQ"%w;A ΈFɦ1̮2& Ja$M~qxz&5VhdR{zy"Q4X,r }’lV Y+bx:ھٛbsL^<(_7P4i((@VPٲ D "M>*Ϲd3lXN SJ+AZ;Eraly  fr@:q* \I Yu L^uEӓStpT 8K۪/dZdYr&G%>iWM$<XfTnU *xD4&90B'|4c@ųGjSWlA:HG_;TWcvBf1,ݬ 2g8(kğX " 'TbTIr>HnrY-N H***,M鹒M3/o~c"}$](d+TG8[DPHHi^4[RwV@n _(a1ظ`wբek2ߚDX_8;%Ov 1Wf'dߺVI~T+T%+{s;TCi# .V@raqds6'[jٳ/9=W{cV=7ŨDx?z%O.O.2J)F i Ta۱-V =tKkPZh)̞MNUz"(O/sm}dk[ӂ8[NN]JnˣMе敥 4dv(e\+/4IzԳMgpc%ي%d8Ь*74k֚b~@r(`|7˄`V|abk`VmNG2y&s5olX["cW[]~3gߣr:a^61ߌ^Z$lޗX(MG{Eۆ%A^t:0k3|= 5GHDY7v4P ]|] cKhU?d"w)G*q,`3X%$NMatc& H&OSs 3_Ŧ:>EHYv u;]61~mch~  č._zLhq.z}b뤖9襣4T1B^A7щ:#E|gkjTWAh qʗ^;Nہ,Y~ELluhګaͤAIRf|QT̺p iNpAvcЧX/Bg/\OzxCq QM|OSĆ,23 4oI45} !5DS:)w*h3Eiԕ4aݕ~7~+8[9rqAuU3L? Jb@xp=ۆ'Efe-'Zdo/^Sh$Sqϫ4xa&p[gyO0/o]R:8t[H}B!0wKnSkutf(hp5M.2fo#Dh’2B ׈zYT"W3.ʌ*ްU;[tbؠ=j*d澫4݊,D| 'ln;HNm/~%Ȕ˙w;nQ86ex* ,FX/Vsy֟+nh 2pE2]a>s<Ҁ=Fz56Q$xuO`мCY70ƶZgIs3>JKwƐC_t2@a\9CP_q:}[7uqJyYG7n '޺70 F&Ў ~W#a)QyLZlmOl¡MiKZJL>ҦvhdTE/hf]o4RAg(X # ??7*1Ьc7ce-z+ ScZcߔ'8q=*Uzs%].W|tʻVw&Ҫ c֓a|<n7vLXiZO=Ұ@RO3F_x%ZjVJbjS %$r~tsL)\hؼn-)ѝ/8>סjV+K/^;iYQ̲n=9ˆ"|aZХ>v x=#͓**rFG&E}r7Tf e֗ p3{ţ  "›,Ge>QwI9)OG7>E&tYl)ъ4}V#Q_`,EY Vl0S!:϶ T@`>+s n`lڋ@C[ր汒 nyC/<'Aج]Zd:r]@?|rɝVoZ`GPiQal)Օ>uA+hе!lgc7Yw RCrۖz ^?}DK}Vc|{ vclM; px L7]W[x1qASORf-k 3c]KUˀIa^,ߐyDN죨/Ey0[*lؼǮ7;\ڒ!D|9W7\\Ƴr_rtv DY):>s_X -mGakCi7GcSj?2* !Laj8SN$$zq˙;vh>(}Bh1>aN3k7LYSzqDlY8Eol /uk,0F2Ō: ɹ X@*T>Z6 -Ek&:\S0X'F1B5:{ AwvN_Htze}i$i K Ei }pnԒn-betxݛ4RTA߃ TręvuJ/:o/)I- z&eeECާZ5'I̓r(],($QG>E.v0>uUySjXLڱ -0П9uY§.*zotЮ}2Ȧ0$e,gv`nO^2=eQfxrosVJ 3DedPvqij>%gfG!6l 'k&6>z92E^49 >/ߑW;#ꏿL#›j~|X6tR URgs=* <V*7y3`,X,#s <̩^Ưdq 0&;F#FXFoYZJ7"&w~ԛhS=Vtsm޹˃\j/Wq.HpVCK('\)\÷ E%x)3TGVz XO3tD_{>B#DVH$y~G@ִFqeq,Bu9HY̅% XYmo;!$`ϙ#Up_4[K =KuJ|JBT-}~퇠{݂u3EtS)_roL%5_Dt8޳x8PRawHEv ~G74K8jFB*F[8b46 Ua̧Ú;^ؤS$@0h~R', oYJ]}$.G`S޶_'!sjdSo`@}[B2Im"?;_"\)J+cB=JcibIb<umq_r#S+.%Uofm D+Fe!xnMA;k;ìJ,\dL,WL~bd OIi(;*q?f^;G2W1rJ7':hh#}~]4?tNA4z)&$eŮO̺5+ s[qi2AQ|xpG&Z~h="mUtͻ)IWx@z[uwnn`*Z͵w$7e1|bZ]NM Y8΅[gP39"7"1?ba5K/oi6q`%*ܺSl\M @i0=w(v:i/PRRB əH<8]lp:f*w""DC9ɜTN$:%фUiSo-%\G~sU^4 [&X'bG@hLP}|2j|Yw\w9HJ]#}hb#mq;0z*%!ie>J# N>,[Nbؼiv[Yvl"} u(:GSz*7O YIsӇuoLZAn-1EyxvurDfN6/?/!<^m`P-95I ɇ&[8M26>qltx6jdײLzxq5[TO T`r鶅͑ ݍ́3M<om_[ Wtl2 $'}>9> 4n;vt[+ljf1 eo f"=;YE8.h-.9\EڛĒOa`*xDNbN3 ^쓚In`a۝jQ}#|0y( VMm-ӮaAa>Tk*RC`)| YGtI?6y!y&޾nBt7RLq yiYuXG:/;9Qߏn_ bUb _O1U@!s1^@. RlDrmqb?"zJ"8Iz۽$i"m"k~ǁ(cgLOT~+5"F'.xk%3'"kXEl -p^w"*gON$ pT1oDL4C dU*+:_㑡FHVaU=&eDɕWꍋ%!S}K|Nj^Ї<D}hKP /Vq'k"I[;_>,%5aA%_ 0>8 }~m_RۯF #(] ɜNd0Z=RtM0uNXH`R^pj_sHyR2.Ji7@LFVS􈟦Q~3]+|J}%#ooͻ>$zϑos֞I%>Z~B`s#8&b':!TsF!~Jl$"dOߣC!.Ur?ܼzq-c(;GW4lš\ UĻZ`e3B6l^MW{}KNr%K Y7@IU Tّ=Hδڊ<$|׈8꞉`'>#PY^P{ۼD<p=AJ.K!ٽR%L"V,k=?iv$˟ u$-c)aD'RZWvMҹŴb{Mb=K[ @8 EIZ*)r.2wZ7AsO;#Fy6l>`\U9UG)Á*SVmy"O;˭Lۅ g7'#B*ɣsaw__-,a0 þ3Hg ۍY?E:+70)^f9#ѵ  q@҆Rv'9È 8 qJlz mdCswUQIa/Q򷕓 hYIW_GR=,ǰ=--$i1Ff4y2f9\ ͷ,*T0I ֎_}ϖeAKlm[\ +3inPQԕ:=.6¤4ݙOnRɦmJul^32x뙑9%ӛ)AЉ`L/|i)1GB\>"kEz ,|f 兒=kmmyr&^i@SqC=Jۿ=I/|*6VȢ”RR:~u`V :CzIyCWLpsݦI wbsr%7*|?;a٤sPfLCTvl顙cZl鲼>ã5Z CoA޴w&J/wdX?q/f2}QIOGqC.]t/QU'P0YG^a _D%\Oހ.`w^LO&˴axԶxNXQtRfX̬d^/V"V& ӜBy2|?`"?f ヹ\kZD8/8{W]6ނSE[ضhxsu j׻;,;fDhEmO('yZJF~4oԻH0aA.CUz`>AզQPht?n ,sYY_+6bwQdL]`2Jq7ۤ_(oH/ FMd7ymZٽG'O jVQů a2oxKŇleųԣamؐ8)x0&7"N ' NfKwvpѡyԥ򲾳ԇ fE h5gk9ַ5Ic7ʟ4r;WQy fXut SaLvYO ^QQOO%d56ȫەlǝض_LX][d _MT$0Y3 PT~3Nw|X62Z֘klFW-SpU) @תi^Z"[Jesv<;tvIMJ|X,WtzWm,9>ϭ_Ұvkpy]8!djhEfr[O֚i]7oGv0B]J8 獦mw!j%m'">rT b|g~fSV( w?j *r)-(&LÐ+ܗ9zf^AMj<§iT{ fO,vxhQ.;[wO˧FRnD\<!ˀ^SJ7(qܤI pڑ*75srx9ͣ@ű$~\nY÷75)y$XjPUl9u7h%BO#/ 9eZ0qF bD۷kƈikʜU !G pW_LŌr\o/ <%qO|uCOF>(6zwjYE2,(Ԭ9\{C"7` (@z% *#|3괜Et}3,`1}0vW:bA]B+@3sƜ&zoj,߁% P- ]ܐ `mz]Ss%kkZ5]B\Ȃ<((>[sHܱ[1x3d<-O'@5`Lڍ̯Ʈr&ōN;:C)?)]:<~N8>e;>E}3LFc0avm_sZ0>64Zt9w@ba&OQsG(=DJ<aλ J = NN# ^Cf;ʒ1DQ,4%zY"کY/|ɗsQts'`&xZ_۳Lx)D UdI![rM#hxS^ F0TaFxƸ2x.ϺB`m;lk;)Br+zj{#F-gMg)`,V~Qp\,W¡عw$9 1F殼=P'uU-g%)t;{v0ÝȽ~-VMxL8۬3(1{{]-.{vʏkӈgnAW؊{_і:bum ;Qߙ%^S!̣(cШ -@˱Jh: քu ,VK%sY0ʣJ.¬4H;$a%نP!sl8 K#ܲiFn][5+=:mSMAs~)oUMbs'mm`{d.UxWg7=O-!f x`QSEǂmjDiiU4ma bocMu \RW-wim @^ֳVpEOңT 0KU]  |{Mމf kE4y,XqNcU aRrpAb # }} ԃ]΀}*?(OTfyE\޻;Dp5+n){lǜm t n!~"Y vl7zNG3$Y,g>/dk<Må\|ެy:%-1FfˢG [)+5} ~[L $/զY/3"0({dB/>eA-UT‰\gs%G.Qi\[hfĶ횸 nrmKiD`~Bo L#o7^wUHNuq8nlFzE+GmD@Fm䱊rppoz1|Q/5J"ߤ O-1̖nO4" nt">fL.`VGm6Y/Ɏ.'K]˹n񬉞G6+T<6yt]vx&P~*YKwɺGRzK>` Ӧ-!WhQR&B1do-`I6ʥR&DO@C.|Zf+~^x1E iAq(VG,*31Ә*#4RcA|Eّ?}5Fz3-dq02ί̍5$f<~X5z:X(Ӂ"+o[0N)oK3"9LVDY|:q:4%B2z6,MI AI?/NDvhI<~%G߸e]sñ }:xrftS^D lο/ <u/օ8'R-''w Q6+ J#'[)'鉑hQՊի5ZOH1AMփU,sa?]9'GŢKܿG,dֿE*uy4D@9G 3S֦]#FްF_}$7Nyu HUɅ7(, ^?X\ϔA֚%:f9o,͖i#r(iAlbP2h]8[%8 FtO0xwtYe((oaBV+%cQM3{,yJ\%!qSDC`TTi{ +sD cuT,*5#Cg;mSҿ?3Ԁy.w6r; . Pw2v?FklOCkQ{DQfN3-?2>Y-h` .c1WO8ڱy Xr<@BLK1ʔsDnK|Y7Uq'g%^w{B?K~`Gg_3c h'5l9L@Fncy?'‚\F X&2x)~ T&{ÊP~=+]#OaWU׮&xx [dGX@ylet LOF\wVpKp\i]l,[z-irGEۋt7=&اOGWQ;H + L6 b"R $g)jQң@"#JE.˿x}ـ[CfB߅!\ Qm,9r%$;Nj,rϔ!t(H%ɑNO<…FNy0+e#fH@;F,5EYu/Pʸǽ/lzݖUۜ52&nَ2 Yeb5-F]y7lIr<K_(-bဧ;%R4LmDu ɫo|I;zjx`ڹ#m8P_30 ڟ4w{I1Ff9ThH*Z2oycAqy"E惪l751\ !Rf1 iedjH<3ek:2 pA["r#ɵϖĪe,|~&e-,m$u:jua5~sٴSlQL{RW@ۓI|)]ha Ab4W@[pmV 9p $>K'6%Wo`D%EB$/s)`Mtzuc\ݎtr&:+qS͏X[isj=A $5,W*٤tKμ;6oNZ3q8ٵUȬ1_P!s_akɩIO d(YЌQ?"hcLl⽟ttUޙv1tцC,~X~4гy={/Pz&aJ W9xit}K=s&SVA.Ӕ6J|b)7U%7% _~kVӅR9/ "rC0fk6LOkOZ@jyl*mufwm^S)Kjh =jl^҈Mu:Cc >2q't1?2DV"9έht/N|3OHa׳1d'cbo@P>kg.S,1q/|8g[+_^o?~7gSncQX3`dՁN^.g(jwp:$WQ,t%}v6 ߳uGS] /6NLڧ m'qн}~ĝ:+7B9gZt=2W(=Q>!|aD~Ti89/Q0zuF%R\[Yn[[W]LśMR/>WK*dCD솻Q Ifi"'3Bq4{ԆvPh( [dGNodTWo?c((?WL/]0Dig4ή{b>+Ys"sǗǚ!K)A*Kq`0D ?,Iΰ?޼7oۦaZ0eư^[{'0HuFjldk+xz[ @VUo"yTSU@L sEݙذ hSC*>$E+. 0V{j 鬁1VQ> A*1Ý>aoVZ%p<#3 |NSoaDlWU0 QssE?Z e(Vk)kv1BիJf+íti'ͫv!{0wG@'>Těm Z)ZvZ:^L$rqxwh0P~HTk^ia~O73?M}5"Uw;,=Fly~xDc_8] 6o%#ݗMeg0̷XLAUʁ7)[+<2 &0!/+ W Aȫf/\= y=zuD$=wSV$8jTmwskbY08z5~$0즐䗳dV#3u{IO]A;括 9!Fe@eD RZdI+.HY]xIiF"Z}QM!^iM.L@ V{ی[Hss=C->0v];9 wM<i0#Mm]E-_?p3#I6q[t{am] RU#.kGfT5HFw@ľdo9QQWc245d3l5*O$6݅uǓ^R4S_'FW\8TT7bn u[gX X~B,ӻ4rK{Nhkޏ}"F^ikS{*I80B3G,15Ӑt@}JD%e&A;wWFL0#w W=Βe Q* CuqW&~]x? \r>s*/ђI r͞_%2!#e0_\ݑ)u,ys 6v:3:m;jr)n㇠Iq*)[ZmlQwvR Qc(R u`Dp@hجI2<.xf,ǎsr^^ WxWM[I k9QŠdmތ7Fyi$ƑhtHOyHn(3_)_<ֽ&Ue?0ZlHf}$H,o !q/!,{‰5T1si- Y3uN]T֓]2$DRGO:(>Ԉ"nz2 k2%\+d=#8I}ɒFɡ돢kh`w|:s8L( 6zPq} 1S4N*JiVMtں~:^bj1KPgC$ Aݤp7 r8[u{'UR)!(ofg&5P2LGvXaTL-%`^o;j޳~ Shz趃\*qtXt61!\$|sժ>_B,pоm߲LնGuK?Ŋ(vxVuA^ 7=mspCSTXȸ  erVD!! hו /t mmO1mI MRV t=:=us sdEc[㥕Fu(ښ".뚢/P߾cuc:rk`kJ0QuΩw5/`hAa,ٳ39sƒ^2x٪ΚC~i8`-*/U'ʨL2V"Gq}.QʉhSZT5 ܍)d8p&:nLV녢sh=T-C?p 80Xab ZF*%7N˱Sz:q(LW9]%ӣM;U3"MIIgpBٲ(5xqrHZ'[e"Bs*DiYo^R%J.fD =',Y3;E4o.q+u>Yڤ>2vH>eD@Xcwl^)~\T[H}nMtk4pYi,<=oc1 = E}5x:h41IOH띋xx5{yPwůŤb/[hԸvas3.QFjvSOF&ʒW=7q fN,yU)aa}av4#JhaRN8u: ?}/!/X|\1͇Rp/HP@V9n=P㿿']h nwU15KPa\ j[cq2Z|wJc {nmg@҅z*]T c Es`NߥC'QnYʋhv|4neN &Θ)1 S}@_;vVZ< c5˲]qy\ԶFAL$lsi-<,_d8C)Py?#-h=O^PW_eY?~z.q'#>bpoV¥\/\Ȯ7QyxnO؍h 6rE-dFZ`2sp{g=Aģ9|yjM1h/z[vxߏU.M"yF(GLu SAR`qMƁkq~ֶTW<;i.\آ^f"Y<;,e }tC"Zq\*^3t418r|g^ (x3:@q߻\6қ~iH9H`VXe'>Dv`%<~ˏ8h'֌ˉzO?3?GRu**;M8_71 ]1܃#^p>^1>\,䱉7rY :}e- Rsxy7) Bn¤Fx'aO1r!\ gAgʣ z-? _P&iMV(yAմZ*pYp?jDF<#}f@oNfP#oJB/ kFd/ 1໑z„׮ bFZpBir[Am5P59;(hrGD4G_ǎl#n6b?On_׬Յ@%T싳| Y1'7})52DvHE w2C\TںMy36@_&IRq"c["CDoh ߶И`|Dq6$em.4-1O3{gܾ~$3Ĺk_³< ao&}fZ`ڷjv\3[#Zz2(={'#M#iZL9m]GgBKDu_˗'kaAb,PIӂ׿3C փo kpVmv5k#\rП.4F&PNKAބB'5e )dĥnl 1a~mkuȒd9hyfj"7U #2uBAz$<a.F*8sXamߵ S2h8/..H.E"-$eꖍ}詄(]3Y$}zUJрNc#է9e  :F=;:vx1XЯDzf=,_"aH$VތC |))G`ȮrNGϑi;!޳MzĎNJf }ǂ`pO#e yWz v"]>Jjqo05:a(- $>|T^N>*Zw9@HmvT{Is~"FWyk%7Ёqϣ{N[(8hў03xyUՅ=fk95yjMYDXA !<#b.Q%nsoa!2+xQ#i&篻:! t8~<2-d Ed l=z5ǫbpH#|<arQ.3r2#KP v8reAc {ř՚q=(:!t xYVԨ+}K], |sg:krBL.{X8xd' usz?o\䴐 (GngQB XQt~< (xQk:@$̐|wZ tӍWIQG~8 VX.wC5 lqB58z˵ο?#M࡝6 VbHZN%\ PZzz?eȊ/lϧfaz)*5FHxg|bG1;j/WDJ144bUED/Oȥk'PisgLgk| @|Svs·H5vJ$_T1!?s)\fstJV *PI۱}R >CppØh< 5YPb$eG u"4 Bc_o -U1|&307{+QC2h ^/?4}%_jqLoAvD lZI(A9(݈[)$0R}v4yU!A[|"e?R3Lz~gȼ{Ld(dmC*YaCW8R*Sp7⌃]u~ϲq@1e%2Ae=αME0@t]]\6ڸwd*ϰdK24Z!9/l:=޵ L}<1Fo=M'\1`+%FSu l2ParB,o(&؝W"2LP/χ,Fgas4f9R!䔐F>4JZ&6]/Ma=b 5"!ج0Pwc˛ޫC3,(zܝ0G2M#Gz INYYnYcF1VL`;t3VSxJEІsј eQۃ)kv =v ۞ th!7yB e$Umh",[z6s c\: ue&;٣@ A ݾCk8Pg:}JglDl MN\d'&U11)>g?f Zڴ1Nxĉ*rޏR}9,8.9T~uLcG@BhZZ$_C?v:n+b8@љLn<~Y&};\ϩIi!j~n7/iy:'Q=AC/2+KP9+I!]lsFFqeOEc״TE{Q0b)?^ bp( p9s **z9[ l1șUsrQc]JUwVKx0 c _ՎU?"WYdwTr=Q$ rF׮4Ԭ~9X%R>rjme~qHl.@QxwS7n*lP:XnDd?x÷SF:i2mg_8GkHx[Țo#5\7!uvi5]HlJ~ vį stCEJo5?c9@\ٯ }?4feNL€㴨nwǷfH%hĶ3">-4Z k G#Rd 0/XLM*'\x(¸З;q0Kr sƙQ7b<L< ef\I[_ ' ꖼ@"Ot=|`tpFO.e܄Le$7Ȕ&-LC3sKxқ 872ْz]Y|#eϤgüReQ.ܲ n &<-6(=4уӅ*E1V'Q\/f<9(`>bђs,W?_ ‡~Kt&#rW6Q݁8bQUVK 5oX*k0#=!w|d8\Z(o DV+=P|a}ώGjM@͒҃PZ3+~/}F6*`&Q~"a@<S*3♵ޑ]_du J!T^~`QÁbGixsJ)c}oF9ά5<\p-"~ U\ {9߃ƌ*p,t\xWAxqFn&c]"-2&8@,PQm6N`4U+XS$i-vXdKd]^kJϡN1Vl wCaH+0G<> dxϓcClPI,ُt[ ˱qeЏdEÏj3URc]ipG8NhA .w2:Re!5=[:d!'W` ^ze;Uz <؈]YhsXc4{*S͌Ȭ/P圁r H;J˩ZPPk-٣Nɥe[vCwk 9I&|Y{EdqKm$;޸C{>##N3Es-k*Qqe/} !jqukʌJTe2n05D֤lJa;L"e/n$q`oZ]:y)%~@]$ëwAoz*(- @MJg "@#6ʄ֭=9SX_Z8f؄ſwtC$Ock!䴡ܟa3C6$W+{/,pb٢lˉ6‡I1.RMP6qM(ڶߒc`sjT'#<QdZ*4:X;b]tnƞ̐ B"YS]-53L~W.B{ Kj4|AUO _mÄr.։`Y?Qc{{c` ptθK#,{ǝ")߇!&鶏k&"'-65}#"JT(eAOkăP_̣wAir'4| 7/6\Nm9靊^;0 E !˳# E]l{JOlZZ"=;\@[phW7_%#é˜g/XK}+SҹuG^g&H7ya*cp4uCx<hVqg-a8m ThzȨ ~:Gl,/?21`7p6toXK hoRI80FxUă,$MS6/W2Kģ.=(`ȁٺ}[!ؼ̯`ě-O!r)2v\Z:l =5QC^pa 8Mʋ tYPOؠؒ镐)\G_껛v t4g79~6?_S՜u_ug?Z7萏Gʅ~oPAL@\C%nsuGTɿ;RY܃TVx1wVs 0[K ?ꬴǯ|Tͻ,6ڦ"rBIRXpP)֫NEt^Q\⪐ոae\Lk[Ȧu `9 Nl4݄'2|qBĪ4֨ l=6UD;&׼b;YlNgFD(rߗ@8W$"Z"Z#ȝ-MAj1RLHUˮO'h|Mհ,2]&:uTۿ6Ma5Ju@ZiɹҦsMdAkdR1?a)/#Gї ~"X JIY$Q$L_T#ф7LɽO3b SAC~\W d5.%xN@q󹰼-p : >y:i5jз~/Q쇚販%mf=z̽wQxb 3< K%L٫ҋxHBUx' ;;hw#2[<y I4 ["d䰦u<#أO [i{j[`ClT l].A|М}d_/.r4Bi qzH8ߵ ~p $P/bb-GXn#+Y֨T p*.\<(S6q{i8KZ<MP_AƊ ll#?F<=Tv+yiFtfkSǑn2.0DMJ|j¼=l0i fJ١*'? Ph9v]Ec_1"=nJeb̡΁-ge]{ulk70z:=V) _A]gqDD?nYcpK߈ξ ςTT" ̝ؼ!,MW?DMwyy ,hgeE=6kz=3k!v oHj:,@Clmg1[jOF$ .XT8H:)k}JD텨Dafm-#HZ⽩mM$=DnH=,vL4i) & atυv^d∂+Gl x,ҊɘذS~Xvː+{9)Q((MC=2ioi,Vܷ*WX=Jnhw5artΣH G@mhkn `pst8\t(Cx x6bS~iVV),ze>L<@CBMV&^ Y˜>*>Q^ھ A]4gihdH^(s# -|*HaUxv! ۘO,{QYa+s:|(YšW8v5~0ng{FLȳсObNd8o3HS"pas3j S&C,0Xþ^< ތQ:DX#aD|Z'Ӣ^g_"F x_ngY(Ѥ#I%Oha5W܀rqTڍH `W]B#?ǴAL'L8[I6 7\]KJh<í՜PŖ˺0 b)Wg+.#GBK vp6H @{L(6;[}r%5c@꬜ ųvD$紀΁2Ѩ>Ы-%DgNn ܂:&0)eLIn=P EjojuI5y2_Xф3'0Dw 0!`-s,v_ќe0d$|;5D%<YI:6̾d(43-Ep>걊>[lE~_?*ղzxX<hՋmKXdw]&ιFdM HƿKL7I{OYE: _E7k>:x2[iƸd[f2r4e}BrJn{KX6`? dNy.J&ؖ7NW^.RYC/Ks8`^OQHrL.QN{_4.-80;CT|Ê4maK,Z}\0vbN{)| c:٩O<};qJ \SjʜSXcx[|͖Y !U|IsQ,%iq?t5Y4yB<Ώur֝T!NHM8^M߂Lo^2ku0QYC%k_)D|bt'IB $܀6*0 \ 랼ړGog&2DNOWmi<<0pz 'TVR1'eD2/^Hٕb&bJH<2P{/5<gۦkaD#kP`9M-]mgK-_)5Yg-ߦNLUn(Ӄ~NG3Ψ0\Z:#bP6.x>*d A4?Cu8++~=p.]@ЂzT%̓vp*< h$=QĝFJ٪JC\mq<MnLaƝQ+#P{.E& Lq7q +Ϫ;E5 w8怒qݹgWփqJ*3"L2ݞ׎Ww*1v5U'RB2jGD憮f"I$I 2]f4,xe&{/A/ F`)= LWJTudW6TaaJ #(YY1&0˜-\|kc,s0'\;yMZn%e_}VuԈC42M}.1WC:t7jQ@H^yujt$ig~mhfw^B^~٧|K*s%yȄL mGIص:,p-W(. A#'Ԃ 7,Of2zu#Fɗu֯A@ [@t 3 hfg#Q_ V^ 8'ڵo$XX[c宎޴pW?Ξ Pl5\lԈsb尓rC͋pHc]G 7G0IDv@sн Sk[OzyoO:#d!ZS'zTݝgi,El]BF5=bZ:leF0H3ю8ԃF FIk(])A8snKG,7 Xg񡁩c=4ԼH4B gI [g) +96]KPÆ nf ;,Cךk/c c;s"mLXۮ#e ի%NH)Y iKNkS GWJxlx;\gokPYKaJdyly /pdk! ( _LJݕz_)8* #V)I""En; bpr1ڙp?Dؼʹ`ivӶJoiL!! H({K 'O""e@5wWI[C,wƒջ&Ǔ$jC80O6JVIyR-o їl#'@Ny(תIY_mpnY? (z {o_  {bhdjIo Noen)7A#MX[z̙Z{5;f%-_~]_hR7a 9D'o -=6=a^jOQS%I(62`0Jš,;b\~s(aDrRi_3Y+ٺ)[:3م^\S *F*{gBfȎ;0"(.NRg,/Ƶ:uJ{4F!,sRvvסSٳUkOO H5ܲ5D [`i@"o 1A#B5[4xcubipZv^Fg:!쩚[Hk PIх޶jZX25fmH25gf' >R&c jtKk[:ԅg4Ic1F ֥f H0#325i. G]AaR{A2i}zJ@Ws̴KF,ڂ`~>Mg!{?;FuB5DmB~d%{o=涝!9{AY)-<2OEnb ZrSrUv3/,1aPxM7 RG"8\3rz&cFwjSgo!k 0@ " K>w4(c|1)_dn:B/ixgI-;n˩`JF? Ny\&Á^ ^d1Zqkg}較e 6F-FwRq~ZbMOR(|11j\Yݩy([ }q3+'ƙb홲"y .rw vXڂ>I.LlR56Aϑ:>hng .,u6 i/@l# !]QI7hz3mܺ0Cޥ< OFT7Fh"G(rn͍z/(02~9ϰ=8zlDoUEM)eĉ/5LH#JéP8P| %-oNW%#\o™ `w3s~\-&hBEÜ;%H,R"Yʕv'%_4ܭE[XVWe!ωد.C7YVs0$onRwrUCm|$pŖ"=n^xBTg] V+\УcW׋-WeȽüQCl/kOltl6$<oSrƈնopSQp#FS*GΥ^IE:X(3 Μ8ݽ> uACl `Gb3p\\`f 'SXo3.mvEwu7H(FG^[ΏP2;}kx RGbv_F6- ;ɩnf*Yyu;ABS7)'Ȱ/ /}Rc\:@b@Z1Tzp+M1 :OF55 ۰, 2L#䩞KNu˜y?VԻb~T[1B4L v_\\JXZoT^3E.0Zӡu|玿 OŹ73Zxynv3UkCy'lOogPP+<1KQlWd}>l7&Ȕt@)c 5$0#)[7+XM>\I<<ѱB=/i~{4{a4vcÄ::*!s@H ^F<0, * Y-P*1$P0PHk 91ii3~tK{=-idTQ[k{ڗmz(0' M;m)1)P h\rti>$̺[(}W긨F|9i:,l1JլM5$[&e爈,h1?<_c9tj+9lɐ[wQ?)0mH&p)E:ˏZfw0@㋏ xl;)QʖN~pFz?'â%n٫85gߑPq_Zlw}wX8  (f8,Lv%A!2v1.x*.(u\Yogv͔@-o*څhtUDp[Q-0 >ۮ$ۼ].P{BheG lM[b*4x6H Y_&0cyF9 'VU ; j`Jn+6nFL+u3"ai=sF{{ÈVӡĢ@.?uy//)h!UaZ1 #h.6T@E+DzO㸈37P3ReOzQEw`?DN - _}@"Tnۢ@! ydT_ s8O]vơ947l(y cӭV\b'SI@G<-*w𬵮:ɠIBW:ȧJwfƛGk?\_TgY:n ;UDqKBD-.+^|4?GH ECe璈qzצkԁ\PrEe77Yq ĤW#zp|B۪vSG~2e9HBwzи 6R(ġAk3kыbֱq]Gy@,Ḱܝ/k)SX-u.^ۮ_@x,|%xG'&Q}"HX]eEWp:(6#a(0:_He$'L>gdOĬ_5@:p)9jٴ]4d~a${o[}n@, A?VmZJ #=IдxQT 6vۏQzJk6&^q·4W~iNUvzUs\kA]cwp }No;з``%1 M0&[h 7fG8nHuD@䅁ZoeQfpQQR1d'1EOi{}*;ĵM!?Us&ۃbml&eɗ!⩰p+K7'+b5+&RqSϒw"C(o&eе g|\%AebǏ bu!AX\ݍK; Kv>iE[T6a'WZ2 zr BqnWUˤ45D*vN@6H@e~PpENձM>yn3d@-mimf]9&a:Hp3HGWOoLy]Ɜ4#r[;d>2* :r]@w/Z$rW4VxuS;sN90uC_mgpu`ʃJZЏ$6uRǃfC:cIb+ GVv/c,c;i&:@}a'cX͔=׍iS"ۘL} ثPY NXV[)82)dmn]leerURҗ[x4dM鷰Wj;I]AS&B ޒ5"`bt[Ϳ 7N 㣔8v {'1 2 Ws7K_h60,{&`[Jf_d5,$DQ%Ք݅ jzi-@1RxSGLIF/Xر %_*V\˗ ZIfhW( H<ֶ6-s T4ɓޮ_aQJ;S t{wf.ա%jfݒVGYDOz.+! #&JB+uݬWՎs'QNtlG?p%mQ]$؟G C^ӊUꑩq(+d+2CžEzԹӼME}w*iReeiߢ6ɤn >#xe'Q VQ(kV vUf Fk-D4@rJq`@1 ,0) ɋ|˥vɻ [&?t'Fk%kq $<kH3oČ!MW͓Cdjc-5z`B{vlB[ h ZI҄C"lSK%/Cc95h8tA_F/ <;™>P(]Řq{-oCkMOB˲A(9[;6ds_is4 &%17O& yG:kSI4"^e-=:g @B`)\kg,2[8.>ɏi Ay ؑxU+t"s$#˂jtm[{.ȃ Т-=45;`d@/ֈP՝.${z23S6 2>#{v*~wy|{'>"FcY$ ~P#0W7U650˴u'ع.麩=/goƶzҨ4\;Vt68A~_Y)&Ѻ:+{hՌTjyln[>ÖUJ<-l,C>[×iJO䉃 4$Eu0ڷCyת_ld'3~kr6* 64J1 '-m3~tfM\fS6ōZ W$YwV'9 |&rYOs$ ](R؃##_Xz6c~ndkݷݑIHtrhCis/'im#zɿ d-YOWLLl2s ĕ*ZW v{z=`ݮҘF r0~Uw,B~T]i( 'I}cGvOp,!'F>*VܓːȤ 㷩s7a5h/C8[2Ɣqh>?QJ9F:Acgrbf*^݈J=qtڟgEX yRtSl|>(omm|鱞$ڰ|0[jv IX_ҞH2A-wrqތ/iӱ5e$kѓ3 g|˯b_!('HfYTBhXAA!}\Zy^uA8%eہIKByBӈxwbpht-oޡ)lxg<)5 ~`T p?/Yr>{SpSf n+A>#MaH ڷ fJAsj6<Թ= KǑph~S8K̨#+5\4q&8dn+m Q@<>7l?15(s8W ^ :$wSw"}FxmDZAc>I aq>`U,&L4Q?$GQDGf f3K 1~ߑpW\1oMOpL^ 1 E+9%~J(̢h^0- p)NωzAh?-ǀc+ Z҅zy\7gKmgQ w3(1l5h0u5mn\jBvX"$U+Ȏ*/Sf"$t6@VGB )oXDȞY+HֶuGn<` eݗVU^V#aQJR(*s}*)zi|;!`fQ'dU_QLł o|>W6A/eL'R~N6d:DzMBfň:3QOEߵFQ`> l=ErdϵA1oy.KUd(}l]{7KW@\[TfX}'( s a,VE˟D w h[but?|:3d%:N&OyJcI}#+zԆ3pYL9 ̡U~*A$/X@~< Xj Q(_  Swta̘͊8:{tƪm| (iMq^aLLFK&!9=R@ iFٿU>W 5Bӽ Y/+Q.2{9ȏ ݐxJw%1CdtsLך):U nIf4d-YC9T \iÉ0[>͇tlˤX+$Bҁ9؈] t돕 LMTv )dorB_duNr*rxFS[Po/'(1g-?."8빎7G.)O?Ip]~NQHX/dYgDY?v&g(9KTh~_2p3_,!%a~ {ʬKy>SAb0)eNҁ3Ngw"1{}EXڃ.' %iga (>H#{?KUKΒ ^:aR9­&aa4k 8Ҥ2-gި}zb+k:e=\RBGp9cK=ނQ}{6!5!#%H-i`0<6U\]pˋ΋ ,Yhª#Q, ]Prz셬!,dk8!45>Uy ]\O+2-9_D°e/2CuGK1 ]bg9} FjT97g.{neQhBZ*č2G{mЏIlvS]_KG@u)nxf \kO LiƦH#}gcVV\BlvH/HITȼdFEuj*Y8{pPmڭ+nдg-mML 3_ wg:Tv@X^}9LLL,6 s;l־k'03LFZU9vSb촻 Ԉ"ζtq! -`~`@Ǹ'~$MM㤰H{dM;dŸL^`1zd2]qn8 qk Xztg>:;akۈgP1wpc납`D/$[,~x͠_B3P$<+@"[pgq y=*=>$eXf4cZT:`z% <uO @{fֹ&FnYtZUY/ M&2 [=|'zj.c թ('0GHi-OdTvZ7i$$̓GZwxDnlNq-wBhw׿I}ߏP\3 6|}FՅCr%Un.eRxo~|x?σuDNcnN+/&SwsRؖ]HvTukľw!֜wuOv祖<8DDtmٴǝ[cjכ6HJ _}kdwK4ՃN+bڈckmSBMs7kDÞ=ȣ1z+d~-!R7;k@3Bu}+w~^FXެ*j^P-r ns|_qt O9<K 3ELqMytFT{24΢4j Z^Zi6]MuY],RiSA)Cq(a| 4eBc) ^(z=9h+]OW6Գs .>J?c&ϼQJfb+z=wZTZ.{Ud Q ĕ Ofi\K3&1R*VUu=a\J#:h DJ( |xbd^ YX^f-pvO7p6ajs`׈gSNT%w/K_FxzfK\| N)1|0f 0nPzA`($:)@_k 3ܼ&1e6eiL.*ן.%+W ,D[}ɷVH]S]}upᲩ%Nbaѝ#de KL;FH}j6$i.:L@/{C3!Q?02&i:k[˵Dgr\eY&^3r#?p`4#T>f[}j^)ǟ jO1 =Wza(Oa!t- +^ [;`7g3=Ü8Zıp椬5$3:Y)ȃNjY 6@6$$ff/zh{z/#֭bNӞx~+-SSIj:%HKړ3T(=!R۔n6batj&dy*~Zg ?D + p?ޛTh?3%'mG\R> mcXժ?GaVps(鍺F9G 'E&=n\ʆDz,'ShWO 5@ԏ*!E5D:=8)\54c}4Zu' ;Rm0̜=CCfF&cw?y c4Fq뫹+lA9\tfͺ^` tnTހ`r9(CN1 l,_tDzAF`wDe Xgخ8hٞRTԙX@-͆f=sH{uEo$O'6Bi}*'![ zG)@d#jK_oJHTGc ? x_WЌҗ|349|_"cl˾2`9+\eZ>`3OVYN[hC 5I,m/*?'c (aL}1. Ş]<ʕTv@%JU.꿆zzJF;s4e ̿bna;4.A8@*_l])5L]*bҺOec1ӸYER#JbԼ>#sY>֌+ƕXb(O}RXl}#ٳD5+׫]y@qa*Slr-p.+oY򒞗]ӕHnG TD4$nVw&NSa6pPlSZ4YVy+-&}#▖L&*ײ.Z=D/aǂmCpo?md+F6_@`t"T*Q;mi=`xAUk8̟q)ouUF G5l}0.Uf:׆J<DC ltLHuە()G&"E& 0yഏ4%kuA`#t=yAԺW:.=‹:oe*}\o2]LϮiG·C~:Zq%h !=ʼnm[U$3NJ*Ӳ6é_@Xg-,qlcY8%&;mTԵBzCZ]_I)}a*Ex(3;Jb'V5P]},us(8!i.zx~%~N[tUy.E|BQh8AkU-4"Ÿ!G*8 tu-r&ZMA{$d%K(x;&r:3Խ ҕ< 5oś9= UfLn-EnǓ]H&>[H vt'tVN6;jwVdMSq2nP˼D0L|'bBeGznaF1$ s;k _~= KK Ys/0n:$Y==#$#NC+Y@F4AǐR/|_,D:#Yg,VYJSR/H`WƂ|&aj-i po~@Z%S5(f|䎝-i(?sڧd*0|? [/Ymdq,Pu"'*>~DyP+*@I+hdjA"}ݵQFP`?p,<xU ;DHOY [S*caoʺ 6'*.(>aTC~ףO7Hgu6W^̵R7|& I~ZJy] ^(L< '4*ПE/IQy-OiqkHZ;F6 鬹uC!芍f ѡ^{k#݆)LQ|Mp~44 Pm/*"~.Hh*i "Ry eO{/و$o/i{iS>>Nx=\ee*" 4*Lcq@UooG48"wB #Oy:fܭR6b4N:~}p@|$7S^SjB5ޗCwb)l .X0QU{\""~>7Ljc0;)).fȀ5 sU{t;M駐 P 2j;粖UhTukpߚ_1L1_DIqF18=AqMD#~;)qg}bvN `v120d;Tjl/Ldye;- WYڟa#\%ʜ쵲N:smqvv ?1}h Z$T.&jMs0@w5*`+vK-uceYų`tT6;aR;:ݣDo[48+.N)Ę7Ĩd\^F7 W&~n|XRs\[/L%V]ۂ8w=" eʆ8Р$,􂦍 ߧ%;s Z2Jk luM] V,!%;!ƚWNȠԆulژƗjqH<.TW멑a6Y=]_3s3GSy`=Q;7kb$ ysS 6fcKmql` s =2ӀT'Q)Kks[h(D lE; ]? {_FL1$g 2mUFkҧ$G9v-:9W::6H۠z{snaNR[Qz".ƛ@Рןs}H_uXsw,M"hʒ;] R#_<@~lv  y@0h=1`ӎ^4W՝>걱V 51? NUz2փtO2EՐйw*c9l!PD4QvZNSYK-6ʯ>lݠpcMH7ݯE4H>i6ط니V+_k8] )w(PR:QuX4ȇK[.bJijiң,wʃG ݝlhZgv5a'ܪ7"nKGEmK'[AK{'l;)<"Z͙̹YW͌_Yvm>&LʃB{CɀtӠnbw1suGZ@d!dBϙ NG8Stg@_9"{rk9".fՔlCC׫Oqa\i 3$c;*6vXY2@aͽ$Y4"4<Ҵ&цxc/T _'ٓFau<@O:+ex'ȝܟe͞T*Ҫ&(Ƿlb鋼YFyszت^eøfAiGc }t ¦<@'_n01W-DO A}eLb>،@ KUGϟZ-@$O~/(sjqP#c2&hl;Ȼ9\&%/']uRyBK;9t$ YG#/?@I%Č3*TU5A%p-j5% }g#5H<֥=.`mc%fc|w0x~2ۖ-JE)gS7y=iݡ1  cngFD[B#hZq^ ɬ@$ fn723#yݹ1ǃ̥.? lv;r8G;篳7ruv^*qH~=F/qdN&44G9\$;W/==$0>.G=@}#:, ~&G7ҐrGs6=sGِ8u~l,9Jyh/&`E['=9`F_2%%ȕ3z끕~{.A31SMtBhJK.&~s;zJyT' MP- EՐgu8*ȘMEEc{@yѕd~`82k 1՘l-ʼi6p a_92yeXtq'=O y-Z-_rɉBXל)S>OQDRJ7\sψP9,6n9"zZT>R@>.%ČP}rĩpenMuseQt3s:ǂ@&*ݍcbe@"h3S"ۖBH2y& lzD:VB93Wr&y2:{yf6噕AL|=^CZPVyOXCĽGdsk''8Yvn=lo`35]ʼCG dLb_{T)dp E;6== ;P۱n/ .w26U БJAZΫzMnـI)\ rT>,ep }N0iANO S܃?`#ϏԔ-ucxDo;8Fq%K2MC^$ Տ8Y=,0RnbyPw^|AbG JDXKj)s[fHebD٢r;$]9'ѯr('*֧6O_y6wkw<˪_½gfݭ<}}% Lxc͙ԩq0$Lc݃\YFbj 0>}\k !en ~nJe$R^wcYPɍ3 *ﳚhAgE1gp2νF׶O՘7LjZ N뢚mۛϿ,1]XS N8X'DR˅-(h* ThWq@ҷj&xj`A^C{g v|C71k)/#p_<\K*{s#X)YWTp6 7}X8[KI4FUT>|J/ooKUEJ#) rx&|@`@$k#{ NJc0- æ#:ٸ=P=_B;yկSB!0[|Q"n gqɑur_[cR?_zLb`q{Pw!֟lǡjQIBL UI<; Bxi&Gk<4W~v& oBʹ(V<_>j"B>$|sVqWA&y8T df"Y͓6B:V &oK6 !"Ƽt$Γ>{Wi{[DC<`_`x}~m8 $BڍhZ[l/В އA"nKǂk0‰"{D+CYFebnHJ,"I}t}j`|bު[VpР w *"O] %*HS2~-l2̨!I܇v۳P\ro [z$3X鞪薠uy1GB ll)Uda#;_̱qX|ןbLR[? .e }1~b-٣|nE[sKʯ6z4$zѷL4D!,X<B@W ph={kN"L  }G^q̓?mZb2NEUFʣpndޥ7o0rJ63us A5?we8 @+Yc7ttuF }3SGqcj M崼ץl |aaoKk"0[4]n[~۲ `=3͇CNXB=)2+1r!'HS o( 9 \ GC`g- r*\,q$^ Qi~9zz"M)e ~Ptx@G5؇S ' T)$V ‘?X hA;AvC܍ȹx[npo Aa-̹0x^؈boYv'PHk˯9bjYczVQ1On&m;,N%nK+o38PYoV}pf*=k< kxwØtc` .%HO[NzchW/],B؃3V7ɡwΎ6lz=p yX%5_u1huZJՕYuΓ| 5@S-\B.Q^ tj4>V19/y+Sj_>SB)iyHMY٧VlUhr%Ԍx<~" Kإ!"|˧+7]'3px[2PP{Ef0nP嬀YnEwGS.Վ JA\# Q'up߻YUӁ OP6~)ÄqFoX % T9owgέ&CCΤ~vGu Ӎ6 ϋ;]Apݞ ȸg (ɋ 3ܰA}7(QI<@^;)5;\,ihk6" BPVĻ ̸It=-ň4e;Ӎ7Į28]{+rT\Kmزfڣ~1=_hMѭ|[Y2ƿTUtҧ lUߓC3:.3Ϣ|ݒb~+'][Skf%XL' {v] x~BvW)\aDE=Y~KG|!cs<wc30#Ǖ3^g'v"qsZPG @lqG$qDg0_9ԍU`Xm17 V0[@<#q]Bh{ H ` !>Y'ibXl 亮 ;s!i@dsX[7vZ|dTB=x7 ^o>`] Ifx%m{G emxx0&aWWЈǶuBy\yMI5yJRδrILy-j|[~ jU |6~XgׄKcd^7[-jv}O)6t%P(+R?ΦC\LڎQ>-O $,C[}6`k'[_G])j|Դ)ZQ{#vf>ұ8 W:@H'YTyZ0+R{̥xMJoV2l= sFľI>' hȼu$m- 0v_Ob`v 㖤rL2>BdymO0{c2 d6/[WXB:{ p$@]tfWs=Z![4ub~U5u!ZtEUeevGGq?z|:aDGXMbv^6SH{ge&d&Of9ǁ7Z5mfXZ+ }PwkĺtGʒjv?3~G !"[M7S?-Eϖ^`N= WiEm9/nfmn=Z^,́gUǺB[߉]>[5V$K'CsB& rT+F\DϘv>ͮFѦp--lc ifLXϿI,@.D$[gh怣y")Hr/p*(ＳOIz k-٨.EjJيS)IeJvݛiBTbKG{JDsc0-_e\!mϜE|' otI5}PPpKq{MAFBHr9Zm(W{}6w+\M_M__.3m^pl!Z#iɇ#pR*v`"'3WNdn^th/NT)n%$3uv+j62}.­Ϻ^Ї"l$_ ;VP64fn a߄$%+Jh#6Wm+Hm{MiJ3zU@&:qV E+U$z9ty;3(e{o,h{DwVtHKq03 Һ;B nR#77ǰN{йIO?—J/Hw|9\4؝4ua.i4owʝE-އQg[\˟vCbK ~D2xC"bh|%?n %?L.JQFD!CXyK)Q/IB&vîbAnh?FƐ8Wm6y]$\􉬚~4R(GvGՕ?A84bs|' >$$.'~  c4cMF*i0%>kS֮̈́_D!!M_.PeڔvH^$ E{`;kEΧ0{ؔk" [ ZO.E#xQétHy17&}<[rPz~F!"2iYלDSNIRaڵ ume!˅ʂæddN缋|6s(yA,ۣs*L h"c]π0M$3@Iy5d-f+S?dcC5e}ALI^Vڈ78m`)MGmppf[;҇ d5RūJI0X+za"|?O 煛Py}['$ {; !{K'Tk,k#R]wPjz|Y*I:aKI11Bp:#&H3.!PE YiaQtj0ܰ44:j#dh=2zD@V-[*7CБPG)p=ͤ`VjK39Ԫ;CS9N9N%F.fߨ.d0sI|)x,lFJD8}]۹U&R`9V@Ҫ /|X= s;*:ځ.knTۿ?Wo$MaLӵ)o|3A8)ǨpB& rT_i{Y@{Mh[+w參Z]9L3 m50% i2we)S@͡S"5~Vc^bĭqDٗ?gV%mёĈ5\Jӌ- dxsrWsYt .T/pӋj!1̓DOd8Ca;pf"zlM ˏ=jL lv!N5~fmt"reW AX -^XPIԼI:s0amqP+!V-ctf\xSTIl d'J ɯ,UCpa2D@:qB f%p567go&fE΢9܌:N!S )~KQUcB^IW2Sgh!-O?f&]c!9&J7U) ļMSO#*9ξSV&!v1Gw(Cۄ;ean;yWۅi-m94ፂm(_hbHK}Cퟆlm'V)>RR鴜oL*<մe< Y#2EVIr:5)RUBC=a14$χJ-1~%MxW4h*Q~޹c#+Yh\uV;LO!Og  3t~JM 5pՆ jq#CO͝m;G|4*ʯxI!VFhr乘q6d^)!޷0f^ll0'!kd[;O))^Ğ>_ wrGwKL?}a=Ǐ|=D+nZ+oR5qLR{5Yϖ2D-! hٕo/ Rם<,6NP)'%ʀKpOwҁD=\m7h6}H|rTQ9Tg?\/ڶ&Wf2Bʬќdr l!B\v܀i/Ьai#2`h3~&`NG /ݳ*^^x޸Db : dïKAy gZ5!"59M*8GDBFr-kPKHeē jR*;k72]*?kЫ&Wmb+Fv3| cgK@3,FP]Ђ@xBܿ,$[1 tY+qBGK˃)Z[f]j4N7ܫK',] 0Ed %3Uek?oI_V3m@F#Q{+"O9`~Xp4)6#tkCzB4E3F섻 l$cNxk_ e׆-!o>`O$NF⽲*iBwwe  `b8h\5ھۅZ t0lx4vx",?\bAipiH(g/2#tl}JXlނc[!ۀ7G8!9f@WwjpPCS _5G8z*.+Hx sXsD aIي!4:J37#wq9S: S>) JHe_ssvWAE''huFS3`ؙs3UȀrcݗHH~4o'ZWnx,]\BʪfՂ٨z?ץa+F*@nTOmmrU*TW!UH-8J^vJEhe9 {ta.@)Z*|p+|9S6(^\7 k SBf7MXؗ1u|Gpͳrk\p]}D )gB8g7{@"T Јh$ڎl%{H1VǷ-FUHoiMs/[,A_/>#/&˕ ^ ](NVJNcǛM2SmSS?/t Rw8ۀ 9m-`05}Ng*h'Gov˺0XA+]%aL0[T{.©#0Cq~ >#N%Tsd^&A:Դ!$u4vػYrph@AީO d*jy+.7;v }1|vN!G,ktE8KŁjoM"̯p-VD\$0؛ 5]F7a=;ܿ6ݩ*:7Ayҏ©߷fIZ<Pc ʀ+f| QBBCBJOWB0Ys,Ò!Dap#͸؀Gͫ2GQxLbgqѱshs514%+Q0ن|8q8U| eQA?!8fiIo)D_W7" v*XRq>hcy('C}toD#yo}ѝ mTif¾cy(v ROIJ|Swuh-M#ky1Yn,ҥ'bgn4k?ZB-8;lmZMLaMY)]1hDqTPrZJ͸mι9qs<^\Y.cF`Y82KH!N6k%*9Y5XGqSW섋,1Ka"M6 ac<>&, k Gdd Qjݔ nKTV!RY;[3hBS)T, u(0JuL&Cy585DQюWZD@ԠP>u Se61 aTSnYh 0PdYc' )y w9tk6vJ#!oAl)6n{ka p/flW} vw{Gt $4%?Bu}':Ջw0i1'6kǝU)=:KgD5E  WjpY&ۉ{KHjhh畐{Wz/eKfѦ3vHo|(zD@dc@bhżaj?{?-P'׏vWF``o%I'2G$C&Me?`x4prEA_YOKroBi#WJq(G&X_[Dσ5~](@@8kDTBV[ȁ2K)9tRѥZ p3bƔҾqY|۞tcWKO {p_XdRgV [m{Z`:0i)LX"b_>$~P{UWyJ--j(NA:ځ֋X[3w<;0Wӳ˽̛GOu& cJIL" E O7tnSp%8s'` (kɣ@.E]loLTЈg xE qobJjƿ1ulO:sϼWZɉt~~uW=Lv莽\#6 Y?R^3>᪍8f]%.*mouMQEƜ! KoaCo{EwmD9n*yꏩeV at_*5*m u]Gаz;|*%UBKV$d xc?mٓ&xj.Yg B>C dO ZO_`q[}N^&ba8܌jEwnA}ь OR+^g5j{aZ>H,oCJZ?Zb\F}w@.=Y =򼍝.)EYuOc8M@RJ 9P6E|5v:R yisOxZ eB`y%jq/f4Fa5 Գ^m_)rmw-cuhW)@*Ü<|HB+(X/F-D2%GLBt@MR7'oLþ]jw瓈 &m+<`jzG|a;Ev"LOE\d΂ɗm.;[GjYBm"op077hQ3|a@qDpqF,~"Jm6Zu1:)AՔϾԜU1}+a8B-p(z"1P[0ޡ d>:@+a2vl(%, J:wߐZϽ<_5D~r7xįeq&y>$f7 ULS ?'OqPJS'6/O"aSnB n1 ĴQ جڋLGgUY`h\fe X)[VPdX25?%Ph;^}LVR`Α##&DGz49Xo"jBjk>桯VzY1 X>륇us8&ލ0FepW%;g=?udQsP8}2c>bcgό_ƛ)i05ݖn<Yf{^;7S1".3 os8@Lw%}j4o<[Is)T0gf`4PPp59oK)Q}UDh??:{[#KFB`6`jy$jz n- 7]lU@$WϦ62vu|PZ/J #FT D_ cF s-op-q`sS?A؄+"p)(G'&aAc{뵆Q jb.u /b'HǘtwYV WX6 ?Փ=O.ХGqr|!0rep6cZ\VDK~:ӿ/oc#v|it䈭tbEVzpa@II:QFЯ}v{*jՃo?s ƃO9ު8#~͟trfhAddrXv2G1bBerUAmzLt>T.`0n/đqg،yqU*]fάC~h26h4nn~U) 2]wPICU,z;jMUIҌQӪ+<)lCR= 0 ^܀sti`Grp!QrC5׹Z|W c-&*LAVt/R^HV=AI"E@TcIz`{d} 0%!L^Icn8BPz+E< v7=DuOqV+-ʊXWFZHm Ѳi(&N돂9h2f6Ќ{8A$gҥ ?I*o/2ZoNb*33% }YưW{q%3h/} QLw>/9m.lD^jz0x>0ꉌ6&Uޒx֋5bec?65^$S}TtvUh/Qvݕ8suKWR~,~tpBfxlW'&b\@!K,c[Az+Ja{3y8ca5(H)ǐ^ &vЈZ%9+m'D]>Cu6kyLl΋Ҵdε%^$^ ):C6$113Yܯ9^'{d)ϥhwG2'm4+ Ď "vY)p0T+xI nzb/}M hT9) TWƣ\W_ _BGQ,95PYO2)%H-cXWCYaRzع12bvBQ:3t9`Z^T>jjMNXյnP/sc ?'IzEDcB.e\̒]_6至!/&_bxL\|i%ŪEޫͫS+ f{Yb!o0 +Ym?ZK7nﯴs\L34u+;8t],0?6:++"~+lϘ=[Ze Yya~`h!I :HFcY?J3öl"u5i"̀"UDYkps)y:;t#q;f=Ѷ-Ngz*P<)b,m 0;*4je$w7maLrdRt=1 r=^J>jI /X55^CM^}YLJ.iymnuɡ{D͡ z>\l,wHi1zeLE2l* 4Aj1iּk‰ZB!)jǿ̙$f<*<BWqm>Wu~/єbI\w8">2iӏuBuyGG[N$ap6n ɩq*h|"= C@>|;{ӥ+( vVG<?*nN0[4sb"/8mJ|тxl)gHYrgD>ՠH8u+̜v'sRxbYh*9gZHZ4;4sOJ$4js Q/KTF* `٬XD@O:H7E7T:%3ϹxDNœLSSGm98ae.q j8v5Gdˤ#҃ گPU1Rf]?S⎦h4ŽJS,:=51o B"q>+ L"ila<'63(a:|*r)2$*cy`z"W!^ (9T1$ēN#jO?oВKYWTU⽋NJ,Z0<9#M1u +*X*$0YVP#IQnf/ƨDr\֙ks/_mdm$gQت4W|0&mtY>)NI-]&W1ø i2n2&œ:rmtIIp`' n<Қ^: ;}| w0N[[xk?1a: omcȊ/R@^\FHsV|ng%YH?Mڒ<I,q tDBBZ5lq%ZY+ee&Q\h݉DOk[w&eyvbgy3f{^+ZqyYݱ=46AzU|s> .5ɍԅNFoVKG_G'8h!(D,=x=;;zĭ\6oeGSV$z&4yb"3Zt?umz3!.Nu/%"ϓmn z \ޫK2rئ5n+5D/Ej9|1Giܾ~_G am@Fii^AVq§B/zJܖ6@~Qgq(Sd&8+Y65_ObIm*g] {*`qNdmcyT} N棬U?|q|V-g WNܥ+w’wVTitX0L'wY|gOy; J*}>w"pXͱ^c Pn#.^$߀S}ghM"C=i|; nu`!f, 15bAkC_V[T_݇aRVc}G/v5]gOLֲTv,Rw [5+Q wӮ&q * |EQܙ":TgE+xc"I_oE܋*Lb3 shW .hDRvZ3n8#f!qQ88~f[J4XTS|6=A3wUFPuy& azg5EDIKCEfegՈ9~%ٞ!y*L̕&EQX O^e)Dds]`~a7po# j<޻yцp # UK2FBC\t"WZyrv{ݝ`ӮZwV(6hgӣo>kQ /꒎6-~^˶! z?K~QT8IlQ$ )H?(NF 2 >ibA'/{b&[5{Lg!P!Ȍ5:CM&PDz!F5%+c*[]6vPwqT9/7[{'{ | 3>/.| 2{`o8ÆZ,x} bN;wU+Zl^;HFh˦">=(/fOZVt$g~S(* B?}HQ>i2^I DbhZğ\bDl:Al4u ߄@K|$XTЍf-s# p3N6UDJ̈=Nj^FD^{j/j ר1Rb 5B5]H#HPV' ny;aԇ>4g!ZUKh+u!{ЊO=>ԧ0Ocok.qq^y[sW3dݢk#"L t7^N 1I_Gh_Aj,-/8zv^(~3hfZ`p< A5p hثv|?0+DZ)?= E2 Q suŽ_rU >]4\\mUZиOb홧2}#zցD3QdO\ӯ(j\WEȱ_Nҋxc c7 aں֩qPx^Cd>>aǗt0`%__P8SxCB'5I<}M4Ѡa25A?}Q:pt""{ \(53Q*;qTάH>`Š0޶lv\IY!6a1Z$9 &[;}9c,8X́W'j]1XlZ:>ݷka+ @uGg1~sSUtAZi|=C[xw^oAeKlJ"*]/L=.hb ٴ6֞Nx5W:fb]$ࣲ—%pZdi  0]WJ4HMeFFw˥+`EGڤ ^mQr(u硝6{YXe$ ]"^gRVάʮ黝ww2Ѝ4q;^6:юPFV^Y)\h ] BeLU[- :p9#Lov^/$iI.?5p^LVV+SЯ)%` !Rmʱ_ca2[(zГ%߇&>>m)!Frw?Tcivth˜ !‚$dlB®BZX*j=8rUD]-ĺRjA:z|Rּ\zebrBEVzU _c5?CJS 7G(\< d?I L|x8J5)Q4,L01N]v7u̿|FY]KS;АԄ Srnd^To F(t&;2qPf+طj1 Ufm5J N@mţԔdb UnؓR,֤Q"; 'O;z[G'$\~䬶XlrFmlvSUbϔI*zX/T!"¬)VJ*Kwä`P4^GHx8x!qEEu7W0)U|62}fjcG+_!ZL٦Ztм/ .}< f\AUaZ6-Y bj"ý{]2LTzA7J u,Lդ #kMg ') Efy`Fivf wj$.QjO9pp1 @G^D2|^oψBjxF9Ph 4]⿼ X* "HѽA*&*ꛞܟjBf }O~0)0XwiŸ [@|Cg6Ugm^boJ&B;$]yƑ)UNJI=2,~O+ao ³uד"7zD,rJ7kb&VuJ*>wf8-iO.k%Y) wΈB2hQwD_f`iF@7K(qð"Ygx}?N1.fwaSgaI\/5EWz(1+*De_0ڧߐZ^?geC<)4#_G(v@jmWn=;xx;_T 2bPKf @CߨxfϝB=\#oPe#7GQVHT`2C~LuT;)B/<^W*͕#8 n74OtK7(~jbQIX%r3xH[atMxg1U胬o]");:yT S H&#JSS=s2_Ũ@<8鲦?s:!- kfM\+ou\IX: cERqPÉjp0dQnUZs'c(SXbNJuꋵ-Nr [f֫*Rȝb ǐtË:HT C߳ n::-|̜@e)DJp P^`="Bk28;~@m,{,YpjxhDD]cxE- .a?~&JD!R,~>=᷀Ǹy+@n~t[h4Mnĩ X'w (\ln#/AۃCF+BLh}iZKi&4)DD* gGu L|5,5^MacC{Up+ZvS$Fz~! Ni0R})= ckY0vUuQa3y=NU5$t \xZ5N$7ɽqޥ@oh6Xevv򺝣M2T{nATa5TkCm"<9%qޛ3P&1$avU اp _$sk{Ͷ3CQ03_HZR`7C?@>F"%mOv&mTCXe;:o%XY.0lkt ׻4F!5ъl uaI -5 S.1=Äd*//0%缜:nč=HL|2U,jp]=Հ0oW؁aMWy'_ǜgoNx;!jih%^DٓuZS*z)QR9I.4K%iɁJ^dM[׸{D翉OH" Ā pF-HbRSLJ?DT ipŨfYXf Y {7 ƣgk0}BkzHfٍǤl_wSo zd;|R>p܃<Ʊe2Dד mD.>A4Y|/raߩ\b^&l V ˭"`#˝5_ K@#.y.^4sb.25Rޞo}Nj|!u荢6m0\o/t@cz*4ё~( ͘zJ${J$b< {NT*L=^0?0mCs>I?{ k:h4;VFAJ "\ u{UrA>9ƭfsWcxdwQ*6ǹ}Υݠ]T E</(Md'{l7yt6Y&=؝ݡHs-ԁ:r߾nutʍs^4Z4׽tq~F|8+ &w=ڬq{L[fPK6Ew:P:M,a6ъ}*8*''7ND9kS,p0K|R>lY!LwvU3Hk}h2f~:I#jGaZMT&{*N &{ѥ$ Mxamߔ|\g1ry+~&UCOfcIHt\E{N٭7K % Ԫ kM̷9'2I]~pƶ]Vnods94Qsd+=TrF 뛼r|%ISŎ(ԐA+;$K eZpJb. ݅h_ۑLeXʹ@ ضh?-<~<[źjS.-}=ïѠE>c;ill.?x6#Bq~03!90,})U\("Sf(SFtYθ:'|: /Z̹5CA=ie4k:f;@:4rl@# rRl`Gu '_b:Z{N.-OPT1Dfbtpf#^W2a_ybLv)gg/ci_BRS5E$u3t<q*kZj J]nj3&wƆ]Z1Ϭظ>;x!Z;3oz Fn&k~ T.mCT:Xg jd1.\U0c$Dm[]mUR;\<lVrGLx;l5.=joA׃3HF=wPnyo~P^t&i %2>|-ds?E/"OBGX/鞘G XvҔuĝamQd}Ze)rbBQĩ!}uI*+(ׂWކJI{ YFCepN8}2J0iĐ1fqc+\ 4j\m7TsEHhKʕԓ87|g~m iHg &c}_<[?ҫ5A''xf\a-'奏IO'UlPAQ>W#⽯Us vu٤!N^aE 4J==.ƛ;[bs+*K:ő.A*{p@\ԕ߬RBKV_byk%Fc0A}f,e"|1@1# XWZ*#]>;'Nel) c2A9$;+N]f6C3p A&u Y]# 8 >:KAL2*JEZ!.NWh {h"Y͖jiJͳr*R1xq>?1\åMjsk#bD>%a6) ]f$U($Y=./U>2>cG1ӷT(N* ++[5 3Tol&W F<{PX{%: 4^w1Rx8C<XknWK֔νBpǸD!Buܭ:_{h/̄ϵ4 7ؕs B?9o!ƺ| +ֺF`N]^*0rIʟ]m[mz=,l ! c1Wշ@Ȟ zLBw©?Zb?Lľ]1#Ac጑x\0(zLΌ yG䩏/M *FߒK_泇Xb~7FdEyƙԙ/GM#fb<,+7D^>푁E\I)Y@)`mDdψ&Q.au%ϮqGi2OOQpM -5\ZE+!7ZLFf1"xD~2P8iY=cL F=C;)xlLAĵ_98 ?75gQfM@9q-CB B[{$ | !v.E1tu1h:yp \=RScv, b[ {5Aȱgc"Lb7hRCVVM$r&w4gyfܧz6ywݨ&v@Axm'ONYJ螨!}V֥4(-ښX1 _\aܷ2+n1hTb\ȦO^+ͦL(S3J92vMeuhC}Ymi'ů ]d"}aSer;)Ķ pKߊO A!q]gC;>& ŬNt]Tb#,'(M\6M-xb \]JĠ˧6%>qfbsF/>cCx'оK,r=WMJhKarV^F|]|*FyE:k l%[.fZ{ 裣q&Ȯ =,y@TŞA>b^! 5̨'hgבܹ62R|YMj0([ {KDoc%):w3yra'ۆZUI ){T|y @rŶΞlkh,{xQ2&Pp*OS"?D:6ےSj!*1d-L4ћ@US;ZE Z X뙓Ϝ]"|>6H *h3u7DI&1KPO[QBVIztqX-jX_A4Aloc(j+w饳H) K#:& C4*V:PD⦤{#Ζ }4SGEC^2/6DqR,"oNw:e^zUcn`ͅRBoxJecy-a7u,»J^ u)n8ڪ3B[jf#PW*g{ӻ"~Ly1YMuaI5Q 0Xiʮ?@EU8f&R̔m֗j!g^ j\hoE~ 7R5k/҄Q#M2R'ƝBg]Ak1Bޘ̽vߛok [ϿC:%NJ˺7@UX ZMfpƛ^79J(Ƙ7׈H͖J~qޱn^qSMTXWQ, 1;3#eݹ֚]ͽ_ݦw ɱ -}Q:-i* c '&(IwH`U!3EIv~Ĭ:e&3bUwB\<C+VZr{*>:BKH @q/^NpEo;'8Bޜzj- vV?a& bc2RdWQ0͘©0 \L(?FSXj Jv00S҉l&GvkiAE'd<}ÓrKf))at"@u Q.BLIP%%D@Hd@uc&X9XS)p_^=vpҥg^SYi8:.ADy[aG)ф?5TyK|s[w~oߪiu%&ޚ%LK($CiӪʶ37` <<-<=x+h|n=_8"1-5HHE_,>0ќ1:ډ 1%w; 5>%O6EIQqO@}RGC⟢yu_‘bJ8:tn>QX6 ܐo)PL=p/jF"{ 5sQ$fiz^BcFxJ5cUp'++6sK~A zD~ G7(RӾ.GHGK Fjg,o`QV<).ehUvkQ8M#g:&!T(PF!Q+Y&xSЬsy+8h#+,8ܞaZ(;[""D{2ٛacݙ(j}UFvH2ld-x @:%4{._Vo!Y_q7\3ϾtOc}bL_C _cAZ)(I:@~ZZx{9݈RABy̖x%3Dsn }>)˦Ya"[pWùOLאxJcxO%&3Lwh.^1e6]Ԯ~7huY0"`WWZ=52`s8pSg;2=ȗj%8Lٸ{^V5>ƳOTL|Omz 1Z^j))fWk 6nf Qx}KuCZPv̀26Pe]'\rxb`u07}Cƾ)JCLR--y&#Qtp`@xE2>Η|;l[vXREƝMٌ`d,HFr(myl 阺(!5]V?j^W}OVLMC Hl`3;Aʯ+Rb8 *J}bᕙA^n* p[w2k#8_n!?8[h~BsFB0R̮ާnɃ$ AlglSn`QC?Y7usH<\ӢQ쓩1J~k魮y YX);{B)G( ei/ty~ZݎMz5c в/_4ȚV[!D6\}͊bcǻcb^:~ eI]61hY0t5i V`+ujtcC"<6k3s_p"I_[qC`]"^:8̙+!1ج!^ċ#-y?G~+n,f16-f4]ilOcnԻ6FI?@45WL f3@`!`U'ZuRqnl2{dL4Yܮ7ǤG%BGE9\Ȓaz^XB;0i-%Bɶ+^l 4%; 4>"()X~ǽƧϠhKޮH _իɥq2Ѕd֧p[GƩdMf7$sM!tJab5:漥/\CѣfƔ5'},%}rqkk(V4݊:b;]v0I&[k2dvRFI,`UҢݚ6A$؛p'ORo1[WNlqr铯EϢ:I~fa>18 v&S1Q%X.\s.(W [P:3|Z!7Vo%- 1ca~ل<_ n{h)bV-όcb?kO/[\*o҈ tvt/lYrL}^5~wi-eiaA wq1r7HuL~IqUbk -mYaz>yCPG\|Gg6# ިpLE;P=8Ϗ Wϖ N~T=DGl8:żq c>1ys24ٍɧ&2oQЯ qrOM5 (XƎ=ʶ^yl-EaHGŦ}[V~k4ZH:ԎomTз*A\\L.C2 #i,{r *.=/V%V^. gB?K1J5sDEXJËt B+ٿ ;tg@/"9NQw)WR5uWzӟI|3=ͻ3Ax]62wZ#

W6Qmlͽh>{a_ۭof Z"ص4Di- FE𶗽4.4JSqJ#A.#7XUnf `C²W.g}^0 !hBt*AT$ل4ϡYv_&jd(G"GPͲT^z9jA]{}dEOsZxϹJph]'T @0mU0A$crӣt KQ"9S&h!čuM[z psk$ oZԑy)Z{$P(Z?<޴J O]1Eظ. N&MF1ϻiN>M 2!5#9wa :6g,wsjC z'Ɣh[BG-3;1 ́7nFH}<P޲/15Ν,emY>v$jrodݠl3(Ɲ^Ï2 EY)Q<')94p`N-~Al O.~tTToiq,(یav5 |$ω <>=ge*Vt}Apɖ *y;Qڤ>3"eAsN*+|\s<5Qߔb kL6k9K?+wSP[>aZciuijYHZti%kVa/D}q <\BWF`< 4 yue<%X,#it;{ <,NK Lֻ*yyR սZ˰v}Iv%dyg6ՒdV<NkPTZ!a&'Ķ3 Sod¦4T)E@|k6ҸLJ]9Kȳ 'RTDYvAĘڹv }D Ճ= >-Y1Z_E!0(?]Y.(K&kDfZKr s`ρ~yΫD"$~8F7]y3ʮnv- *پ iq^Z0oօ$ӻ)cCO=.=3?DaYڷv!19*KAF|eJSWIq7hfRVFYVv 0:$Cs\aT=/\ lV5'DN֫@{EsߧR 4Ջ*n8x&hOjÿ- q N6a~Wqt]r6cى"D@x[4nXDQO=2^$ZDHeib3Vo;N~DUxh3̗x,˦݌a{;f!4a1!*[tq_'ز haJ;:jE!N&L}33Z5Z#7Q`L8^C {AIop/ g^K>{3Ylqs1^65Îfod6'-! X-\?@LkP;T;e%cZP*RY#-ͿBa޿D}OȾˉ_W b[k3RӡKg{t: *X',ooWQOIw'h-J[MwU*?/wB~Ю4iF=l5zkyHN#O&;zFDtbݸ[ ZX!Q^ªOǫ4󠏙RXE8Q`ɤi͆gJXY/4Mpx`cTT3zX5uy"#G)Ca҄'FHa%5!#Zt<Hv3tS|`TW/5=Ey~ё8\>]mWƀ ׋= JH %2Vz4ب-Qd&J? Q.C;4W-%'E.2Q^gH %a׆DZ:fźZp]l:'u @iyʀPg"r#^]pxƳmi襛@Ma[DB΅xDM5n~ElLtoѫX !vk_o+U 7Ǩ#jtu]y\"x'=\.[RH #+^(s'a8<)k[w$>_@Y5O 5[mA4u> <'kp$t ȄBo 7祏I?^k8M&N#罿sH/TTF9YXak&#\+bUT= P2oޘ3*d$ߊw47L$$e-f$~J>FkR 6Mkng_͞聛U`腷.57L dK :,Ć@M¶jfTy*(ÎIުsjϏXKaN(vG RxgpH1*4"B, P(>64$ZBB<48% y.ӊBTfMCɅӬ))e] K Z0}Zep1ٝRHG)FɖNRhYjtڌ%%t!+of.:ܴn^m^XNLM gnq7bXj ''ʝ.-;#Cg0eE)?%[ oF]}'hXWh4~e-F< ]xw^T) 䞫 t3խ5=ɽ1XE)4=&*tStXEZqr4GRfq.Wph?*xX߄68(kn0lӣ܉$XE0 Si7 "`r6gf,g J#!=(`")vǩz,zkQm-l蠞#Ta[vpn\a9TՇNO(3o]G5ݧ7jj`'z..ްcÿ5m_%D[yZKu@ `oLhXΪm ya%m hl>9#Z F77qQW / IA-,)ePM `؄PaDtZsc{b ORָlDž5)Bc13@(=:g2_"6Wtk}'-ɸ;Q$:VE^wW@Dhڢ>R΋v=&;.h/YOA:*f`iu"̡9qRWN%ivFEz[ 89lՀJ7r8&g`u},EcFgylw-='^T?B :t엶&c}*"`~+XZȧaR&D*d't.]ᆇ+PI{zn}Hط:O jNByv|W>CG-̤uqE6>KLCBqfk~H8'GXsUs\0diS~2MOQМ_̤`Ik"Gc5Bzy M3'df(D*I.@(oڠe7t,n={};|!?w>ӫ b < 9bn  #jccvC|1Yڈ-䗺h:{ylQ3Zai@x4Jo{E&[G:8M7 ˔\q- P pdD\7o$xB(_&4X5[͜B7amQppW9%#RmZGK|5oA&y~`rhH^t6)|;z`Q; d 5ۈʏ4|4b֟tL74(@rx]qW_WsAtVyatϑ+I9$aׅFٞdhYݓʵLp>Ɓۑ&n~^tΞ[4Ӵq,i=+.zQD qֽ1y-^"%f7h#|ܱ+h`M{`jtB^r USZiD8?pow`=k-88an&r-3kJ bQ| {. .uٮ-~14>U\f~3bqsdHi:E?3mv֣i!|땯֩rce\N}wm`x*9430&dB:i})q7RpIG Sհ7_LdDj olbRZ<lo]z<$+Ӏ! `$}ԕaX=@VY\zpuaсڧ1CP0uKk Tc|a2 F@A.זPfL3EԮgmc.ϿzVaLz@PJ5S U1 EXv[`Iqdd?GY Q 4 8l <JRP1Ԏ1 CB0T1X X&^[{ìo@3V޿ɉ}uЙ1+ HWǻ&׻&hK!)J8EgW=Xb yu_Z&,aL{j/&͞UhhfQIUUe>ߨp(%dx04g)Aw _|dZu#xW^b~П Xw6-(̻z0Ѵ/_]R>nђ~Ob&@ŽjߢgHMѩ "L&x'HN?8Ҏ@YxCiz[ĐtH$j.㨲nP'ŖD7F<()Rw$ͮ뺩'y[~ٕ±_~(Jyź I E0L3W\]4Q9]1d+8$G<}tM6@MJ Ƙљ%; Z-v`ⷍVN$ )=HT}X,3y&mCQ4Hy3Y3e8q$ ?eG6\oYH_Ud;`]^şw-H?Ց8@2zY9e: 9q6f3C;9."W &DG;%f»Â-,Q[Phȸz/338&by9X> g̕oK {ڲ_I*H=8v] ZHZH=+81wGd3_e >Ȍ@o7%z<҈#Жpe3#K k,qbc9b1p:L7LdrDx _#ᰄgz'T!Frax+E [cu0_dg9al & y=\Q] YKƋt'%Q* CEՓNm^x5}doq$vCbSrt$Dl`6}#;1ua͇IOKU8.NPXfU1 qPWY>ާG)[yAT;:[uvH%=;G]>:ϣ*=%Akݾu}=u]O&,Wb Ep@*=P]TEI: Nc[DzxT \\dgH4b򽔗$'y1q#LҰpv4V&7z譲ȳ!DYGbXG4V.IxkL͸ H%k"i1Es^}P+9;Jl6@ Y9S.S<;Rd (?W132rjDYn'leCӣ!zR#6މ\LY3h0ԽiFM0]c$gڳ[9,,jO$өPuf_oqIؐT֌Qʍ?Kun;L}L@ +^7" *fT@E!]I%߆хΰ;sᬜM? AiZ1lq89i@[%b˰"5wdspCZuZN+V ц[wކ^cmb}: &[w|7BvC|'G7T_aoJ6Ӭg>F3e+,SWGL D=@ml"-S1 ?8^L<$+1~A Js$P>3d&<:e8t5塏ן``ô-rL׮SnoaߊN\r8MƸ jH$+8/$0kZؠxmԺߝ5i-]z-K`0l#4{5zP+bP,h7w.d f9z ; Rk,{"Ⱦ(.| =&9IL&,=QɿF]R4 Ǿ5;׻j}R`pH>@QgcAjԱKZJV *ir!'MXוɭGWzXk wr,捖|KZ #WyX٩xF_X>[F^hkoOJ^G?^?S9-2{ ]bMC2uv5$NfU3u[fx*ottX'PF9"#Vb+ѐ[TO}w6f/!XLR~p7\CĄՕ9ɱD9;PYbbrdx_ ^屉WYxtr9tj-_9B'.^f ajLaq#1g,8펵?2{ !Ԉ41L:-{H2pT9 !;MY0CS^mNrZ+Tuwl#tBBu.ܱx̀X{ʁzfՃzs)Ub&_Sz9a9DYū:QDk6XDY}H* ;@[jv-H_9Z}0n(72M&2\I!j='[údR5 2^α8ZPۚe35'k6ъxB\, @Ja}UˉH :]O<;#KY(RGm%Ay,HO3!x.|Ꞧ l1H|_3=T-K=VIv,)qݥq9)K~z{Њ0hc_!L,9-$ )rj{H<Z?RwsJWGf2'6'uz04sbċ)E }8iOp*n[-ɪrCʚ܋@~A 0лn 3>D |4&KIm qop s^6N<· 9V[U U;P |B]icl;Ly Ş=E&Z7薜MP\s> 1+wp!0 SB6[ wBNkJ Q|SJ?XX!n*/`앣6s#̨7 :\}q=9v@h_BtY_:\7\%txrNCUIBwO5c䡠Ŗ^}B%g.<pV9z{5TmY.풒d.DHEjo RQYsiO_/%!gLi(꘍DXcry7 \UR Fĭ O~(㏧"mG|( N: Fɂ·PL T9 {LG#ӏM-"3$a›QK {c 38a.- $'(꺜@'<ŧՒzGaA'Oɇ=u\B|IJownB$U/I,~irJ$W-wPxo_y=f8Ũ^v͜,ӽ,':^ ^[7 eY?܂7JB2wd^O9vmKؾx zjdn#M#Wj- !oqEktYcmHҐG >6 ;EҴv=K-C'v@+ y|/=qk%+n_“NF}M}Is nۭyBvYOFcWZ._ Fʪu+v1 ,;w;.}΄c뺽s_)Y?&L,e{a1EH"kE{J"h H-G Ґ />c/Kl 臸:pH;M,_E077CX4Kd8O=(p&^[#N@X"U[N}VE.kFF !Q^0`sTۣUZiOrtLJkkLڻg>% к^5:2HYi؞^+nb %Tdf{tj ,ݵ/=ہ%bPȱJY~Rui%lzSCEnPɢ^ ~x"l{g3NRV8(*?9_ٷGI5Sd;Q qѡPx\:<1|u'w5Y]sabbi%nYj"&nLM3*V#ʇQa2D:n l>᳐rIf;@w^tVg&7K5)FLה#v*-(@3Uxyeffc#cπ[{At?Q g=iLA_gՁl.މ/@{d-Fш$^3a$-F{k#st֮m#68,/z':w9 p6yzك6`qh3IR}4cL栵 ?r~+|q #Hsxt盲 {tgoY5AJ.q/{z)4P1GYIL> ޏ9 ȑ53炃'>bQEJuww10&\_r<~<`а$Y#?MW+>[ra.5H[R2:˷23g1V H5-ƻ;A8+?U@Pݶ/\M1sa-zdo%mc?gLK7}Tҵ844 7C«FQ/Yz:@lkVQU Wz.-2{F--o&bQॏOc".Sp0#ٶ$(& vT,b2>ƢUKc#C2oɩ4טh0hFK|8=HPeUMcR"@HV ⵢ/+LØ'ER)r ‰dE3%v2 p \+\wҊx1ef>ť2TC?zN.SBa/sMnD8R|^Pe5Ɵ%U2Վgr-}MWVZrX8~% CcW@OcEJj$NLrsi|ŨB=mqFD/9r:#/GPB6+[RsD-Kx]Hrqq4V%LSj_|urp>~`9A Uίn?` 44L?TB]O="mҊy^FŁ\a hTr\9L'T25f9ITQkK d%F,\>*?0)),;!'{cX!Nʨ(a[)2%I G^U!"U**GtЫ3Mc;JL~@'*R#c>1'/497ɍL4dу_ fir񂬘[!.)2^~ g3`Xt }fK&RsvFH/UAǕ8C\ $9,:H  ~W=1ЁRg8#d#peZ؏n:՜nTpDm~2Ҧkä 1cmH.CRa Q5aie ^EH6TE9[=Û-AuΠD`A^vJ 9Βu;CY $`j5_K?oŁ@4tfyUKNmBD!A Ed0&-7 ShVY{c$YmTპ*xFźUàn?tcV97:ȯ Sg1HVO;h黄й%22ƊD2`!j}(.Az#Ϛ(GT;Q:~<5pA:4%ݭ>ݑ:_b4qd55b 62.DZL3}急gkXMw;.qO)ʹ=v zSȊ'nP{A#[1^JءFO^̜µE6i'\wr\LAO/N!|RwDζ[>!Dz&o`ޔ7(+"Y .C=+.Ov4SK C PɻŶJ*l8AC.YQu,OnRW( }ڔ%.^v76B&7kc©@Q5҇uXd^:M\L*bZR'id6[bf5*Q#r\_E7!(W^lU,: ˕`Ũ4 9;iCn \D:t\uLq\#f[N2S``1֥lsoͲ`Wx ʌx4 T\QC ő`ozV^8dٲiXPq*|;+ _2T̓dHlW(h b8&,b,Zz s63m[k{"YBKڑGs@@f-+x:zjbA7@ dl~VW!\>^iЩL!ma MZi{QMv6PWAU`gn|uZ`2lJLUpsĭ9:` &4nyFuo\$z(i+fm6*aZ}^!E&KM ǍacH.~52!~ߥ}\aA{{\#;#hZrXuRh+ȯAB-'Fukur(RAcYEa/;W0׶JaW7bE?(ATgSw̞8  AZݛLaͽAOܝ DU}rr$dfZ6[Z`miW'K9a!g! &5 ^/ ?O+O-Ay!4AM].}-H̓ 8kkæc64}K^j| j\xMI xЫ8'ZJn>| #7 5EjpOX͠šD>zPR<#Sqgra6}9^\H᪌g}R Zҵń<p#20ØgC/ߓ~4)-1 aK1oЏM6o@ 'HKs<~L%+](*\%׈ vD5DwVaGWhIM37B_xIJicWK.qrܱ2@k^ , %\.u_%)W1=#\pEf}4ɍ)HNґ{ ⷇5`ozJvG^DSxFh2YĢ#VXŹw3ȷ!7N5bPҵM@4 d:$Ÿ^ Y1a[DKe!M,;kdm}@͕FVOI )jg]qY,ssWۋRY*A546 U4q kzL/<[ő..#9шDĽH^T#*niuZQD}NanwMAUvlDҷ0%PMDa1¶I)* (7tJͰNAr, BGظ큘fxks;D!۸8 P:bOE󵟍X14G?OzD ^ n?ټ'j!0/_o_F$8ԗ6-E 5nч"n, 4- ˶>! Đ?/Gvd;!6)ϥIҮ}Tq=2429zxѰx4}-ˌH10YZ'1VD6Xܞ^{#n@E|K, JoɄr$0!5҂-2(ݢ|8jo.15Q4 <@R0[0v! K]05Jz 1.Xu(x0 #0UY(CjS#K}%&u#]ҍەoAPkdӓeg5_VAQ2?&6B] XvhBgxaؚfb.z*ABA=cHVV"$P pLz+,#vw`!u$?"s .Ҹ̬jmOH)]̸~hIO*.0c!s_E`="p\`0@+9)oMwh4H^5KnEAGFM Cr ri rذ\Led>_zJf,iRR ׫;l]RIY垂6P t1=xL^<'Ҧ0>å0Ĝؑmc/lGJKI&7N=3I !6!M)rYGCA be~BC-d?{PV- ZFKR">g_a05Er~GuһX?!/>>1:t2-M 5i1_P,IK]_[hH|c?+شeU8+t؏Y?3famU,'Gi䳲;ے` "XC '7! j.:}扅Ӷisz,mk#I|4c6&> KYmf @.oH 3JUiq0+ڔ5h<`kY3lK}4߁elDd}~/cDuhCܖMb"ϰ$a;^{]2~F%tFc5 ⤄vstm."՞QڪϕD>Yx1?&(ׄ vF\'SR٢^ ^Lɡ]Wfҳ᲏duߓ&:w'C,b$q[~=r*ĽgaLU {]I>ZS`0d @J._W8 ՎGH*Ǫwce>SVZ(n]]&£V )/_|hc = ^XZ>_+i٠ځFZ A˿_͋A7E2r14eݜgv9O~gOH2yӖ>VӠJ; zcEr $^V/(NU9@N6xtRV?:nf~}"!?ٿS;r6:_Zy^Cpo}'r=/$i^d׏Q?ZYD*ӽ+hVDXe#rURj#Pvp $dp`^+zB˚ΑHs$+gx!$Dψۭ8Is*-f(+7O͆8f,t3w 3窂m}W)n  ??Voweɬ^%-nҡ_tޞ;qޭ ln=b^Ϊb5w lO:ƜxY__^s' >#)B; א]j$;E ݲG!U@èit 0<a3GMvH ΀'Fc ,t4sI͵&oN,&z t x=W8_Yhza%dsșVQDY38=Ŵ`;- ܀J(ps̀ݐY>F:r@ b0BB|k%B$ȱ8& g 0[׉-">A3vE|`ݔmՑى[Z#,re<2Ti3_<ݶD<Vdb7;ӻieB]1hхeߜVA뚡#OK%3@-n4"շjgG#K/B8ք[/_ƶ5!De=i^>NM%0O*?re^ʈWF`jT53}md' a#^ QUa1$DyR|O+ )*W34 GQzO$i$bT\- r\,wo=Lm&-n?LAr >]>m:*;hoN |95;ET6<4_@&{rU c\3Dc΍l#<0E 9ek;H ٦eN v5))s`)xIkgY8$C- :\s&=aW:; 1ҒkF]B{A5KɁ;G60&ٜ/N ZlL0)ߑٜPc M O7l} `ѲX&*fKV_s&O.d{Pq[\VQ Kms+cZSt'`!^{˜0@߬6dZ2$x%gM1bH{A58KzCq :aCKhBlIwta'yёL{`~]>3bex~ 2^/.-R[=vuwm_;8 W},^e-ZJW@pw?gzfNST5T7ε7!袇AwbwOW2F=Ix<}1ʴ#KB9[# ynGpCPN^/2LW~Ey\ ,#e75GвyM1;zEld|kMn*OW"9!jd5 <4 "<:CK!a]:[e|7#޻E4P Iv譓H_z)ֳ Xc459ם}6"5W,ngx{V*RRhrA*@-YZy0=2m>փiՉkF{2M?;v1Y<s򜳙2nP?7Sz}[XowwI+ߐTt2Ph1)(ǝ9' z]guC=]Zsº @ӽg I'z-ٞwVWGk3):wDL:_ qI(m=)v&O%G5J%+(Ҁ6ga?l =diܫxYgRsyɂ~~XK&7_ڨ/K}ڢ|&Iψ2W#8'%cW}A  ]24joԔo`bОy8LIG]uSmi6?MY_ :v2V v.g,2!xc0kFg',*3X0J=/IfZ9fH͈r? Y(,ASD"FGm .gJlyNOUWˡ+y_ R[ }Ad>٦XÄ>wxzZVVC^BU')o*Ӧ7摵Tӱ%3C#bZ<8(5h¸JUN Xu-\0TQwIV-gU 5J+иZ@┴rXɡ쀶y{Oחҥd?#N>HR-6r6T>^,|utM\6 XO'5|4#_УyR5Xl?s@<Н>Mq2@c']~W}~.T;jtUgeKɔjBŅi淏ky.] Z9N|*IZB 1bR\0l)gp PZ[@^FJL@^J-g^d{2jF9R5 *hlNM VPdM6W#miEW%"]Ƙp .[AN_+;] 9UP4ˏCK-pQ @&Te(0A61I:v=Rqw!' %A+byܟJN<+Pӌ*a\y5/bk}\~1`WQ yPR]#6+)'OyE]HΥ{ paYpS81{/—&|~WչL>0#T*c]T1!A67Qв~ 8e o5iyYoY)}z?3+>.q6vYWȰ@|Gv2\VTٓ9HS-|w _DҩL/t(`T^Ts2S@po7[(nIoEG4\Hwiׯ.IU:tSdjT(#+h3oetQjn|&~mz_׶^>gʌtGz\jGpi6{\L~./ɗCH2) 㰺RoZO7h7kCS.m qI\lnxD[ȰY>2Ofa ~C| }WFֶ;t GY*-a.s<B-q^~6O*I QyW,EM7aڧ̧0:GaڦSs,k4DCu,fە _ ̙YQ2+ `M&E-XRU` )ddV-$8i>Ј觐ZkĀ[uT_eyD* i :;49\ 73A"|9[&prSKi=ʑyio;)OF&׺dΏ~?"B^S砉b"(OYK(gbi$X$N{Fj S#X/v5Uy:bd4Aώk"Wہ Kr*R /LȒ646'B~gAЊvϗ"<& aVL|EJg`TyDR+:&-ʔl}:жU'P"pޛ0d읺l=G۩qg;4v  H@?1#4_oUTQ-XܩK l7/) &)#7|Ҕiv[S<-3 LT^|-vgxzΨsƟiy(}]}9@%sy!0%feg“zj-f@;XPCW@/8 & )mH٭W9ꂽx wGo`A M̈юt;M'tF$YOS9}apނr=]L1ty3?zb|5}xadv2olE)P7[?  ? UҿOqJѵ(YJrh M4X`-K\l`R3r3[:p.~ bT,-xw:Y0j(czpQy)$N[ OdAvR8t?'s<{w 3yæԷm}C]q'ÿm?3k;V0ؾ31 Wt(^RBZV~ty鬬 EݤB] A{X"T~}G9A&K.Kney(f֯n *9!Uk1S m 2=6ș1C𡋠O'| z $`tw FV_X1EIc eoI˿\x]_#'c VM?A&#=F]S)[Sxԧh#Pvy$\]g_Fטu֮k( 7! }ZG'בܔ<7nz8;hhhIqDYQC&3XL(r{k 7.'U,s·>/hx蚵ĚmscV_!׮lm3)ߧ8nB=Dȟ!@1fufNJ^ّJ*(S i%o$Ԅӡ>]1;J58a>lɥ<2zG0"3AS;b7zTiqPZpD%x4ZWNL6NbYK!M̖nА+hDoצjuڷ!ť^r"efvbw^iwF v88B5HC8*vNSDO9ɑkmCS<|-F⸉`_15HFP|M(tw{Q%bH~t9o)aNxptg2;Z0urlS^^`"EPɠeK .MʖnPw<0fH:Cǀ%bRcCB}韮^SA_ /梫#{ lS9j5rlj63 Fsa fWgAaϕD)>zD(&<]MiRulPSPa3%rT&"3fq%5XẋM5Chr(;1 iUa|z,3XMbֆ'ys!KިDH5D^󷛊vzmeJ{360KFۨ3βMuܑ3ԿZCfIF@uߘzXⰼ0AergDoQ%Tc0 "jwF(v įb4uG5ŗ4@+*uVlOU42ܧy^vK܊y %ݡ t}wN`C^ yn0{Ԝ5x&^g] }sSaҫtOz,\Dڣ12Q&i%oiSx1k wa-}QrybؠӢ7qHo1eM[F?"V}7bnJ!4#g@ O#d?@.J+TV>pC `}"V [C hBI3a(jm')TO|V)uR7P_@MiB:Ū !j.zkcǟ[mjڎE9!o h#+3 q iyz$CSwP[5ϒv:3 i C Gz!(˦\kBulul_d/: XhQH%bXIp]iU*h[z M,!@{=]z {b@*CNF>nMDRhy o\1諒KC$Js^|:8Fb# $2u8xPPҴkH`OmBuaʂ@rw!b*Ĺ/^ۭ$]=w_zuct;`%U6!c܈íŻgpI0x/Z̶#O"-Qj+ាլ c"&/i:Fs$Y5~$堆gHtav]dO}nK(+&( >drw6-[k[z 2BhR&e37ŢnUԜwGqf}2v1ƕec=X>fC6? 't |Ku% _m#InG_uC%kٍS[ |B)xx`I@弊T,¤|]'\/mSH]L) b!q0?ٙd&J+H27&/>*D X-p7p?z5~C1*lT!k%&^U:135,p5V^o 𨃇.]h? ñ_nya.uGE oDۘtrf[(Y|#:NfKEp#G@?O "~MRg9LV2j dV$G!|@6dGXc".`p-U.8 p._y.?D}h&dn[0AU4+BÑ2ڷW"X^_K5^ZPvXƎIl"तʍY[Yp^T4PhBϪ   A~FӜsjy] dyc:@߲C9Ov1S0Fizs%z/'ud>YVVa96Zfĉ0B(ς%,!&i\igt76'}LBlBntmL]sŒ0^nf)esi*>Rͤvkg_荱?|iy]r1s;S_lJeJ_ҹ6m>`͌P&p]n5Q>@ˢ7+)N6>k] 9 #mQGws Ω٬h, !ahjA߲ʹ ֮Zq*e~[Hҿ')!pf[A1L( xC,Wd4Fl9Xe.b~ehP/r4mٸW@RR팖6;|wQD}e%->+o2\d #,ϑZ$! e!w;t;|wk &@9y\66W\j7܃o\g9؉~Gǜ%zg/,q8ŚF z:Q R4t&-##NvjxE1"jPDvcN2I*uSڐVh|`_^j/Ҏ^NuU4 vrqys(c'!QW=NmsBf&b|t6erPbq8<#E: A+0[T9IT H3>^p>w'{1*+[ieO18佘 -R-Ջ,a_Wii/VC-1N%ީLƿqF½lY,ZVb҂4FߩUO}Y-j3Ir; hʖ'=%}eJ{\ p~n!eFa-qHҐ^ٻ7$`P6H c w E qodP/T 8ʄa( l(_N[uH{rda@P7@ J'%ei0xKg _(TVf x+д0)44]gtoĖ@ʏQQۯO5H *0ط5"hAǑ#Vm}?MdO9qJۧW|XVQdyC8fD_DQ !p}%`(%8 Ƀ|d;&LllT?`aqIū|0^_v(g#az2G,pOJ=i lw@ٟ|MP?}`-HPD{ pZ:\Gv3SH_Z܆wcF7J@ނ-FUõAܐV_S> 7i?#1M%(N4ƒxZk* 헷͢a|58sL?rR(O_QkAaFLE0K&%S0gG|kdžK (/o6AN`h=+&u%]ʳdfP۳ElbHVioG&T{Nj17OLZ{K*E ]YW_ʻ y{?4*mȭȆv$knd~u'Z {NȁMA"y1k6kƶ|=כ(ь%LkK/aS@:9PeczU4{LAasmYBlbʜJ~ityGZؼ:C35Vz'^*;:%v9HimjaPpPˡT90Nz6z(.W>-CsuŠ*+/A [߶TmfSe/ 4h^r/g2<ٔr-o" ܛ(Q b{즯u朲0-O6f 0+? v֓~-m8(n H0eGmx,ɳ)e!zj?8DgALy"Pc/h@a<-(TV-}, yن cF:v=tA/T,OA TO1wFA Xc`dDp+.YHcjHk:ŀm~uylmaЂf5T *m;ё`[}/t?n/w]*M(Unaol]A81:!Tyy0X׎?\/eM'4+Y@BGGa x%W);<1Rrp~l9`uWߟ Jy6\yP虥ĉ&Xj/[-}U4:QE`ox{|;қqb]w3x WdtiL,@ѐvx֓A< O<;2VՌǠR(S*yF >iJ},.lBr/5Pұpq3SF%e7od`/| Ha}HPP|~Pb7ɐ0.˓;y#8-7iR̂;7e]0|ẉuK!h X6+~u vl h g~\`x]WeQﶔԡnMQߤlkaKaJLͿtw%r]v@v$G)2n,S8YV^MnE8eݒQꣳ*v ǖ]~Sh`;bQTjIW3͸Z1=i.!ՙ״W#S[""V܂YCXC)Li؛s _1 @@t !$xvA= 7DqR,&CH 6*E$v4~)!˖w>/Dۼti;O f_P(>vi "uk@Y3OxrW}>0OV-w_ \:tm*t4yvzAET5bu,Gɖ#ZM~"1/'WG*@=}Pٹ4$upCHuxKH~t4s{-< b)"~M6J9 G(hi{C-?#n_P:W.G!WhoK8: 0$5JWhH0=A'[RAb=V}їĥWug%F4-*H.>SL?z8}?+~3{"K54ՄEHF 2VatpHQe{KF2(eq%ܚGH[Y+2{*s9rfBL~lBѤap5yթXP]4v{U,*KC͂,y,zh2z^)l ۿBCdYR]SL` 32d<>Y "!;n]tѩ\]e=EoA̎C_0YCejPjbeoB1<+]rzq0T4Ni"]$f+L9Bt ŬԿ՘ >/ndIn*6YkiFgn@3ի$) UGP+D-%D E߲&sgyo^N>VTpa\z Ϩ)˛E=0ցxz|,3^ؑ%O3zؕz; Z]`v.ݵyBU>MQ8;3N~ = \kK% 8!3#YF<(kbֱ*&uRa؍ೃ% щ J ahD }ʍљtC3IV0Şot䐊YHiVUjCy㧎oxa2[EJMڔr<` dzj1QLkhrr잫rSRlB%r >9O;͐H9m6HAsƺK: $( ;4#+No85(L Tç&fmBJ Iw+.UB֎:H3je{4$ٱUIΦ}򼟮.%OR0E#lDO$#`o.U9#3 >.؞1C]4dֺ?v۠fLrڙEU-4^T<C#/ jpR f^pX5%֤wT[v| ԩ".Et%>sm߉i ~C*lY;&!!mZmjQ%whq`43K`Eg|yB1N4՗bf MvojpZ=ܝ[o0'3jykd^Pl, .7pMSy@sUxR$l AXp!fp]9)KQrbCf/]CQ NIaB=v0n\MJ.?%3CM3XfRl>J5'ɑsFNbs?t?7! %KZnL.}ٶxr\dri$N$,}C?c9DTwV+" AIxߡёō;d8rסi'Mࡆ`ݟ.óHwp%ULvzrԼX43oqO図GՋ ܿJ^8y [\b!d.ֹrf<`@) a>C0ӍwGTS"T/Upl żb@q= @@K̚#?E/P5Q^E+ɍ K!ܻʷ?SHsحwdWc!Ȝo]UOM й=ڍ47EhѼssf]F~ =B) ։e;E9΄{v܁ m8D)T\C,nH}#eeA>N|=qp9(b )ma:u(lWd&'7h0dHbʆʳʤߪtjZQQ/3Y-_%sQl;6+ITwo !xN<߭QsPme]l 2DXPJKjp8k<Ca"?J"5 jzc|St ;i-UlfNKSF!d5?s* Գtrf&4<XV E떊T_@/%,-#i`cU?u}YY"kIppfYqƬ%dQ2IWW`?*99, Ӹ. -@:IZ(߾xjj }o <Q&d/w%ZOyhDmHR'u˶UERqˈW#C㚷2!^GD1q:B D;i@+BԄYk2#x" W ֦3px(7O(˸X$~&і;.<@HEAbw_4i7^4.7 H eCj}P@*Lyi[viUׁ)4]}Fam6xKp;OVL=dt>:5j؇z'$eZŌr4 T`"*v(FYb!:^"_ۋcb$#Aپ6K fY>靋q1|Gأi<VzlgHt[Vi,^V]&ID])5p-]_竽\wjMdTZd]Cqg~  ЏȅAԱAAJK=@0!eުKir? z)]snڍuRBHoayaԄ}iH; ![ju㦉P 8*Ske-_·`fx CL ֻ[7ޔ4S}eÀkS[pgwیT>>BH/@|f+ֈo%,Q&j۳\|BG6neZKFJQWi_S9xuS]6C!٢#TtF'n~E1lb_j`FbZct\5X'}r.g,+ l혺$^A\1T"NbgHa \[s\EBA0j[^'kkj}p|neq.S{.@UF=Cn6h.8\cgW4{8W?w{&DH`5MF(+ԡZzwnqK)\:q G݌[JR0?٫ ,͒*6;FVl%0-,][ ܹ?qIӳId[-F ڱ(sy%mp|^Y~~YKe+3$ C;SOUQ߮OM 2K+ m;OAcDW<~/8>b'UZ3-d,^8A4hv zb:kq8[16=\qQ y(jtcxJAjڽ-SuD͈au+ElL\CXs0 yTm8龀LRRhtq fqj@z5M$u*;lCmᢔ7> K;UU/τWG=aZhcks9Q!u' |ao+_EZtP\nZ2 ipn73gkMJy7AV;ޥhv [/s'XaPkdV^z.g,Sr&|e#KEVLQE>ᥪ*s/ċHݐj6-*Pynk*l)o Z]g;<\c߼ƃAd8.#kJ Jȣ۪TqRHqYi| `J! 4zHZO(CW'-dGnO}P)@ֳThCAW} 'q'G5!`u1VL>lB%y1#V( iub(qo`G원yW6;ß\,%=cwsʉhL%3M71v>L<:7A-dփ?@Y\oN" ;׬+`^[ۇv奲,MML)n6Uq.Fr~K}ҍHaý&:Cf{# 8L4Y߶1V>4,5l3ɱa$zf @P0ks Qad~ݘƪ>N]W {Y^Z0%MjAZKvM}ZE%GZDҒ,"92eϤ?6y؅fm(^~+u3Z6WڼʒFo$C[ΧCC: r 2y91y8.M^+ ɝ[@-Ք;TZ(8x< .B#ehٷZ am}EKa). # fPVÊbNqYk& "bf^55wpu``QeHZ"*SG<v%JbM(KuOҍ鶔,INmhUЛijG'uf>4neuV^:crVI)B- tnr6~3ۧ ssny7@⩱INO⭥|IݏdL3םWs\ݡIl3-( by1 q*BOZ6;?sŔ W*+ĭBӗ&ptL@R4aD){zҲ],YD7_yȦ`IH1X!ncIӉ[_V$ RlS|'7eෛ5A&qP5zvb")9akdѮњiꞂv*Ta,hVgN7s8u\dJ "qUwH̞[4D@_t-_g) $*o$HZl}#Lh \.cN@[("XENP"fh۩z іjw_&\Z5b#oN3nM=ġPZc j6[k7EԷyT]NID\ͩ#=YxP AxF IC(ktZbn[Ɲj>;iɜe$ _l"AF"Z]._0h:!\Ͼ]UЗut j!Y4 ,7]}e]<$DCIH'"I2|n]pe 흐QmFwG 9Wu㘔 >pp;U"5CdTLc .yWv`yDZv~$f9 W&KϗSvǀI}cc-WH,'S|2`/)#YHqh DVZ~jS A㬂e>ʾwW7x&B=LWւo hc=ۖ\mG: DlEqǭH"FCW5euQ՛LUʂ%O0)u{xN 9Iz{ op\ `0fٗL&p f$w; kc&+Yr%5]BGMKnr?l\uu*?,㻄ϝ/X,qW;s[4!oG ӣB፦+>RloU0ZiuPQN,n{>l*`HGt2þ̰yZ 5a%S%dM_9Pe7ӫِY\$,?1.z/S$߂_ DۢUh{MD ?`2mX JS;m, x_^j.*{{#U RҦHWiA9Tw]Yzk+j3kT\ @R7{}+=7HqUb(0sP/Wp=jZ'M[7T.v!x:0B?{(pJ7ڮ /!g[p-ЧH-z ߳քgGL4RyBZf9ۃi pկCc᳿'.Z~q]GRJ@Pa1<;,ڣE4ʘ4y=$ViQ0CoSA,?$?{ ::W