API tools faq
paste
Advertisement
xiaoy1

Untitled

xiaoy1
May 20th, 2025
42
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 242.50 KB | None | 0 0
raw download clone embed print report
  1. // autogenerated by syzkaller (https://github.com/google/syzkaller)
  2.  
  3. #define _GNU_SOURCE
  4.  
  5. #include <arpa/inet.h>
  6. #include <endian.h>
  7. #include <errno.h>
  8. #include <fcntl.h>
  9. #include <net/if.h>
  10. #include <netinet/in.h>
  11. #include <setjmp.h>
  12. #include <stdbool.h>
  13. #include <stddef.h>
  14. #include <stdint.h>
  15. #include <stdio.h>
  16. #include <stdlib.h>
  17. #include <string.h>
  18. #include <sys/ioctl.h>
  19. #include <sys/mman.h>
  20. #include <sys/mount.h>
  21. #include <sys/socket.h>
  22. #include <sys/stat.h>
  23. #include <sys/syscall.h>
  24. #include <sys/types.h>
  25. #include <unistd.h>
  26.  
  27. #include <linux/genetlink.h>
  28. #include <linux/if_addr.h>
  29. #include <linux/if_link.h>
  30. #include <linux/in6.h>
  31. #include <linux/loop.h>
  32. #include <linux/neighbour.h>
  33. #include <linux/net.h>
  34. #include <linux/netlink.h>
  35. #include <linux/rtnetlink.h>
  36. #include <linux/veth.h>
  37. static long syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(volatile long val)
  38. {
  39. char command[256];
  40. sprintf(command, "echo %ld > /proc/sys/vm/zone_reclaim_mode", val);
  41. int ret = system(command);
  42. if (ret != 0) {
  43. return 0;
  44. }
  45. return 0;
  46. }
  47.  
  48.  
  49. static long syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode()
  50. {
  51. char command[256];
  52. sprintf(command, "echo 0 > /proc/sys/vm/zone_reclaim_mode");
  53. int ret = system(command);
  54. if (ret != 0) {
  55. return 0;
  56. }
  57. return 0;
  58. }
  59. static long syz_proconfig_reset__sys_fs_cgroup_system_slice_rsyslog_service_cgroup_freeze()
  60. {
  61. char command[256];
  62. sprintf(command, "echo 0 > /sys/fs/cgroup/system.slice/rsyslog.service/cgroup.freeze");
  63. int ret = system(command);
  64. if (ret != 0) {
  65. return 0;
  66. }
  67. return 0;
  68. }
  69. static long syz_proconfig_set__sys_fs_ext4_sda_inode_readahead_blks(volatile long val)
  70. {
  71. char command[256];
  72. sprintf(command, "echo %ld > /sys/fs/ext4/sda/inode_readahead_blks", val);
  73. int ret = system(command);
  74. if (ret != 0) {
  75. return 0;
  76. }
  77. return 0;
  78. }
  79. static long syz_proconfig_reset__sys_fs_ext4_sda_inode_readahead_blks()
  80. {
  81. char command[256];
  82. sprintf(command, "echo 32 > /sys/fs/ext4/sda/inode_readahead_blks");
  83. int ret = system(command);
  84. if (ret != 0) {
  85. return 0;
  86. }
  87. return 0;
  88. }
  89. static long syz_proconfig_reset__sys_devices_breakpoint_perf_event_mux_interval_ms()
  90. {
  91. char command[256];
  92. sprintf(command, "echo 1 > /sys/devices/breakpoint/perf_event_mux_interval_ms");
  93. int ret = system(command);
  94. if (ret != 0) {
  95. return 0;
  96. }
  97. return 0;
  98. }
  99.  
  100. static long syz_sysconfig_set__proc_sys_vm_vfs_cache_pressure(volatile long val)
  101. {
  102. char command[256];
  103. sprintf(command, "echo %ld > /proc/sys/vm/vfs_cache_pressure", val);
  104. int ret = system(command);
  105. if (ret != 0) {
  106. return 0;
  107. }
  108. return 0;
  109. }
  110.  
  111.  
  112. static long syz_sysconfig_reset__proc_sys_vm_vfs_cache_pressure()
  113. {
  114. char command[256];
  115. sprintf(command, "echo 100 > /proc/sys/vm/vfs_cache_pressure");
  116. int ret = system(command);
  117. if (ret != 0) {
  118. return 0;
  119. }
  120. return 0;
  121. }
  122. static long syz_proconfig_set__sys_fs_ext4_sda_mb_min_to_scan(volatile long val)
  123. {
  124. char command[256];
  125. sprintf(command, "echo %ld > /sys/fs/ext4/sda/mb_min_to_scan", val);
  126. int ret = system(command);
  127. if (ret != 0) {
  128. return 0;
  129. }
  130. return 0;
  131. }
  132.  
  133.  
  134. static long syz_proconfig_reset__sys_fs_ext4_sda_mb_min_to_scan()
  135. {
  136. char command[256];
  137. sprintf(command, "echo 10 > /sys/fs/ext4/sda/mb_min_to_scan");
  138. int ret = system(command);
  139. if (ret != 0) {
  140. return 0;
  141. }
  142. return 0;
  143. }
  144. static long syz_sysconfig_set__proc_sys_net_ipv4_neigh_sit0_unres_qlen_bytes(volatile long val)
  145. {
  146. char command[256];
  147. sprintf(command, "echo %ld > /proc/sys/net/ipv4/neigh/sit0/unres_qlen_bytes", val);
  148. int ret = system(command);
  149. if (ret != 0) {
  150. return 0;
  151. }
  152. return 0;
  153. }
  154.  
  155. static long syz_proconfig_set__sys_fs_cgroup_system_slice_rsyslog_service_pids_max(volatile long val)
  156. {
  157. char command[256];
  158. sprintf(command, "echo %ld > /sys/fs/cgroup/system.slice/rsyslog.service/pids.max", val);
  159. int ret = system(command);
  160. if (ret != 0) {
  161. return 0;
  162. }
  163. return 0;
  164. }
  165.  
  166.  
  167. static long syz_proconfig_reset__sys_fs_cgroup_system_slice_rsyslog_service_pids_max()
  168. {
  169. char command[256];
  170. sprintf(command, "echo 971 > /sys/fs/cgroup/system.slice/rsyslog.service/pids.max");
  171. int ret = system(command);
  172. if (ret != 0) {
  173. return 0;
  174. }
  175. return 0;
  176. }
  177.  
  178.  
  179. #ifndef __NR_copy_file_range
  180. #define __NR_copy_file_range 326
  181. #endif
  182. #ifndef __NR_io_pgetevents
  183. #define __NR_io_pgetevents 333
  184. #endif
  185. #ifndef __NR_memfd_create
  186. #define __NR_memfd_create 319
  187. #endif
  188. #ifndef __NR_openat2
  189. #define __NR_openat2 437
  190. #endif
  191. #ifndef __NR_quotactl_fd
  192. #define __NR_quotactl_fd 443
  193. #endif
  194. #ifndef __NR_seccomp
  195. #define __NR_seccomp 317
  196. #endif
  197.  
  198. static unsigned long long procid;
  199.  
  200. #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
  201. #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \
  202. *(type*)(addr) = \
  203. htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \
  204. (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
  205.  
  206. struct csum_inet {
  207. uint32_t acc;
  208. };
  209.  
  210. static void csum_inet_init(struct csum_inet* csum)
  211. {
  212. csum->acc = 0;
  213. }
  214.  
  215. static void csum_inet_update(struct csum_inet* csum, const uint8_t* data,
  216. size_t length)
  217. {
  218. if (length == 0)
  219. return;
  220. size_t i = 0;
  221. for (; i < length - 1; i += 2)
  222. csum->acc += *(uint16_t*)&data[i];
  223. if (length & 1)
  224. csum->acc += le16toh((uint16_t)data[length - 1]);
  225. while (csum->acc > 0xffff)
  226. csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16);
  227. }
  228.  
  229. static uint16_t csum_inet_digest(struct csum_inet* csum)
  230. {
  231. return ~csum->acc;
  232. }
  233.  
  234. struct nlmsg {
  235. char* pos;
  236. int nesting;
  237. struct nlattr* nested[8];
  238. char buf[4096];
  239. };
  240.  
  241. static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
  242. const void* data, int size)
  243. {
  244. memset(nlmsg, 0, sizeof(*nlmsg));
  245. struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
  246. hdr->nlmsg_type = typ;
  247. hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
  248. memcpy(hdr + 1, data, size);
  249. nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
  250. }
  251.  
  252. static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data,
  253. int size)
  254. {
  255. struct nlattr* attr = (struct nlattr*)nlmsg->pos;
  256. attr->nla_len = sizeof(*attr) + size;
  257. attr->nla_type = typ;
  258. if (size > 0)
  259. memcpy(attr + 1, data, size);
  260. nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
  261. }
  262.  
  263. static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type,
  264. int* reply_len, bool dofail)
  265. {
  266. if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
  267. exit(1);
  268. struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
  269. hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
  270. struct sockaddr_nl addr;
  271. memset(&addr, 0, sizeof(addr));
  272. addr.nl_family = AF_NETLINK;
  273. ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0,
  274. (struct sockaddr*)&addr, sizeof(addr));
  275. if (n != (ssize_t)hdr->nlmsg_len) {
  276. if (dofail)
  277. exit(1);
  278. return -1;
  279. }
  280. n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
  281. if (reply_len)
  282. *reply_len = 0;
  283. if (n < 0) {
  284. if (dofail)
  285. exit(1);
  286. return -1;
  287. }
  288. if (n < (ssize_t)sizeof(struct nlmsghdr)) {
  289. errno = EINVAL;
  290. if (dofail)
  291. exit(1);
  292. return -1;
  293. }
  294. if (hdr->nlmsg_type == NLMSG_DONE)
  295. return 0;
  296. if (reply_len && hdr->nlmsg_type == reply_type) {
  297. *reply_len = n;
  298. return 0;
  299. }
  300. if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
  301. errno = EINVAL;
  302. if (dofail)
  303. exit(1);
  304. return -1;
  305. }
  306. if (hdr->nlmsg_type != NLMSG_ERROR) {
  307. errno = EINVAL;
  308. if (dofail)
  309. exit(1);
  310. return -1;
  311. }
  312. errno = -((struct nlmsgerr*)(hdr + 1))->error;
  313. return -errno;
  314. }
  315.  
  316. static int netlink_query_family_id(struct nlmsg* nlmsg, int sock,
  317. const char* family_name, bool dofail)
  318. {
  319. struct genlmsghdr genlhdr;
  320. memset(&genlhdr, 0, sizeof(genlhdr));
  321. genlhdr.cmd = CTRL_CMD_GETFAMILY;
  322. netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr));
  323. netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name,
  324. strnlen(family_name, GENL_NAMSIZ - 1) + 1);
  325. int n = 0;
  326. int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
  327. if (err < 0) {
  328. return -1;
  329. }
  330. uint16_t id = 0;
  331. struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN +
  332. NLMSG_ALIGN(sizeof(genlhdr)));
  333. for (; (char*)attr < nlmsg->buf + n;
  334. attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
  335. if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
  336. id = *(uint16_t*)(attr + 1);
  337. break;
  338. }
  339. }
  340. if (!id) {
  341. errno = EINVAL;
  342. return -1;
  343. }
  344. recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
  345. return id;
  346. }
  347.  
  348. static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
  349. {
  350. if (a0 == 0xc || a0 == 0xb) {
  351. char buf[128];
  352. sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
  353. (uint8_t)a2);
  354. return open(buf, O_RDWR, 0);
  355. } else {
  356. char buf[1024];
  357. char* hash;
  358. strncpy(buf, (char*)a0, sizeof(buf) - 1);
  359. buf[sizeof(buf) - 1] = 0;
  360. while ((hash = strchr(buf, '#'))) {
  361. *hash = '0' + (char)(a1 % 10);
  362. a1 /= 10;
  363. }
  364. return open(buf, a2, 0);
  365. }
  366. }
  367.  
  368. static long syz_open_procfs(volatile long a0, volatile long a1)
  369. {
  370. char buf[128];
  371. memset(buf, 0, sizeof(buf));
  372. if (a0 == 0) {
  373. snprintf(buf, sizeof(buf), "/proc/self/%s", (char*)a1);
  374. } else if (a0 == -1) {
  375. snprintf(buf, sizeof(buf), "/proc/thread-self/%s", (char*)a1);
  376. } else {
  377. snprintf(buf, sizeof(buf), "/proc/self/task/%d/%s", (int)a0, (char*)a1);
  378. }
  379. int fd = open(buf, O_RDWR);
  380. if (fd == -1)
  381. fd = open(buf, O_RDONLY);
  382. return fd;
  383. }
  384.  
  385. static long syz_genetlink_get_family_id(volatile long name,
  386. volatile long sock_arg)
  387. {
  388. int fd = sock_arg;
  389. if (fd < 0) {
  390. fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
  391. if (fd == -1) {
  392. return -1;
  393. }
  394. }
  395. struct nlmsg nlmsg_tmp;
  396. int ret = netlink_query_family_id(&nlmsg_tmp, fd, (char*)name, false);
  397. if ((int)sock_arg < 0)
  398. close(fd);
  399. if (ret < 0) {
  400. return -1;
  401. }
  402. return ret;
  403. }
  404.  
  405. //% This code is derived from puff.{c,h}, found in the zlib development. The
  406. //% original files come with the following copyright notice:
  407.  
  408. //% Copyright (C) 2002-2013 Mark Adler, all rights reserved
  409. //% version 2.3, 21 Jan 2013
  410. //% This software is provided 'as-is', without any express or implied
  411. //% warranty. In no event will the author be held liable for any damages
  412. //% arising from the use of this software.
  413. //% Permission is granted to anyone to use this software for any purpose,
  414. //% including commercial applications, and to alter it and redistribute it
  415. //% freely, subject to the following restrictions:
  416. //% 1. The origin of this software must not be misrepresented; you must not
  417. //% claim that you wrote the original software. If you use this software
  418. //% in a product, an acknowledgment in the product documentation would be
  419. //% appreciated but is not required.
  420. //% 2. Altered source versions must be plainly marked as such, and must not be
  421. //% misrepresented as being the original software.
  422. //% 3. This notice may not be removed or altered from any source distribution.
  423. //% Mark Adler [email protected]
  424.  
  425. //% BEGIN CODE DERIVED FROM puff.{c,h}
  426.  
  427. #define MAXBITS 15
  428. #define MAXLCODES 286
  429. #define MAXDCODES 30
  430. #define MAXCODES (MAXLCODES + MAXDCODES)
  431. #define FIXLCODES 288
  432.  
  433. struct puff_state {
  434. unsigned char* out;
  435. unsigned long outlen;
  436. unsigned long outcnt;
  437. const unsigned char* in;
  438. unsigned long inlen;
  439. unsigned long incnt;
  440. int bitbuf;
  441. int bitcnt;
  442. jmp_buf env;
  443. };
  444. static int puff_bits(struct puff_state* s, int need)
  445. {
  446. long val = s->bitbuf;
  447. while (s->bitcnt < need) {
  448. if (s->incnt == s->inlen)
  449. longjmp(s->env, 1);
  450. val |= (long)(s->in[s->incnt++]) << s->bitcnt;
  451. s->bitcnt += 8;
  452. }
  453. s->bitbuf = (int)(val >> need);
  454. s->bitcnt -= need;
  455. return (int)(val & ((1L << need) - 1));
  456. }
  457. static int puff_stored(struct puff_state* s)
  458. {
  459. s->bitbuf = 0;
  460. s->bitcnt = 0;
  461. if (s->incnt + 4 > s->inlen)
  462. return 2;
  463. unsigned len = s->in[s->incnt++];
  464. len |= s->in[s->incnt++] << 8;
  465. if (s->in[s->incnt++] != (~len & 0xff) ||
  466. s->in[s->incnt++] != ((~len >> 8) & 0xff))
  467. return -2;
  468. if (s->incnt + len > s->inlen)
  469. return 2;
  470. if (s->outcnt + len > s->outlen)
  471. return 1;
  472. for (; len--; s->outcnt++, s->incnt++) {
  473. if (s->in[s->incnt])
  474. s->out[s->outcnt] = s->in[s->incnt];
  475. }
  476. return 0;
  477. }
  478. struct puff_huffman {
  479. short* count;
  480. short* symbol;
  481. };
  482. static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
  483. {
  484. int first = 0;
  485. int index = 0;
  486. int bitbuf = s->bitbuf;
  487. int left = s->bitcnt;
  488. int code = first = index = 0;
  489. int len = 1;
  490. short* next = h->count + 1;
  491. while (1) {
  492. while (left--) {
  493. code |= bitbuf & 1;
  494. bitbuf >>= 1;
  495. int count = *next++;
  496. if (code - count < first) {
  497. s->bitbuf = bitbuf;
  498. s->bitcnt = (s->bitcnt - len) & 7;
  499. return h->symbol[index + (code - first)];
  500. }
  501. index += count;
  502. first += count;
  503. first <<= 1;
  504. code <<= 1;
  505. len++;
  506. }
  507. left = (MAXBITS + 1) - len;
  508. if (left == 0)
  509. break;
  510. if (s->incnt == s->inlen)
  511. longjmp(s->env, 1);
  512. bitbuf = s->in[s->incnt++];
  513. if (left > 8)
  514. left = 8;
  515. }
  516. return -10;
  517. }
  518. static int puff_construct(struct puff_huffman* h, const short* length, int n)
  519. {
  520. int len;
  521. for (len = 0; len <= MAXBITS; len++)
  522. h->count[len] = 0;
  523. int symbol;
  524. for (symbol = 0; symbol < n; symbol++)
  525. (h->count[length[symbol]])++;
  526. if (h->count[0] == n)
  527. return 0;
  528. int left = 1;
  529. for (len = 1; len <= MAXBITS; len++) {
  530. left <<= 1;
  531. left -= h->count[len];
  532. if (left < 0)
  533. return left;
  534. }
  535. short offs[MAXBITS + 1];
  536. offs[1] = 0;
  537. for (len = 1; len < MAXBITS; len++)
  538. offs[len + 1] = offs[len] + h->count[len];
  539. for (symbol = 0; symbol < n; symbol++)
  540. if (length[symbol] != 0)
  541. h->symbol[offs[length[symbol]]++] = symbol;
  542. return left;
  543. }
  544. static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode,
  545. const struct puff_huffman* distcode)
  546. {
  547. static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13,
  548. 15, 17, 19, 23, 27, 31, 35, 43, 51, 59,
  549. 67, 83, 99, 115, 131, 163, 195, 227, 258};
  550. static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2,
  551. 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
  552. static const short dists[30] = {
  553. 1, 2, 3, 4, 5, 7, 9, 13, 17, 25,
  554. 33, 49, 65, 97, 129, 193, 257, 385, 513, 769,
  555. 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577};
  556. static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3,
  557. 4, 4, 5, 5, 6, 6, 7, 7, 8, 8,
  558. 9, 9, 10, 10, 11, 11, 12, 12, 13, 13};
  559. int symbol;
  560. do {
  561. symbol = puff_decode(s, lencode);
  562. if (symbol < 0)
  563. return symbol;
  564. if (symbol < 256) {
  565. if (s->outcnt == s->outlen)
  566. return 1;
  567. if (symbol)
  568. s->out[s->outcnt] = symbol;
  569. s->outcnt++;
  570. } else if (symbol > 256) {
  571. symbol -= 257;
  572. if (symbol >= 29)
  573. return -10;
  574. int len = lens[symbol] + puff_bits(s, lext[symbol]);
  575. symbol = puff_decode(s, distcode);
  576. if (symbol < 0)
  577. return symbol;
  578. unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
  579. if (dist > s->outcnt)
  580. return -11;
  581. if (s->outcnt + len > s->outlen)
  582. return 1;
  583. while (len--) {
  584. if (dist <= s->outcnt && s->out[s->outcnt - dist])
  585. s->out[s->outcnt] = s->out[s->outcnt - dist];
  586. s->outcnt++;
  587. }
  588. }
  589. } while (symbol != 256);
  590. return 0;
  591. }
  592. static int puff_fixed(struct puff_state* s)
  593. {
  594. static int virgin = 1;
  595. static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
  596. static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
  597. static struct puff_huffman lencode, distcode;
  598. if (virgin) {
  599. lencode.count = lencnt;
  600. lencode.symbol = lensym;
  601. distcode.count = distcnt;
  602. distcode.symbol = distsym;
  603. short lengths[FIXLCODES];
  604. int symbol;
  605. for (symbol = 0; symbol < 144; symbol++)
  606. lengths[symbol] = 8;
  607. for (; symbol < 256; symbol++)
  608. lengths[symbol] = 9;
  609. for (; symbol < 280; symbol++)
  610. lengths[symbol] = 7;
  611. for (; symbol < FIXLCODES; symbol++)
  612. lengths[symbol] = 8;
  613. puff_construct(&lencode, lengths, FIXLCODES);
  614. for (symbol = 0; symbol < MAXDCODES; symbol++)
  615. lengths[symbol] = 5;
  616. puff_construct(&distcode, lengths, MAXDCODES);
  617. virgin = 0;
  618. }
  619. return puff_codes(s, &lencode, &distcode);
  620. }
  621. static int puff_dynamic(struct puff_state* s)
  622. {
  623. static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5,
  624. 11, 4, 12, 3, 13, 2, 14, 1, 15};
  625. int nlen = puff_bits(s, 5) + 257;
  626. int ndist = puff_bits(s, 5) + 1;
  627. int ncode = puff_bits(s, 4) + 4;
  628. if (nlen > MAXLCODES || ndist > MAXDCODES)
  629. return -3;
  630. short lengths[MAXCODES];
  631. int index;
  632. for (index = 0; index < ncode; index++)
  633. lengths[order[index]] = puff_bits(s, 3);
  634. for (; index < 19; index++)
  635. lengths[order[index]] = 0;
  636. short lencnt[MAXBITS + 1], lensym[MAXLCODES];
  637. struct puff_huffman lencode = {lencnt, lensym};
  638. int err = puff_construct(&lencode, lengths, 19);
  639. if (err != 0)
  640. return -4;
  641. index = 0;
  642. while (index < nlen + ndist) {
  643. int symbol;
  644. int len;
  645. symbol = puff_decode(s, &lencode);
  646. if (symbol < 0)
  647. return symbol;
  648. if (symbol < 16)
  649. lengths[index++] = symbol;
  650. else {
  651. len = 0;
  652. if (symbol == 16) {
  653. if (index == 0)
  654. return -5;
  655. len = lengths[index - 1];
  656. symbol = 3 + puff_bits(s, 2);
  657. } else if (symbol == 17)
  658. symbol = 3 + puff_bits(s, 3);
  659. else
  660. symbol = 11 + puff_bits(s, 7);
  661. if (index + symbol > nlen + ndist)
  662. return -6;
  663. while (symbol--)
  664. lengths[index++] = len;
  665. }
  666. }
  667. if (lengths[256] == 0)
  668. return -9;
  669. err = puff_construct(&lencode, lengths, nlen);
  670. if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
  671. return -7;
  672. short distcnt[MAXBITS + 1], distsym[MAXDCODES];
  673. struct puff_huffman distcode = {distcnt, distsym};
  674. err = puff_construct(&distcode, lengths + nlen, ndist);
  675. if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
  676. return -8;
  677. return puff_codes(s, &lencode, &distcode);
  678. }
  679. static int puff(unsigned char* dest, unsigned long* destlen,
  680. const unsigned char* source, unsigned long sourcelen)
  681. {
  682. struct puff_state s = {
  683. .out = dest,
  684. .outlen = *destlen,
  685. .outcnt = 0,
  686. .in = source,
  687. .inlen = sourcelen,
  688. .incnt = 0,
  689. .bitbuf = 0,
  690. .bitcnt = 0,
  691. };
  692. int err;
  693. if (setjmp(s.env) != 0)
  694. err = 2;
  695. else {
  696. int last;
  697. do {
  698. last = puff_bits(&s, 1);
  699. int type = puff_bits(&s, 2);
  700. err = type == 0 ? puff_stored(&s)
  701. : (type == 1 ? puff_fixed(&s)
  702. : (type == 2 ? puff_dynamic(&s) : -1));
  703. if (err != 0)
  704. break;
  705. } while (!last);
  706. }
  707. *destlen = s.outcnt;
  708. return err;
  709. }
  710.  
  711. //% END CODE DERIVED FROM puff.{c,h}
  712.  
  713. #define ZLIB_HEADER_WIDTH 2
  714.  
  715. static int puff_zlib_to_file(const unsigned char* source,
  716. unsigned long sourcelen, int dest_fd)
  717. {
  718. if (sourcelen < ZLIB_HEADER_WIDTH)
  719. return 0;
  720. source += ZLIB_HEADER_WIDTH;
  721. sourcelen -= ZLIB_HEADER_WIDTH;
  722. const unsigned long max_destlen = 132 << 20;
  723. void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ,
  724. MAP_PRIVATE | MAP_ANON, -1, 0);
  725. if (ret == MAP_FAILED)
  726. return -1;
  727. unsigned char* dest = (unsigned char*)ret;
  728. unsigned long destlen = max_destlen;
  729. int err = puff(dest, &destlen, source, sourcelen);
  730. if (err) {
  731. munmap(dest, max_destlen);
  732. errno = -err;
  733. return -1;
  734. }
  735. if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
  736. munmap(dest, max_destlen);
  737. return -1;
  738. }
  739. return munmap(dest, max_destlen);
  740. }
  741.  
  742. static int setup_loop_device(unsigned char* data, unsigned long size,
  743. const char* loopname, int* loopfd_p)
  744. {
  745. int err = 0, loopfd = -1;
  746. int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
  747. if (memfd == -1) {
  748. err = errno;
  749. goto error;
  750. }
  751. if (puff_zlib_to_file(data, size, memfd)) {
  752. err = errno;
  753. goto error_close_memfd;
  754. }
  755. loopfd = open(loopname, O_RDWR);
  756. if (loopfd == -1) {
  757. err = errno;
  758. goto error_close_memfd;
  759. }
  760. if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
  761. if (errno != EBUSY) {
  762. err = errno;
  763. goto error_close_loop;
  764. }
  765. ioctl(loopfd, LOOP_CLR_FD, 0);
  766. usleep(1000);
  767. if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
  768. err = errno;
  769. goto error_close_loop;
  770. }
  771. }
  772. close(memfd);
  773. *loopfd_p = loopfd;
  774. return 0;
  775.  
  776. error_close_loop:
  777. close(loopfd);
  778. error_close_memfd:
  779. close(memfd);
  780. error:
  781. errno = err;
  782. return -1;
  783. }
  784.  
  785. static void reset_loop_device(const char* loopname)
  786. {
  787. int loopfd = open(loopname, O_RDWR);
  788. if (loopfd == -1) {
  789. return;
  790. }
  791. if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
  792. }
  793. close(loopfd);
  794. }
  795.  
  796. static long syz_mount_image(volatile long fsarg, volatile long dir,
  797. volatile long flags, volatile long optsarg,
  798. volatile long change_dir,
  799. volatile unsigned long size, volatile long image)
  800. {
  801. unsigned char* data = (unsigned char*)image;
  802. int res = -1, err = 0, need_loop_device = !!size;
  803. char* mount_opts = (char*)optsarg;
  804. char* target = (char*)dir;
  805. char* fs = (char*)fsarg;
  806. char* source = NULL;
  807. char loopname[64];
  808. if (need_loop_device) {
  809. int loopfd;
  810. memset(loopname, 0, sizeof(loopname));
  811. snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
  812. if (setup_loop_device(data, size, loopname, &loopfd) == -1)
  813. return -1;
  814. close(loopfd);
  815. source = loopname;
  816. }
  817. mkdir(target, 0777);
  818. char opts[256];
  819. memset(opts, 0, sizeof(opts));
  820. if (strlen(mount_opts) > (sizeof(opts) - 32)) {
  821. }
  822. strncpy(opts, mount_opts, sizeof(opts) - 32);
  823. if (strcmp(fs, "iso9660") == 0) {
  824. flags |= MS_RDONLY;
  825. } else if (strncmp(fs, "ext", 3) == 0) {
  826. bool has_remount_ro = false;
  827. char* remount_ro_start = strstr(opts, "errors=remount-ro");
  828. if (remount_ro_start != NULL) {
  829. char after = *(remount_ro_start + strlen("errors=remount-ro"));
  830. char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
  831. has_remount_ro = ((before == '\0' || before == ',') &&
  832. (after == '\0' || after == ','));
  833. }
  834. if (strstr(opts, "errors=panic") || !has_remount_ro)
  835. strcat(opts, ",errors=continue");
  836. } else if (strcmp(fs, "xfs") == 0) {
  837. strcat(opts, ",nouuid");
  838. }
  839. res = mount(source, target, fs, flags, opts);
  840. if (res == -1) {
  841. err = errno;
  842. goto error_clear_loop;
  843. }
  844. res = open(target, O_RDONLY | O_DIRECTORY);
  845. if (res == -1) {
  846. err = errno;
  847. goto error_clear_loop;
  848. }
  849. if (change_dir) {
  850. res = chdir(target);
  851. if (res == -1) {
  852. err = errno;
  853. }
  854. }
  855.  
  856. error_clear_loop:
  857. if (need_loop_device)
  858. reset_loop_device(loopname);
  859. errno = err;
  860. return res;
  861. }
  862.  
  863. uint64_t r[83] = {0x0,
  864. 0xffffffffffffffff,
  865. 0xffffffffffffffff,
  866. 0xffffffffffffffff,
  867. 0xffffffffffffffff,
  868. 0xffffffffffffffff,
  869. 0x0,
  870. 0xffffffffffffffff,
  871. 0xffffffffffffffff,
  872. 0xffffffffffffffff,
  873. 0xffffffffffffffff,
  874. 0xffffffffffffffff,
  875. 0xffffffffffffffff,
  876. 0xffffffffffffffff,
  877. 0xffffffffffffffff,
  878. 0x0,
  879. 0xffffffffffffffff,
  880. 0xffffffffffffffff,
  881. 0x0,
  882. 0xffffffffffffffff,
  883. 0xffffffffffffffff,
  884. 0xffffffffffffffff,
  885. 0xffffffffffffffff,
  886. 0xffffffffffffffff,
  887. 0xffffffffffffffff,
  888. 0xffffffffffffffff,
  889. 0xffffffffffffffff,
  890. 0x0,
  891. 0x0,
  892. 0x0,
  893. 0xffffffffffffffff,
  894. 0xffffffffffffffff,
  895. 0xffffffffffffffff,
  896. 0xffffffffffffffff,
  897. 0xffffffffffffffff,
  898. 0xffffffffffffffff,
  899. 0xffffffffffffffff,
  900. 0xffffffffffffffff,
  901. 0xffffffffffffffff,
  902. 0xffffffffffffffff,
  903. 0xffffffffffffffff,
  904. 0xffffffffffffffff,
  905. 0xffffffffffffffff,
  906. 0xffffffffffffffff,
  907. 0xffffffffffffffff,
  908. 0xffffffffffffffff,
  909. 0xffffffffffffffff,
  910. 0xffffffffffffffff,
  911. 0xffffffffffffffff,
  912. 0xffffffffffffffff,
  913. 0xffffffffffffffff,
  914. 0xffffffffffffffff,
  915. 0xffffffffffffffff,
  916. 0xffffffffffffffff,
  917. 0x0,
  918. 0xffffffffffffffff,
  919. 0xffffffffffffffff,
  920. 0xffffffffffffffff,
  921. 0xffffffffffffffff,
  922. 0xffffffffffffffff,
  923. 0x0,
  924. 0xffffffffffffffff,
  925. 0xffffffffffffffff,
  926. 0xffffffffffffffff,
  927. 0xffffffffffffffff,
  928. 0xffffffffffffffff,
  929. 0xffffffffffffffff,
  930. 0xffffffffffffffff,
  931. 0x0,
  932. 0xffffffffffffffff,
  933. 0xffffffffffffffff,
  934. 0x0,
  935. 0xffffffffffffffff,
  936. 0xffffffffffffffff,
  937. 0xffffffffffffffff,
  938. 0xffffffffffffffff,
  939. 0x0,
  940. 0xffffffffffffffff,
  941. 0xffffffffffffffff,
  942. 0xffffffffffffffff,
  943. 0xffffffffffffffff,
  944. 0xffffffffffffffff,
  945. 0xffffffffffffffff};
  946.  
  947. int main(void)
  948. {
  949. syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
  950. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  951. /*offset=*/0ul);
  952. syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
  953. /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
  954. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  955. /*offset=*/0ul);
  956. syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
  957. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  958. /*offset=*/0ul);
  959. const char* reason;
  960. (void)reason;
  961. intptr_t res = 0;
  962. if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  963. }
  964. res =
  965. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x8903, /*arg=*/0x200000000140ul);
  966. if (res != -1)
  967. r[0] = *(uint32_t*)0x200000000140;
  968. *(uint32_t*)0x200000000000 = 2;
  969. *(uint32_t*)0x200000000004 = 0x80;
  970. *(uint8_t*)0x200000000008 = 0xb9;
  971. *(uint8_t*)0x200000000009 = 0;
  972. *(uint8_t*)0x20000000000a = 0;
  973. *(uint8_t*)0x20000000000b = 0;
  974. *(uint32_t*)0x20000000000c = 0;
  975. *(uint64_t*)0x200000000010 = 0;
  976. *(uint64_t*)0x200000000018 = 0x302;
  977. *(uint64_t*)0x200000000020 = 0;
  978. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 0, 1);
  979. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 1, 1);
  980. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 2, 1);
  981. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 3, 1);
  982. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 4, 1);
  983. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 5, 1);
  984. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 6, 1);
  985. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 7, 1);
  986. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 8, 1);
  987. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 9, 1);
  988. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 10, 1);
  989. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 11, 1);
  990. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 12, 1);
  991. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 13, 1);
  992. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 14, 1);
  993. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 15, 2);
  994. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 17, 1);
  995. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 18, 1);
  996. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 19, 1);
  997. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 20, 1);
  998. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 21, 1);
  999. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 22, 1);
  1000. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 23, 1);
  1001. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 24, 1);
  1002. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 25, 1);
  1003. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 26, 1);
  1004. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 27, 1);
  1005. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 28, 1);
  1006. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 29, 1);
  1007. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 30, 1);
  1008. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 31, 1);
  1009. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 32, 1);
  1010. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 33, 1);
  1011. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 34, 1);
  1012. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 35, 1);
  1013. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 36, 1);
  1014. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 37, 1);
  1015. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 38, 26);
  1016. *(uint32_t*)0x200000000030 = 0;
  1017. *(uint32_t*)0x200000000034 = 0;
  1018. *(uint64_t*)0x200000000038 = 0;
  1019. *(uint64_t*)0x200000000040 = 0;
  1020. *(uint64_t*)0x200000000048 = 0;
  1021. *(uint64_t*)0x200000000050 = 0;
  1022. *(uint32_t*)0x200000000058 = 0;
  1023. *(uint32_t*)0x20000000005c = 0;
  1024. *(uint64_t*)0x200000000060 = 0;
  1025. *(uint32_t*)0x200000000068 = 0;
  1026. *(uint16_t*)0x20000000006c = 0;
  1027. *(uint16_t*)0x20000000006e = 0;
  1028. *(uint32_t*)0x200000000070 = 0;
  1029. *(uint32_t*)0x200000000074 = 0;
  1030. *(uint64_t*)0x200000000078 = 0;
  1031. res = syscall(__NR_perf_event_open, /*attr=*/0x200000000000ul, /*pid=*/r[0],
  1032. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  1033. if (res != -1)
  1034. r[1] = res;
  1035. *(uint32_t*)0x2000000011c0 = 0;
  1036. *(uint32_t*)0x2000000011c4 = 0;
  1037. *(uint32_t*)0x2000000011c8 = 0;
  1038. *(uint32_t*)0x2000000011cc = 0;
  1039. *(uint32_t*)0x2000000011d0 = 0;
  1040. *(uint32_t*)0x2000000011d4 = 0;
  1041. syscall(__NR_getgroups, /*size=*/6ul, /*list=*/0x2000000011c0ul);
  1042. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_CLOEXEC*/ 0x80000ul,
  1043. /*proto=*/4);
  1044. if (res != -1)
  1045. r[2] = res;
  1046. *(uint32_t*)0x200000000100 = 0;
  1047. syscall(__NR_setsockopt, /*fd=*/r[2], /*level=*/0x29,
  1048. /*optname=IPV6_MULTICAST_HOPS*/ 0x12, /*optval=*/0x200000000100ul,
  1049. /*optlen=*/3ul);
  1050. syscall(__NR_setreuid, /*ruid=*/0, /*euid=*/0xee00);
  1051. res = syscall(__NR_epoll_create1, /*flags=*/0ul);
  1052. if (res != -1)
  1053. r[3] = res;
  1054. *(uint32_t*)0x20000025c000 = 2;
  1055. *(uint32_t*)0x20000025c004 = 0x80;
  1056. *(uint8_t*)0x20000025c008 = 0x15;
  1057. *(uint8_t*)0x20000025c009 = 1;
  1058. *(uint8_t*)0x20000025c00a = 0;
  1059. *(uint8_t*)0x20000025c00b = 6;
  1060. *(uint32_t*)0x20000025c00c = 0;
  1061. *(uint64_t*)0x20000025c010 = 1;
  1062. *(uint64_t*)0x20000025c018 = 0;
  1063. *(uint64_t*)0x20000025c020 = 0;
  1064. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 0, 1);
  1065. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 1, 1);
  1066. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 2, 1);
  1067. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 3, 1);
  1068. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 4, 1);
  1069. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 5, 1);
  1070. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 6, 1);
  1071. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 7, 1);
  1072. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 8, 1);
  1073. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 9, 1);
  1074. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 10, 1);
  1075. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 11, 1);
  1076. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 12, 1);
  1077. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 13, 1);
  1078. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 14, 1);
  1079. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 15, 2);
  1080. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 17, 1);
  1081. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 18, 1);
  1082. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 19, 1);
  1083. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 20, 1);
  1084. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 21, 1);
  1085. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 22, 1);
  1086. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 23, 1);
  1087. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 24, 1);
  1088. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 25, 1);
  1089. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 26, 1);
  1090. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 27, 1);
  1091. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 28, 1);
  1092. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 29, 1);
  1093. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 30, 1);
  1094. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 31, 1);
  1095. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 32, 1);
  1096. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 33, 1);
  1097. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 34, 1);
  1098. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0x8000, 35, 1);
  1099. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 36, 1);
  1100. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 37, 1);
  1101. STORE_BY_BITMASK(uint64_t, , 0x20000025c028, 0, 38, 26);
  1102. *(uint32_t*)0x20000025c030 = 0;
  1103. *(uint32_t*)0x20000025c034 = 2;
  1104. *(uint64_t*)0x20000025c038 = 0xfff;
  1105. *(uint64_t*)0x20000025c040 = 0;
  1106. *(uint64_t*)0x20000025c048 = 0;
  1107. *(uint64_t*)0x20000025c050 = 0;
  1108. *(uint32_t*)0x20000025c058 = 0x2000000;
  1109. *(uint32_t*)0x20000025c05c = 0;
  1110. *(uint64_t*)0x20000025c060 = 0;
  1111. *(uint32_t*)0x20000025c068 = 0;
  1112. *(uint16_t*)0x20000025c06c = 0;
  1113. *(uint16_t*)0x20000025c06e = 0;
  1114. *(uint32_t*)0x20000025c070 = 0;
  1115. *(uint32_t*)0x20000025c074 = 0;
  1116. *(uint64_t*)0x20000025c078 = 0x1000000000000000;
  1117. res = syscall(__NR_perf_event_open, /*attr=*/0x20000025c000ul, /*pid=*/0,
  1118. /*cpu=*/0ul, /*group=*/r[1], /*flags=*/0ul);
  1119. if (res != -1)
  1120. r[4] = res;
  1121. *(uint32_t*)0x20000001d000 = 1;
  1122. *(uint32_t*)0x20000001d004 = 0x80;
  1123. *(uint8_t*)0x20000001d008 = 0x10;
  1124. *(uint8_t*)0x20000001d009 = 0x40;
  1125. *(uint8_t*)0x20000001d00a = 0;
  1126. *(uint8_t*)0x20000001d00b = 0;
  1127. *(uint32_t*)0x20000001d00c = 0;
  1128. *(uint64_t*)0x20000001d010 = 0;
  1129. *(uint64_t*)0x20000001d018 = 2;
  1130. *(uint64_t*)0x20000001d020 = 0;
  1131. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 0, 1);
  1132. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 1, 1);
  1133. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 2, 1);
  1134. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 3, 1);
  1135. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 4, 1);
  1136. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 5, 1);
  1137. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 6, 1);
  1138. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 7, 1);
  1139. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 8, 1);
  1140. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 9, 1);
  1141. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 10, 1);
  1142. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 11, 1);
  1143. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 12, 1);
  1144. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 13, 1);
  1145. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 14, 1);
  1146. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 15, 2);
  1147. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 17, 1);
  1148. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 18, 1);
  1149. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 19, 1);
  1150. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 20, 1);
  1151. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 21, 1);
  1152. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 22, 1);
  1153. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 23, 1);
  1154. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 24, 1);
  1155. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 25, 1);
  1156. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 26, 1);
  1157. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 27, 1);
  1158. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 28, 1);
  1159. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 29, 1);
  1160. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 30, 1);
  1161. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 31, 1);
  1162. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 32, 1);
  1163. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 33, 1);
  1164. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 34, 1);
  1165. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 35, 1);
  1166. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 36, 1);
  1167. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 37, 1);
  1168. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 38, 26);
  1169. *(uint32_t*)0x20000001d030 = 0;
  1170. *(uint32_t*)0x20000001d034 = 0;
  1171. *(uint64_t*)0x20000001d038 = 0x200000000000;
  1172. *(uint64_t*)0x20000001d040 = 2;
  1173. *(uint64_t*)0x20000001d048 = 0;
  1174. *(uint64_t*)0x20000001d050 = 0;
  1175. *(uint32_t*)0x20000001d058 = 0;
  1176. *(uint32_t*)0x20000001d05c = 2;
  1177. *(uint64_t*)0x20000001d060 = 0;
  1178. *(uint32_t*)0x20000001d068 = 0;
  1179. *(uint16_t*)0x20000001d06c = 0;
  1180. *(uint16_t*)0x20000001d06e = 0;
  1181. *(uint32_t*)0x20000001d070 = 0;
  1182. *(uint32_t*)0x20000001d074 = 0;
  1183. *(uint64_t*)0x20000001d078 = 0;
  1184. res = syscall(__NR_perf_event_open, /*attr=*/0x20000001d000ul, /*pid=*/r[0],
  1185. /*cpu=*/-1, /*group=*/-1, /*flags=PERF_FLAG_FD_NO_GROUP*/ 1ul);
  1186. if (res != -1)
  1187. r[5] = res;
  1188. syscall(__NR_mmap, /*addr=*/0x200000ffc000ul, /*len=*/0x3000ul,
  1189. /*prot=PROT_GROWSUP*/ 0x2000000ul,
  1190. /*flags=MAP_UNINITIALIZED|MAP_FIXED*/ 0x4000010ul, /*fd=*/r[5],
  1191. /*offset=*/0ul);
  1192. syscall(__NR_ioctl, /*fd=*/r[4], /*cmd=*/0x2405, /*other=*/r[5]);
  1193. *(uint32_t*)0x200000000100 = 1;
  1194. *(uint32_t*)0x200000000104 = 0x80;
  1195. *(uint8_t*)0x200000000108 = 0;
  1196. *(uint8_t*)0x200000000109 = 0x10;
  1197. *(uint8_t*)0x20000000010a = 0;
  1198. *(uint8_t*)0x20000000010b = 0;
  1199. *(uint32_t*)0x20000000010c = 0;
  1200. *(uint64_t*)0x200000000110 = 7;
  1201. *(uint64_t*)0x200000000118 = 0;
  1202. *(uint64_t*)0x200000000120 = 0;
  1203. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 0, 1);
  1204. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 1, 1);
  1205. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 2, 1);
  1206. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 3, 1);
  1207. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 4, 1);
  1208. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 5, 1);
  1209. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 6, 1);
  1210. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 7, 1);
  1211. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 8, 1);
  1212. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 9, 1);
  1213. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 10, 1);
  1214. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 11, 1);
  1215. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 12, 1);
  1216. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 13, 1);
  1217. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 14, 1);
  1218. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 15, 2);
  1219. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 17, 1);
  1220. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 18, 1);
  1221. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 19, 1);
  1222. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 20, 1);
  1223. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 21, 1);
  1224. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 22, 1);
  1225. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 23, 1);
  1226. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 24, 1);
  1227. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 25, 1);
  1228. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 26, 1);
  1229. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 27, 1);
  1230. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 28, 1);
  1231. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 29, 1);
  1232. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 30, 1);
  1233. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 31, 1);
  1234. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 32, 1);
  1235. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 33, 1);
  1236. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 34, 1);
  1237. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 35, 1);
  1238. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 36, 1);
  1239. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 37, 1);
  1240. STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 38, 26);
  1241. *(uint32_t*)0x200000000130 = 0;
  1242. *(uint32_t*)0x200000000134 = 0;
  1243. *(uint64_t*)0x200000000138 = 0x200000000000;
  1244. *(uint64_t*)0x200000000140 = 0;
  1245. *(uint64_t*)0x200000000148 = 0x10;
  1246. *(uint64_t*)0x200000000150 = 0;
  1247. *(uint32_t*)0x200000000158 = 0;
  1248. *(uint32_t*)0x20000000015c = 0;
  1249. *(uint64_t*)0x200000000160 = 0;
  1250. *(uint32_t*)0x200000000168 = 0;
  1251. *(uint16_t*)0x20000000016c = 0;
  1252. *(uint16_t*)0x20000000016e = 0;
  1253. *(uint32_t*)0x200000000170 = 0;
  1254. *(uint32_t*)0x200000000174 = 0;
  1255. *(uint64_t*)0x200000000178 = 0;
  1256. syscall(__NR_perf_event_open, /*attr=*/0x200000000100ul, /*pid=*/0,
  1257. /*cpu=*/-1, /*group=*/-1, /*flags=*/0ul);
  1258. syscall(
  1259. __NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xff5000ul, /*prot=*/0ul,
  1260. /*flags=MAP_POPULATE|MAP_NORESERVE|MAP_NONBLOCK|MAP_HUGETLB|MAP_FIXED|0x2000000000821*/
  1261. 0x200000005c831ul, /*fd=*/-1, /*offset=*/0ul);
  1262. syscall(__NR_mprotect, /*addr=*/0x200000000000ul, /*len=*/0x800000ul,
  1263. /*prot=PROT_SEM|PROT_WRITE*/ 0xaul);
  1264. *(uint64_t*)0x2000000000c0 = 0;
  1265. *(uint32_t*)0x2000000000c8 = 0x12;
  1266. *(uint32_t*)0x2000000000cc = 0;
  1267. *(uint64_t*)0x2000000000d0 = 0;
  1268. *(uint64_t*)0x2000000000d8 = 0;
  1269. syscall(__NR_timer_create, /*id=*/0ul, /*ev=*/0x2000000000c0ul,
  1270. /*timerid=*/0x200000000080ul);
  1271. *(uint64_t*)0x200000000000 = 0;
  1272. *(uint32_t*)0x200000000008 = 0x14;
  1273. *(uint32_t*)0x20000000000c = 0;
  1274. *(uint64_t*)0x200000000010 = 0;
  1275. *(uint64_t*)0x200000000018 = 0;
  1276. res = syscall(__NR_timer_create, /*id=*/0ul, /*ev=*/0x200000000000ul,
  1277. /*timerid=*/0x200000000200ul);
  1278. if (res != -1)
  1279. r[6] = *(uint32_t*)0x200000000200;
  1280. *(uint64_t*)0x200000000180 = 0;
  1281. *(uint64_t*)0x200000000188 = 0;
  1282. *(uint64_t*)0x200000000190 = 0;
  1283. *(uint64_t*)0x200000000198 = 0x1c9c380;
  1284. syscall(__NR_timer_settime, /*timerid=*/0, /*flags=TIMER_ABSTIME*/ 1ul,
  1285. /*new=*/0x200000000180ul, /*old=*/0ul);
  1286. *(uint64_t*)0x200000000140 = 0;
  1287. *(uint64_t*)0x200000000148 = 0x989680;
  1288. *(uint64_t*)0x200000000150 = 0;
  1289. *(uint64_t*)0x200000000158 = 0x1c9c380;
  1290. syscall(__NR_timer_settime, /*timerid=*/r[6], /*flags=*/0ul,
  1291. /*new=*/0x200000000140ul, /*old=*/0ul);
  1292. *(uint32_t*)0x200000000240 = 1;
  1293. syscall(__NR_futex, /*addr=*/0x200000000240ul, /*op=FUTEX_LOCK_PI*/ 6ul,
  1294. /*val=*/0, /*timeout=*/0ul, /*addr2=*/0ul, /*val3=*/0);
  1295. syscall(__NR_openat, /*fd=*/-1, /*file=*/0ul, /*flags=*/0, /*mode=*/0);
  1296. syscall(__NR_getpid);
  1297. syscall(__NR_timer_gettime, /*timerid=*/r[6], /*setting=*/0ul);
  1298. *(uint64_t*)0x200000000100 = 0;
  1299. memcpy((void*)0x200000000108,
  1300. "\x3c\xc0\x9b\x27\xb1\xbc\x34\x4e\x52\x71\x28\xf0\x68\xfc\x41\x3e",
  1301. 16);
  1302. *(uint64_t*)0x200000000118 = 0;
  1303. *(uint64_t*)0x200000000120 = 0;
  1304. memset((void*)0x200000000128, 0, 3032);
  1305. memset((void*)0x200000000d00, 0, 1024);
  1306. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0xd000941e, /*arg=*/0x200000000100ul);
  1307. memcpy((void*)0x200000000040, "/sys/kernel/oops_count", 22);
  1308. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  1309. /*dir=*/0x200000000040ul, /*flags=*/0, /*mode=*/0);
  1310. if (res != -1)
  1311. r[7] = res;
  1312. *(uint32_t*)0x200000000080 = 0;
  1313. *(uint64_t*)0x200000000084 = 0;
  1314. syscall(__NR_epoll_ctl, /*epfd=*/r[3], /*op=*/1ul, /*fd=*/r[7],
  1315. /*ev=*/0x200000000080ul);
  1316. memcpy((void*)0x2000000000c0, "&\000", 2);
  1317. *(uint64_t*)0x200000000180 = 0x1ff;
  1318. *(uint64_t*)0x200000000188 = 1;
  1319. *(uint64_t*)0x200000000190 = 0xffffefff;
  1320. *(uint64_t*)0x200000000198 = 0x66;
  1321. memset((void*)0x2000000001a0, 0, 32);
  1322. syscall(__NR_mq_open, /*name=*/0x2000000000c0ul, /*flags=O_RDWR*/ 2ul,
  1323. /*mode=S_IXGRP|S_IWGRP|S_IRGRP*/ 0x38ul, /*attr=*/0x200000000180ul);
  1324. *(uint64_t*)0x200000000180 = 0x200000000080;
  1325. memcpy((void*)0x200000000080,
  1326. "\x39\x00\x00\x00\x13\x00\x03\x47\x00\xbb\x65\xe1\xc3\xe4\xff\xff\x01"
  1327. "\x00\x00\x00\x01",
  1328. 21);
  1329. *(uint64_t*)0x200000000188 = 0x15;
  1330. syscall(__NR_writev, /*fd=*/-1, /*vec=*/0x200000000180ul, /*vlen=*/1ul);
  1331. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_DGRAM*/ 2ul,
  1332. /*proto=*/0);
  1333. if (res != -1)
  1334. r[8] = res;
  1335. syscall(__NR_setsockopt, /*fd=*/r[8], /*level=*/0x29, /*optname=*/0x14,
  1336. /*optval=*/0ul, /*optlen=*/0x46ul);
  1337. syscall(__NR_socket, /*domain=AF_NETLINK*/ 0x10ul, /*type=SOCK_RAW*/ 3ul,
  1338. /*proto=*/0x1f);
  1339. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/0);
  1340. memcpy((void*)0x200000000200, "./bus\000", 6);
  1341. res = syscall(__NR_creat, /*file=*/0x200000000200ul, /*mode=*/0ul);
  1342. if (res != -1)
  1343. r[9] = res;
  1344. memcpy((void*)0x200000000040, "./bus\000", 6);
  1345. res = syscall(__NR_creat, /*file=*/0x200000000040ul, /*mode=*/0ul);
  1346. if (res != -1)
  1347. r[10] = res;
  1348. memcpy((void*)0x200000000000, "/dev/loop#\000", 11);
  1349. res = -1;
  1350. res = syz_open_dev(/*dev=*/0x200000000000, /*id=*/0x100, /*flags=*/0);
  1351. if (res != -1)
  1352. r[11] = res;
  1353. syscall(__NR_ioctl, /*fd=*/r[11], /*cmd=*/0x1274, /*arg=*/0ul);
  1354. syscall(__NR_fallocate, /*fd=*/r[10], /*mode=FALLOC_FL_KEEP_SIZE*/ 1ul,
  1355. /*off=*/0ul, /*len=*/0xc000000ul);
  1356. *(uint64_t*)0x200000000500 = 0x200000000580;
  1357. memset((void*)0x200000000580, 153, 1);
  1358. *(uint64_t*)0x200000000508 = 1;
  1359. syscall(__NR_writev, /*fd=*/r[10], /*vec=*/0x200000000500ul, /*vlen=*/1ul);
  1360. syscall(__NR_fallocate, /*fd=*/r[9], /*mode=FALLOC_FL_INSERT_RANGE*/ 0x20ul,
  1361. /*off=*/0ul, /*len=*/0xffff77ff000ul);
  1362. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  1363. memcpy((void*)0x200000000140, "msdos\000", 6);
  1364. memcpy((void*)0x200000000180, "./file0\000", 8);
  1365. memcpy(
  1366. (void*)0x200000000400,
  1367. "\x6e\x6f\x64\x6f\x74\x73\x2c\x66\x6d\x61\x73\x6b\x3d\x30\x30\x30\x30\x30"
  1368. "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x33\x35\x37\x30\x34\x2c"
  1369. "\x64\x6f\x73\x31\x78\x66\x6c\x6f\x70\x70\x79\x2c\x73\x68\x6f\x77\x65\x78"
  1370. "\x65\x63\x2c\x64\x6f\x74\x73\x2c\x64\x6f\x74\x73\x2c\x64\x6f\x74\x73\x2c"
  1371. "\x6e\x6f\x64\x6f\x74\x73\x2c\x71\x75\x69\x65\x74\x2c\x6e\x6f\x64\x6f\x74"
  1372. "\x73\x2c\x6e\x6f\x64\x6f\x74\x73\x2c\x63\x68\x65\x63\x6b\x3d\x72\x65\x6c"
  1373. "\x61\x78\x65\x64\x2c\x64\x6f\x74\x73\x2c\x00\xff\x95\x6c\x49\x5f\x61\x73"
  1374. "\x56\x6d\xd9\x82\x63\xe8\x35\x83\xd4\x80\xb6\x47\xbb\x87\x96\xe2\x79\xc9"
  1375. "\xc7\x2c\x1d\x3d\x86\xa0\xfc\x98\x01\xb6\xdc\xf1\xe9\x90\xe3\x32\xbd\xab"
  1376. "\xca\x6e\x40\x98\x2b\xc1\x74\x1d\xf3\xd7\xf9\xe2\x9e\x68\xbc\x24\x34\xaa"
  1377. "\xa9\xef\x1c\xe1\x40\xd6\xd4\x93\xbc\xa5\x72\x81\x46\x17\x3a\x02\x82\xbf"
  1378. "\xb9\xec\xfb\xac\xa4\x17\x2e\xd7\x75\xf6\xb1\xd8\x8e\x5f\xbd\x09\x1f\xe8"
  1379. "\x52\x16\x22\x1b\xcd\x4a\x9b\x74\x85\xe9\x6e\x88\x06\xb9\xbf\x7f\x2c\xa2"
  1380. "\xdd\x9e\x53\x23\xa6\x54\x8b\xfc\x72\x7c\xab\x84\xac\x98\x87\x5c\x0f\x09"
  1381. "\xec\x6a\xf8\x38\x3c\xbb\x94\x85\x1c\x82\xf6\x0a\x85\x81\x62\x06\x9d\x7e"
  1382. "\xfd\x82\x75\x12\xab\x8a\xfe\xe2\x81\xa3\x77\x0b\x30\x27\xee\x18\x81\xff"
  1383. "\x4f\x98\x3c\x30\x8b\xb8\x4d\xfe\x53\x75\x51\x01\x7d\x0f\x67\xdd\x62\x32"
  1384. "\x72\x57\xf3\x7d\xb9\x7b\xf9\xb3\x0a\xe9\xb4\x50\xa1\x13\xbd\x65\x0e\x87"
  1385. "\x50\xf7\xa0\x3e\x7a\xd2\x86\xca\xe6\x19\xcc\x49\x2f\x47\xce\xe1\xab\x4e"
  1386. "\x9f\xc1\x86\x13\x83\x53\xff\x1e\xb7\xbd\xe0\x53\x9d\x46\x66\x7a\x37\xe0"
  1387. "\x15\x67\xf8\xbe\xbd\xc8\x98\x4e\x9c\x71\x87\x3a\xe6\xcd\xf1\x7e\x9d\x07"
  1388. "\x41\x2d\x5a\xe4\xea\x69\x04\x1f\xea\x25\x84\xb0\xa9\x1c\x43\xcd\xa3\x20"
  1389. "\x54\xf3\xca\x7c\x51\x3a\x55\x99\x62\x07\x9c\x96\xc0\x4c\xc4\xb2\x40\xb8"
  1390. "\x7c\x2d\x35\xe8\x78\x28\x6f\x81\x4f\x2c\x66\x90\x14\x4a\x9a\x07\xfa\xf0"
  1391. "\x29\xf0\xbf\x8e\x62\xff\x93\x0f\xaf\x52\x50\x6a\x0e\xf8\xdd\xc2\xa4\x3d"
  1392. "\x67\x0c\xb7\xe5\x01\x7a\x19\x00",
  1393. 458);
  1394. memcpy(
  1395. (void*)0x200000000200,
  1396. "\x78\x9c\xec\xdb\x31\x4b\x1b\x61\x18\x07\xf0\x27\x69\xda\xa6\xed\x92\xb9"
  1397. "\x74\x38\xe8\xd2\x29\xb4\xa5\x1f\xa0\xa5\x44\x10\x0f\x04\x25\x83\x4e\x0a"
  1398. "\xd1\x25\x11\xc1\x2c\xa7\x53\x3e\x8a\x5f\x50\x90\x4c\xd9\x5e\xd1\xd3\x44"
  1399. "\x43\x32\x38\x24\x07\xe6\xf7\x5b\xee\x0f\x7f\x0e\xde\x67\xb8\x3b\xde\x83"
  1400. "\xf7\xe8\xdb\x59\xbf\x77\x3e\x3c\x1d\xfc\x19\x47\xb3\x56\x8b\xfa\xdf\xc8"
  1401. "\x62\x52\x8b\x56\xd4\xe3\xc9\x28\x00\x80\xb7\x64\x92\x52\xdc\xa6\x94\xd2"
  1402. "\xc7\x51\x7c\xba\x8e\x94\x52\xd5\x2b\x02\x00\x56\xcd\xf7\x1f\x00\x36\xcf"
  1403. "\xfe\xc1\xe1\xce\xbf\x3c\xef\xec\x65\x59\x33\xe2\x66\x54\x74\x8b\x6e\x79"
  1404. "\x2d\xfb\xad\xed\xbc\xf3\x33\x7b\xd0\x9a\xdd\x35\x2e\x8a\xee\xbb\x69\xff"
  1405. "\xab\xec\xb3\x97\xfd\xfb\xf8\xfc\xd8\xff\x5e\xd8\x7f\x88\x1f\xdf\xcb\xfe"
  1406. "\xbe\xfb\xbf\x9b\xcf\xf5\x5f\xa2\xb7\xfa\xf1\x01\x00\x00\x60\x23\xb4\xb3"
  1407. "\xa9\x85\xfb\xfb\x76\x7b\x59\x5f\xa6\x67\xff\x07\xe6\xf6\xef\x8d\xf8\xda"
  1408. "\x58\xdb\x18\x00\xc0\x2b\x0c\x2f\xaf\xfa\xc7\x83\xc1\xc9\x85\x20\x08\xc2"
  1409. "\x34\x54\xfd\x66\x02\x56\x6d\xf6\xd0\x57\xbd\x12\x00\x00\x00\x00\x00\x00"
  1410. "\x00\x00\x00\x00\x00\x60\x99\x75\x1c\x27\xaa\x7a\x46\x00\x00\x00\x00\x00"
  1411. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1412. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36\xcf\x5d\x00"
  1413. "\x00\x00\xff\xff\x0c\x2e\x39\xe7",
  1414. 314);
  1415. syz_mount_image(/*fs=*/0x200000000140, /*dir=*/0x200000000180, /*flags=*/0,
  1416. /*opts=*/0x200000000400, /*chdir=*/1, /*size=*/0x13a,
  1417. /*img=*/0x200000000200);
  1418. memcpy((void*)0x200000000000, "./bus\000", 6);
  1419. res = syscall(
  1420. __NR_open, /*file=*/0x200000000000ul,
  1421. /*flags=O_SYNC|O_NONBLOCK|O_NOATIME|O_LARGEFILE|O_CREAT|0x2*/ 0x149842ul,
  1422. /*mode=*/0ul);
  1423. if (res != -1)
  1424. r[12] = res;
  1425. syscall(__NR_mmap, /*addr=*/0x200000002000ul, /*len=*/0x4000ul, /*prot=*/0ul,
  1426. /*flags=MAP_LOCKED|MAP_FIXED|MAP_DENYWRITE|0x2*/ 0x2812ul,
  1427. /*fd=*/r[12], /*offset=*/0ul);
  1428. memcpy((void*)0x200000000100, "target default\000", 15);
  1429. syscall(__NR_write, /*fd=*/r[12], /*data=*/0x200000000100ul, /*len=*/0xful);
  1430. *(uint32_t*)0x200000000200 = 9;
  1431. *(uint32_t*)0x200000000204 = 0x80;
  1432. *(uint8_t*)0x200000000208 = 0;
  1433. *(uint8_t*)0x200000000209 = 0;
  1434. *(uint8_t*)0x20000000020a = 0;
  1435. *(uint8_t*)0x20000000020b = 0;
  1436. *(uint32_t*)0x20000000020c = 0;
  1437. *(uint64_t*)0x200000000210 = 0;
  1438. *(uint64_t*)0x200000000218 = 0;
  1439. *(uint64_t*)0x200000000220 = 0;
  1440. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 0, 1);
  1441. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 1, 1);
  1442. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 2, 1);
  1443. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 3, 1);
  1444. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 4, 1);
  1445. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 5, 1);
  1446. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 6, 1);
  1447. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 7, 1);
  1448. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 8, 1);
  1449. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 9, 1);
  1450. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 10, 1);
  1451. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 11, 1);
  1452. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 12, 1);
  1453. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 13, 1);
  1454. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 14, 1);
  1455. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 15, 2);
  1456. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 17, 1);
  1457. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 18, 1);
  1458. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 19, 1);
  1459. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 20, 1);
  1460. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 21, 1);
  1461. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 22, 1);
  1462. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 23, 1);
  1463. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 24, 1);
  1464. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 25, 1);
  1465. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 26, 1);
  1466. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 27, 1);
  1467. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 28, 1);
  1468. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 29, 1);
  1469. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 30, 1);
  1470. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 31, 1);
  1471. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 32, 1);
  1472. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 33, 1);
  1473. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 34, 1);
  1474. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 35, 1);
  1475. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 36, 1);
  1476. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 37, 1);
  1477. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 38, 26);
  1478. *(uint32_t*)0x200000000230 = 0;
  1479. *(uint32_t*)0x200000000234 = 0;
  1480. *(uint64_t*)0x200000000238 = 0x200000000000;
  1481. *(uint64_t*)0x200000000240 = 3;
  1482. *(uint64_t*)0x200000000248 = 0;
  1483. *(uint64_t*)0x200000000250 = 0;
  1484. *(uint32_t*)0x200000000258 = 0;
  1485. *(uint32_t*)0x20000000025c = 0;
  1486. *(uint64_t*)0x200000000260 = 0;
  1487. *(uint32_t*)0x200000000268 = 0;
  1488. *(uint16_t*)0x20000000026c = 0;
  1489. *(uint16_t*)0x20000000026e = 0;
  1490. *(uint32_t*)0x200000000270 = 0;
  1491. *(uint32_t*)0x200000000274 = 0;
  1492. *(uint64_t*)0x200000000278 = 0;
  1493. syscall(__NR_perf_event_open, /*attr=*/0x200000000200ul, /*pid=*/0,
  1494. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  1495. syz_open_procfs(/*pid=*/0, /*file=*/0);
  1496. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/0x10001);
  1497. syscall(__NR_memfd_create, /*name=*/0x200000000000ul, /*flags=*/0ul);
  1498. syscall(__NR_madvise, /*addr=*/0x200000559000ul, /*len=*/0x1000ul,
  1499. /*advice=*/0ul);
  1500. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_DGRAM*/ 2ul,
  1501. /*proto=*/0);
  1502. if (res != -1)
  1503. r[13] = res;
  1504. *(uint32_t*)0x200000000280 = 0;
  1505. syscall(__NR_getsockopt, /*fd=*/-1, /*level=*/1, /*optname=*/0x11,
  1506. /*optval=*/0ul, /*optlen=*/0x200000000280ul);
  1507. *(uint8_t*)0x2000000000c0 = -1;
  1508. *(uint8_t*)0x2000000000c1 = 1;
  1509. memset((void*)0x2000000000c2, 0, 13);
  1510. *(uint8_t*)0x2000000000cf = 1;
  1511. *(uint32_t*)0x2000000000d0 = 0x800;
  1512. *(uint8_t*)0x2000000000d4 = 0;
  1513. *(uint8_t*)0x2000000000d5 = 3;
  1514. *(uint16_t*)0x2000000000d6 = 1;
  1515. *(uint16_t*)0x2000000000d8 = 0;
  1516. *(uint16_t*)0x2000000000da = 0;
  1517. *(uint32_t*)0x2000000000dc = 0;
  1518. syscall(__NR_setsockopt, /*fd=*/r[13], /*level=*/0x29, /*optname=*/0x20,
  1519. /*optval=*/0x2000000000c0ul, /*optlen=*/0x20ul);
  1520. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  1521. *(uint32_t*)0x200000000040 = 2;
  1522. *(uint32_t*)0x200000000044 = 0x80;
  1523. *(uint8_t*)0x200000000048 = 0x55;
  1524. *(uint8_t*)0x200000000049 = 1;
  1525. *(uint8_t*)0x20000000004a = 0;
  1526. *(uint8_t*)0x20000000004b = 0;
  1527. *(uint32_t*)0x20000000004c = 0;
  1528. *(uint64_t*)0x200000000050 = 0;
  1529. *(uint64_t*)0x200000000058 = 0;
  1530. *(uint64_t*)0x200000000060 = 0;
  1531. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 0, 1);
  1532. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 1, 1);
  1533. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 2, 1);
  1534. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 3, 1);
  1535. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 4, 1);
  1536. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 5, 1);
  1537. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 6, 1);
  1538. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 7, 1);
  1539. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 8, 1);
  1540. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 9, 1);
  1541. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 10, 1);
  1542. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 11, 1);
  1543. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 12, 1);
  1544. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 13, 1);
  1545. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 14, 1);
  1546. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 15, 2);
  1547. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 17, 1);
  1548. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 18, 1);
  1549. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 19, 1);
  1550. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 20, 1);
  1551. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 21, 1);
  1552. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 22, 1);
  1553. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 23, 1);
  1554. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 24, 1);
  1555. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 25, 1);
  1556. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 26, 1);
  1557. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 27, 1);
  1558. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 28, 1);
  1559. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 29, 1);
  1560. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 30, 1);
  1561. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 31, 1);
  1562. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 32, 1);
  1563. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 33, 1);
  1564. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 34, 1);
  1565. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 35, 1);
  1566. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 36, 1);
  1567. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 37, 1);
  1568. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 38, 26);
  1569. *(uint32_t*)0x200000000070 = 0;
  1570. *(uint32_t*)0x200000000074 = 0;
  1571. *(uint64_t*)0x200000000078 = 0;
  1572. *(uint64_t*)0x200000000080 = 0;
  1573. *(uint64_t*)0x200000000088 = 0;
  1574. *(uint64_t*)0x200000000090 = 0;
  1575. *(uint32_t*)0x200000000098 = 0;
  1576. *(uint32_t*)0x20000000009c = 0;
  1577. *(uint64_t*)0x2000000000a0 = 0;
  1578. *(uint32_t*)0x2000000000a8 = 0;
  1579. *(uint16_t*)0x2000000000ac = 0;
  1580. *(uint16_t*)0x2000000000ae = 0;
  1581. *(uint32_t*)0x2000000000b0 = 0;
  1582. *(uint32_t*)0x2000000000b4 = 0;
  1583. *(uint64_t*)0x2000000000b8 = 0;
  1584. res = syscall(__NR_perf_event_open, /*attr=*/0x200000000040ul, /*pid=*/0,
  1585. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  1586. if (res != -1)
  1587. r[14] = res;
  1588. *(uint32_t*)0x200000000000 = 0xe8;
  1589. res = syscall(__NR_getsockopt, /*fd=*/-1, /*level=*/0, /*optname=*/0x11,
  1590. /*optval=*/0x200000000180ul, /*optlen=*/0x200000000000ul);
  1591. if (res != -1)
  1592. r[15] = *(uint32_t*)0x2000000001b4;
  1593. syscall(__NR_quotactl_fd, /*fd=*/r[14],
  1594. /*cmd=Q_GETINFO_GRP*/ 0xffffffff80000501ul, /*id=*/r[15],
  1595. /*addr=*/0x200000000280ul);
  1596. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/5);
  1597. *(uint32_t*)0x200000048000 = 1;
  1598. syscall(__NR_futex, /*addr=*/0ul, /*op=FUTEX_TRYLOCK_PI*/ 8ul, /*val=*/0,
  1599. /*timeout=*/0ul, /*addr2=*/0x200000048000ul, /*val3=*/0);
  1600. syscall(__NR_prctl, /*option=*/7ul, 0, 0, 0, 0);
  1601. syscall(__NR_ftruncate, /*fd=*/r[14], /*len=*/2ul);
  1602. syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0ul, /*mode=*/0ul);
  1603. syscall(__NR_syslog, /*cmd=SYSLOG_ACTION_READ_ALL*/ 3ul,
  1604. /*buf=*/0x2000000000c0ul, /*len=*/0x6558a7e3409167e0ul);
  1605. *(uint32_t*)0x2000000002c0 = 2;
  1606. *(uint32_t*)0x2000000002c4 = 0x80;
  1607. *(uint8_t*)0x2000000002c8 = 0xe7;
  1608. *(uint8_t*)0x2000000002c9 = 0x20;
  1609. *(uint8_t*)0x2000000002ca = 9;
  1610. *(uint8_t*)0x2000000002cb = 0x80;
  1611. *(uint32_t*)0x2000000002cc = 0;
  1612. *(uint64_t*)0x2000000002d0 = 0x32c;
  1613. *(uint64_t*)0x2000000002d8 = 0x300;
  1614. *(uint64_t*)0x2000000002e0 = 8;
  1615. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 0, 1);
  1616. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 1, 1);
  1617. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 2, 1);
  1618. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 3, 1);
  1619. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 4, 1);
  1620. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 5, 1);
  1621. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 6, 1);
  1622. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 7, 1);
  1623. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 8, 1);
  1624. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 9, 1);
  1625. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 10, 1);
  1626. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 11, 1);
  1627. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 12, 1);
  1628. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 13, 1);
  1629. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 14, 1);
  1630. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 15, 2);
  1631. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 17, 1);
  1632. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 18, 1);
  1633. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 19, 1);
  1634. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 20, 1);
  1635. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 21, 1);
  1636. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 22, 1);
  1637. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 23, 1);
  1638. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 24, 1);
  1639. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 25, 1);
  1640. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 26, 1);
  1641. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 27, 1);
  1642. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 28, 1);
  1643. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 29, 1);
  1644. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 30, 1);
  1645. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 31, 1);
  1646. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 32, 1);
  1647. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 33, 1);
  1648. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 34, 1);
  1649. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 35, 1);
  1650. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 1, 36, 1);
  1651. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 37, 1);
  1652. STORE_BY_BITMASK(uint64_t, , 0x2000000002e8, 0, 38, 26);
  1653. *(uint32_t*)0x2000000002f0 = 2;
  1654. *(uint32_t*)0x2000000002f4 = 1;
  1655. *(uint64_t*)0x2000000002f8 = 0xf487a34;
  1656. *(uint64_t*)0x200000000300 = 0x136;
  1657. *(uint64_t*)0x200000000308 = 0;
  1658. *(uint64_t*)0x200000000310 = 4;
  1659. *(uint32_t*)0x200000000318 = 0x80000000;
  1660. *(uint32_t*)0x20000000031c = 9;
  1661. *(uint64_t*)0x200000000320 = 6;
  1662. *(uint32_t*)0x200000000328 = 0x1ff;
  1663. *(uint16_t*)0x20000000032c = 0xc95;
  1664. *(uint16_t*)0x20000000032e = 0;
  1665. *(uint32_t*)0x200000000330 = 0xff;
  1666. *(uint32_t*)0x200000000334 = 0;
  1667. *(uint64_t*)0x200000000338 = 5;
  1668. syscall(__NR_perf_event_open, /*attr=*/0x2000000002c0ul, /*pid=*/0,
  1669. /*cpu=*/0xbul, /*group=*/r[14], /*flags=PERF_FLAG_FD_CLOEXEC*/ 8ul);
  1670. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  1671. res = syscall(__NR_socket, /*domain=*/1ul, /*type=SOCK_DGRAM*/ 2ul,
  1672. /*proto=*/0);
  1673. if (res != -1)
  1674. r[16] = res;
  1675. memcpy((void*)0x200000000b80, "ext4\000", 5);
  1676. memcpy((void*)0x200000000bc0, "./file0\000", 8);
  1677. memcpy((void*)0x200000000040, "stripe", 6);
  1678. *(uint8_t*)0x200000000046 = 0x3d;
  1679. sprintf((char*)0x200000000047, "0x%016llx", (long long)0xfff);
  1680. *(uint8_t*)0x200000000059 = 0x2c;
  1681. memcpy((void*)0x20000000005a, "nolazytime", 10);
  1682. *(uint8_t*)0x200000000064 = 0x2c;
  1683. memcpy((void*)0x200000000065, "stripe", 6);
  1684. *(uint8_t*)0x20000000006b = 0x3d;
  1685. sprintf((char*)0x20000000006c, "0x%016llx", (long long)5);
  1686. *(uint8_t*)0x20000000007e = 0x2c;
  1687. *(uint8_t*)0x20000000007f = 0;
  1688. memcpy(
  1689. (void*)0x200000000c40,
  1690. "\x78\x9c\xec\xdc\xcd\x6b\x5c\xe5\x1a\x00\xf0\xe7\x9c\x7c\xb4\xb7\xe9\xbd"
  1691. "\xc9\x85\xbb\xb8\x75\x15\xd0\x62\xa1\x74\xf2\xd1\xfa\x05\x2e\xda\x85\xae"
  1692. "\x2c\x14\x14\xdc\x59\xc7\xc9\x34\x84\x4c\x32\x25\x33\xa9\x4d\x0c\xda\x82"
  1693. "\x2e\x0a\x2e\x04\xbb\x71\x59\xff\x04\xb7\x16\x29\x5d\xb9\x55\x10\x41\x70"
  1694. "\xe1\x42\x29\x85\x22\xc1\x65\x03\x91\x33\x39\x99\xa4\xc9\x4c\x9a\xa4\x49"
  1695. "\x06\xe2\xef\x07\x27\xf3\x3c\xe7\x9d\x99\xf7\x3c\x73\xce\x79\xf3\x0e\xcc"
  1696. "\x39\x01\xfc\x63\x0d\x66\x7f\xd2\x88\x13\x11\xf1\x45\x12\xd1\x9f\xaf\x4f"
  1697. "\x23\xa2\xb7\x11\x1d\x8d\xb8\xb1\xf2\xbc\xc7\x8b\x0b\xa5\xa5\xc5\x85\x52"
  1698. "\x12\xcb\xcb\x6f\xff\x99\x44\x92\xaf\x5b\x7d\xaf\x24\x7f\xec\xcb\x93\xff"
  1699. "\x47\xc4\xfd\xcf\x22\x4e\xa7\x9b\xfb\xad\xcd\xcd\x4f\x16\x2b\x95\xf2\x4c"
  1700. "\x9e\x0f\xd5\xa7\xae\x0e\xd5\xe6\xe6\xcf\x4c\x4c\x15\xc7\xcb\xe3\xe5\xe9"
  1701. "\x73\x23\xe7\x5e\x7b\xe9\xec\xf0\xab\xa3\x2f\xef\x59\xad\x6f\x2e\x17\x7f"
  1702. "\x7c\xe1\xb7\x37\x7e\xbe\x7b\xeb\x8f\x0f\xef\xdf\x3e\xfb\x20\x89\xf3\x71"
  1703. "\x3c\x6f\x5b\x5f\xc7\x5e\x19\x8c\xc1\xfc\x33\xe9\x89\xf3\x1b\xda\xde\xdb"
  1704. "\xeb\xce\x3a\x2c\xe9\xf4\x06\x00\x00\xb0\x2d\xd9\xd4\xbc\x2b\x22\xba\x23"
  1705. "\xfb\x0e\xd0\x1f\x5d\x8d\x08\x00\x00\x00\x38\x4c\x3e\x89\x88\x65\x00\x00"
  1706. "\x00\xe0\x90\x4b\x7c\xff\x07\x00\x00\x80\x43\x6e\xf5\x77\x00\x8f\x17\x17"
  1707. "\x4a\xab\x4b\x67\x7f\x91\x70\xb0\x1e\x5d\x88\x88\x81\xb5\x6b\x9b\x97\x9a"
  1708. "\xf5\x77\xc7\x8d\xc6\xe3\xd1\xe8\x89\x88\x63\x7f\x25\x4f\x5c\x19\x91\xac"
  1709. "\xbc\xec\x99\x0d\x46\xc4\xf7\xb7\x3e\x3d\x91\x2d\xb1\x4f\xd7\x21\x03\xb4"
  1710. "\x72\xe3\x66\x44\xdc\x3b\xdf\x62\xfc\x4f\xf2\xf1\x6f\xf7\x86\x37\xe4\xad"
  1711. "\xee\x11\x30\xb8\x21\x37\xfe\xc1\xc1\xb9\x77\x61\xe5\x44\xdd\x7c\xfe\xa7"
  1712. "\xcd\xf9\x4f\xb4\x98\xff\x74\xb5\x38\x77\x77\xe3\xe9\xe7\x7f\xfa\x70\x0f"
  1713. "\xba\x69\x2b\x9b\xff\xbd\x1e\x11\x4b\x9b\xe6\x7f\xcd\x9b\xd6\x0c\x74\xe5"
  1714. "\xd9\xbf\x1b\x73\xbe\x9e\xe4\xca\x44\xa5\x9c\x8d\x6d\xff\x89\x88\x53\xd1"
  1715. "\x73\x24\xcb\x47\xb6\xe8\xe3\xe4\xc7\xf3\x5f\xb5\x6b\x5b\x3f\xff\xcb\x96"
  1716. "\xac\xff\xd5\xb9\x60\xbe\x1d\x0f\xbb\x8f\x3c\xf9\x9a\xb1\x62\xbd\xf8\x2c"
  1717. "\x35\xaf\xf7\xe8\x66\xc4\x73\xdd\xad\xea\x4f\x9a\xfb\x3f\x69\x33\xff\xbd"
  1718. "\xb4\xcd\x3e\xee\x7e\xf4\xca\xaf\xed\xda\x9e\x5e\xff\xfe\x5a\xbe\x13\xf1"
  1719. "\x62\xcb\xfd\xbf\xf6\xdf\x2a\xd9\xfa\xfe\x44\x43\x8d\xe3\x61\x68\xf5\xa8"
  1720. "\xd8\xec\x9b\xd1\x93\x9f\xb7\xeb\xbf\xd3\xf5\x67\xfb\xff\xd8\xd6\xf5\x0f"
  1721. "\x24\xeb\xef\xd7\x54\xdb\x79\x1f\x5f\x7e\xfb\xee\xef\xed\xda\x76\x7b\xfc"
  1722. "\xf7\x26\xef\x34\xe2\xde\x7c\xdd\xf5\x62\xbd\x3e\x33\x12\xd1\x9b\xbc\xb5"
  1723. "\x79\xfd\xe8\xda\x6b\x57\xf3\xd5\xe7\x67\xf5\x9f\x7a\xbe\xf5\xf9\xbf\xd5"
  1724. "\xf1\x9f\x8d\x09\xef\xe7\x9f\x52\x36\x36\x14\xf3\xc7\x2c\xff\x60\x43\x8d"
  1725. "\xbf\xfc\xd0\x77\x7a\xf7\xf5\xef\xaf\xac\xfe\xb1\x1d\xed\xff\x9d\x07\x77"
  1726. "\xbe\xfe\xee\xa7\x76\xfd\x6f\x6f\xff\x9f\x6b\x44\xa7\xf2\x35\xdb\x19\xff"
  1727. "\xb6\xbb\x81\xcf\xf2\xd9\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1728. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1729. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x70\x70\xd2\x88\x38"
  1730. "\x1e\x49\x5a\x68\xc6\x69\x5a\x28\x44\xf4\x45\xc4\xff\xe2\x58\x5a\xa9\xd6"
  1731. "\xea\xa7\xaf\x54\x67\xa7\xc7\xb2\xb6\x88\x81\xe8\x49\xaf\x4c\x54\xca\xc3"
  1732. "\x11\xd1\xbf\x92\x27\x59\x3e\xd2\x88\xd7\xf2\xd1\x0d\xf9\xd9\x88\xf8\x6f"
  1733. "\x44\xdc\xee\xff\x57\x23\x2f\x94\xaa\x95\xb1\x4e\x17\x0f\x00\x00\x00\x00"
  1734. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1735. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1736. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1737. "\x00\x00\x00\x00\x40\x53\x5f\x44\x1c\x8f\x24\x2d\x44\x44\xda\x88\xd3\xb4"
  1738. "\x50\x58\x69\x7b\xd0\xdf\xe9\xad\x03\x00\x00\x00\xf6\xcc\x40\xa7\x37\x00"
  1739. "\x00\x00\x00\xd8\x77\xbe\xff\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1740. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1741. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1742. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1743. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1744. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1745. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1746. "\x7b\xe0\xd2\xc5\x8b\xd9\xb2\xbc\xb4\xb8\x50\xca\xf2\xb1\x6b\x73\xb3\x93"
  1747. "\xd5\x6b\x67\xc6\xca\xb5\xc9\xc2\xd4\x6c\xa9\x50\xaa\xce\x5c\x2d\x8c\x57"
  1748. "\xab\xe3\x95\x72\xa1\x54\x9d\x7a\xda\xfb\x55\xaa\xd5\xab\xc3\x31\x3d\x7b"
  1749. "\x7d\xa8\x5e\xae\xd5\x87\x6a\x73\xf3\x97\xa7\xaa\xb3\xd3\xf5\xcb\x13\x53"
  1750. "\xc5\xf1\xf2\xe5\x72\xcf\x81\x54\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1751. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1752. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1753. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0"
  1754. "\x4e\xd5\xe6\xe6\x27\x8b\x95\x4a\x79\x46\x20\x10\x08\x9a\x41\xa7\x47\x26"
  1755. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1756. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1757. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1758. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1759. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1760. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1761. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1762. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1763. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1764. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1765. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1766. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1767. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1768. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1769. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1770. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1771. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1772. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1773. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1774. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1775. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1776. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1777. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1778. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1779. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1780. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1781. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1782. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1783. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1784. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1785. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1786. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1787. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1788. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1789. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1790. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1791. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1792. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1793. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1794. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1795. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1796. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1797. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1798. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1799. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1800. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1801. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1802. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1803. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1804. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1805. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1806. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1807. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1808. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1809. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1810. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1811. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1812. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1813. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1814. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1815. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1816. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1817. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1818. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1819. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1820. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1821. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1822. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1823. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1824. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1825. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1826. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1827. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1828. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1829. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1830. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1831. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1832. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1833. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1834. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1835. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1836. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1837. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1838. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1839. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1840. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1841. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1842. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1843. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1844. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1845. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1846. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1847. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1848. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1849. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1850. "\x00\x00\x00\x0e\xb3\xbf\x03\x00\x00\xff\xff\x6f\x6b\x12\xe6",
  1851. 2895);
  1852. syz_mount_image(/*fs=*/0x200000000b80, /*dir=*/0x200000000bc0, /*flags=*/0,
  1853. /*opts=*/0x200000000040, /*chdir=*/1, /*size=*/0xb4f,
  1854. /*img=*/0x200000000c40);
  1855. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/0x40000);
  1856. *(uint32_t*)0x200000000000 = 2;
  1857. *(uint32_t*)0x200000000004 = 0x80;
  1858. *(uint8_t*)0x200000000008 = 0xb9;
  1859. *(uint8_t*)0x200000000009 = 0;
  1860. *(uint8_t*)0x20000000000a = 0;
  1861. *(uint8_t*)0x20000000000b = 0;
  1862. *(uint32_t*)0x20000000000c = 0;
  1863. *(uint64_t*)0x200000000010 = 0;
  1864. *(uint64_t*)0x200000000018 = 0;
  1865. *(uint64_t*)0x200000000020 = 0;
  1866. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 0, 1);
  1867. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 1, 1);
  1868. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 2, 1);
  1869. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 3, 1);
  1870. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 4, 1);
  1871. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 5, 1);
  1872. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 6, 1);
  1873. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 7, 1);
  1874. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 8, 1);
  1875. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 9, 1);
  1876. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 10, 1);
  1877. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 11, 1);
  1878. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 12, 1);
  1879. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 13, 1);
  1880. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 14, 1);
  1881. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 15, 2);
  1882. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 17, 1);
  1883. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 18, 1);
  1884. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 19, 1);
  1885. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 20, 1);
  1886. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 21, 1);
  1887. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 22, 1);
  1888. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 23, 1);
  1889. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 24, 1);
  1890. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 25, 1);
  1891. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 26, 1);
  1892. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 27, 1);
  1893. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 28, 1);
  1894. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 29, 1);
  1895. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 30, 1);
  1896. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 31, 1);
  1897. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 32, 1);
  1898. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 33, 1);
  1899. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 34, 1);
  1900. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 35, 1);
  1901. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 36, 1);
  1902. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 37, 1);
  1903. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 38, 26);
  1904. *(uint32_t*)0x200000000030 = 0;
  1905. *(uint32_t*)0x200000000034 = 0;
  1906. *(uint64_t*)0x200000000038 = 0;
  1907. *(uint64_t*)0x200000000040 = 0;
  1908. *(uint64_t*)0x200000000048 = 0;
  1909. *(uint64_t*)0x200000000050 = 0;
  1910. *(uint32_t*)0x200000000058 = 0;
  1911. *(uint32_t*)0x20000000005c = 0;
  1912. *(uint64_t*)0x200000000060 = 0;
  1913. *(uint32_t*)0x200000000068 = 0;
  1914. *(uint16_t*)0x20000000006c = 0;
  1915. *(uint16_t*)0x20000000006e = 0;
  1916. *(uint32_t*)0x200000000070 = 0;
  1917. *(uint32_t*)0x200000000074 = 0;
  1918. *(uint64_t*)0x200000000078 = 0;
  1919. syscall(__NR_perf_event_open, /*attr=*/0x200000000000ul, /*pid=*/0,
  1920. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  1921. memcpy((void*)0x200000000040, "./file0\000", 8);
  1922. res = syscall(__NR_open, /*file=*/0x200000000040ul, /*flags=*/0ul,
  1923. /*mode=*/0ul);
  1924. if (res != -1)
  1925. r[17] = res;
  1926. syscall(__NR_futimesat, /*dir=*/r[17], /*pathname=*/0ul, /*times=*/0ul);
  1927. *(uint16_t*)0x200000003000 = 1;
  1928. memcpy(
  1929. (void*)0x200000003002,
  1930. "\351\037q\211Y\036\2223aK\000\000\000\000\000\000\000\000\000\000\000"
  1931. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  1932. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  1933. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  1934. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  1935. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000",
  1936. 108);
  1937. syscall(__NR_bind, /*fd=*/r[16], /*addr=*/0x200000003000ul,
  1938. /*addrlen=*/0x6eul);
  1939. memcpy((void*)0x200000000000, "\351\037q\211Y\036\2223aK\000", 11);
  1940. memcpy((void*)0x200000000180, "tmpfs\000", 6);
  1941. memcpy((void*)0x2000000002c0,
  1942. "\x6d\x70\x6f\x6c\x3d\x69\x6e\x74\x65\x72\x6c\x65\x61\x76\x65\x3d\x72"
  1943. "\x65\x6c\x61\x74\xa5\x83\x63\xe7\x1a\x2e\xd6\xa5\x5b\x6a\x38\x0a\x43"
  1944. "\xfc\xa9\x69\x76\x65\x90\x09\x99\xd4\x3a\x38\x2d\x37",
  1945. 47);
  1946. sprintf((char*)0x2000000002ef, "%020llu", (long long)-1);
  1947. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000000ul,
  1948. /*type=*/0x200000000180ul, /*flags=*/0ul, /*opts=*/0x2000000002c0ul);
  1949. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  1950. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x541c, /*arg=*/0ul);
  1951. syscall(__NR_preadv, /*fd=*/-1, /*vec=*/0x2000000017c0ul, /*vlen=*/0x333ul,
  1952. /*off_low=*/0, /*off_high=*/0);
  1953. memcpy((void*)0x200000000000, "./file0\000", 8);
  1954. syscall(__NR_openat, /*fd=*/-1, /*file=*/0x200000000000ul,
  1955. /*flags=__O_TMPFILE|O_CREAT|O_RDWR*/ 0x400042, /*mode=*/0);
  1956. syscall(__NR_prctl, /*option=*/0x23ul, /*opt=PR_SET_MM_ENV_START*/ 0xaul,
  1957. /*arg=*/0x2000002d5000ul, 0, 0);
  1958. res = syscall(__NR_getpgrp, /*pid=*/0);
  1959. if (res != -1)
  1960. r[18] = res;
  1961. *(uint32_t*)0x200000000040 = 2;
  1962. *(uint32_t*)0x200000000044 = 0x70;
  1963. *(uint8_t*)0x200000000048 = 0x6a;
  1964. *(uint8_t*)0x200000000049 = 1;
  1965. *(uint8_t*)0x20000000004a = 0;
  1966. *(uint8_t*)0x20000000004b = 0;
  1967. *(uint32_t*)0x20000000004c = 0;
  1968. *(uint64_t*)0x200000000050 = 0;
  1969. *(uint64_t*)0x200000000058 = 0;
  1970. *(uint64_t*)0x200000000060 = 0;
  1971. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 0, 1);
  1972. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 1, 1);
  1973. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 2, 1);
  1974. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 3, 1);
  1975. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 4, 1);
  1976. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 5, 1);
  1977. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 6, 1);
  1978. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 7, 1);
  1979. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 8, 1);
  1980. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 9, 1);
  1981. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 10, 1);
  1982. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 11, 1);
  1983. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 12, 1);
  1984. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 13, 1);
  1985. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 14, 1);
  1986. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 15, 2);
  1987. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 17, 1);
  1988. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 18, 1);
  1989. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 19, 1);
  1990. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 20, 1);
  1991. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 21, 1);
  1992. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 22, 1);
  1993. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 23, 1);
  1994. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 24, 1);
  1995. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 25, 1);
  1996. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 26, 1);
  1997. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 27, 1);
  1998. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 28, 1);
  1999. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 29, 1);
  2000. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 30, 1);
  2001. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 31, 1);
  2002. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 32, 1);
  2003. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 33, 1);
  2004. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 34, 1);
  2005. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 35, 1);
  2006. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 36, 1);
  2007. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 37, 1);
  2008. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 38, 26);
  2009. *(uint32_t*)0x200000000070 = 0;
  2010. *(uint32_t*)0x200000000074 = 0;
  2011. *(uint64_t*)0x200000000078 = 0x200000000000;
  2012. *(uint64_t*)0x200000000080 = 0;
  2013. *(uint64_t*)0x200000000088 = 0;
  2014. *(uint64_t*)0x200000000090 = 0;
  2015. *(uint32_t*)0x200000000098 = 0;
  2016. *(uint32_t*)0x20000000009c = 0;
  2017. *(uint64_t*)0x2000000000a0 = 0;
  2018. *(uint32_t*)0x2000000000a8 = 0;
  2019. *(uint16_t*)0x2000000000ac = 0;
  2020. *(uint16_t*)0x2000000000ae = 0;
  2021. *(uint32_t*)0x2000000000b0 = 0;
  2022. *(uint32_t*)0x2000000000b4 = 0;
  2023. *(uint64_t*)0x2000000000b8 = 0;
  2024. syscall(__NR_perf_event_open, /*attr=*/0x200000000040ul, /*pid=*/0,
  2025. /*cpu=*/-1, /*group=*/-1, /*flags=*/0ul);
  2026. *(uint32_t*)0x200000000040 = 1;
  2027. *(uint32_t*)0x200000000044 = 0x70;
  2028. *(uint8_t*)0x200000000048 = 0;
  2029. *(uint8_t*)0x200000000049 = 0;
  2030. *(uint8_t*)0x20000000004a = 0;
  2031. *(uint8_t*)0x20000000004b = 0;
  2032. *(uint32_t*)0x20000000004c = 0;
  2033. *(uint64_t*)0x200000000050 = 0x510;
  2034. *(uint64_t*)0x200000000058 = 0;
  2035. *(uint64_t*)0x200000000060 = 0;
  2036. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 0, 1);
  2037. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 1, 1);
  2038. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 2, 1);
  2039. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 3, 1);
  2040. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 4, 1);
  2041. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 5, 1);
  2042. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 6, 1);
  2043. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 7, 1);
  2044. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 8, 1);
  2045. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 9, 1);
  2046. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 10, 1);
  2047. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 11, 1);
  2048. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 12, 1);
  2049. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 13, 1);
  2050. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 14, 1);
  2051. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 15, 2);
  2052. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 17, 1);
  2053. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 18, 1);
  2054. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 19, 1);
  2055. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 20, 1);
  2056. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 21, 1);
  2057. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 22, 1);
  2058. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 23, 1);
  2059. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 24, 1);
  2060. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 25, 1);
  2061. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 26, 1);
  2062. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 27, 1);
  2063. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 28, 1);
  2064. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 29, 1);
  2065. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 30, 1);
  2066. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 31, 1);
  2067. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 32, 1);
  2068. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 33, 1);
  2069. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 34, 1);
  2070. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 35, 1);
  2071. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 36, 1);
  2072. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 37, 1);
  2073. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 38, 26);
  2074. *(uint32_t*)0x200000000070 = 0;
  2075. *(uint32_t*)0x200000000074 = 0;
  2076. *(uint64_t*)0x200000000078 = 0x200000000000;
  2077. *(uint64_t*)0x200000000080 = 0;
  2078. *(uint64_t*)0x200000000088 = 0;
  2079. *(uint64_t*)0x200000000090 = 0;
  2080. *(uint32_t*)0x200000000098 = 0;
  2081. *(uint32_t*)0x20000000009c = 0;
  2082. *(uint64_t*)0x2000000000a0 = 0;
  2083. *(uint32_t*)0x2000000000a8 = 0;
  2084. *(uint16_t*)0x2000000000ac = 0;
  2085. *(uint16_t*)0x2000000000ae = 0;
  2086. *(uint32_t*)0x2000000000b0 = 0;
  2087. *(uint32_t*)0x2000000000b4 = 0;
  2088. *(uint64_t*)0x2000000000b8 = 0;
  2089. syscall(__NR_perf_event_open, /*attr=*/0x200000000040ul, /*pid=*/0,
  2090. /*cpu=*/-1, /*group=*/-1, /*flags=*/0ul);
  2091. memcpy((void*)0x200000000100, "fdinfo\000", 7);
  2092. res = -1;
  2093. res = syz_open_procfs(/*pid=*/0, /*file=*/0x200000000100);
  2094. if (res != -1)
  2095. r[19] = res;
  2096. syscall(__NR_getdents64, /*fd=*/r[19], /*ent=*/0x200000000140ul,
  2097. /*count=*/0x1000ul);
  2098. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/4);
  2099. syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0ul, /*f=MSG_NOSIGNAL*/ 0x4000ul);
  2100. syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0ul, /*f=*/0ul);
  2101. memcpy((void*)0x200000003f80,
  2102. "wg2\000\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  2103. syscall(__NR_ioctl, /*fd=*/r[19], /*cmd=*/0x8933, /*arg=*/0x200000003f80ul);
  2104. memcpy((void*)0x200000004100, "ip_vti0\000\000\000\000\000\000\000\000\000",
  2105. 16);
  2106. *(uint64_t*)0x200000004110 = 0x200000004080;
  2107. memcpy((void*)0x200000004080, "ip_vti0\000\000\000\000\000\000\000\000\000",
  2108. 16);
  2109. *(uint32_t*)0x200000004090 = 0;
  2110. *(uint16_t*)0x200000004094 = htobe16(0x29);
  2111. *(uint16_t*)0x200000004096 = htobe16(4);
  2112. *(uint32_t*)0x200000004098 = htobe32(0x40);
  2113. *(uint32_t*)0x20000000409c = htobe32(0xfffffffd);
  2114. STORE_BY_BITMASK(uint8_t, , 0x2000000040a0, 0, 0, 4);
  2115. STORE_BY_BITMASK(uint8_t, , 0x2000000040a0, 4, 4, 4);
  2116. STORE_BY_BITMASK(uint8_t, , 0x2000000040a1, 0, 0, 2);
  2117. STORE_BY_BITMASK(uint8_t, , 0x2000000040a1, 0, 2, 6);
  2118. *(uint16_t*)0x2000000040a2 = htobe16(0);
  2119. *(uint16_t*)0x2000000040a4 = htobe16(0);
  2120. *(uint16_t*)0x2000000040a6 = htobe16(0);
  2121. *(uint8_t*)0x2000000040a8 = 0;
  2122. *(uint8_t*)0x2000000040a9 = 0;
  2123. *(uint16_t*)0x2000000040aa = htobe16(0);
  2124. *(uint32_t*)0x2000000040ac = htobe32(0);
  2125. *(uint32_t*)0x2000000040b0 = htobe32(0);
  2126. struct csum_inet csum_1;
  2127. csum_inet_init(&csum_1);
  2128. csum_inet_update(&csum_1, (const uint8_t*)0x2000000040a0, 20);
  2129. *(uint16_t*)0x2000000040aa = csum_inet_digest(&csum_1);
  2130. syscall(__NR_ioctl, /*fd=*/r[19], /*cmd=*/0x89f8, /*arg=*/0x200000004100ul);
  2131. syz_open_dev(/*dev=*/0, /*id=*/2, /*flags=*/0);
  2132. memcpy((void*)0x200000000140, "/dev/input/event#\000", 18);
  2133. res = -1;
  2134. res = syz_open_dev(/*dev=*/0x200000000140, /*id=*/2, /*flags=*/0);
  2135. if (res != -1)
  2136. r[20] = res;
  2137. syscall(__NR_ioctl, /*fd=*/r[20], /*cmd=*/0x40284504, /*arg=*/0ul);
  2138. *(uint16_t*)0x200000001240 = 0;
  2139. *(uint16_t*)0x200000001242 = 1;
  2140. *(uint64_t*)0x200000001248 = 0;
  2141. *(uint64_t*)0x200000001250 = 9;
  2142. *(uint32_t*)0x200000001258 = 0;
  2143. *(uint32_t*)0x20000000125c = 0;
  2144. memset((void*)0x200000001260, 0, 16);
  2145. syscall(__NR_ioctl, /*fd=*/r[20], /*cmd=*/0x40305828,
  2146. /*arg=*/0x200000001240ul);
  2147. *(uint64_t*)0x2000000000c0 = 0x20000000f000;
  2148. *(uint64_t*)0x2000000000c8 = 0x200000ffc000;
  2149. *(uint64_t*)0x2000000000d0 = 0x200000002000;
  2150. *(uint64_t*)0x2000000000d8 = 0x2000002d6000;
  2151. *(uint64_t*)0x2000000000e0 = 0x200000011000;
  2152. *(uint64_t*)0x2000000000e8 = 0x20000000d000;
  2153. *(uint64_t*)0x2000000000f0 = 0x200000ffa000;
  2154. *(uint64_t*)0x2000000000f8 = 0x200000fed000;
  2155. *(uint64_t*)0x200000000100 = 0x200000003000;
  2156. *(uint32_t*)0x200000000140 = 0xff;
  2157. *(uint32_t*)0x200000000144 = 9;
  2158. *(uint32_t*)0x200000000148 = 0xb5d;
  2159. *(uint32_t*)0x20000000014c = 0x7a290914;
  2160. syscall(__NR_move_pages, /*pid=*/r[18], /*nr=*/9ul,
  2161. /*pages=*/0x2000000000c0ul, /*nodes=*/0x200000000140ul,
  2162. /*status=*/0x200000000180ul, /*flags=MPOL_MF_MOVE*/ 2ul);
  2163. memcpy((void*)0x2000000001c0, "environ\000", 8);
  2164. res = -1;
  2165. res = syz_open_procfs(/*pid=*/-1, /*file=*/0x2000000001c0);
  2166. if (res != -1)
  2167. r[21] = res;
  2168. *(uint64_t*)0x200000001400 = 0x200000000040;
  2169. *(uint64_t*)0x200000001408 = 0x200000b1;
  2170. syscall(__NR_preadv, /*fd=*/r[21], /*vec=*/0x200000001400ul, /*vlen=*/1ul,
  2171. /*off_low=*/0, /*off_high=*/0);
  2172. syscall(__NR_shmat, /*shmid=*/0, /*addr=*/0x200000000000ul,
  2173. /*flags=SHM_REMAP*/ 0x4000ul);
  2174. syscall(__NR_shmctl, /*shmid=*/0, /*cmd=*/0xcul, 0);
  2175. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  2176. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/2ul, /*proto=*/0x88);
  2177. if (res != -1)
  2178. r[22] = res;
  2179. memcpy((void*)0x200000000000, "./bus\000", 6);
  2180. res = syscall(
  2181. __NR_open, /*file=*/0x200000000000ul,
  2182. /*flags=O_SYNC|O_NONBLOCK|O_NOATIME|O_LARGEFILE|O_CREAT|0x2*/ 0x149842ul,
  2183. /*mode=*/0ul);
  2184. if (res != -1)
  2185. r[23] = res;
  2186. syscall(__NR_mmap, /*addr=*/0x200000002000ul, /*len=*/0x4000ul, /*prot=*/0ul,
  2187. /*flags=MAP_LOCKED|MAP_FIXED|MAP_DENYWRITE|0x2*/ 0x2812ul,
  2188. /*fd=*/r[23], /*offset=*/0ul);
  2189. memcpy(
  2190. (void*)0x200000001780,
  2191. "\x7e\x11\xb8\x60\x58\x1c\x55\x25\x55\x86\xe5\xe1\x3d\xff\x83\x1d\x3e\x27"
  2192. "\x1d\x77\x29\x7f\x2c\xca\xce\x05\xa5\x27\x4b\x41\xfb\x17\xe4\x8f\xe9\x04"
  2193. "\x5d\xaa\x72\xe0\xda\xa9\x28\xfe\x9c\xd4\x67\x09\x5a\x0f\x9e\x58\x86\xa9"
  2194. "\xff\x23\x32\x16\x41\xcd\x30\x01\x3b\xa6\xc9\x33\x3b\x24\xce\x38\x62\x6c"
  2195. "\x13\x6a\xf2\x65\x5f\xa4\xc2\x1e\x01\x99\xd8\x88\xd1\x33\xbb\x53\x97\x89"
  2196. "\x55\xdd\x40\x76\x57\x37\xa7\x98\x23\x34\x59\xc1\xf5\xa1\xd0\xc6\x19\xbd"
  2197. "\x30\xa4\xfe\x1d\x74\x69\x5c\x0d\x47\x90\xd1\xbe\xb5\x96\xcf\xec\x3f\xe5"
  2198. "\x58\x6a\xf1\xc6\x4f\xce\xf3\x02\x40\x9c\x69\x2a\xa8\x5d\x14\x2f\xac\x08"
  2199. "\x83\xcf\x67\x70\xf5\xe2\x70\x9c\xd5\xba\x0c\x64\x2f\x8d\x5e\xdb\x10\x5d"
  2200. "\x19\x10\xdd\xb8\x9e\xc3\x78\xcd\x1c\x1f\xfb\x2e\xcc\xab\x6e\xa0\x55\x0d"
  2201. "\xa9\x48\x12\x6a\xce\xde\xd0\xf9\x35\xd8\x40\xd2\x92\x55\x9c\xee\x76\x8e"
  2202. "\x6b\xc3\x93\xfb\x86\xfa\x55\x1c\x50\x46\x5f\xb8\xd3\x85\x1c\x17\xd7\x14"
  2203. "\x9d\x18\x1e\x93\x7c\x49\xf8\xda\x37\xa1\x21\x75\xa5\x8b\x53\x7a\xba\xb0"
  2204. "\xcb\x8c\xa0\xfb\x4b\xfe\xbd\x9e\xa2\xd3\x9e\xbc\x14\xa3\xd2\x05\x99\x44"
  2205. "\x83\x90\x0e\xbd\x87\x20\x11\x4f\x51\x36\x95\x36\xf9\x10\xde\xb2\x3e\x6d"
  2206. "\x6c\x88\xb7\x5a\x57\x8b\x6b\x38\xdd\xc9\xc7\x13\x7d\xfe\x2c\xad\x6a\xac"
  2207. "\x39\xd6\xcb\xb9\xf3\x36\x70\x4a\x7b\x86\xe3\x70\xd8\x3f\x96\xc8\x04\x96"
  2208. "\xc8\xf3\x39\xc9\x14\xd2\xbc\x4b\x62\x05\x3e\xad\x2b\xcf\xee\x7b\xc8\x96"
  2209. "\x7b\xae\xb9\x2e\x78\xba\xca\xd0\x8d\xe3\xe7\xc5\xca\xd8\xbb\x52\xf5\x66"
  2210. "\x38\xab\xce\xe6\x13\x29\x95\x51\x0e\x00\xc6\x5f\x44\xbc\x9d\x9f\x60\xa3"
  2211. "\x3a\xa2\x95\xc3\xbd\x0b\x02\xa3\xae\x6b\x45\x6a\xf0\x84\xe0\x54\xf8\x81"
  2212. "\x0f\xa3\x48\x49\x60\xfc\xb5\x95\x00\x98\x3d\xed\x1a\x93\xf2\x10\x0c\x6b"
  2213. "\x83\xc2\xb4\x90\xa9\xd1\x0f\xf5\x58\xb3\xbd\xc5\xb6\xed\x7c\x6b\x54\xc4"
  2214. "\x51\xc5\x76\x00\x5f\x9b\x04\xa3\xf0\x1b\xc0\x8a\x93\x2a\x56\x9b\xce\xc5"
  2215. "\xd2\xe8\x2e\x8e\xb7\xf9\x47\x3b\x8c\x4b\x2a\x5a\x9e\xe4\x1d\x97\x0e\xe5"
  2216. "\x03\x10\x40\x84\xfb\x32\xcb\xb6\x2d\x8f\xa8\x76\xae\x67\xd0\x8e\x44\xce"
  2217. "\xa5\xf5\xc8\x19\xfa\x2e\xe6\x17\xb6\xf5\x4b\x56\xba\xa2\x48\x02\x1a\xd7"
  2218. "\x97\x18\x28\xd0\x5d\xb2\x76\x6a\xf8\x84\x84\xfe\x47\xb0\x0e\x4a\x7f\xac"
  2219. "\xf3\xde\xd6\x89\x69\x33\xcf\xd0\xa6\xe3\x88\x04\x4f\x89\xdd\x50\xdb\x82"
  2220. "\x52\x04\xfc\x11\x63\xc5\x0e\x47\xba\x9f\xa8\xd6\xcd\xeb\x75\x2e\xc5\x28"
  2221. "\x41\x53\xb4\x8d\xbc\x19\x82\xb0\xa5\x32\x35\x97\xce\x4f\xa1\xa8\x05\xa7"
  2222. "\x1e\x16\x6c\x2e\x67\xdb\x41\x5c\xed\xcb\x48\xea\x9c\x5b\xcb\xe3\xc4\xc1"
  2223. "\xf6\x18\x6e\xd9\x40\xd3\xee\x24\xaa\x11\xd2\x26\xa4\x4f\xe4\x1e\x80\xd9"
  2224. "\x93\x5a\x46\x5e\x29\x23\x58\x64\xfa\x77\xec\x9a\x05\x66\xd7\x83\x38\x14"
  2225. "\x6f\x4b\x8c\x8d\x31\xb4\xc7\x50\x28\x19\x6e\x4c\x27\xe4\xd7\x6d\x3b\xca"
  2226. "\x69\x2e\xa8\xdf\xca\xe0\x04\xb9\x22\xe7\x32\x97\x6f\xa3\x15\x62\x64\xba"
  2227. "\xfe\x21\x80\xab\x78\xb0\x53\xbb\x0c\x54\xee\x86\x41\x3d\x10\x4c\xaa\x33"
  2228. "\xde\x3c\x6c\xbe\x68\x7d\xc4\xe4\xf5\xdd\x2d\xbb\x20\xd1\x2f\xa9\x53\xdc"
  2229. "\x0f\x16\xe2\x53\x5f\x4e\x88\x31\xce\xc0\xf7\x87\xa4\x16\x68\xd4\xa0\xad"
  2230. "\xd2\x75\x5d\xf5\x1d\x88\x50\xad\x9b\x18\x01\xa5\x08\x5b\xff\x9d\x02\x92"
  2231. "\x01\x6b\xf3\x4a\xa0\x11\x42\xb0\xc9\x9a\xa2\x6c\x75\x01\xe1\x9f\x2d\x20"
  2232. "\x5d\x37\xd1\xe6\x92\x31\x43\xa2\x8b\xfb\x47\x63\xfe\xcf\x26\x21\x12\x3e"
  2233. "\xe4\x8a\x73\x6d\xd3\x35\x35\x8c\x3f\xd5\x45\x08\xe2\x9e\x0f\x24\x68\xad"
  2234. "\x0e\xf7\x79\x0f\xfe\xd1\xb8\x35\xde\x3d\x70\xfc\xf0\x32\x4d\x62\xf3\xab"
  2235. "\x2f\xab\x7b\x88\xdd\x3c\xe4\xf5\x1a\xab\x35\x30\x2d\x14\x99\x61\xe7\xfb"
  2236. "\x28\x1a\x44\x92\x99\x14\x45\x90\x9e\x9f\xc8\x7d\x46\xd3\xb0\xed\xe3\x1d"
  2237. "\xf1\xfd\x82\x55\xb8\x8d\xa4\x0c\x67\x95\xd7\xa7\x7b\x13\x76\x3d\x56\x16"
  2238. "\xe1\x81\x60\x99\xeb\x0d\x96\x54\x77\xc1\x2a\x43\x55\x56\xb6\xb3\x0d\x6c"
  2239. "\x3f\x91\x29\xe4\x90\xdc\x95\x23\x34\x37\x16\x39\xe5\x59\x23\xbc\xc1\x2e"
  2240. "\x0e\xa4\x4c\x4d\x14\x53\xa1\xaf\xb2\xf3\xfd\x92\xc6\xa8\x23\xf2\x9e\xca"
  2241. "\xa4\xac\x14\xe5\xb4\x8c\x4f\xa3\x20\x9b\x81\x27\x7d\xfb\x8b\xa9\x6d\x2a"
  2242. "\x35\x21\x05\x60\x27\xbf\x58\xa4\x7f\x42\x36\xd4\xea\x6a\x34\xfa\x6b\x89"
  2243. "\x07\x75\x04\x6b\x1f\x53\x84\x33\x56\x80\x36\xeb\x43\x65\x66\xee\xb7\x42"
  2244. "\xd2\xe9\x2d\x1d\x17\xa9\xb3\xa4\x0b\x25\xd0\x2f\x63\x31\x2a\x3a\xd9\x25"
  2245. "\xe0\xa3\x51\x81\xe1\xa3\x60\x0d\x0c\x31\x02\x94\x9a\x10\x49\x51\xa5\x5f"
  2246. "\x99\xb7\x28\x01\x03\x31\x37\xba\xa5\x35\xc1\xd5\x06\x26\x2e\x29\x91\x8a"
  2247. "\x70\x3c\x15\xb5\xeb\x8e\xab\x49\x1f\xc0\x0e\xe0\xbf\x99\x29\x74\xcf\x86"
  2248. "\xbd\x17\xe1\xd5\xa5\x34\xf8\x67\x5f\x8b\x28\x0e\x9b\x18\xf1\x10\x2d\xc7"
  2249. "\x1e\xb0\xe8\x9a\x42\xa4\x6a\x9d\xb5\xd6\xcd\xed\x23\x74\x0c\x30\xb6\x48"
  2250. "\x94\xbe\x62\x5c\x3b\x23\xfe\x8b\xa4\xb5\x84\x5e\x79\xdb\x26\xf5\x2d\x93"
  2251. "\x8f\xcd\x13\xdf\x10\x90\xe9\x54\xb6\x8d\x93\xb9\x76\x5f\x95\x6f\xa3\x0d"
  2252. "\x9f\x59\x88\xea\x82\x07\x54\xff\x3e\xb3\x57\xe6\x41\xca\x86\x51\x9d\xdf"
  2253. "\x70\x26\xe6\x88\x65\xe9\x9d\x3b\x96\x74\xa5\x52\x43\x7d\x48\x52\x68\x19"
  2254. "\x78\x1b\xb3\xf9\x30\xd1\xba\x5e\xc8\x0a\x51\xf9\x5f\x58\x8c\x9a\xe6\xe0"
  2255. "\xd6\x44\xde\xb3\xd6\x82\xe4\xe2\xa3\x42\x57\xb8\x9b\x1c\xa9\x33\xd7\x8a"
  2256. "\xce\xdf\x27\x92\x77\x5c\xcf\x51\xe7\x1b\x87\xe4\x5d\x77\x3f\xec\xd5\xcb"
  2257. "\x7c\x5b\x4e\xe0\x33\xd8\x87\xcb\x0e\x3d\xc3\xff\x1c\xca\x2f\x31\xc9\x5e"
  2258. "\x1e\xc3\xed\x01\xec\xf0\x06\x25\xba\x5b\xb6\x8e\x94\xa5\x36\xd0\xf2\x98"
  2259. "\xa2\x7e\x93\xfa\x03\x9c\x6a\x3e\x8d\x8a\x12\x46\xf0\x3a\x5d\x0c\x11\xf5"
  2260. "\x1a\xde\xde\x02\x8a\x83\x19\x51\x46\x76\x70\x71\xeb\x00\xb6\x1a\xbc\xc1"
  2261. "\x01\xf8\x1a\xa5\x0b\x17\x88\x45\x6e\x48\x07\x4f\x68\x9f\x11\x72\xe5\x97"
  2262. "\xa7\x55\x6e\x66\x1a\x42\x71\x0b\x5f\xda\xf2\x73\x9d\x1d\xf6\xa2\xed\x89"
  2263. "\xc3\x57\xb7\x8b\xd7\xd9\x5d\x49\x4a\x60\x3b\x00\x39\xfb\x84\xf9\x0e\x0f"
  2264. "\x98\x7d\x74\xb9\xc8\xea\x40\x4b\xff\x69\x3a\xb8\x69\xce\x58\x17\xbe\xad"
  2265. "\x42\xf9\xf9\x5d\x59\x05\xc8\xb0\x25\xe0\x2a\xd1\xd5\xe2\x96\x4b\xc1\xb8"
  2266. "\x27\x70\x36\x1b\xc8\x5b\x43\x0e\x5f\x10\x75\xc9\xcc\x77\x43\xea\xcc\x69"
  2267. "\xa4\xd8\x9a\xdf\x2f\xcd\xf2\x65\xa5\x64\x24\xa6\x60\x66\xdd\xbb\xda\x85"
  2268. "\x23\x55\x15\x4f\x64\x57\x85\x56\x1b\xea\x9e\x8a\x20\xd5\xfd\xbe\x05\x25"
  2269. "\x8f\x4c\x0f\x93\xc7\xe8\x2a\x5e\xe5\x53\xbf\xaf\x06\x7a\x13\xa4\xeb\x25"
  2270. "\xae\x2b\x71\x75\xe4\xa6\x30\x1c\x55\x94\xcf\x86\x60\x49\xb6\x1e\x71\x61"
  2271. "\xc1\x7b\x97\x35\x75\xff\x3a\xf3\x70\x46\x8f\x3d\x31\x69\x66\xbd\x10\x2b"
  2272. "\xfa\x6b\x20\xf3\x1c\x79\x24\x89\x2f\x3d\x7f\x1c\xa9\x02\x91\x45\xaf\xc0"
  2273. "\x0e\x5e\x81\x52\xfa\x04\x3a\xd2\x4a\x29\xe2\x7c\x8a\xc5\x33\xe1\xf2\x4a"
  2274. "\x23\x93\x47\x55\x71\x91\x8d\xca\x44\x8e\x31\x2b\x55\xb6\xf2\x04\x1f\x12"
  2275. "\x98\x60\x98\x3b\x79\x60\x2a\x08\x7f\xa4\xfa\xb3\xa0\xa5\x93\xf1\x61\xdd"
  2276. "\xd9\x14\x65\x81\x3a\x51\x7a\xf6\x81\xbd\x3f\xd9\xd1\x0e\xc4\x6c\x0b\x31"
  2277. "\xc5\x6a\xcb\xfd\xd6\xa5\x51\x5e\xa8\xd7\xfa\x16\x1d\xc4\x5c\xca\x3a\x0d"
  2278. "\x4b\xa0\x2d\xce\x7d\x88\xbb\x3a\x0a\x88\x83\x24\x85\x1b\xa3\x8a\x7c\x65"
  2279. "\x9d\x6f\x1c\xa5\xaf\x76\x4e\x63\xfb\x8a\x9c\xa4\xc9\xd4\x6f\x91\xd0\x5c"
  2280. "\x48\xf6\x68\xe7\x2e\xba\x32\x5f\x2c\xf7\xda\xb6\x6b\x9b\x0e\xea\x98\x81"
  2281. "\xd9\x6c\x01\x47\x31\x44\xfb\x88\xf5\x6d\x83\x2f\x96\x32\xe0\xae\x4d\xe9"
  2282. "\x1e\xc5\xd0\x04\x63\xc3\xed\xcb\xe6\xe4\x75\xd2\x2b\x42\x57\x49\x00\x20"
  2283. "\x5f\x45\x22\xd8\x2c\xe2\x3c\x87\xcb\x91\x87\xd2\x33\x32\x49\x82\x31\x39"
  2284. "\xe2\x04\xb0\x33\x01\x94\xf1\x41\xc3\x50\x54\x12\xe7\x4e\x7d\x1a\x5a\x23"
  2285. "\x34\xd5\x7a\x65\xb9\x04\x2e\x5a\x06\xc6\x8b\xf8\xa2\x6f\xe0\xe8\x33\x38"
  2286. "\x25\xc6\x61\xff\x2e\xef\x1b\xb6\xca\xc0\x45\x0e\x26\x00\x64\x18\xf1\xcb"
  2287. "\xa6\xae\x66\x91\xe0\xc6\x46\x5f\xf6\x6c\xdb\x97\x57\xf7\x38\x5c\xfb\xc2"
  2288. "\x17\x69\x1e\xd7\x68\xd3\x4c\x59\x5c\xc7\x6c\x30\x0a\xb8\xc0\x68\x79\x09"
  2289. "\x63\xd7\x2d\xc6\xd6\x9f\x0d\x0d\xad\x36\xfd\x1b\x18\xff\x0b\x7d\x48\x6a"
  2290. "\x61\xee\x64\x7f\x7b\x20\x1f\xd6\xd7\x6a\xf5\x54\x6f\x77\x0f\xef\x85\xc6"
  2291. "\xc9\xe8\xa9\xe8\x51\x29\x81\x56\x1c\xaa\x27\x4a\x1b\x5e\x9d\xbf\x10\xb1"
  2292. "\x5d\x12\x56\x80\xc6\x81\x8c\x6a\x4b\x88\x2e\x9a\x70\x9d\x95\xb0\xbf\x5f"
  2293. "\x66\xa5\x4c\xd8\x2b\x3f\x15\x6d\xc2\x19\x46\x1b\x7d\x9e\x02\x64\x1e\x2d"
  2294. "\x0e\x96\xb6\xe3\xe5\x8c\x17\x9a\x76\x04\x7d\xb7\x4b\x9e\x9c\xe3\x7a\x7b"
  2295. "\xa8\x59\xa1\xb7\x3e\x6f\x37\x97\x5a\x44\xd1\x11\x8f\x82\x0c\xda\x01\x28"
  2296. "\x2c\x09\x8d\x39\x47\xf4\xba\xce\x61\xf2\x2a\xe2\xf6\x47\x86\x4e\xbe\xb7"
  2297. "\x87\xaa\x33\x69\x25\x0c\x04\x9d\xbe\x71\xc4\xf4\xf3\x0e\x50\x9f\xfc\x20"
  2298. "\x34\x41\x6c\x5e\xae\x5d\x91\x95\xb1\x95\x9f\x8a\x3f\xc9\xcb\x2c\x90\xa2"
  2299. "\x88\xfa\xe9\x07\xe5\xdb\x05\xd7\x76\x87\x8c\x85\x09\x7c\x83\x1d\x6a\x46"
  2300. "\x75\x9d\x32\x94\xe5\xef\x2e\x85\x7c\x72\x45\xd3\x30\x30\xd0\x3d\x4e\x0f"
  2301. "\xb6\x26\x9d\xca\x2a\x85\xa6\x8f\x55\xf9\x71\xa4\x46\x68\x64\x3b\x4f\xc8"
  2302. "\x70\x76\x22\xc1\x99\x04\x1c\x00\x9b\x44\x1e\xfc\x92\x6b\xe4\x67\x8a\xff"
  2303. "\x45\x26\x21\xfd\xbd\xdd\x86\x6e\x4d\x60\xfd\x48\xec\x1a\x5c\x7b\x2e\xa4"
  2304. "\x0f\xaa\x26\xb8\x6c\xfd\x4d\x36\xe9\xc4\x2b\x1f\x98\xbe\x96\xb0\x35\x80"
  2305. "\x7d\x83\x5d\xd2\x35\xf4\xbd\xad\x89\x85\x93\xe8\x95\xf0\xc0\x90\x6b\x2b"
  2306. "\x69\xa9\x4f\xf8\x26\x28\x04\xfb\x2b\x13\x9b\xcb\x6a\x35\xa8\x9d\xb1\x97"
  2307. "\xc3\x4a\x83\xa8\x3b\x38\xfc\x50\x47\xbf\x4b\x3e\xd3\x52\x2e\xb7\xf3\x07"
  2308. "\x42\x4c\x29\xab\x33\x7d\x04\x81\xf5\x07\x72\xe1\x2b\xde\x7c\x16\xda\x7c"
  2309. "\xc4\x49\x36\x8d\x3b\xb1\x97\x86\x32\xab\x8b\xd8\xe1\x56\xcc\xb1\x20\xd6"
  2310. "\x35\xf4\x71\x29\x16\xe1\x91\x10\x7d\xfc\x04\x65\x75\x97\x7c\x5a\x80\xe2"
  2311. "\x80\x52\x86\xd5\xe0\x88\x50\x64\xb9\x16\x99\x9c\x00\x75\x83\x23\x16",
  2312. 2177);
  2313. *(uint16_t*)0x200000000100 = 0xa;
  2314. *(uint16_t*)0x200000000102 = htobe16(0x4e21);
  2315. *(uint32_t*)0x200000000104 = htobe32(0);
  2316. memset((void*)0x200000000108, 0, 16);
  2317. *(uint32_t*)0x200000000118 = 0;
  2318. syscall(__NR_sendto, /*fd=*/r[22], /*buf=*/0x200000001780ul, /*len=*/0x881ul,
  2319. /*f=*/0ul, /*addr=*/0x200000000100ul, /*addrlen=*/0x1cul);
  2320. memcpy((void*)0x200000000240, "msdos\000", 6);
  2321. memcpy((void*)0x200000000280, "./file0\000", 8);
  2322. *(uint8_t*)0x200000000540 = r[22];
  2323. memcpy(
  2324. (void*)0x2000000002c0,
  2325. "\x78\x9c\xec\xdd\xcf\x6a\x13\x51\x14\x07\xe0\x63\x93\x34\xb1\x9b\x74\x2d"
  2326. "\x0a\x17\xdc\xb8\x0a\xea\x13\x18\xa4\x82\x18\x10\x22\x59\xe8\xca\x40\x75"
  2327. "\xd3\x8a\x90\x6e\xa2\xab\xf8\x16\x3e\x80\x2b\x1f\xc9\xc7\xe8\xaa\xbb\x91"
  2328. "\x64\x5a\xf3\xcf\x9a\x48\x9b\x4c\xcb\x7c\x1f\xb4\x39\xf0\xbb\x03\x67\x02"
  2329. "\x99\x9b\xc5\x99\xc9\xfb\xfb\x9f\x8e\x0e\x3f\x9f\x7c\xcc\x7e\x7d\x8f\x46"
  2330. "\x23\x45\x35\x62\x14\x67\x11\xfb\xb1\x13\x95\x88\xb8\x1b\x53\x3b\x11\x71"
  2331. "\x27\x76\x63\xd6\x28\xd6\xf0\x6d\xfc\xef\xc7\x3a\x2b\x01\x80\x2d\xe8\x76"
  2332. "\xfb\xed\xff\x3e\xa8\xb2\x91\x56\xd8\x90\xc1\xa0\xdd\xaf\x45\x44\x7d\x29"
  2333. "\xe9\xfd\x2c\xa4\x21\x00\x00\x00\x00\x00\x00\x00\x00\x00\xae\x6c\xd5\xfc"
  2334. "\x7f\x4c\x66\xfe\x73\xf9\xfc\x7f\x6d\xee\xf8\xb5\xe6\xff\x01\x80\x1b\x65"
  2335. "\x79\xfe\xff\xd9\xd2\x1a\x7b\xfc\xed\x36\x18\xb4\xfb\x7b\xe7\xdf\xdf\xe6"
  2336. "\x99\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2337. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2338. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8a\x73\x96"
  2339. "\x65\xcd\xec\x1f\x7f\x45\xf7\x07\x00\x5c\x3f\xfb\x3f\x00\x94\x8f\xfd\x1f"
  2340. "\x00\xca\xc7\xfe\x0f\x00\xe5\xf3\xe6\xed\xbb\x57\xed\x4e\xe7\xa0\x9b\x52"
  2341. "\x23\xe2\x74\x34\xec\x0d\x7b\xf9\x6b\x9e\xbf\x78\xd9\x39\x78\x9c\x26\xf6"
  2342. "\xa7\x47\x9d\x0e\x87\xbd\xca\x9f\xfc\x49\x9e\xa7\xf9\xbc\x16\x7b\xe7\xf9"
  2343. "\xd3\xbf\xe6\xbb\xf1\xe8\x61\x9e\x8f\xb3\xe7\xaf\x3b\x0b\x79\x3d\x0e\x2f"
  2344. "\xe9\x39\xcb\xae\xf7\x3d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2345. "\x00\x00\x00\x80\xa2\xb5\x52\x4a\x59\xf3\xf2\xfb\xfb\x5b\xad\x74\x61\x21"
  2346. "\xcf\xab\x99\xe7\x03\x2c\xdc\xbf\x5f\x8d\x7b\xd5\xad\x9d\x06\x00\x00\x00"
  2347. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xdc\x6a\x27\x5f\xbe\x1e"
  2348. "\xd5\x23\x62\x30\x2e\xfa\xc7\xc7\x1f\x36\x5a\x64\xcd\xd5\x6b\x62\x94\x3f"
  2349. "\x36\x60\x26\x8a\x88\xd1\x66\x1b\x53\x28\x8a\x2b\x1e\x54\xa7\x1f\xc6\x9b"
  2350. "\xd0\xcf\xa4\xb8\xb8\x42\xa4\xc2\xae\x4d\x00\x00\x00\x00\x00\x00\x00\x00"
  2351. "\x00\x00\x00\x00\x00\x00\x50\x36\xd3\x9b\x7e\x57\xaf\xad\x6d\xa3\x21\x00"
  2352. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2353. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x28\xc0\xf4\xf7\xff\x37"
  2354. "\x57\x14\x7d\x8e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2355. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2356. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2357. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2358. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2359. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x39"
  2360. "\xfc\x0e\x00\x00\xff\xff\xe9\xc4\x8f\xed",
  2361. 640);
  2362. syz_mount_image(/*fs=*/0x200000000240, /*dir=*/0x200000000280, /*flags=*/0,
  2363. /*opts=*/0x200000000540, /*chdir=*/1, /*size=*/0x280,
  2364. /*img=*/0x2000000002c0);
  2365. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/0);
  2366. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  2367. syscall(__NR_prctl, /*option=*/0x26ul, /*arg=*/1ul, 0, 0, 0);
  2368. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/5);
  2369. syz_proconfig_reset__sys_fs_cgroup_system_slice_rsyslog_service_cgroup_freeze();
  2370. res = syscall(__NR_timerfd_create, /*clockid=CLOCK_MONOTONIC_RAW*/ 4ul,
  2371. /*flags=TFD_NONBLOCK*/ 0x800ul);
  2372. if (res != -1)
  2373. r[24] = res;
  2374. *(uint64_t*)0x200000000000 = 0x200000001840;
  2375. memcpy(
  2376. (void*)0x200000001840,
  2377. "\x71\xe9\xfa\x2b\xb0\xb0\xe9\x0a\x3e\x99\x06\x17\x1d\xc2\x46\xf6\xc3\xc7"
  2378. "\x03\xc2\x6d\xed\x59\x5a\xfa\x44\x7d\xda\x45\x93\x21\xb6\xf8\xd8\x7b\x80"
  2379. "\xf9\x69\x5d\xe3\xc0\xa4\xa5\x84\x92\x04\x77\x54\xad\x73\x50\xe3\x97\x80"
  2380. "\xd8\x89\xba\x04\x06\x0f\x6a\x27\x21\xd6\x88\xfc\x80\xfd\x62\xd1\x84\xe6"
  2381. "\xc1\xf7\x7d\xe7\x17\xea\x13\x43\x03\xc1\x99\x69\xee\xdd\x99\xc3\xcf\x56"
  2382. "\x10\x2b\xb5\x5d\x33\x7b\x84\x69\xc0\x73\x8d\x84\x96\x1d\x21\x23\xc7\xfd"
  2383. "\x0c\x6e\x5b\x53\x7d\xff\x97\x62\x02\x25\x6d\x4a\x89\x18\xb3\x89\x39\xc1"
  2384. "\x66\x31\x0f\x02\x94\xfd\x9f\x32\xf0\x08\xd8\x19\x0c\x31\xfa\x91\x80\x26"
  2385. "\x5f\xc5\xac\x11\xea\x1a\x5d\x62\x52\xce\x47\x05\xaa\xa9\xcc\x95\x0f\xd1"
  2386. "\x1f\x9a\x58\x4a\x4f\x1f\xaa\x0b\x9f\x6b\x0d\xdc\x4e\xed\x3e\x56\x26\x52"
  2387. "\xab\xad\x6a\x6a\x6b\xa8\x1b\x97\x12\x07\x82\x88\x48\xcb\x08\xcf\x98\x09"
  2388. "\x94\x31\x91\xb9\xa9\x9c\x35\x4c\x34\x3e\x9f\xfa\xef\xef\xd3\xfd\x67\x07"
  2389. "\xb2\xd7\x34\xe9\x8b\xb9\xbc\xd0\x8a\x18\x6f\x61\xb4\x01\x07\x7d\xd7\x96"
  2390. "\x20\x6d\xeb\xaf\x99\x9c\x3f\x93\xf4\xea\x8c\x82\x36\xe3\xad\x59\xc5\x4b"
  2391. "\x63\xa5\x15\x70\x8d\xfa\x01\xc6\xa4\xc9\x2f\xee\x11\xb1\x61\x19\x60\x0f"
  2392. "\xcf\x92\x91\xfe\xc6\x22\x4d\x01\xdb\x63\xd1\xd1\xae\x57\x21\xc4\x42\x95"
  2393. "\xf4\x66\x4e\xbe\x54\xcd\x23\xac\xef\x37\x70\xdd\xb3\xdd\xff\x87\x1f\xc2"
  2394. "\x07\xa1\x46\x84\xde\x0b\xf8\x74\xe9\xaa\xc6\xe6\x27\xb0\x70\x3f\xdc\xd0"
  2395. "\x5e\x38\xf7\xaa\x50\xe3\x1c\x56\x8d\x70\x5f\xcd\xd8\x79\xe8\x24\x5d\x72"
  2396. "\xd8\xfc\x2f\xfe\xb3\xd5\x79\xf4\x4d\x6b\x32\xdf\x40\x83\xc5\xcb\xe0\xb4"
  2397. "\xf8\x37\xe9\x82\x00\x36\x20\x58\x55\x20\xb1\x70\xb8\x36\xf8\x08\x4f\x26"
  2398. "\x42\xbd\xff\x4d\x1d\x9a\x2e\x61\x34\xda\x1d\x26\xa5\xc4\x1a\xc0\x8c\x6c"
  2399. "\x06\x27\x9d\xe7\x45\xc9\xbb\xd1\x67\x3b\x32\x22\x7c\xf5\xbb\xcb\x9e\x85"
  2400. "\x22\x6d\x6e\x83\xa2\x6d\xb5\x02\xf8\x65\x0e\xd1\x16\xa9\xd9\x2c\xad\xf9"
  2401. "\x61\xbb\x5e\xff\xcb\x85\xcc\x3b\xc9\x15\x13\x7a\xe0\x3f\x95\x41\x20\x22"
  2402. "\x38\xc1\x0c\xf6\xf6\xce\x8a\x91\xb5\x7a\x89\x5c\x4a\x7b\x36\x50\x7c\x5d"
  2403. "\x56\x3f\xdd\xbe\x9b\x83\xde\x6d\x17\x33\x67\x17\xd4\x32\x35\xb9\xf5\xf5"
  2404. "\xbd\xcb\x20\xff\xed\xa2\x98\x8b\x11\xfc\x72\x21\xcc\xba\xf0\x65\x7a\x56"
  2405. "\x9e\xee\xe3\x7f\xb8\xef\x52\x7f\x87\x60\x43\x3b\xcc\x33\xca\xb1\xc8\x48"
  2406. "\x33\x0b\x2b\xb5\x9f\x80\x8a\x5d\x6e\xa9\x77\x35\xc1\xce\x89\x3e\x85\x0e"
  2407. "\xed\xf8\x41\xdd\x91\x1c\x6b\x78\x59\x63\xb9\xb8\x7c\xd1\x64\xcf\xd5\x38"
  2408. "\xb5\x0e\x25\x91\x41\xba\xf1\xd1\xa7\xf9\x19\xa9\xb9\xcd\xd9\x63\x18\x37"
  2409. "\x6f\xee\x12\x36\x9e\x7c\x70\x2a\x29\x9c\xdd\x08\x32\x13\x78\xc3\x9b"
  2410. "\x3a",
  2411. 594);
  2412. *(uint64_t*)0x200000000008 = 0x252;
  2413. *(uint64_t*)0x200000000010 = 0;
  2414. *(uint64_t*)0x200000000018 = 0;
  2415. syscall(__NR_writev, /*fd=*/r[24], /*vec=*/0x200000000000ul, /*vlen=*/2ul);
  2416. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  2417. *(uint16_t*)0x200000000000 = 1;
  2418. *(uint64_t*)0x200000000008 = 0x200000000140;
  2419. *(uint16_t*)0x200000000140 = 6;
  2420. *(uint8_t*)0x200000000142 = 0;
  2421. *(uint8_t*)0x200000000143 = 0;
  2422. *(uint32_t*)0x200000000144 = 0x7fffff7a;
  2423. res = syscall(__NR_seccomp, /*op=*/1ul, /*flags=*/0ul,
  2424. /*arg=*/0x200000000000ul);
  2425. if (res != -1)
  2426. r[25] = res;
  2427. syscall(__NR_ioprio_get, /*which=IOPRIO_WHO_USER*/ 3ul, /*who=*/0);
  2428. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0x88);
  2429. if (res != -1)
  2430. r[26] = res;
  2431. *(uint32_t*)0x200000000280 = 5;
  2432. res = syscall(__NR_getsockopt, /*fd=*/r[26], /*level=*/1, /*optname=*/0x11,
  2433. /*optval=*/0x200000000240ul, /*optlen=*/0x200000000280ul);
  2434. if (res != -1) {
  2435. r[27] = *(uint32_t*)0x200000000244;
  2436. r[28] = *(uint32_t*)0x200000000248;
  2437. }
  2438. syscall(__NR_setuid, /*uid=*/r[27]);
  2439. syscall(__NR_quotactl_fd, /*fd=*/r[25],
  2440. /*cmd=Q_QUOTAOFF_PRJ*/ 0xffffffff80000302ul, /*id=*/r[27],
  2441. /*addr=*/0ul);
  2442. *(uint32_t*)0x200000000180 = 1;
  2443. *(uint32_t*)0x200000000184 = 1;
  2444. *(uint32_t*)0x200000000188 = 0x18;
  2445. *(uint32_t*)0x20000000018c = r[25];
  2446. *(uint32_t*)0x200000000190 = r[27];
  2447. *(uint32_t*)0x200000000194 = r[28];
  2448. memcpy((void*)0x200000000198, "./file0\000", 8);
  2449. res = syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0xc018937b,
  2450. /*arg=*/0x200000000180ul);
  2451. if (res != -1)
  2452. r[29] = *(uint32_t*)0x200000000190;
  2453. *(uint32_t*)0x200000000000 = 2;
  2454. *(uint32_t*)0x200000000004 = 0x80;
  2455. *(uint8_t*)0x200000000008 = 0xb9;
  2456. *(uint8_t*)0x200000000009 = 0;
  2457. *(uint8_t*)0x20000000000a = 0;
  2458. *(uint8_t*)0x20000000000b = 0;
  2459. *(uint32_t*)0x20000000000c = 0;
  2460. *(uint64_t*)0x200000000010 = 0;
  2461. *(uint64_t*)0x200000000018 = 0;
  2462. *(uint64_t*)0x200000000020 = 0;
  2463. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 0, 1);
  2464. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 1, 1);
  2465. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 2, 1);
  2466. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 3, 1);
  2467. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 4, 1);
  2468. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 5, 1);
  2469. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 6, 1);
  2470. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 7, 1);
  2471. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 8, 1);
  2472. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 9, 1);
  2473. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 10, 1);
  2474. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 11, 1);
  2475. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 12, 1);
  2476. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 13, 1);
  2477. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 14, 1);
  2478. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 15, 2);
  2479. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 17, 1);
  2480. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 18, 1);
  2481. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 19, 1);
  2482. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 20, 1);
  2483. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 21, 1);
  2484. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 22, 1);
  2485. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 23, 1);
  2486. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 24, 1);
  2487. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 25, 1);
  2488. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 26, 1);
  2489. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 27, 1);
  2490. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 28, 1);
  2491. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 29, 1);
  2492. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 30, 1);
  2493. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 31, 1);
  2494. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 32, 1);
  2495. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 33, 1);
  2496. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 34, 1);
  2497. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 35, 1);
  2498. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 36, 1);
  2499. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 37, 1);
  2500. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 38, 26);
  2501. *(uint32_t*)0x200000000030 = 0;
  2502. *(uint32_t*)0x200000000034 = 0;
  2503. *(uint64_t*)0x200000000038 = 0;
  2504. *(uint64_t*)0x200000000040 = 0;
  2505. *(uint64_t*)0x200000000048 = 0;
  2506. *(uint64_t*)0x200000000050 = 0;
  2507. *(uint32_t*)0x200000000058 = 0;
  2508. *(uint32_t*)0x20000000005c = 0;
  2509. *(uint64_t*)0x200000000060 = 0;
  2510. *(uint32_t*)0x200000000068 = 0;
  2511. *(uint16_t*)0x20000000006c = 0;
  2512. *(uint16_t*)0x20000000006e = 0;
  2513. *(uint32_t*)0x200000000070 = 0;
  2514. *(uint32_t*)0x200000000074 = 0;
  2515. *(uint64_t*)0x200000000078 = 0;
  2516. syscall(__NR_perf_event_open, /*attr=*/0x200000000000ul, /*pid=*/0,
  2517. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  2518. syscall(__NR_rt_sigtimedwait, /*these=*/0ul, /*info=*/0ul, /*ts=*/0ul,
  2519. /*sigsetsize=*/0ul);
  2520. memcpy((void*)0x200000000080, "syz\000", 4);
  2521. memcpy((void*)0x2000000000c0, "./file0\000", 8);
  2522. memcpy((void*)0x200000000100, "9p\000", 3);
  2523. memcpy((void*)0x2000000002c0, "trans=virtio,", 13);
  2524. memcpy((void*)0x2000000002cd, "cache=mmap", 10);
  2525. *(uint8_t*)0x2000000002d7 = 0x2c;
  2526. memcpy((void*)0x2000000002d8, "pcr", 3);
  2527. *(uint8_t*)0x2000000002db = 0x3d;
  2528. sprintf((char*)0x2000000002dc, "%020llu", (long long)0xa);
  2529. *(uint8_t*)0x2000000002f0 = 0x2c;
  2530. memcpy((void*)0x2000000002f1, "euid<", 5);
  2531. sprintf((char*)0x2000000002f6, "%020llu", (long long)r[29]);
  2532. *(uint8_t*)0x20000000030a = 0x2c;
  2533. memcpy((void*)0x20000000030b, "fsmagic", 7);
  2534. *(uint8_t*)0x200000000312 = 0x3d;
  2535. sprintf((char*)0x200000000313, "0x%016llx", (long long)7);
  2536. *(uint8_t*)0x200000000325 = 0x2c;
  2537. memcpy((void*)0x200000000326, "smackfsfloor", 12);
  2538. *(uint8_t*)0x200000000332 = 0x3d;
  2539. memcpy((void*)0x200000000333, "session", 7);
  2540. *(uint8_t*)0x20000000033a = 0x2c;
  2541. memcpy((void*)0x20000000033b, "dont_appraise", 13);
  2542. *(uint8_t*)0x200000000348 = 0x2c;
  2543. *(uint8_t*)0x200000000349 = 0;
  2544. syscall(__NR_mount, /*src=*/0x200000000080ul, /*dst=*/0x2000000000c0ul,
  2545. /*type=*/0x200000000100ul,
  2546. /*flags=MS_PRIVATE|MS_REMOUNT|MS_NODIRATIME*/ 0x40820ul,
  2547. /*opts=*/0x2000000002c0ul);
  2548. memcpy((void*)0x200000000680, "iso9660\000", 8);
  2549. memcpy((void*)0x2000000006c0, "./file0\000", 8);
  2550. memcpy((void*)0x2000000001c0,
  2551. "\x73\x62\x73\x65\x63\x74\x6f\x72\x3d\x30\x78\x30\x30\x30\x30\x4d\xee"
  2552. "\x00\x8e\x22\x00\x00\x00\x30\x30\x30\x33\x2c\x73\x65\x73\x73\x69\x6f"
  2553. "\x6e\x3d\x30\x78\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
  2554. "\x30\x34\x34\x2c\x64\x6d\x6f\x64\x02\x00\x00\x00\x30\x30\x30\x30\x30"
  2555. "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x35\x2c\x00\x7d\x56\x5b\x7f"
  2556. "\x91\x57\x22\x1d\x96\x3b\x95\x3d\xab\x51\x84\x8f\xd7\x1b\x25\xc7\x89"
  2557. "\x90\xd5\x16\xbd\x0f\xde\x83\x35\xcf\xde\x42\x1b\x51\xec",
  2558. 116);
  2559. memcpy(
  2560. (void*)0x200000000740,
  2561. "\x78\x9c\xec\xdd\xdf\x6e\x14\xe7\xd9\x00\xf0\x67\xf9\xa3\x0f\xf9\x93\x50"
  2562. "\xd5\x56\x08\x21\x42\x26\xd0\x4a\x20\x11\xb3\xbb\x0e\x46\x56\x8e\xb6\xe3"
  2563. "\x59\x7b\x92\xdd\x9d\xd5\xcc\x3a\x82\xa3\x08\x05\x13\x21\x4c\x52\x41\x2a"
  2564. "\x15\xce\x38\xa1\xad\xd4\x5e\x44\x4e\x7b\x11\xed\x15\x45\xbd\x84\x56\x33"
  2565. "\xbb\x26\x06\x6c\x2f\x05\xe2\x4d\xd1\xef\xb7\x82\xf7\xdd\x99\x67\xe6\x7d"
  2566. "\x66\xbc\x9a\x47\x63\xef\xcc\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2567. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2568. "\x00\x00\x00\x10\xad\x74\xbd\xdd\xee\xb4\x62\x90\x8f\xb6\x6e\x26\x07\x4b"
  2569. "\xd7\xcb\x62\x78\xc8\xfc\xdd\xf5\xfd\xf3\x85\xe6\x90\x71\x23\x5a\xf5\xbf"
  2570. "\x38\x75\x2a\xce\x4e\x27\x9d\xfd\xf5\x8f\xb3\xcf\xd4\xff\x5d\x8c\xf3\xd3"
  2571. "\x77\xe7\xe3\x54\xdd\x9c\x8a\x27\xff\x7f\xe6\x17\x9f\xfe\xea\xc4\xb1\xdd"
  2572. "\xe5\x0f\x49\xe8\x48\x3c\x7a\xfc\xe4\xfe\xed\x9d\x9d\xed\x87\x8b\x4e\x64"
  2573. "\x41\x36\xb2\x51\x5e\x15\xf9\xb0\xb7\x91\x25\x79\x55\x24\x6b\xab\xab\xed"
  2574. "\x6b\x9b\xfd\x2a\xe9\xe7\x83\xac\xba\x55\x4d\xb2\x61\x92\x96\x59\x6f\x52"
  2575. "\x94\xc9\xe5\xf4\x4a\xd2\x59\x5b\x5b\x49\xb2\xe5\x5b\xc5\xd6\x68\x63\xbd"
  2576. "\x37\xc8\x76\x27\xde\xf8\xb8\xdb\x6e\xaf\x26\x9f\x2d\x8f\xb3\x5e\x59\x15"
  2577. "\xa3\x6b\x9f\x2d\x57\xe9\x66\x3e\x18\xe4\xa3\x8d\x26\xa6\x9e\x5d\xc7\xdc"
  2578. "\xa8\x3f\x88\x9f\xe7\x93\x64\x92\xf5\x86\x49\x72\xf7\xde\xce\xf6\xca\xbc"
  2579. "\x24\xeb\xa0\xce\xeb\x04\x75\xe7\x05\x75\xdb\xdd\x6e\xa7\xd3\xed\x76\x56"
  2580. "\xaf\xaf\x5d\xbf\xd1\x6e\x9f\x78\x65\x42\xfb\x25\xf1\x4a\xc4\xe2\x3f\xb4"
  2581. "\x2c\xd6\x3b\x3e\x82\xc3\x9b\x3b\x36\xab\xff\x31\x88\x3c\x46\xb1\x15\x37"
  2582. "\x23\xd9\xf7\x95\xc6\x7a\x94\x51\xc4\xf0\x80\xf9\x33\xbb\xf5\xff\xb7\xd7"
  2583. "\xb2\x43\xc7\xdd\x5b\xff\x77\xab\xfc\xd9\x1f\x67\x9f\x8b\xa6\xfe\x5f\x98"
  2584. "\xbe\xbb\x70\x50\xfd\x3f\x20\x97\xa3\x7b\x3d\x8a\xc7\xf1\x24\xee\xc7\xed"
  2585. "\xd8\x89\x9d\xd8\x8e\x87\x0b\xcf\xe8\x68\x5f\x1b\x91\xc5\x28\xf2\xa8\xa2"
  2586. "\x88\x3c\x86\xd1\x6b\xa6\x24\xb3\x29\x49\xac\xc5\x6a\xac\x46\x3b\xbe\x8c"
  2587. "\xcd\xe8\x47\x15\x49\xf4\x23\x8f\x41\x64\x51\xc5\xad\xa8\x62\x12\x59\xf3"
  2588. "\x89\x4a\xa3\x8c\x2c\x7a\x31\x89\x22\xca\x48\xe2\x72\xa4\x71\x25\x92\xe8"
  2589. "\xc4\x5a\xac\xc5\x4a\x24\x91\xc5\x72\xdc\x8a\x22\xb6\x62\x14\x1b\xb1\x1e"
  2590. "\xbd\x66\x2d\x77\xe3\x5e\xb3\xdf\x57\x0e\xc9\xf1\x79\x50\xe7\x75\x82\xba"
  2591. "\x87\x04\xa9\xff\xbc\xbd\x77\x7f\x10\x87\x37\xf4\xef\xdd\xfa\x0f\x00\x00"
  2592. "\x00\xbc\xb7\x5a\xcd\x6f\xdf\xeb\xf3\xff\x93\xf1\x41\xd3\xeb\xe7\x83\xac"
  2593. "\xbd\xe8\xb4\x00\x00\x00\x80\x77\xa8\xf9\xcb\xff\xf9\xba\x39\x59\xf7\x3e"
  2594. "\x88\x96\xf3\x7f\x00\x00\x00\x78\xdf\xb4\x9a\x6b\xec\x5a\x11\xb1\x14\x1f"
  2595. "\x4e\x7b\xbb\x57\x42\xf9\x25\x00\x00\x00\x00\xbc\x27\x9a\xbf\xff\x5f\xa8"
  2596. "\x9b\xa5\xba\xf7\x61\xb4\x9c\xff\x03\x00\x00\xc0\xfb\xe6\xcf\x73\xef\xb1"
  2597. "\x5f\x8d\xff\xaf\xf5\x8f\x7f\x45\x59\x9e\x6c\x3d\x1d\xdf\xfc\x4d\xeb\x41"
  2598. "\xaf\x8e\xeb\x3d\x38\x3e\x5d\xee\xf8\xcb\x6b\x9c\xf4\xcf\xb5\x4e\xcf\x56"
  2599. "\xd2\x34\xab\x27\x66\xef\xd2\xec\x7c\x6b\x76\xf7\xcb\xe7\x37\xc1\xfc\x61"
  2600. "\xd6\xdc\x9d\x97\x47\xeb\x1d\x24\x10\x7f\x8d\x8f\xa6\x31\x1f\xdd\x99\xb6"
  2601. "\x77\x76\xe7\x4c\x47\x59\xea\xe7\x83\x6c\x39\x2d\x06\x9f\x76\xa2\xd7\x3b"
  2602. "\x7d\x6c\x92\xdd\x9c\xfc\xe1\x9b\x7b\x7f\x8c\x66\xf3\xff\x32\x1a\x9e\x6e"
  2603. "\xc5\xdd\x7b\x3b\xdb\xcb\x5f\x7d\xbb\x73\xa7\xc9\xe5\x69\xbd\x96\xa7\x0f"
  2604. "\x66\x37\x50\x7c\xe5\x3e\x8a\x87\xe4\xf2\x5d\x73\xbf\x85\xe6\x9a\x8b\x7d"
  2605. "\xb7\xf8\x64\x73\x21\xc6\x6c\xdc\xa5\xe9\xb8\xed\xbd\xdb\x7f\x6c\xba\xf8"
  2606. "\xb1\xff\x62\xcc\x67\x71\x71\x1a\x73\x71\x69\xda\x2e\xbd\xb8\xfd\xa7\xea"
  2607. "\x31\x3b\xcb\x07\x6d\xfd\x2c\x8b\xce\x5b\x6e\xf9\xb3\xb8\x34\x8d\xb9\x74"
  2608. "\xf9\xd2\xb4\xd9\x27\x8b\xee\xbc\x2c\xba\x7b\xb3\x78\xa3\x7d\xf1\x1a\x59"
  2609. "\xac\xcc\xcb\x62\xe5\x2d\xb3\x00\x58\x94\xbb\x73\xaa\x50\xeb\xd5\xc2\xff"
  2610. "\x06\x47\xb9\xa3\xa9\xee\xcf\xe2\xf2\x34\xe6\xf2\xb9\xe6\xc0\x7a\xe2\xdc"
  2611. "\x3e\x47\xf4\xf6\xbc\x23\x7a\xfb\x2d\xab\xdb\xdf\xe3\xca\x34\xe6\xca\x6e"
  2612. "\xf0\x41\x35\xb6\x1e\xf7\x6f\x2f\x55\xd5\xef\xeb\x05\xbe\x3f\x70\xdc\x6a"
  2613. "\xd0\x6d\xd5\xbb\xf0\xf8\x77\x0f\x7e\x1f\x67\x1e\x3d\x7e\xf2\xf1\xbd\x07"
  2614. "\xb7\xbf\xde\xfe\x7a\xfb\x9b\x6e\x77\x65\xb5\xfd\x49\xbb\x7d\xbd\x1b\x27"
  2615. "\x9b\xcd\x98\x35\x6a\x0f\x00\xfb\x98\xff\x8c\x9d\xb9\x11\xad\x4f\xe6\x9c"
  2616. "\x55\xff\xf2\xf9\x57\x0a\x96\xe3\xab\xf8\x36\x76\xe2\x4e\x5c\x6d\xae\x36"
  2617. "\x68\xbe\x71\xb0\xef\x5a\x97\xf6\x7c\x0d\xe1\xea\x9c\xb3\xd6\xa5\x3d\x4f"
  2618. "\x78\xb9\x3a\xe7\xac\x6e\x69\xcf\x83\x5e\x5e\x3f\x76\xe5\x08\x7e\x12\x00"
  2619. "\x70\x74\x2e\xce\xa9\xc3\xaf\x53\xff\xaf\xce\x39\xef\x7e\xb1\x96\x1f\x7e"
  2620. "\x76\xbc\xb7\x96\x03\x00\x3f\x8d\xac\xfc\xa1\xb5\x34\xf9\x53\xab\x2c\xf3"
  2621. "\xf1\x97\x9d\xb5\xb5\x4e\x6f\xb2\x99\x25\x65\x91\x7e\x9e\x94\xf9\xfa\x46"
  2622. "\x96\xe4\xa3\x49\x56\xa6\x9b\xbd\xd1\x46\x96\x8c\xcb\x62\x52\xa4\xc5\xa0"
  2623. "\xee\x7c\x91\xaf\x67\x55\x52\x6d\x8d\xc7\x45\x39\x49\xfa\x45\x99\x8c\x8b"
  2624. "\x2a\xbf\xd9\x3c\xf9\x3d\x99\x3d\xfa\xbd\xca\x86\xbd\xd1\x24\x4f\xab\xf1"
  2625. "\x20\xeb\x55\x59\x92\x16\xa3\x49\x2f\x9d\x24\xeb\x79\x95\x26\xe3\xad\xdf"
  2626. "\x0d\xf2\x6a\x33\x2b\x9b\x85\xab\x71\x96\xe6\xfd\x3c\xed\x4d\xf2\x62\x94"
  2627. "\x54\xc5\x56\x99\x66\xcb\x49\x52\x65\xd9\x9e\xc0\x7c\x3d\x1b\x4d\xf2\x7e"
  2628. "\x5e\x77\x47\xc9\xb8\xcc\x87\xbd\xf2\x56\xf2\x45\x31\xd8\x1a\x66\xc9\x7a"
  2629. "\x56\xa5\x65\x3e\x9e\x14\xd3\x15\xee\x8e\x95\x8f\xfa\x45\x39\x6c\x56\xbb"
  2630. "\xbc\xe8\x9d\x0d\x00\x3f\x13\x8f\x1e\x3f\xb9\x7f\x7b\x67\x67\xfb\xe1\x4f"
  2631. "\xd8\x59\xf4\x36\x02\x00\x2f\x52\xa5\x01\x00\x00\x00\x00\x00\x00\x00\x00"
  2632. "\x00\x00\xe0\xe7\xef\x28\xae\xff\xd3\xd1\xd1\xf9\x5f\xeb\x2c\xfa\xc8\x04"
  2633. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2634. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2635. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2636. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2637. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2638. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2639. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2640. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2641. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2642. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2643. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2644. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2645. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2646. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2647. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2648. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2649. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaf\xfa\x4f\x00\x00\x00\xff\xff"
  2650. "\xee\x6e\x58\x08",
  2651. 1606);
  2652. syz_mount_image(/*fs=*/0x200000000680, /*dir=*/0x2000000006c0, /*flags=*/0,
  2653. /*opts=*/0x2000000001c0, /*chdir=*/1, /*size=*/0x646,
  2654. /*img=*/0x200000000740);
  2655. syz_proconfig_set__sys_fs_ext4_sda_inode_readahead_blks(/*val=*/0x80000000);
  2656. syz_proconfig_reset__sys_fs_ext4_sda_inode_readahead_blks();
  2657. memcpy(
  2658. (void*)0x2000000001c0,
  2659. "secur\215ty.se|\374H\234\'}"
  2660. "\000\313u\000\000q\020B\220\332\2102\024\326\232\216ic\324N\t\352\r0\226"
  2661. "3\212R\321\266\r\361\332\263\246\216\266\203,\223wc\021k\027\234\255>"
  2662. "\005\317\265\341X\273H\221f\246T\000\000\000\000\275r\342\273T\025F$"
  2663. "\300?\211\266\354P\272\254\312=\352\240\273\361\327\005\301\354$E#"
  2664. "\306\214I5\023\312\035g\225\263I\355\252m\222\226q\005\000\344\225\0350"
  2665. "\330\243\340\350\245\322AH&\022\037\020\351\n\256\0167Y\306^"
  2666. "\340l\006A\365\304\345c\352\"#\312\275BQ\220\231E\020)N\335Kd\3431\231`"
  2667. "\277*"
  2668. "\020\356\200\004\300I\201\301\016\376\305i\245\273\030\242\223\0311V\275"
  2669. ",\273\265\352\376Z\036\311\224\345\310fnz\345\240F\212\346\003\000\235"
  2670. "\324\344\255\276\212;"
  2671. "\342\272\377\034\\\237U\337\244\223\2625\236\337\264\356\253)"
  2672. "\177\335\000\357\203$\346\35349=\000\000\321\300\360\316\221P;\242$"
  2673. "\223\023\336f\335\215\363\024+{"
  2674. "\366\236\260\361\362sf\257\225\213\345\360\334\3377\255\271#"
  2675. "m\227\353W\020[\260Bq\250\372^\347\311\024q\367\a\341\260z."
  2676. "K\2415\204\315",
  2677. 326);
  2678. syscall(__NR_memfd_create, /*name=*/0x2000000001c0ul,
  2679. /*flags=MFD_ALLOW_SEALING*/ 2ul);
  2680. memcpy((void*)0x200000000b80, "ext4\000", 5);
  2681. memcpy((void*)0x200000000bc0, "./file0\000", 8);
  2682. memcpy((void*)0x200000000140, "debug_want_extra_isize", 22);
  2683. *(uint8_t*)0x200000000156 = 0x3d;
  2684. sprintf((char*)0x200000000157, "0x%016llx", (long long)0xc000000000000000);
  2685. *(uint8_t*)0x200000000169 = 0x2c;
  2686. memcpy((void*)0x20000000016a, "nolazytime", 10);
  2687. *(uint8_t*)0x200000000174 = 0x2c;
  2688. memcpy((void*)0x200000000175, "stripe", 6);
  2689. *(uint8_t*)0x20000000017b = 0x3d;
  2690. sprintf((char*)0x20000000017c, "0x%016llx", (long long)5);
  2691. *(uint8_t*)0x20000000018e = 0x2c;
  2692. *(uint8_t*)0x20000000018f = 0;
  2693. memcpy(
  2694. (void*)0x2000000017c0,
  2695. "\x78\x9c\xec\xdc\xcd\x6b\x1c\xe5\x1f\x00\xf0\xef\x4c\x5e\xda\x5f\xd3\x9f"
  2696. "\x89\xe0\xc1\x7a\x0a\x68\xb1\x50\xba\x79\x69\x7d\x03\x0f\xed\x41\x4f\x16"
  2697. "\x0a\x0a\xde\xac\xeb\x66\x1b\x42\x36\xd9\x92\xdd\xd4\x26\x06\x6d\xa1\x1e"
  2698. "\x0a\x1e\x04\x7b\xf1\x58\xff\x04\xaf\x16\x29\x3d\xf5\xaa\x20\x82\xe0\xc1"
  2699. "\x83\x52\x0a\x45\x82\xc7\x06\x22\xb3\x99\xbc\x34\xd9\x4d\x93\x34\xc9\x42"
  2700. "\xfc\x7c\x60\x33\xdf\xef\x3c\xbb\xfb\xcc\x77\x67\xe6\xc9\xb3\xb0\x33\x01"
  2701. "\xfc\x67\xf5\x67\x7f\xd2\x88\x63\x11\xf1\x75\x12\xd1\x9b\xaf\x4f\x23\xa2"
  2702. "\xbb\x11\x1d\x8e\xb8\xb6\xf4\xbc\xc7\xf3\x73\xa5\x85\xf9\xb9\x52\x12\x8b"
  2703. "\x8b\xef\xff\x9d\x44\x92\xaf\x5b\x7e\xaf\x24\x5f\xf6\xe4\xc9\x8b\x11\x71"
  2704. "\xef\xcb\x88\x93\xe9\xc6\x7e\x6b\x33\xb3\xe3\xc5\x4a\xa5\x3c\x95\xe7\x03"
  2705. "\xf5\x89\xcb\x03\xb5\x99\xd9\x53\x63\x13\xc5\xd1\xf2\x68\x79\xf2\xcc\xd0"
  2706. "\x99\xb7\x5e\x3b\x3d\xf8\xe6\xf0\xeb\xbb\x56\xeb\xbb\x8b\xc5\x9f\x5f\xf9"
  2707. "\xe3\x9d\x5f\xef\xdc\xfc\xeb\xd3\x7b\xb7\x4e\x3f\x48\xe2\x6c\x1c\xcd\xdb"
  2708. "\xd6\xd6\xb1\x5b\xfa\xa3\x3f\xff\x4c\xba\xe2\xec\xba\xb6\x8f\x76\xbb\xb3"
  2709. "\x36\x4b\xda\xbd\x01\x00\x00\x6c\x49\x36\x35\xef\x88\x88\xce\xc8\xbe\x03"
  2710. "\xf4\x46\x47\x23\x02\x00\x00\x00\x0e\x92\x2f\x22\x62\x11\x00\x00\x00\x38"
  2711. "\xe0\x12\xdf\xff\x01\x00\x00\xe0\x80\x5b\xfe\x1d\xc0\xe3\xf9\xb9\xd2\xf2"
  2712. "\xa3\xbd\xbf\x48\xd8\x5f\x8f\xce\x45\x44\xdf\xea\xb5\xcd\x0b\x2b\xf5\x77"
  2713. "\xc6\xb5\xc6\xf2\x70\x74\x45\xc4\x91\x7f\x92\x27\xae\x8c\x48\x96\x5e\xf6"
  2714. "\xcc\xfa\x23\xe2\xfe\xcd\x1b\xc7\xee\xdf\xbc\xd1\x11\x7b\x74\x1d\x32\x40"
  2715. "\x33\xd7\xae\x47\xc4\xdd\xb3\x4d\xc6\xff\x24\x1f\xff\x76\x6e\x70\x5d\xde"
  2716. "\xec\x1e\x01\xfd\xeb\x72\xe3\x1f\xec\x9f\xbb\xe7\x96\x4e\xd4\x8d\xe7\x7f"
  2717. "\xba\x32\xff\x89\x26\xf3\x9f\x8e\x26\xe7\xee\x4e\x3c\xfd\xfc\x4f\x1f\xee"
  2718. "\x42\x37\x2d\x65\xf3\xbf\xb7\x23\x62\x61\xc3\xfc\x6f\xe5\xa6\x35\x7d\x1d"
  2719. "\x79\xf6\xff\xc6\x9c\xaf\x2b\xb9\x34\x56\x29\x67\x63\xdb\x73\x11\x71\x22"
  2720. "\xba\x0e\x65\xf9\xd0\x26\x7d\x1c\xff\x7c\xf6\xdb\x56\x6d\x6b\xe6\x7f\x8d"
  2721. "\x47\xd6\x7f\xb6\x5c\x7d\x46\xfa\xb0\xf3\xd0\x93\xaf\x19\x29\xd6\x8b\xcf"
  2722. "\x52\xf3\x5a\x8f\xae\x47\xbc\xd4\xd9\xac\xfe\x64\x65\xff\x27\x2d\xe6\xbf"
  2723. "\x17\xb6\xd8\xc7\x9d\xcf\xde\xf8\xbd\x55\xdb\xd3\xeb\xdf\x5b\x8b\xb7\x23"
  2724. "\x5e\x6d\xba\xff\x57\xff\x5b\x25\x9b\xdf\x9f\x68\xa0\x71\x3c\x0c\x2c\x1f"
  2725. "\x15\x1b\x7d\x3f\x7c\xfc\xab\x56\xfd\xb7\xbb\xfe\x6c\xff\x1f\xd9\xbc\xfe"
  2726. "\xbe\x64\xed\xfd\x9a\x6a\xdb\xef\xe3\x9b\x1f\x3e\xfc\xb3\x55\xdb\x4e\x8f"
  2727. "\xff\xee\xe4\x83\x46\xdc\x9d\xaf\xbb\x5a\xac\xd7\xa7\x86\x22\xba\x93\xf7"
  2728. "\x36\xae\x1f\x5e\x7d\xed\x72\xbe\xfc\xfc\xac\xfe\x13\x2f\x37\x3f\xff\x37"
  2729. "\x3b\xfe\xb3\x31\xe1\xe3\xfc\x53\xca\xc6\x86\x62\xbe\xcc\xf2\x4f\xd6\xd5"
  2730. "\xf8\xdb\x4f\x3d\x27\x77\x5e\xff\xde\xca\xea\x1f\xd9\xd6\xfe\xdf\x7e\x70"
  2731. "\xfb\xbb\x1f\x7f\x69\xd5\xff\xd6\xf6\xff\x99\x46\x74\x22\x5f\xb3\x95\xf1"
  2732. "\x6f\xab\x1b\xf8\x2c\x9f\x1d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2733. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2734. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfb\x27\x8d\x88"
  2735. "\xa3\x91\xa4\x85\x95\x38\x4d\x0b\x85\x88\x9e\x88\x78\x21\x8e\xa4\x95\x6a"
  2736. "\xad\x7e\xf2\x52\x75\x7a\x72\x24\x6b\x8b\xe8\x8b\xae\xf4\xd2\x58\xa5\x3c"
  2737. "\x18\x11\xbd\x4b\x79\x92\xe5\x43\x8d\x78\x35\x1f\x5e\x97\x9f\x8e\x88\xe7"
  2738. "\x23\xe2\x56\xef\xff\x1a\x79\xa1\x54\xad\x8c\xb4\xbb\x78\x00\x00\x00\x00"
  2739. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2740. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2741. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2742. "\x00\x00\x00\x00\x00\x56\xf4\x44\xc4\xd1\x48\xd2\x42\x44\xa4\x8d\x38\x4d"
  2743. "\x0b\x85\xa5\xb6\x07\xbd\xed\xde\x3a\x00\x00\x00\x60\xd7\xf4\xb5\x7b\x03"
  2744. "\x00\x00\x00\x80\x3d\xe7\xfb\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2745. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2746. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2747. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2748. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2749. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2750. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2751. "\xb0\x0b\x2e\x9c\x3f\x9f\x3d\x16\x17\xe6\xe7\x4a\x59\x3e\x72\x65\x66\x7a"
  2752. "\xbc\x7a\xe5\xd4\x48\xb9\x36\x5e\x98\x98\x2e\x15\x4a\xd5\xa9\xcb\x85\xd1"
  2753. "\x6a\x75\xb4\x52\x2e\x94\xaa\x13\x4f\x7b\xbf\x4a\xb5\x7a\x79\x30\x26\xa7"
  2754. "\xaf\x0e\xd4\xcb\xb5\xfa\x40\x6d\x66\xf6\xe2\x44\x75\x7a\xb2\x7e\x71\x6c"
  2755. "\xa2\x38\x5a\xbe\x58\xee\xda\x97\xaa\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2756. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2757. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2758. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2759. "\xd8\xae\xda\xcc\xec\x78\xb1\x52\x29\x4f\x09\x04\x02\xc1\x4a\xd0\xee\x91"
  2760. "\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2761. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2762. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2763. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2764. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2765. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2766. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2767. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2768. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2769. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2770. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2771. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2772. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2773. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2774. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2775. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2776. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2777. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2778. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2779. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2780. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2781. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2782. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2783. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2784. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2785. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2786. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2787. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2788. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2789. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2790. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2791. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2792. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2793. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2794. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2795. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2796. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2797. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2798. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2799. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2800. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2801. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2802. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2803. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2804. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2805. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2806. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2807. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2808. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2809. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2810. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2811. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2812. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2813. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2814. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2815. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2816. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2817. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2818. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2819. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2820. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2821. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2822. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2823. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2824. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2825. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2826. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2827. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2828. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2829. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2830. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2831. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2832. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2833. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2834. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2835. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2836. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2837. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2838. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2839. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2840. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2841. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2842. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2843. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2844. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2845. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2846. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2847. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2848. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2849. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2850. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2851. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2852. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2853. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2854. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2855. "\x00\x00\x00\x80\x83\xec\xdf\x00\x00\x00\xff\xff\xe8\x68\x12\xd0",
  2856. 2896);
  2857. syz_mount_image(/*fs=*/0x200000000b80, /*dir=*/0x200000000bc0, /*flags=*/0,
  2858. /*opts=*/0x200000000140, /*chdir=*/1, /*size=*/0xb50,
  2859. /*img=*/0x2000000017c0);
  2860. res = syscall(__NR_inotify_init1, /*flags=*/0ul);
  2861. if (res != -1)
  2862. r[30] = res;
  2863. res = -1;
  2864. res = syz_open_procfs(/*pid=*/-1, /*file=*/0);
  2865. if (res != -1)
  2866. r[31] = res;
  2867. syscall(__NR_lseek, /*fd=*/-1, /*offset=*/0ul, /*whence=*/0ul);
  2868. syz_proconfig_reset__sys_devices_breakpoint_perf_event_mux_interval_ms();
  2869. syscall(__NR_inotify_rm_watch, /*fd=*/r[30], /*wd=*/0);
  2870. syscall(__NR_unlink, /*path=*/0ul);
  2871. memcpy((void*)0x200000000080, "memory.events\000", 14);
  2872. res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000080ul,
  2873. /*flags=*/0x275a, /*mode=*/0);
  2874. if (res != -1)
  2875. r[32] = res;
  2876. memcpy((void*)0x200000000040, "memory.events\000", 14);
  2877. res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000040ul,
  2878. /*flags=*/0x275a, /*mode=*/0);
  2879. if (res != -1)
  2880. r[33] = res;
  2881. syscall(__NR_io_pgetevents, /*ctx=*/0ul, /*min_nr=*/0ul, /*nr=*/0ul,
  2882. /*events=*/0ul, /*timeout=*/0ul, /*usig=*/0ul);
  2883. memcpy((void*)0x200000000100, "memory.events\000", 14);
  2884. res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000100ul,
  2885. /*flags=*/0x100002, /*mode=*/0);
  2886. if (res != -1)
  2887. r[34] = res;
  2888. syscall(__NR_dup2, /*oldfd=*/r[31], /*newfd=*/r[33]);
  2889. sprintf((char*)0x200000000200, "0x%016llx", (long long)0);
  2890. syscall(__NR_write, /*fd=*/r[33], /*buf=*/0x200000000200ul, /*len=*/0xfdeful);
  2891. syscall(__NR_copy_file_range, /*fd_in=*/r[32], /*off_in=*/0ul,
  2892. /*fd_out=*/r[34], /*off_out=*/0ul, /*len=*/9ul, /*flags=*/0ul);
  2893. syscall(__NR_write, /*fd=*/-1, /*buf=*/0ul, /*len=*/0ul);
  2894. syscall(__NR_unshare, /*flags=CLONE_NEWPID|CLONE_NEWNET*/ 0x60000000ul);
  2895. *(uint64_t*)0x200000000340 = 0x101;
  2896. syscall(__NR_sched_setaffinity, /*pid=*/-1, /*cpusetsize=*/8ul,
  2897. /*mask=*/0x200000000340ul);
  2898. syz_genetlink_get_family_id(/*name=*/0, /*fd=*/-1);
  2899. *(uint64_t*)0x200000000100 = 0;
  2900. res = syscall(__NR_signalfd, /*fd=*/-1, /*mask=*/0x200000000100ul,
  2901. /*size=*/8ul);
  2902. if (res != -1)
  2903. r[35] = res;
  2904. syscall(__NR_fcntl, /*fd=*/r[35], /*cmd=*/8ul, /*pid=*/0);
  2905. syscall(__NR_fcntl, /*fd=*/r[35], /*cmd=*/9ul, /*sz=*/0ul);
  2906. syz_sysconfig_set__proc_sys_vm_vfs_cache_pressure(/*val=*/0);
  2907. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/2ul, /*proto=*/0);
  2908. if (res != -1)
  2909. r[36] = res;
  2910. syscall(__NR_write, /*fd=*/r[36], /*data=*/0x200000000080ul, /*len=*/0x70ul);
  2911. syscall(__NR_renameat, /*oldfd=*/-1, /*old=*/0ul, /*newfd=*/-1, /*new=*/0ul);
  2912. syz_sysconfig_reset__proc_sys_vm_vfs_cache_pressure();
  2913. res = -1;
  2914. res = syz_open_dev(/*dev=*/0xc, /*major=*/4, /*minor=*/1);
  2915. if (res != -1)
  2916. r[37] = res;
  2917. syscall(__NR_ioctl, /*fd=*/r[37], /*cmd=*/0x540a, /*arg=TCIOFF*/ 2ul);
  2918. syscall(__NR_madvise, /*addr=*/0x200000aab000ul, /*len=*/0x3000ul,
  2919. /*advice=*/0ul);
  2920. res = syscall(__NR_socket, /*domain=*/0x11ul, /*type=SOCK_DGRAM*/ 2ul,
  2921. /*proto=*/0x300);
  2922. if (res != -1)
  2923. r[38] = res;
  2924. memcpy((void*)0x200000000000, "./file0\000", 8);
  2925. *(uint64_t*)0x200000000040 = 0;
  2926. *(uint64_t*)0x200000000048 = 0x94;
  2927. *(uint64_t*)0x200000000050 = 1;
  2928. res = syscall(__NR_openat2, /*fd=*/0xffffffffffffff9cul,
  2929. /*file=*/0x200000000000ul, /*how=*/0x200000000040ul,
  2930. /*size=*/0x18ul);
  2931. if (res != -1)
  2932. r[39] = res;
  2933. memcpy((void*)0x200000000080, "./file0\000", 8);
  2934. syscall(__NR_openat, /*fd=*/r[39], /*file=*/0x200000000080ul,
  2935. /*flags=O_NOATIME|O_CREAT|O_APPEND*/ 0x40440, /*mode=S_IXGRP*/ 8);
  2936. syz_proconfig_reset__sys_fs_ext4_sda_mb_min_to_scan();
  2937. *(uint32_t*)0x200000000100 = 0x401;
  2938. *(uint32_t*)0x200000000104 = 0x4010;
  2939. *(uint32_t*)0x200000000108 = 0x91;
  2940. *(uint32_t*)0x20000000010c = 0x81;
  2941. syscall(__NR_setsockopt, /*fd=*/r[38], /*level=*/0x107, /*optname=*/5,
  2942. /*optval=*/0x200000000100ul, /*optlen=*/0x10ul);
  2943. syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x2000ul, /*prot=*/0ul,
  2944. /*flags=MAP_FIXED|MAP_SHARED*/ 0x11ul, /*fd=*/r[38], /*offset=*/0ul);
  2945. syz_proconfig_set__sys_fs_ext4_sda_mb_min_to_scan(/*val=*/-1);
  2946. memcpy((void*)0x200000000100, "update ", 7);
  2947. memcpy((void*)0x200000000107, "ecryptfs", 8);
  2948. *(uint8_t*)0x20000000010f = 0x20;
  2949. memcpy((void*)0x200000000110, "trusted:", 8);
  2950. memcpy((void*)0x200000000118, "user\000", 5);
  2951. *(uint8_t*)0x20000000011d = 0;
  2952. syscall(__NR_keyctl, /*code=*/0xcul, /*key=*/0, /*payload=*/0x200000000100ul,
  2953. /*paylen=*/0xfffffffffffffd81ul, /*keyring=*/0);
  2954. res = syscall(__NR_socketpair, /*domain=*/1ul, /*type=SOCK_STREAM*/ 1ul,
  2955. /*proto=*/0, /*fds=*/0x200000000040ul);
  2956. if (res != -1)
  2957. r[40] = *(uint32_t*)0x200000000044;
  2958. memcpy((void*)0x200000000280,
  2959. ")\213\212\026\021\222O\325 "
  2960. "1\301\214N\355H\335\337k\201\377\377\377\377\377\377\377J\002u\233"
  2961. "\257a\254\320\370TU\257\266\274\322\377\253ll\312\332\220\316\347\357"
  2962. "\230\3628\2128\375\212\006o\3600\317^\250\306\275> "
  2963. "zY3R\316h\354\001b\264\201}\313\f\032\331S*"
  2964. "\373\327Eh5\310\224\317eX0L\032\266\274\v\002)^"
  2965. "\a\257\333\246\336\255 \314N\312\005yy\333",
  2966. 120);
  2967. res = syscall(__NR_memfd_create, /*name=*/0x200000000280ul,
  2968. /*flags=MFD_ALLOW_SEALING|MFD_CLOEXEC*/ 3ul);
  2969. if (res != -1)
  2970. r[41] = res;
  2971. syscall(__NR_write, /*fd=*/r[41], /*data=*/0x2000000002c0ul, /*len=*/8ul);
  2972. *(uint64_t*)0x2000000001c0 = 0;
  2973. syscall(__NR_sendfile, /*fdout=*/r[40], /*fdin=*/r[41],
  2974. /*off=*/0x2000000001c0ul, /*count=*/0xfffful);
  2975. syscall(__NR_fcntl, /*fd=*/r[41], /*cmd=*/0x409ul,
  2976. /*seals=F_SEAL_WRITE*/ 8ul);
  2977. syscall(__NR_mmap, /*addr=*/0x200000ffe000ul, /*len=*/0x1000ul,
  2978. /*prot=PROT_GROWSDOWN|PROT_SEM*/ 0x1000008ul,
  2979. /*flags=MAP_FIXED|MAP_32BIT*/ 0x50ul, /*fd=*/-1,
  2980. /*offset=*/0x7716f000ul);
  2981. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/0);
  2982. syscall(__NR_fallocate, /*fd=*/r[41], /*mode=*/0ul, /*off=*/0ul,
  2983. /*len=*/0x18e7ul);
  2984. syscall(__NR_write, /*fd=*/r[41], /*buf=*/0x200000000300ul, /*count=*/0ul);
  2985. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0ul,
  2986. /*flags=*/0x200002, /*mode=*/0);
  2987. if (res != -1)
  2988. r[42] = res;
  2989. memcpy((void*)0x200000000000, "syz0\000", 5);
  2990. syscall(__NR_openat, /*fd=*/r[42], /*file=*/0x200000000000ul,
  2991. /*flags=*/0x200002, /*mode=*/0);
  2992. syscall(__NR_openat, /*fd=*/r[42], /*file=*/0ul, /*flags=*/0x26e1,
  2993. /*mode=*/0);
  2994. syscall(__NR_timer_create, /*id=*/0ul, /*ev=*/0ul, /*timerid=*/0ul);
  2995. syz_sysconfig_set__proc_sys_net_ipv4_neigh_sit0_unres_qlen_bytes(/*val=*/0);
  2996. syscall(__NR_msgget, /*key=*/0ul, /*flags=*/0ul);
  2997. *(uint16_t*)0x200000000240 = 2;
  2998. *(uint64_t*)0x200000000248 = 0x200000000040;
  2999. *(uint16_t*)0x200000000040 = 5;
  3000. *(uint8_t*)0x200000000042 = 0;
  3001. *(uint8_t*)0x200000000043 = 0;
  3002. *(uint32_t*)0x200000000044 = 0;
  3003. *(uint16_t*)0x200000000048 = 6;
  3004. *(uint8_t*)0x20000000004a = 0;
  3005. *(uint8_t*)0x20000000004b = 0;
  3006. *(uint32_t*)0x20000000004c = 0;
  3007. syscall(__NR_seccomp, /*op=*/1ul, /*flags=*/0ul, /*arg=*/0x200000000240ul);
  3008. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  3009. *(uint32_t*)0x2000000001c0 = 2;
  3010. *(uint32_t*)0x2000000001c4 = 0x80;
  3011. *(uint8_t*)0x2000000001c8 = 0x52;
  3012. *(uint8_t*)0x2000000001c9 = 1;
  3013. *(uint8_t*)0x2000000001ca = 0;
  3014. *(uint8_t*)0x2000000001cb = 0;
  3015. *(uint32_t*)0x2000000001cc = 0;
  3016. *(uint64_t*)0x2000000001d0 = 0;
  3017. *(uint64_t*)0x2000000001d8 = 0;
  3018. *(uint64_t*)0x2000000001e0 = 0;
  3019. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 0, 1);
  3020. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 1, 1);
  3021. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 2, 1);
  3022. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 3, 1);
  3023. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 4, 1);
  3024. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 5, 1);
  3025. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 6, 1);
  3026. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 7, 1);
  3027. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 8, 1);
  3028. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 9, 1);
  3029. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 10, 1);
  3030. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 11, 1);
  3031. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 12, 1);
  3032. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 13, 1);
  3033. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 14, 1);
  3034. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 15, 2);
  3035. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 17, 1);
  3036. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 18, 1);
  3037. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 19, 1);
  3038. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 20, 1);
  3039. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 21, 1);
  3040. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 22, 1);
  3041. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 23, 1);
  3042. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 24, 1);
  3043. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 25, 1);
  3044. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 26, 1);
  3045. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 27, 1);
  3046. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 28, 1);
  3047. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 29, 1);
  3048. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 30, 1);
  3049. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 31, 1);
  3050. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 32, 1);
  3051. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 33, 1);
  3052. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 34, 1);
  3053. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 35, 1);
  3054. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 36, 1);
  3055. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 37, 1);
  3056. STORE_BY_BITMASK(uint64_t, , 0x2000000001e8, 0, 38, 26);
  3057. *(uint32_t*)0x2000000001f0 = 0;
  3058. *(uint32_t*)0x2000000001f4 = 0;
  3059. *(uint64_t*)0x2000000001f8 = 0;
  3060. *(uint64_t*)0x200000000200 = 0;
  3061. *(uint64_t*)0x200000000208 = 0;
  3062. *(uint64_t*)0x200000000210 = 0;
  3063. *(uint32_t*)0x200000000218 = 0;
  3064. *(uint32_t*)0x20000000021c = 0;
  3065. *(uint64_t*)0x200000000220 = 0;
  3066. *(uint32_t*)0x200000000228 = 0;
  3067. *(uint16_t*)0x20000000022c = 0;
  3068. *(uint16_t*)0x20000000022e = 0;
  3069. *(uint32_t*)0x200000000230 = 0;
  3070. *(uint32_t*)0x200000000234 = 0;
  3071. *(uint64_t*)0x200000000238 = 0;
  3072. syscall(__NR_perf_event_open, /*attr=*/0x2000000001c0ul, /*pid=*/0,
  3073. /*cpu=*/-1, /*group=*/-1, /*flags=*/0ul);
  3074. memcpy((void*)0x200000000000, "./bus\000", 6);
  3075. res = syscall(__NR_creat, /*file=*/0x200000000000ul, /*mode=*/0ul);
  3076. if (res != -1)
  3077. r[43] = res;
  3078. *(uint32_t*)0x200000000200 = 9;
  3079. *(uint32_t*)0x200000000204 = 0x80;
  3080. *(uint8_t*)0x200000000208 = 0;
  3081. *(uint8_t*)0x200000000209 = 0;
  3082. *(uint8_t*)0x20000000020a = 0;
  3083. *(uint8_t*)0x20000000020b = 0;
  3084. *(uint32_t*)0x20000000020c = 0;
  3085. *(uint64_t*)0x200000000210 = 0;
  3086. *(uint64_t*)0x200000000218 = 0;
  3087. *(uint64_t*)0x200000000220 = 0;
  3088. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 0, 1);
  3089. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 1, 1);
  3090. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 2, 1);
  3091. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 3, 1);
  3092. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 4, 1);
  3093. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 5, 1);
  3094. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 6, 1);
  3095. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 7, 1);
  3096. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 8, 1);
  3097. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 9, 1);
  3098. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 10, 1);
  3099. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 11, 1);
  3100. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 12, 1);
  3101. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 13, 1);
  3102. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 14, 1);
  3103. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 15, 2);
  3104. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 17, 1);
  3105. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 18, 1);
  3106. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 19, 1);
  3107. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 20, 1);
  3108. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 21, 1);
  3109. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 22, 1);
  3110. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 23, 1);
  3111. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 24, 1);
  3112. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 25, 1);
  3113. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 26, 1);
  3114. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 27, 1);
  3115. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 28, 1);
  3116. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 29, 1);
  3117. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 30, 1);
  3118. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 31, 1);
  3119. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 32, 1);
  3120. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 33, 1);
  3121. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 34, 1);
  3122. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 35, 1);
  3123. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 36, 1);
  3124. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 37, 1);
  3125. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 38, 26);
  3126. *(uint32_t*)0x200000000230 = 0;
  3127. *(uint32_t*)0x200000000234 = 0;
  3128. *(uint64_t*)0x200000000238 = 0x200000000000;
  3129. *(uint64_t*)0x200000000240 = 0;
  3130. *(uint64_t*)0x200000000248 = 0;
  3131. *(uint64_t*)0x200000000250 = 0;
  3132. *(uint32_t*)0x200000000258 = 0;
  3133. *(uint32_t*)0x20000000025c = 0;
  3134. *(uint64_t*)0x200000000260 = 0;
  3135. *(uint32_t*)0x200000000268 = 0;
  3136. *(uint16_t*)0x20000000026c = 0;
  3137. *(uint16_t*)0x20000000026e = 0;
  3138. *(uint32_t*)0x200000000270 = 0;
  3139. *(uint32_t*)0x200000000274 = 0;
  3140. *(uint64_t*)0x200000000278 = 0;
  3141. syscall(__NR_perf_event_open, /*attr=*/0x200000000200ul, /*pid=*/0,
  3142. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  3143. memcpy((void*)0x200000000080, "./bus\000", 6);
  3144. res = syscall(__NR_open, /*file=*/0x200000000080ul, /*flags=*/0ul,
  3145. /*mode=*/0ul);
  3146. if (res != -1)
  3147. r[44] = res;
  3148. *(uint64_t*)0x2000000000c0 = 0xfa17;
  3149. *(uint64_t*)0x2000000000c8 = 6;
  3150. *(uint64_t*)0x2000000000d0 = 1;
  3151. *(uint64_t*)0x2000000000d8 = 0x7fffffffffffffff;
  3152. *(uint64_t*)0x2000000000e0 = 0x8000000000000000;
  3153. *(uint64_t*)0x2000000000e8 = 3;
  3154. *(uint64_t*)0x2000000000f0 = 0x400;
  3155. *(uint64_t*)0x2000000000f8 = 5;
  3156. *(uint32_t*)0x200000000100 = 0x20000;
  3157. syscall(__NR_quotactl_fd, /*fd=*/r[43],
  3158. /*cmd=Q_SETQUOTA_USR*/ 0xffffffff80000800ul, /*id=*/-1,
  3159. /*addr=*/0x2000000000c0ul);
  3160. *(uint64_t*)0x200000000040 = r[43];
  3161. syscall(__NR_write, /*fd=*/r[43], /*data=*/0x200000000040ul, /*size=*/0x23ul);
  3162. syscall(__NR_mmap, /*addr=*/0x2000004c8000ul, /*len=*/0x1000ul, /*prot=*/0ul,
  3163. /*flags=MAP_FIXED|MAP_PRIVATE*/ 0x12ul, /*fd=*/r[44], /*offset=*/0ul);
  3164. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/5);
  3165. syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul,
  3166. /*prot=PROT_GROWSUP|PROT_SEM|PROT_WRITE|PROT_EXEC|0xb635773f04ebbee0*/
  3167. 0xb635773f06ebbeeeul,
  3168. /*flags=MAP_POPULATE|MAP_FIXED|MAP_ANONYMOUS|MAP_SHARED*/ 0x8031ul,
  3169. /*fd=*/-1, /*offset=*/0ul);
  3170. *(uint8_t*)0x200000000000 = 0;
  3171. syscall(__NR_prctl, /*option=*/0x3bul, /*mode=*/1ul, /*offset=*/0ul,
  3172. /*len=*/0ul, /*selector=*/0x200000000000ul);
  3173. syscall(__NR_madvise, /*addr=*/0x200000000000ul, /*len=*/0x60000bul,
  3174. /*advice=MADV_REMOVE*/ 9ul);
  3175. syscall(__NR_ioctl, /*fd=*/r[43], /*cmd=*/0x40043d04, /*arg=*/0ul);
  3176. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  3177. syscall(__NR_chdir, /*dir=*/0ul);
  3178. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/1);
  3179. memcpy((void*)0x2000000000c0, "./bus\000", 6);
  3180. res = syscall(__NR_open, /*file=*/0x2000000000c0ul,
  3181. /*flags=O_SYNC|O_NOCTTY|O_EXCL|O_CREAT|O_RDWR|0x3c*/ 0x1011feul,
  3182. /*mode=*/0ul);
  3183. if (res != -1)
  3184. r[45] = res;
  3185. res = syscall(__NR_open, /*file=*/0ul,
  3186. /*flags=O_SYNC|O_NOATIME|O_CREAT|O_RDWR*/ 0x141042ul,
  3187. /*mode=*/0ul);
  3188. if (res != -1)
  3189. r[46] = res;
  3190. *(uint64_t*)0x200000000180 = 0x200000000040;
  3191. memcpy((void*)0x200000000040,
  3192. "\x03\xc2\xcc\xcf\x16\x72\x39\x85\xdb\x6e\x2a\xc8\x6b\x45\xb1\xaa",
  3193. 16);
  3194. *(uint64_t*)0x200000000188 = 0x10;
  3195. syscall(__NR_pwritev, /*fd=*/-1, /*vec=*/0x200000000180ul, /*vlen=*/1ul,
  3196. /*off_low=*/0, /*off_high=*/0);
  3197. memcpy((void*)0x200000000000, "./bus\000", 6);
  3198. syscall(__NR_chdir, /*dir=*/0x200000000000ul);
  3199. syscall(__NR_ioctl, /*fd=*/r[45], /*cmd=*/0x8904, /*arg=*/0x200000000080ul);
  3200. memcpy((void*)0x200000002000, "./bus\000", 6);
  3201. res = syscall(__NR_open, /*file=*/0x200000002000ul,
  3202. /*flags=O_SYNC|O_NONBLOCK|O_NOFOLLOW|O_NOATIME|O_CREAT|O_RDWR*/
  3203. 0x161842ul, /*mode=*/0ul);
  3204. if (res != -1)
  3205. r[47] = res;
  3206. syscall(__NR_ftruncate, /*fd=*/r[47], /*len=*/0x2007ffful);
  3207. syscall(__NR_connect, /*fd=*/r[46], /*addr=*/0ul, /*addrlen=*/0ul);
  3208. syscall(__NR_lseek, /*fd=*/r[45], /*offset=*/0ul, /*whence=SEEK_HOLE*/ 4ul);
  3209. syscall(__NR_sendfile, /*fdout=*/r[45], /*fdin=*/r[45], /*off=*/0ul,
  3210. /*count=*/0x8080fffffffeul);
  3211. syscall(__NR_ftruncate, /*fd=*/r[45], /*len=*/4ul);
  3212. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  3213. res = syscall(__NR_socket, /*domain=AF_NETLINK*/ 0x10ul,
  3214. /*type=SOCK_RAW*/ 3ul, /*proto=*/0);
  3215. if (res != -1)
  3216. r[48] = res;
  3217. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/4);
  3218. memcpy((void*)0x200000000300,
  3219. "sit0\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  3220. *(uint64_t*)0x200000000310 = 0x200000000240;
  3221. memcpy((void*)0x200000000240, "syztnl2\000\000\000\000\000\000\000\000\000",
  3222. 16);
  3223. *(uint32_t*)0x200000000250 = 0;
  3224. *(uint16_t*)0x200000000254 = htobe16(0);
  3225. *(uint16_t*)0x200000000256 = htobe16(0);
  3226. *(uint32_t*)0x200000000258 = htobe32(0);
  3227. *(uint32_t*)0x20000000025c = htobe32(0);
  3228. STORE_BY_BITMASK(uint8_t, , 0x200000000260, 5, 0, 4);
  3229. STORE_BY_BITMASK(uint8_t, , 0x200000000260, 4, 4, 4);
  3230. STORE_BY_BITMASK(uint8_t, , 0x200000000261, 0, 0, 2);
  3231. STORE_BY_BITMASK(uint8_t, , 0x200000000261, 0, 2, 6);
  3232. *(uint16_t*)0x200000000262 = htobe16(0x14);
  3233. *(uint16_t*)0x200000000264 = htobe16(0);
  3234. *(uint16_t*)0x200000000266 = htobe16(0);
  3235. *(uint8_t*)0x200000000268 = 0;
  3236. *(uint8_t*)0x200000000269 = 0;
  3237. *(uint16_t*)0x20000000026a = htobe16(0);
  3238. *(uint32_t*)0x20000000026c = htobe32(0xe0000002);
  3239. *(uint32_t*)0x200000000270 = htobe32(0);
  3240. struct csum_inet csum_2;
  3241. csum_inet_init(&csum_2);
  3242. csum_inet_update(&csum_2, (const uint8_t*)0x200000000260, 20);
  3243. *(uint16_t*)0x20000000026a = csum_inet_digest(&csum_2);
  3244. syscall(__NR_ioctl, /*fd=*/r[48], /*cmd=*/0x89f1, /*arg=*/0x200000000300ul);
  3245. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  3246. syz_sysconfig_set__proc_sys_vm_zone_reclaim_mode(/*val=*/0xfffff591);
  3247. memcpy((void*)0x200000000280, "./file0\000", 8);
  3248. res = syscall(__NR_creat, /*file=*/0x200000000280ul,
  3249. /*mode=S_IXOTH|S_IWOTH*/ 3ul);
  3250. if (res != -1)
  3251. r[49] = res;
  3252. memcpy((void*)0x200000000300, "#! ", 3);
  3253. *(uint8_t*)0x200000000303 = 0x20;
  3254. memcpy((void*)0x200000000304,
  3255. "\343\f\223@\002\347\205\025\261="
  3256. "\2001\257\337F\335\t\214\374\341\2155\b4\003\000\000\000\025\025\004"
  3257. "\v\214\206\\m\n\203\t\320\353\226c\362\371\300g\254;s "
  3258. "\305s\306p536\301\241hE\207\340\260\003%$"
  3259. "\256\253\207\240G\330h\227\367\027f\204\326\314_"
  3260. "\204\317gm\2567\003\241\034\241\001\003\262\276\253\334s3\000\322."
  3261. "\026Us\353U\245\321\267\275u`"
  3262. "\247P\306t\250\370s\320\003\230\266\253\327\244\312\375\223\311\202"
  3263. "\2264\230Wb|"
  3264. "M\000\000\000\200\000\000\000\000\302zG\362\337\b\303\335\335\206\247"
  3265. "\331\352_\347\245\004\270e\270n\256_\321\f\250sin\177,"
  3266. "\r\2743\2039\246\310\021\356\016_"
  3267. "65\2263\267\263\b\030\246\363U\314s\303\005Sv\253\201\t\311\205\361"
  3268. "\362*&\251\356w\2104\241\300<p\005_\310\301\253\202%~s:C\252\005-"
  3269. "\247\006\332{\215\177\214\006\371\0323\3559^\365\252z\247_X\305\371<"
  3270. "\211T\362t\216\215\267e<D\244\215\326\032\004\rb{"
  3271. "\345F\357\201\271T\305$\\\223",
  3272. 291);
  3273. *(uint8_t*)0x200000000427 = 0xa;
  3274. syscall(__NR_write, /*fd=*/r[49], /*data=*/0x200000000300ul, /*len=*/0x128ul);
  3275. *(uint32_t*)0x200000000040 = 4;
  3276. *(uint32_t*)0x200000000044 = 0x80;
  3277. *(uint8_t*)0x200000000048 = 9;
  3278. *(uint8_t*)0x200000000049 = 0x81;
  3279. *(uint8_t*)0x20000000004a = 5;
  3280. *(uint8_t*)0x20000000004b = 0xdf;
  3281. *(uint32_t*)0x20000000004c = 0;
  3282. *(uint64_t*)0x200000000050 = 0x101;
  3283. *(uint64_t*)0x200000000058 = 0x9204;
  3284. *(uint64_t*)0x200000000060 = 9;
  3285. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 0, 1);
  3286. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 1, 1);
  3287. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 2, 1);
  3288. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 3, 1);
  3289. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 4, 1);
  3290. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 5, 1);
  3291. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 6, 1);
  3292. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 7, 1);
  3293. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 8, 1);
  3294. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 9, 1);
  3295. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 10, 1);
  3296. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 11, 1);
  3297. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 12, 1);
  3298. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 13, 1);
  3299. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 14, 1);
  3300. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 3, 15, 2);
  3301. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 17, 1);
  3302. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 18, 1);
  3303. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 19, 1);
  3304. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 20, 1);
  3305. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 21, 1);
  3306. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 22, 1);
  3307. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 23, 1);
  3308. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 24, 1);
  3309. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 25, 1);
  3310. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 26, 1);
  3311. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 27, 1);
  3312. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 28, 1);
  3313. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 29, 1);
  3314. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 30, 1);
  3315. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 31, 1);
  3316. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 32, 1);
  3317. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 33, 1);
  3318. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 34, 1);
  3319. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 35, 1);
  3320. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 36, 1);
  3321. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 37, 1);
  3322. STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 38, 26);
  3323. *(uint32_t*)0x200000000070 = 0xff;
  3324. *(uint32_t*)0x200000000074 = 0;
  3325. *(uint64_t*)0x200000000078 = 0x200000000000;
  3326. *(uint64_t*)0x200000000080 = 0;
  3327. *(uint64_t*)0x200000000088 = 0x8000;
  3328. *(uint64_t*)0x200000000090 = 5;
  3329. *(uint32_t*)0x200000000098 = 5;
  3330. *(uint32_t*)0x20000000009c = 8;
  3331. *(uint64_t*)0x2000000000a0 = 8;
  3332. *(uint32_t*)0x2000000000a8 = 6;
  3333. *(uint16_t*)0x2000000000ac = 0xb7;
  3334. *(uint16_t*)0x2000000000ae = 0;
  3335. *(uint32_t*)0x2000000000b0 = 0;
  3336. *(uint32_t*)0x2000000000b4 = 0;
  3337. *(uint64_t*)0x2000000000b8 = 2;
  3338. res = syscall(__NR_perf_event_open, /*attr=*/0x200000000040ul, /*fd=*/r[49],
  3339. /*cpu=*/2ul, /*group=*/r[49],
  3340. /*flags=PERF_FLAG_PID_CGROUP|0x1*/ 5ul);
  3341. if (res != -1)
  3342. r[50] = res;
  3343. syscall(__NR_close, /*fd=*/r[50]);
  3344. memcpy((void*)0x200000000180, "./file0\000", 8);
  3345. syscall(__NR_execve, /*file=*/0x200000000180ul, /*argv=*/0ul, /*envp=*/0ul);
  3346. syz_sysconfig_reset__proc_sys_vm_zone_reclaim_mode();
  3347. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/2ul, /*proto=*/0x88);
  3348. if (res != -1)
  3349. r[51] = res;
  3350. *(uint32_t*)0x200000000280 = 0;
  3351. syscall(__NR_setsockopt, /*fd=*/r[51], /*level=*/0x29,
  3352. /*optname=IPV6_AUTOFLOWLABEL*/ 0x46, /*optval=*/0x200000000280ul,
  3353. /*optlen=*/1ul);
  3354. res =
  3355. syscall(__NR_socket, /*domain=*/2ul, /*type=SOCK_RAW*/ 3ul, /*proto=*/7);
  3356. if (res != -1)
  3357. r[52] = res;
  3358. memcpy((void*)0x200000000040,
  3359. "lo\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  3360. *(uint16_t*)0x200000000050 = 2;
  3361. *(uint16_t*)0x200000000052 = htobe16(0);
  3362. *(uint32_t*)0x200000000054 = htobe32(-1);
  3363. syscall(__NR_ioctl, /*fd=*/r[52], /*cmd=*/0x8918, /*arg=*/0x200000000040ul);
  3364. syscall(__NR_socket, /*domain=AF_PHONET*/ 0x23ul, /*type=SOCK_RDM*/ 4ul,
  3365. /*proto=*/0);
  3366. memcpy((void*)0x200000000240, "./file0\000", 8);
  3367. syscall(__NR_creat, /*file=*/0x200000000240ul, /*mode=*/0ul);
  3368. syscall(__NR_pipe, /*pipefd=*/0ul);
  3369. syscall(__NR_write, /*fd=*/-1, /*buf=*/0ul, /*count=*/0ul);
  3370. *(uint32_t*)0x200000000000 = 2;
  3371. *(uint32_t*)0x200000000004 = 0x80;
  3372. *(uint8_t*)0x200000000008 = 0;
  3373. *(uint8_t*)0x200000000009 = 0;
  3374. *(uint8_t*)0x20000000000a = 0;
  3375. *(uint8_t*)0x20000000000b = 0;
  3376. *(uint32_t*)0x20000000000c = 0;
  3377. *(uint64_t*)0x200000000010 = 0;
  3378. *(uint64_t*)0x200000000018 = 0;
  3379. *(uint64_t*)0x200000000020 = 0;
  3380. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 0, 1);
  3381. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 1, 1);
  3382. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 2, 1);
  3383. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 3, 1);
  3384. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 4, 1);
  3385. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 5, 1);
  3386. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 6, 1);
  3387. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 7, 1);
  3388. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 8, 1);
  3389. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 9, 1);
  3390. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 10, 1);
  3391. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 11, 1);
  3392. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 12, 1);
  3393. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 13, 1);
  3394. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 14, 1);
  3395. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 15, 2);
  3396. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 17, 1);
  3397. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 18, 1);
  3398. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 19, 1);
  3399. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 20, 1);
  3400. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 21, 1);
  3401. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 22, 1);
  3402. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 23, 1);
  3403. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 24, 1);
  3404. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 25, 1);
  3405. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 26, 1);
  3406. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 27, 1);
  3407. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 28, 1);
  3408. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 29, 1);
  3409. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 30, 1);
  3410. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 31, 1);
  3411. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 32, 1);
  3412. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 33, 1);
  3413. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 34, 1);
  3414. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 35, 1);
  3415. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 36, 1);
  3416. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 37, 1);
  3417. STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 38, 26);
  3418. *(uint32_t*)0x200000000030 = 0;
  3419. *(uint32_t*)0x200000000034 = 0;
  3420. *(uint64_t*)0x200000000038 = 0;
  3421. *(uint64_t*)0x200000000040 = 0;
  3422. *(uint64_t*)0x200000000048 = 0;
  3423. *(uint64_t*)0x200000000050 = 0;
  3424. *(uint32_t*)0x200000000058 = 0;
  3425. *(uint32_t*)0x20000000005c = 0;
  3426. *(uint64_t*)0x200000000060 = 0;
  3427. *(uint32_t*)0x200000000068 = 0;
  3428. *(uint16_t*)0x20000000006c = 0;
  3429. *(uint16_t*)0x20000000006e = 0;
  3430. *(uint32_t*)0x200000000070 = 0;
  3431. *(uint32_t*)0x200000000074 = 0;
  3432. *(uint64_t*)0x200000000078 = 0;
  3433. syscall(__NR_perf_event_open, /*attr=*/0x200000000000ul, /*pid=*/0,
  3434. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  3435. *(uint32_t*)0x20000000a000 = 1;
  3436. *(uint32_t*)0x20000000a004 = 0x80;
  3437. *(uint8_t*)0x20000000a008 = 0;
  3438. *(uint8_t*)0x20000000a009 = 0;
  3439. *(uint8_t*)0x20000000a00a = 0;
  3440. *(uint8_t*)0x20000000a00b = 0;
  3441. *(uint32_t*)0x20000000a00c = 0;
  3442. *(uint64_t*)0x20000000a010 = 0;
  3443. *(uint64_t*)0x20000000a018 = 0x2129;
  3444. *(uint64_t*)0x20000000a020 = 0;
  3445. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 0, 1);
  3446. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 1, 1);
  3447. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 2, 1);
  3448. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 3, 1);
  3449. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 4, 1);
  3450. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 5, 1);
  3451. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 6, 1);
  3452. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 7, 1);
  3453. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 8, 1);
  3454. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 9, 1);
  3455. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 10, 1);
  3456. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 11, 1);
  3457. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 12, 1);
  3458. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 13, 1);
  3459. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 14, 1);
  3460. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 15, 2);
  3461. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 17, 1);
  3462. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 18, 1);
  3463. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 19, 1);
  3464. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 20, 1);
  3465. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 21, 1);
  3466. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 22, 1);
  3467. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 23, 1);
  3468. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 24, 1);
  3469. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 25, 1);
  3470. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 26, 1);
  3471. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 27, 1);
  3472. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 28, 1);
  3473. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 29, 1);
  3474. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 30, 1);
  3475. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 31, 1);
  3476. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 32, 1);
  3477. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 33, 1);
  3478. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 34, 1);
  3479. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 35, 1);
  3480. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 36, 1);
  3481. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 37, 1);
  3482. STORE_BY_BITMASK(uint64_t, , 0x20000000a028, 0, 38, 26);
  3483. *(uint32_t*)0x20000000a030 = 0;
  3484. *(uint32_t*)0x20000000a034 = 0;
  3485. *(uint64_t*)0x20000000a038 = 0;
  3486. *(uint64_t*)0x20000000a040 = 0;
  3487. *(uint64_t*)0x20000000a048 = 0;
  3488. *(uint64_t*)0x20000000a050 = 0;
  3489. *(uint32_t*)0x20000000a058 = 7;
  3490. *(uint32_t*)0x20000000a05c = 0;
  3491. *(uint64_t*)0x20000000a060 = 0x20000000;
  3492. *(uint32_t*)0x20000000a068 = 0;
  3493. *(uint16_t*)0x20000000a06c = 0;
  3494. *(uint16_t*)0x20000000a06e = 0;
  3495. *(uint32_t*)0x20000000a070 = 0;
  3496. *(uint32_t*)0x20000000a074 = 0;
  3497. *(uint64_t*)0x20000000a078 = 0;
  3498. syscall(__NR_perf_event_open, /*attr=*/0x20000000a000ul, /*pid=*/0,
  3499. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  3500. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/2ul, /*proto=*/0x88);
  3501. if (res != -1)
  3502. r[53] = res;
  3503. res = syscall(__NR_io_setup, /*n=*/7, /*ctx=*/0x200000000000ul);
  3504. if (res != -1)
  3505. r[54] = *(uint64_t*)0x200000000000;
  3506. res = syscall(__NR_eventfd2, /*initval=*/0, /*flags=*/0ul);
  3507. if (res != -1)
  3508. r[55] = res;
  3509. memcpy((void*)0x200000000280, "./file0\000", 8);
  3510. syscall(__NR_mkdir, /*path=*/0x200000000280ul, /*mode=*/0ul);
  3511. memcpy((void*)0x20000000aff8, "./file0\000", 8);
  3512. memcpy((void*)0x2000000000c0, "hugetlbfs\000", 10);
  3513. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x20000000aff8ul,
  3514. /*type=*/0x2000000000c0ul, /*flags=*/0ul, /*data=*/0ul);
  3515. memcpy((void*)0x200000cd2ff8, "./file0\000", 8);
  3516. syscall(__NR_chdir, /*dir=*/0x200000cd2ff8ul);
  3517. memcpy(
  3518. (void*)0x2000000013c0,
  3519. "./"
  3520. "file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3521. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3522. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3523. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3524. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3525. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3526. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3527. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3528. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3529. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3530. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3531. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3532. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3533. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3534. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3535. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3536. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3537. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3538. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3539. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3540. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3541. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3542. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3543. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3544. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3545. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3546. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3547. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3548. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3549. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3550. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3551. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3552. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3553. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3554. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3555. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3556. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3557. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3558. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3559. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3560. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3561. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3562. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3563. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3564. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3565. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3566. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3567. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3568. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3569. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3570. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3571. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3572. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3573. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3574. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3575. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  3576. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\000",
  3577. 4089);
  3578. syscall(__NR_mknod, /*file=*/0x2000000013c0ul, /*mode=*/0ul, /*dev=*/0x701);
  3579. *(uint64_t*)0x200000000140 = 0x200000000000;
  3580. *(uint64_t*)0x200000000000 = 0;
  3581. *(uint32_t*)0x200000000008 = 0;
  3582. *(uint32_t*)0x20000000000c = 0;
  3583. *(uint16_t*)0x200000000010 = 8;
  3584. *(uint16_t*)0x200000000012 = 0;
  3585. *(uint32_t*)0x200000000014 = r[53];
  3586. *(uint64_t*)0x200000000018 = 0;
  3587. *(uint64_t*)0x200000000020 = 0;
  3588. *(uint64_t*)0x200000000028 = 0;
  3589. *(uint64_t*)0x200000000030 = 0;
  3590. *(uint32_t*)0x200000000038 = 0;
  3591. *(uint32_t*)0x20000000003c = -1;
  3592. *(uint64_t*)0x200000000148 = 0x200000000040;
  3593. *(uint64_t*)0x200000000040 = 0;
  3594. *(uint32_t*)0x200000000048 = 0;
  3595. *(uint32_t*)0x20000000004c = 0;
  3596. *(uint16_t*)0x200000000050 = 8;
  3597. *(uint16_t*)0x200000000052 = 0x8001;
  3598. *(uint32_t*)0x200000000054 = r[53];
  3599. *(uint64_t*)0x200000000058 = 0;
  3600. *(uint64_t*)0x200000000060 = 0;
  3601. *(uint64_t*)0x200000000068 = 0;
  3602. *(uint64_t*)0x200000000070 = 0;
  3603. *(uint32_t*)0x200000000078 = 3;
  3604. *(uint32_t*)0x20000000007c = r[55];
  3605. syscall(__NR_io_submit, /*ctx=*/r[54], /*nr=*/2ul,
  3606. /*iocbpp=*/0x200000000140ul);
  3607. memcpy((void*)0x2000000000c0, "./file0\000", 8);
  3608. memcpy((void*)0x2000005f7ffb, "nfs4\000", 5);
  3609. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x2000000000c0ul,
  3610. /*type=*/0x2000005f7ffbul, /*flags=*/0ul, /*data=*/0x20000000a000ul);
  3611. memcpy((void*)0x200000000580, "ext4\000", 5);
  3612. memcpy((void*)0x200000000040, "./file0\000", 8);
  3613. memcpy((void*)0x2000000005c0, "auto_da_alloc", 13);
  3614. *(uint8_t*)0x2000000005cd = 0x2c;
  3615. memcpy((void*)0x2000000005ce, "grpjquota=", 10);
  3616. *(uint8_t*)0x2000000005d8 = 0x2c;
  3617. memcpy((void*)0x2000000005d9, "discard", 7);
  3618. *(uint8_t*)0x2000000005e0 = 0x2c;
  3619. memcpy((void*)0x2000000005e1, "lazytime", 8);
  3620. *(uint8_t*)0x2000000005e9 = 0x2c;
  3621. memcpy((void*)0x2000000005ea, "nolazytime", 10);
  3622. *(uint8_t*)0x2000000005f4 = 0x2c;
  3623. *(uint8_t*)0x2000000005f5 = 0;
  3624. memcpy(
  3625. (void*)0x200000002600,
  3626. "\x78\x9c\xec\xdd\x4d\x8f\x53\x55\x1f\x00\xf0\xff\xbd\x9d\x99\x67\x80\x79"
  3627. "\x9c\xc1\x18\x03\x6e\x9c\x68\x82\x24\xc6\x32\x0c\x8a\xd1\x8d\xc0\x5a\x13"
  3628. "\x13\xdd\xb8\x63\x02\x85\x8c\x94\x97\xcc\x8c\x89\x10\x17\xb0\x30\x6e\x5c"
  3629. "\x60\x62\xc2\xc2\x44\x43\xd8\xf8\x21\x5c\x10\x13\xbf\x80\x2b\x71\xe7\xd6"
  3630. "\x84\x18\x03\xc4\x97\x4d\xcd\x6d\x6f\xa7\x65\xa6\x1d\x86\xd2\x72\xa1\xf7"
  3631. "\xf7\x4b\xee\xf4\x9c\x7b\xda\x9e\xf3\xef\xe5\xf4\x9e\xd3\xdb\x43\x03\x28"
  3632. "\xad\xf9\xec\x4f\x1a\xb1\x37\x22\x8e\x27\x11\xb3\x5d\x65\x13\x91\x17\xce"
  3633. "\xb7\xee\x77\xe7\xcf\xcf\x4e\x64\x5b\x12\x8d\xc6\x07\x7f\x24\x91\xe4\xfb"
  3634. "\xda\xf7\x4f\xf2\xdb\x5d\x79\x66\x3a\x22\x7e\x3e\x16\xf1\x6c\x65\x73\xbd"
  3635. "\xab\x17\x2f\x9d\x59\xaa\xd7\x6b\x2b\x79\xfe\xc0\xda\xd9\x0b\x07\x56\x2f"
  3636. "\x5e\x7a\x6d\xf9\xec\xd2\xe9\xda\xe9\xda\xb9\xc3\xaf\xbf\xf1\xd6\xe2\x9b"
  3637. "\x87\x17\x0f\x0d\x2d\xd4\xc9\x8f\x7e\xa8\x5f\xdb\xf3\xeb\xb1\xbf\xbe\x58"
  3638. "\xb9\xb7\xef\xc6\xdf\xf1\x71\x12\x47\x62\x26\x2f\xec\x8e\x63\x58\xe6\x63"
  3639. "\x7e\xfd\x35\xe9\x96\xbd\xae\xef\x0c\xbb\xb2\x82\x54\xf2\x78\x7a\xc5\xc9"
  3640. "\x93\xaf\x7d\xfc\x26\x23\xe2\xf9\x98\x8d\x4a\xde\xeb\x33\xb3\xb1\xfc\x65"
  3641. "\xa1\x8d\x03\x46\xaa\x51\x89\x68\x00\x25\x95\xe8\xff\x50\x52\xed\x71\x40"
  3642. "\x7b\x6e\x3f\x8a\x79\xf0\x93\xec\xf6\xd1\xd6\x04\x68\x73\xfc\x13\xad\xcf"
  3643. "\x46\x62\xba\x39\x37\xda\x79\x27\xe9\x9a\x19\xb5\xe6\xbb\x73\x43\xa8\x3f"
  3644. "\xab\x63\xfa\xa7\xef\xbf\xca\xb6\x18\xd1\xe7\x10\x5b\xb9\x7c\x25\x22\xf6"
  3645. "\xf4\x8a\x3f\x69\xb6\x6d\xae\xf9\x29\x4e\x16\x7f\x7a\x5f\xfc\x69\x44\x2c"
  3646. "\xe4\xb7\xd9\xfe\xc5\x01\xeb\x9f\xdf\x90\x7f\x9a\xe2\x3f\xd2\x15\xff\xb1"
  3647. "\x01\xeb\x2f\x3a\x7e\x00\xca\xe9\xe6\xd1\xd6\x89\x7c\xf3\xf9\x2f\x5d\x1f"
  3648. "\xff\x44\x8f\xf1\xcf\x4c\x8f\x73\xd7\x20\x8a\x3e\xff\xf5\x1f\xff\x75\xe2"
  3649. "\xaf\xf4\x19\xff\xbd\xbf\xcd\x3a\x6e\x5c\xff\xee\x48\xbf\xb2\xee\xf1\x5f"
  3650. "\xb6\x65\xf5\xb7\xc7\x82\x8f\xc3\xed\x2b\x11\x2f\xf4\x8c\x3f\x59\x8f\x3f"
  3651. "\xe9\x11\x7f\x36\xee\x39\xbe\xcd\x3a\x5e\xaa\x7d\x7b\xab\x5f\x59\xd1\xf1"
  3652. "\x37\xae\x47\xec\xeb\x39\xff\xe9\x5c\xd1\x4a\xb6\xbc\x3e\x79\xe0\xd4\x72"
  3653. "\xbd\xb6\xd0\xfa\xdb\xbb\x8e\xab\x9f\x37\xae\xf5\xab\xbf\xe8\xf8\xb3\xe3"
  3654. "\xbf\xb3\x4f\xfc\x5b\x1d\xff\x6c\xdf\x85\x6d\xd6\xf1\xe3\xdd\x7b\xbf\xf5"
  3655. "\x2b\x7b\x70\xfc\xe9\xef\x53\xc9\x87\xcd\xd4\x54\xbe\xe7\xd3\xa5\xb5\xb5"
  3656. "\x95\x83\x11\x53\xc9\xbb\x9b\xf7\x3f\x60\x22\xd2\xbe\x4f\xfb\x39\xb2\xf8"
  3657. "\xf7\xbf\xbc\x75\xff\xef\x15\xff\x8e\x6c\xee\xb0\xcd\xf8\xef\xec\x3f\xfc"
  3658. "\xde\xa0\xf1\xdf\xfe\xa7\x33\x47\x1f\x85\x2c\xfe\x93\x03\x1e\xff\xab\xdb"
  3659. "\xac\x63\x71\xa1\xfa\x4d\xbf\xb2\xa2\xff\xfd\x03\x00\x00\x00\x00\x00\xc0"
  3660. "\x38\x49\x9b\xdf\xe5\x48\xd2\xea\x7a\x3a\x4d\xab\xd5\xd6\x1a\xde\xe7\x62"
  3661. "\x67\x5a\x3f\xbf\xba\xf6\xea\xa9\xf3\x9f\x9c\x3b\xd9\xfa\xce\xc7\x5c\x4c"
  3662. "\xa6\xed\x4b\xdd\xb3\xad\x7c\x92\xe5\x0f\xe6\xdf\x87\x6d\xe7\x17\x37\xe4"
  3663. "\x0f\x45\xc4\xee\x88\xf8\xba\xb2\xa3\x99\xaf\x9e\x38\x5f\x3f\x59\x74\xf0"
  3664. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x84\xd8"
  3665. "\xb5\x61\xfd\xff\xdd\x4a\x6b\xfd\x3f\x50\x12\x13\x45\x37\x00\x28\x8c\xfe"
  3666. "\x0f\xe5\xa5\xff\x43\x79\xe9\xff\x50\x5e\x0f\xdb\xff\xbd\x5f\xc0\xf8\xd0"
  3667. "\x9f\xa1\xbc\xf4\x7f\x28\x2f\xfd\x1f\xca\x4b\xff\x87\xf2\xd2\xff\xa1\xbc"
  3668. "\xf4\x7f\x00\x00\x00\x00\x18\x4b\xbb\x5f\xbc\x79\x2b\x89\x88\xcb\x6f\xef"
  3669. "\x68\x6e\x99\xa9\xbc\x6c\xb2\xd0\x96\x01\xa3\x96\x16\xdd\x00\xa0\x30\x95"
  3670. "\xa2\x1b\x00\x14\xc6\xa5\x7f\x28\x2f\x73\x7c\x20\x59\x4f\xfd\xdb\x68\xb9"
  3671. "\xbf\x7c\xba\xdf\x03\x6f\x26\x03\xd4\x36\x35\xc0\x63\x00\x00\x00\x00\x00"
  3672. "\x00\x00\x00\x00\x00\x80\x57\xf6\x5a\xff\x0f\x65\x65\xfd\x3f\x94\x97\xf5"
  3673. "\xff\x50\x5e\x8f\xb0\xfe\xdf\x7f\x1d\x00\x4f\xb9\x47\x9a\xe3\x7b\x07\x80"
  3674. "\xb1\xf0\xa0\x55\xfc\x9d\xf5\xff\x1b\x66\x0c\x03\xad\xff\x07\x00\x00\x00"
  3675. "\x00\x00\x00\x00\x00\x00\x00\x06\x31\xd3\xdc\x92\xb4\x9a\xaf\x05\x9e\x89"
  3676. "\x34\xad\x56\x23\xfe\x1f\x11\x73\x31\x99\x9c\x5a\xae\xd7\x16\x22\xe2\x99"
  3677. "\x88\xf8\xa5\x32\xf9\xbf\x2c\x7f\xb0\xe8\x46\x03\x00\x00\x00\x00\x00\x00"
  3678. "\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x98\x59\xbd\x78\xe9\xcc\x52\xbd\x5e"
  3679. "\x5b\x19\x42\xa2\x91\xff\x34\xd8\xd0\x9e\xf0\x21\x12\x13\x11\xf1\xd8\x2b"
  3680. "\x95\x90\x18\xdb\x44\xd1\xef\x4c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3681. "\x00\x00\x00\x00\x50\x3e\x9d\x45\xbf\x45\xb7\x04\x00\x00\x00\x00\x00\x00"
  3682. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3683. "\x00\x00\x00\x00\x00\x00\x00\x8a\xd3\xf9\xfd\xff\xd1\x25\x8a\x8e\x11\x00"
  3684. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3685. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3686. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3687. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3688. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3689. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3690. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3691. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3692. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3693. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3694. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3695. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3696. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3697. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3698. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3699. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3700. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3701. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3702. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3703. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3704. "\x00\x00\x00\x78\x3a\xfd\x17\x00\x00\xff\xff\xe8\xb2\x24\xd0",
  3705. 1419);
  3706. syz_mount_image(/*fs=*/0x200000000580, /*dir=*/0x200000000040,
  3707. /*flags=MS_SYNCHRONOUS|MS_NOATIME*/ 0x410,
  3708. /*opts=*/0x2000000005c0, /*chdir=*/1, /*size=*/0x58b,
  3709. /*img=*/0x200000002600);
  3710. memcpy((void*)0x2000000000c0, "fd/3\000", 5);
  3711. res = -1;
  3712. res = syz_open_procfs(/*pid=*/0, /*file=*/0x2000000000c0);
  3713. if (res != -1)
  3714. r[56] = res;
  3715. memcpy((void*)0x2000000001c0, "mounts\000", 7);
  3716. res = -1;
  3717. res = syz_open_procfs(/*pid=*/0, /*file=*/0x2000000001c0);
  3718. if (res != -1)
  3719. r[57] = res;
  3720. memcpy((void*)0x200000000040, ".\000", 2);
  3721. memcpy((void*)0x200000000080, "9p\000", 3);
  3722. memcpy((void*)0x200000000300, "trans=fd,rfdno=", 15);
  3723. sprintf((char*)0x20000000030f, "0x%016llx", (long long)r[56]);
  3724. memcpy((void*)0x200000000321, ",wfdno=", 7);
  3725. sprintf((char*)0x200000000328, "0x%016llx", (long long)r[57]);
  3726. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000040ul,
  3727. /*type=*/0x200000000080ul, /*flags=*/0ul, /*opts=*/0x200000000300ul);
  3728. memcpy((void*)0x200000000080, ".\000", 2);
  3729. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000080ul, /*type=*/0ul,
  3730. /*flags=MS_REC|MS_REMOUNT|MS_RDONLY|MS_NOSUID|0x40c*/ 0x442ful,
  3731. /*data=*/0ul);
  3732. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_DGRAM*/ 2ul,
  3733. /*proto=*/0);
  3734. if (res != -1)
  3735. r[58] = res;
  3736. res = syscall(__NR_socket,
  3737. /*domain=AF_PACKET|0x200000000000000*/ 0x200000000000011ul,
  3738. /*type=SOCK_RAW*/ 3ul, /*proto=*/0);
  3739. if (res != -1)
  3740. r[59] = res;
  3741. memcpy((void*)0x200000000080,
  3742. "sit0\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  3743. res = syscall(__NR_ioctl, /*fd=*/r[59], /*cmd=*/0x8933,
  3744. /*arg=*/0x200000000080ul);
  3745. if (res != -1)
  3746. r[60] = *(uint32_t*)0x200000000090;
  3747. *(uint32_t*)0x2000000004c0 = 2;
  3748. *(uint32_t*)0x2000000004c4 = 0x80;
  3749. *(uint8_t*)0x2000000004c8 = 0x97;
  3750. *(uint8_t*)0x2000000004c9 = 0;
  3751. *(uint8_t*)0x2000000004ca = 0;
  3752. *(uint8_t*)0x2000000004cb = 0;
  3753. *(uint32_t*)0x2000000004cc = 0;
  3754. *(uint64_t*)0x2000000004d0 = 0;
  3755. *(uint64_t*)0x2000000004d8 = 0;
  3756. *(uint64_t*)0x2000000004e0 = 0;
  3757. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 0, 1);
  3758. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 1, 1);
  3759. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 2, 1);
  3760. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 3, 1);
  3761. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 4, 1);
  3762. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 5, 1);
  3763. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 6, 1);
  3764. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 7, 1);
  3765. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 8, 1);
  3766. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 9, 1);
  3767. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 10, 1);
  3768. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 11, 1);
  3769. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 12, 1);
  3770. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 13, 1);
  3771. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 14, 1);
  3772. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 15, 2);
  3773. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 17, 1);
  3774. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 18, 1);
  3775. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 19, 1);
  3776. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 20, 1);
  3777. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 21, 1);
  3778. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 22, 1);
  3779. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 23, 1);
  3780. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 24, 1);
  3781. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 25, 1);
  3782. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 26, 1);
  3783. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 27, 1);
  3784. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 28, 1);
  3785. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 29, 1);
  3786. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 30, 1);
  3787. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 31, 1);
  3788. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 32, 1);
  3789. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 33, 1);
  3790. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 34, 1);
  3791. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 35, 1);
  3792. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 36, 1);
  3793. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 37, 1);
  3794. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 38, 26);
  3795. *(uint32_t*)0x2000000004f0 = 0;
  3796. *(uint32_t*)0x2000000004f4 = 0;
  3797. *(uint64_t*)0x2000000004f8 = 0;
  3798. *(uint64_t*)0x200000000500 = 0;
  3799. *(uint64_t*)0x200000000508 = 0;
  3800. *(uint64_t*)0x200000000510 = 0;
  3801. *(uint32_t*)0x200000000518 = 0x20;
  3802. *(uint32_t*)0x20000000051c = 0;
  3803. *(uint64_t*)0x200000000520 = 0;
  3804. *(uint32_t*)0x200000000528 = 0;
  3805. *(uint16_t*)0x20000000052c = 0;
  3806. *(uint16_t*)0x20000000052e = 0;
  3807. *(uint32_t*)0x200000000530 = 0;
  3808. *(uint32_t*)0x200000000534 = 0;
  3809. *(uint64_t*)0x200000000538 = 0;
  3810. syscall(__NR_perf_event_open, /*attr=*/0x2000000004c0ul, /*pid=*/0,
  3811. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  3812. *(uint8_t*)0x200000000000 = 0xfc;
  3813. *(uint8_t*)0x200000000001 = 0;
  3814. memset((void*)0x200000000002, 0, 13);
  3815. *(uint8_t*)0x20000000000f = 0;
  3816. *(uint32_t*)0x200000000010 = 0;
  3817. *(uint32_t*)0x200000000014 = r[60];
  3818. syscall(__NR_ioctl, /*fd=*/r[58], /*cmd=*/0x8916, /*arg=*/0x200000000000ul);
  3819. syscall(__NR_socket, /*domain=AF_KCM*/ 0x29ul, /*type=SOCK_STREAM*/ 1ul,
  3820. /*proto=*/0xfffffff9);
  3821. memcpy((void*)0x2000000025c0, "./file0\000", 8);
  3822. syz_mount_image(/*fs=*/0, /*dir=*/0x2000000025c0, /*flags=*/0, /*opts=*/0,
  3823. /*chdir=*/0, /*size=*/0, /*img=*/0);
  3824. memcpy((void*)0x200000000080, "./file0\000", 8);
  3825. memcpy((void*)0x2000000000c0, "tmpfs\000", 6);
  3826. memcpy((void*)0x200000000100,
  3827. "\x63\x8f\xc3\xf6\x0f\x68\x8b\x67\x04\x00\x18\x3e\x1e\x38", 14);
  3828. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000080ul,
  3829. /*type=*/0x2000000000c0ul, /*flags=*/0ul, /*opts=*/0x200000000100ul);
  3830. memcpy((void*)0x200000000280, "ext4\000", 5);
  3831. memcpy((void*)0x200000000300, "./file0\000", 8);
  3832. memcpy((void*)0x2000000003c0, "quota", 5);
  3833. *(uint8_t*)0x2000000003c5 = 0x2c;
  3834. memcpy((void*)0x2000000003c6, "euid", 4);
  3835. *(uint8_t*)0x2000000003ca = 0x3d;
  3836. sprintf((char*)0x2000000003cb, "%020llu", (long long)0);
  3837. *(uint8_t*)0x2000000003df = 0x2c;
  3838. memcpy((void*)0x2000000003e0, "fscontext", 9);
  3839. *(uint8_t*)0x2000000003e9 = 0x3d;
  3840. memcpy((void*)0x2000000003ea, "root", 4);
  3841. *(uint8_t*)0x2000000003ee = 0x2c;
  3842. memcpy((void*)0x2000000003ef, "dont_appraise", 13);
  3843. *(uint8_t*)0x2000000003fc = 0x2c;
  3844. memcpy((void*)0x2000000003fd, "uid", 3);
  3845. *(uint8_t*)0x200000000400 = 0x3d;
  3846. sprintf((char*)0x200000000401, "%020llu", (long long)0);
  3847. *(uint8_t*)0x200000000415 = 0x2c;
  3848. memcpy((void*)0x200000000416, "uid>", 4);
  3849. sprintf((char*)0x20000000041a, "%020llu", (long long)0);
  3850. *(uint8_t*)0x20000000042e = 0x2c;
  3851. *(uint8_t*)0x20000000042f = 0;
  3852. memcpy(
  3853. (void*)0x200000000580,
  3854. "\x78\x9c\xec\xdd\xd1\x6f\x53\x5f\x1d\x00\xf0\xef\xed\x36\xb6\xdf\x7e\xfb"
  3855. "\xfd\x36\x94\x07\x35\x2a\x88\x28\x1a\x42\xbb\x15\x58\x08\x2f\xc2\x8b\xc6"
  3856. "\x10\x12\x23\xf1\xc9\x07\x58\xb6\xb2\x2c\xeb\xd6\x65\xed\x90\x4d\x12\xc7"
  3857. "\xff\x60\x22\x89\x4f\xfa\x27\xf0\x60\xe2\x83\x09\x4f\xbe\xfb\xa6\x6f\xbe"
  3858. "\xe0\x83\x09\x2a\xc1\x30\x13\x1f\x6a\xee\xed\xed\x1c\x63\xdd\x06\x94\x95"
  3859. "\xac\x9f\x4f\x72\x72\xcf\xb9\xa7\xeb\xf7\x9c\x36\xf7\x9c\xf6\xac\xed\x09"
  3860. "\xa0\x6f\x9d\x89\x88\xcd\x88\x38\x11\x11\x77\x23\x62\x3c\x3f\x9f\xe4\x29"
  3861. "\xae\xb7\x52\x7a\xbb\x57\x2f\x1e\xce\x6e\xbd\x78\x38\x9b\x44\xb3\x79\xfb"
  3862. "\x9f\x49\x8c\xec\xba\xaf\x24\x3f\x7e\x9a\xdf\x67\x5a\xff\xe3\x1f\xe4\x85"
  3863. "\x5d\xea\xeb\x1b\x8b\x33\xd5\x6a\x65\x35\x2f\x97\x1a\x4b\x2b\xa5\xfa\xfa"
  3864. "\xc6\xc5\x85\xa5\x99\xf9\xca\x7c\x65\xb9\x5c\x9e\x9e\x9a\x9e\xbc\x7a\xe9"
  3865. "\x4a\xb9\x6b\x7d\x3d\xbd\xf4\xe4\xf9\xf7\x17\x6e\xfe\xe4\x0f\xbf\xff\xda"
  3866. "\xb3\x3f\x6d\x7e\xf7\xe7\x69\x7b\xc7\xf2\xba\xb4\x6f\x5d\x0b\xb4\x43\xeb"
  3867. "\x31\x19\xda\x8e\x93\x1a\x8c\x88\x9b\x1f\x22\x58\x0f\x0c\xe4\xfd\x39\xd1"
  3868. "\xeb\x86\xf0\x4e\x0a\x11\xf1\x85\x88\x38\x9b\x5d\xff\xe3\x31\x90\x3d\x9b"
  3869. "\x00\xc0\x71\xd6\x6c\x8e\x47\x73\x7c\x67\x19\x00\x38\xee\x0a\xd9\x1a\x58"
  3870. "\x52\x28\xe6\x6b\x01\x63\x51\x28\x14\x8b\xad\x35\xbc\x53\x31\x5a\xa8\xd6"
  3871. "\xea\x8d\x0b\xf7\x6a\x6b\xcb\x73\xad\xb5\xb2\x89\x18\x2a\xdc\x5b\xa8\x56"
  3872. "\x26\xf3\xb5\xc2\x89\x18\x4a\xd2\xf2\x54\x96\xff\x7f\xb9\xbc\xab\x7c\x29"
  3873. "\x22\x4e\x46\xc4\x2f\x87\x3f\xc9\xca\xc5\xd9\x5a\x75\xae\x97\x2f\x7c\x00"
  3874. "\xa0\x8f\x7d\xba\x6b\xfe\xff\xf7\x70\x6b\xfe\x07\x00\x8e\xb9\xdd\x1f\xe4"
  3875. "\x01\x00\x8e\x3f\xf3\x3f\x00\xf4\x1f\xf3\x3f\x00\xf4\x1f\xf3\x3f\x00\xf4"
  3876. "\x1f\xf3\x3f\x00\xf4\x1f\xf3\x3f\x00\xf4\x1f\xf3\x3f\x00\xf4\x95\x1f\xdd"
  3877. "\xba\x95\xa6\xe6\x56\xfe\xfb\xd7\x73\xf7\xd7\xd7\x16\x6b\xf7\x2f\xce\x55"
  3878. "\xea\x8b\xc5\xa5\xb5\xd9\xe2\x6c\x6d\x75\xa5\x38\x5f\xab\xcd\x67\xbf\xd9"
  3879. "\xb3\x74\xd0\xfd\x55\x6b\xb5\x95\xa9\xcb\xb1\xf6\xa0\xd4\xa8\xd4\x1b\xa5"
  3880. "\xfa\xfa\xc6\x9d\xa5\xda\xda\x72\xe3\x4e\xf6\xbb\xde\x77\x2a\x43\x47\xd2"
  3881. "\x2b\x00\x60\x3f\x27\x4f\x3f\xfd\x4b\x12\x11\x9b\xd7\x3e\xc9\x52\xec\xd8"
  3882. "\xcb\xc1\x5c\x0d\xc7\x5b\xa1\xd7\x0d\x00\x7a\x66\xa0\xd7\x0d\x00\x7a\xe6"
  3883. "\xdd\xae\xff\x1b\x4f\xba\xde\x10\xe0\xc8\xed\xf3\x1e\xdf\x5b\x03\xe8\x13"
  3884. "\xc9\x01\xf5\x1d\x3f\x22\xf4\xb8\xfb\x6d\x01\x8e\xc6\xf9\x2f\x5b\xff\x87"
  3885. "\x7e\xe5\x45\x3e\xf4\x2f\xeb\xff\xd0\xbf\x06\x7b\xdd\x00\xa0\x67\x9a\xcd"
  3886. "\xc4\x9e\xff\x00\xd0\x67\xac\xf1\x03\xfe\xff\x0f\x00\x00\x00\x00\x00\x00"
  3887. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3888. "\x6f\x6f\x2c\x4b\x49\xa1\x98\xef\x05\x3e\x16\x85\x42\xb1\x18\xf1\x59\x44"
  3889. "\x4c\xc4\x50\x72\x6f\xa1\x5a\x99\x8c\x88\xcf\x23\xe2\xcf\xc3\x43\xc3\x69"
  3890. "\x79\xaa\xd7\x8d\x06\x00\xde\x53\xe1\xef\x49\xbe\xff\xd7\xf9\xf1\x73\x63"
  3891. "\xbb\x6b\x4f\x24\xff\x19\xce\x8e\x11\xf1\xb3\x5f\xdf\xfe\xd5\x83\x99\x46"
  3892. "\x63\x75\x2a\x3d\xff\xaf\xed\xf3\x8d\xc7\xf9\xf9\x72\x2f\xda\x0f\x00\x1c"
  3893. "\xa4\x3d\x4f\xb7\xe7\xf1\xb6\x57\x2f\x1e\xce\xb6\xd3\x51\xb6\xe7\xf9\x8d"
  3894. "\xd6\xe6\xa2\x69\xdc\xad\x3c\xb5\x6a\x06\x63\x30\x3b\x8e\xc4\x50\x44\x8c"
  3895. "\xbe\x4c\xf2\x72\x4b\xfa\x7a\x65\xa0\x0b\xf1\x37\x1f\x45\xc4\x97\xf6\xea"
  3896. "\x7f\x92\xad\x8d\x4c\xe4\x3b\x9f\xbe\xdc\xf5\x77\x69\xec\xcf\x8e\x30\xfe"
  3897. "\xe8\xcb\xc2\x6b\xfd\x2f\x66\x75\xad\x35\x9b\xf4\xb1\xf8\x62\x17\xda\x02"
  3898. "\xfd\xe6\x69\x3a\xfe\x5c\xdf\xeb\xfa\x2b\xc4\x99\xec\xd8\xbe\xfe\x5e\x1f"
  3899. "\x7f\x46\xb2\x11\xea\xfd\xb5\xc7\xbf\xad\x37\xc6\xbf\xc2\xf6\xf8\x37\xd0"
  3900. "\x61\xfc\x3b\x73\xd8\x18\x97\xff\xf8\xc3\x8e\x75\x8f\x22\xbe\x32\xb8\x57"
  3901. "\xfc\x64\x3b\x7e\xd2\x21\xfe\xb9\x3c\x7f\xd0\x38\xfc\xd7\xaf\x7e\xfd\x6c"
  3902. "\xa7\xba\xe6\x6f\x22\xce\xc7\xde\xf1\x77\xc6\x2a\x35\x96\x56\x4a\xf5\xf5"
  3903. "\x8d\x8b\x69\xa1\x32\x5f\x59\x2e\x97\xa7\xa7\xa6\x27\xaf\x5e\xba\x52\x2e"
  3904. "\x65\x6b\xd4\xa5\xf6\x4a\xf5\x9b\xfe\x71\xed\xc2\xe7\xfb\xf5\x7f\xb4\x43"
  3905. "\xfc\x91\x03\xfa\xff\xad\x03\xfa\xdd\xf6\xdb\xff\xde\xfd\xe9\x37\xf6\x89"
  3906. "\xff\x9d\x6f\xee\xfd\xfc\x9f\xda\x27\x7e\x3a\x27\x7e\xfb\x90\xf1\x67\x46"
  3907. "\x7f\xd7\x71\xfb\xee\x34\xfe\x5c\x87\xfe\x1f\xf4\xfc\x5f\x38\x64\xfc\x67"
  3908. "\x7f\xdb\x98\x3b\xe4\x4d\x01\x80\x23\x50\x5f\xdf\x58\x9c\xa9\x56\x2b\xab"
  3909. "\xf5\xef\xb5\x33\xeb\x32\x32\xdd\xc8\xfc\xe2\xe3\x68\x46\x6f\x33\xe9\x45"
  3910. "\xf6\x11\x34\xe3\xed\x33\xbd\x1e\x99\x80\x0f\xed\xf5\x81\x0a\x00\x00\x00"
  3911. "\x00\x00\x00\x00\x00\x00\x00\x00\xf8\x18\x75\xeb\x3b\x43\x11\xcd\xe6\x7e"
  3912. "\x5f\x81\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3913. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3914. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3915. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3916. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3917. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3918. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3919. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3920. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3921. "\x00\x00\x00\x00\x00\x00\x00\x00\x80\x0f\xe1\x7f\x01\x00\x00\xff\xff\x9e"
  3922. "\xfa\xd4\x50",
  3923. 1227);
  3924. syz_mount_image(/*fs=*/0x200000000280, /*dir=*/0x200000000300,
  3925. /*flags=MS_DIRSYNC*/ 0x80, /*opts=*/0x2000000003c0,
  3926. /*chdir=*/1, /*size=*/0x4cb, /*img=*/0x200000000580);
  3927. memcpy((void*)0x200000000080, ".\000", 2);
  3928. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000080ul, /*type=*/0ul,
  3929. /*flags=MS_REC|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|0x440*/ 0x446aul,
  3930. /*data=*/0ul);
  3931. memcpy((void*)0x200000000040, "./bus\000", 6);
  3932. res = syscall(__NR_creat, /*file=*/0x200000000040ul, /*mode=*/0ul);
  3933. if (res != -1)
  3934. r[61] = res;
  3935. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/6);
  3936. if (res != -1)
  3937. r[62] = res;
  3938. *(uint32_t*)0x2000000004c0 = 2;
  3939. *(uint32_t*)0x2000000004c4 = 0x80;
  3940. *(uint8_t*)0x2000000004c8 = 0x97;
  3941. *(uint8_t*)0x2000000004c9 = 0;
  3942. *(uint8_t*)0x2000000004ca = 0;
  3943. *(uint8_t*)0x2000000004cb = 0;
  3944. *(uint32_t*)0x2000000004cc = 0;
  3945. *(uint64_t*)0x2000000004d0 = 0;
  3946. *(uint64_t*)0x2000000004d8 = 0;
  3947. *(uint64_t*)0x2000000004e0 = 0;
  3948. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 0, 1);
  3949. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 1, 1);
  3950. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 2, 1);
  3951. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 3, 1);
  3952. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 4, 1);
  3953. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 5, 1);
  3954. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 6, 1);
  3955. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 7, 1);
  3956. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 8, 1);
  3957. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 9, 1);
  3958. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 10, 1);
  3959. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 11, 1);
  3960. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 12, 1);
  3961. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 13, 1);
  3962. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 14, 1);
  3963. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 15, 2);
  3964. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 17, 1);
  3965. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 18, 1);
  3966. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 19, 1);
  3967. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 20, 1);
  3968. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 21, 1);
  3969. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 22, 1);
  3970. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 23, 1);
  3971. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 24, 1);
  3972. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 25, 1);
  3973. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 26, 1);
  3974. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 27, 1);
  3975. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 28, 1);
  3976. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 29, 1);
  3977. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 30, 1);
  3978. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 31, 1);
  3979. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 32, 1);
  3980. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 33, 1);
  3981. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 34, 1);
  3982. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 35, 1);
  3983. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 36, 1);
  3984. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 37, 1);
  3985. STORE_BY_BITMASK(uint64_t, , 0x2000000004e8, 0, 38, 26);
  3986. *(uint32_t*)0x2000000004f0 = 0;
  3987. *(uint32_t*)0x2000000004f4 = 0;
  3988. *(uint64_t*)0x2000000004f8 = 0;
  3989. *(uint64_t*)0x200000000500 = 0;
  3990. *(uint64_t*)0x200000000508 = 0;
  3991. *(uint64_t*)0x200000000510 = 0;
  3992. *(uint32_t*)0x200000000518 = 0x100;
  3993. *(uint32_t*)0x20000000051c = 0;
  3994. *(uint64_t*)0x200000000520 = 0;
  3995. *(uint32_t*)0x200000000528 = 0;
  3996. *(uint16_t*)0x20000000052c = 0;
  3997. *(uint16_t*)0x20000000052e = 0;
  3998. *(uint32_t*)0x200000000530 = 0;
  3999. *(uint32_t*)0x200000000534 = 0;
  4000. *(uint64_t*)0x200000000538 = 0;
  4001. syscall(__NR_perf_event_open, /*attr=*/0x2000000004c0ul, /*pid=*/0,
  4002. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  4003. res = syscall(__NR_socket, /*domain=*/0xaul,
  4004. /*type=SOCK_DGRAM|0x800000000000000*/ 0x800000000000002ul,
  4005. /*proto=*/0);
  4006. if (res != -1)
  4007. r[63] = res;
  4008. *(uint16_t*)0x200000000000 = 0xa;
  4009. *(uint16_t*)0x200000000002 = htobe16(0);
  4010. *(uint32_t*)0x200000000004 = htobe32(0);
  4011. *(uint8_t*)0x200000000008 = 0xfe;
  4012. *(uint8_t*)0x200000000009 = 0x80;
  4013. memset((void*)0x20000000000a, 0, 13);
  4014. *(uint8_t*)0x200000000017 = 0xaa;
  4015. *(uint32_t*)0x200000000018 = 1;
  4016. syscall(__NR_connect, /*fd=*/r[63], /*addr=*/0x200000000000ul,
  4017. /*addrlen=*/0x1cul);
  4018. syscall(__NR_perf_event_open, /*attr=*/0ul, /*pid=*/-1, /*cpu=*/3ul,
  4019. /*group=*/r[61], /*flags=*/0ul);
  4020. memcpy((void*)0x200000000200, "msdos\000", 6);
  4021. memcpy((void*)0x200000000240, "./bus\000", 6);
  4022. memcpy(
  4023. (void*)0x200000000700,
  4024. "\x78\x9c\xec\xda\x3d\x6b\x5b\x57\x18\x07\xf0\x73\x55\xb7\x7e\xc3\x2f\xa5"
  4025. "\xb4\xc5\x5e\x7a\x68\x97\x76\x11\xb5\xe7\x0e\x36\xc5\x86\x52\xd1\x96\xd6"
  4026. "\x2a\xb4\x05\xe3\x6b\x2c\xb7\x42\xaa\x64\x74\x35\x48\xa5\x83\xe6\x4e\x85"
  4027. "\x7c\x81\xcc\x21\x63\xb6\x40\xf0\x17\xf0\x77\xc8\x90\xcd\x04\x8c\x27\x4f"
  4028. "\xb9\xc1\x56\x62\x3b\x26\x89\xe3\x80\x2d\x13\xff\x7e\x8b\x1e\xf1\x3f\x07"
  4029. "\x9d\xa3\x03\x87\x87\xcb\xdd\xfd\xe6\xff\xbf\x6b\x9b\x59\x71\x33\x6d\x87"
  4030. "\x42\x92\x84\xc2\x42\xe8\x85\x83\x24\x4c\x87\x42\x78\xae\x17\xbe\x5a\xfd"
  4031. "\x61\xff\xbf\x5f\x7e\xfb\xfd\xfb\xc5\x52\x69\xe9\xe7\x18\x97\x17\x57\xe6"
  4032. "\xe6\x63\x8c\x93\x9f\x3d\xf8\xe3\xdf\xbb\x9f\x6f\xb7\xc7\x7f\xbd\x37\x79"
  4033. "\x7f\x38\xec\x4c\xaf\xee\xee\xcd\x3f\xda\xf9\x64\x67\x66\xf7\xc9\xca\x5f"
  4034. "\xd5\x2c\x56\xb3\xd8\x68\xb6\x63\x1a\xd7\x9b\xcd\x76\xba\x5e\xaf\xc4\x8d"
  4035. "\x6a\x56\x2b\xc6\xf8\x53\xbd\x92\x66\x95\x58\x6d\x64\x95\xd6\x0b\xf9\x66"
  4036. "\xbd\xb9\xb5\xd5\x8d\x69\x63\x63\x62\x6c\xab\x55\xc9\xb2\x98\x36\xba\xb1"
  4037. "\x56\xe9\xc6\x76\x33\xb6\x5b\xdd\x98\xfe\x99\x56\x1b\xb1\x58\x2c\xc6\x89"
  4038. "\xb1\xc0\x45\xdc\x3a\xf3\xbd\x7c\xe7\x20\xcf\xc3\x5e\xfe\xfe\x5a\xc8\xf3"
  4039. "\x7c\xf4\x76\x18\xdf\x0e\x13\x0f\xc3\x54\x48\x3e\x8c\xc9\x47\x0b\xc9\xc7"
  4040. "\x6b\xc9\xa7\xbd\x64\x66\x2f\xcf\xa7\x06\xb4\x62\x2e\x97\xf3\xbf\xd9\x4e"
  4041. "\x5d\xea\x23\x21\x3c\xee\x75\xca\x9d\x72\xff\xb3\x9f\x2f\x7f\x57\x5a\xfa"
  4042. "\x3a\x1e\x99\x3e\x99\x35\x7a\x5c\x1d\xe6\x73\xfd\x3c\x9e\xe4\xfb\x9d\x4e"
  4043. "\x79\x38\x8c\x3d\xcb\xe7\x5f\x9a\x8f\x84\x2f\xbf\xe8\xe7\x87\xd9\xb7\x3f"
  4044. "\x96\xce\xe4\xb3\x61\xe3\x72\xb7\x0e\x00\x70\x23\x15\xe3\xb1\x53\xfd\xdd"
  4045. "\x61\xff\xf5\x5e\x3f\x2f\xbe\x2a\xef\x57\xa7\xfa\xc3\x33\xfd\xdb\x50\x98"
  4046. "\x1d\xba\xb2\x6d\xf0\x96\xb2\xee\x3f\xb5\xb4\x5e\xaf\xb4\x5e\x53\x7c\x10"
  4047. "\xce\x1f\x33\xa8\xa2\x30\xa8\x5f\x3f\x7a\x2e\x16\x42\x38\x7f\x70\x32\x74"
  4048. "\x1d\xfe\xa8\x77\xa2\x08\xc9\xb5\x58\xc6\x8d\x28\x06\x7d\x33\x71\x15\x4e"
  4049. "\x0e\xfd\x82\x13\x0b\x97\xb4\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\xde"
  4050. "\xc8\x55\xbc\x4e\x38\xe8\x3d\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4051. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4052. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4053. "\x00\xd7\xdb\xd3\x00\x00\x00\xff\xff\x39\xf9\x70\xe7",
  4054. 535);
  4055. syz_mount_image(/*fs=*/0x200000000200, /*dir=*/0x200000000240,
  4056. /*flags=MS_LAZYTIME|MS_STRICTATIME|MS_MANDLOCK*/ 0x3000040,
  4057. /*opts=*/0x2000000002c0, /*chdir=*/1, /*size=*/0x217,
  4058. /*img=*/0x200000000700);
  4059. memcpy((void*)0x2000000001c0, "./bus\000", 6);
  4060. res = syscall(__NR_creat, /*file=*/0x2000000001c0ul,
  4061. /*mode=S_IWOTH|S_IROTH|S_IXGRP|S_IRUSR*/ 0x10eul);
  4062. if (res != -1)
  4063. r[64] = res;
  4064. syscall(__NR_setreuid, /*ruid=*/0, /*euid=*/0xee00);
  4065. *(uint32_t*)0x200000000000 = 0;
  4066. syscall(__NR_ioctl, /*fd=*/r[64], /*cmd=*/0x40047211,
  4067. /*arg=*/0x200000000000ul);
  4068. syscall(__NR_write, /*fd=*/r[62], /*data=*/0x200000000180ul, /*len=*/0x1dul);
  4069. *(uint64_t*)0x200000006d00 = 0;
  4070. *(uint32_t*)0x200000006d08 = 0x1002000;
  4071. *(uint64_t*)0x200000006d10 = 0;
  4072. *(uint64_t*)0x200000006d18 = 0;
  4073. *(uint64_t*)0x200000006d20 = 0;
  4074. *(uint64_t*)0x200000006d28 = 0;
  4075. *(uint32_t*)0x200000006d30 = 0x3800;
  4076. *(uint32_t*)0x200000006d38 = 0;
  4077. syscall(__NR_sendmmsg, /*fd=*/r[63], /*mmsg=*/0x200000006d00ul,
  4078. /*vlen=*/0xc6ul, /*f=*/0ul);
  4079. syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc);
  4080. *(uint64_t*)0x200000000080 = 0;
  4081. *(uint32_t*)0x200000000088 = 0;
  4082. *(uint64_t*)0x200000000090 = 0x200000000240;
  4083. *(uint64_t*)0x200000000240 = 0x2000000000c0;
  4084. memcpy((void*)0x2000000000c0,
  4085. "\xac\x00\x00\x00\x00\x01\x19\x05\x00\x00\x00\x00\x00\x00\x00\x1f\x0a"
  4086. "\x00\x00\x00\x3c\x00\x01\x00\x2c\x00\x01\x00\x14\x00\x03\x00\x16\xf8"
  4087. "\xbc\xd3\x83\x2f\x9b\x15\x77\xde\xf1\x3e\xda\xc1\xb8\xbf\x14\x00\x04"
  4088. "\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xbb"
  4089. "\x0c\x00\x02\x00\x05\x00\x01\x00\x00\x00\x00\x00\x3c\x00\x02\x00\x0c"
  4090. "\x00\x02\x00\x05\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x00\x14\x00"
  4091. "\x03\x00\xfe\x88\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00"
  4092. "\x01\x14\x00\x04\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08"
  4093. "\x00\x00\x00\x01\x08\x00\x07\x00\x00\x00\x00\x00\x18\x00\x06",
  4094. 151);
  4095. *(uint64_t*)0x200000000248 = 0xac;
  4096. *(uint64_t*)0x200000000098 = 1;
  4097. *(uint64_t*)0x2000000000a0 = 0;
  4098. *(uint64_t*)0x2000000000a8 = 0;
  4099. *(uint32_t*)0x2000000000b0 = 0;
  4100. syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0x200000000080ul,
  4101. /*f=MSG_DONTWAIT*/ 0x40ul);
  4102. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc);
  4103. if (res != -1)
  4104. r[65] = res;
  4105. *(uint64_t*)0x200000000000 = 0;
  4106. *(uint32_t*)0x200000000008 = 0;
  4107. *(uint64_t*)0x200000000010 = 0x200000000200;
  4108. *(uint64_t*)0x200000000200 = 0;
  4109. *(uint64_t*)0x200000000208 = 0;
  4110. *(uint64_t*)0x200000000018 = 8;
  4111. *(uint64_t*)0x200000000020 = 0;
  4112. *(uint64_t*)0x200000000028 = 0;
  4113. *(uint32_t*)0x200000000030 = 0;
  4114. syscall(__NR_sendmsg, /*fd=*/r[65], /*msg=*/0x200000000000ul, /*f=*/0ul);
  4115. res = syscall(__NR_socket, /*domain=*/0x11ul, /*type=SOCK_RAW*/ 3ul,
  4116. /*proto=*/0x300);
  4117. if (res != -1)
  4118. r[66] = res;
  4119. res = syscall(__NR_socket, /*domain=*/2ul, /*type=SOCK_CLOEXEC*/ 0x80000ul,
  4120. /*proto=*/0xfb7c);
  4121. if (res != -1)
  4122. r[67] = res;
  4123. memset((void*)0x200000001480, 48, 1);
  4124. syscall(__NR_setsockopt, /*fd=*/r[67], /*level=*/0, /*optname=*/8,
  4125. /*optval=*/0x200000001480ul, /*optlen=*/1ul);
  4126. *(uint32_t*)0x200000000140 = 0xc;
  4127. res = syscall(__NR_getsockopt, /*fd=*/r[67], /*level=*/0, /*optname=*/8,
  4128. /*optval=*/0x200000000040ul, /*optlen=*/0x200000000140ul);
  4129. if (res != -1)
  4130. r[68] = *(uint32_t*)0x200000000040;
  4131. *(uint16_t*)0x200000000100 = 0x11;
  4132. *(uint16_t*)0x200000000102 = htobe16(0);
  4133. *(uint32_t*)0x200000000104 = r[68];
  4134. *(uint16_t*)0x200000000108 = 1;
  4135. *(uint8_t*)0x20000000010a = 0;
  4136. *(uint8_t*)0x20000000010b = 6;
  4137. memset((void*)0x20000000010c, 170, 5);
  4138. *(uint8_t*)0x200000000111 = 0xaa;
  4139. memset((void*)0x200000000112, 0, 2);
  4140. syscall(__NR_bind, /*fd=*/r[66], /*addr=*/0x200000000100ul,
  4141. /*addrlen=*/0x14ul);
  4142. syscall(__NR_close, /*fd=*/r[66]);
  4143. syscall(__NR_lseek, /*fd=*/r[61], /*offset=*/0x800002ul, /*whence=*/0ul);
  4144. syscall(__NR_write, /*fd=*/r[61], /*data=*/0x200000000580ul, /*len=*/0x23ul);
  4145. memcpy((void*)0x200000000000, "io.pressure\000", 12);
  4146. syscall(__NR_openat, /*fd=*/r[61], /*file=*/0x200000000000ul, /*flags=*/2,
  4147. /*mode=*/0);
  4148. *(uint64_t*)0x200000000140 = 4;
  4149. syscall(__NR_ioctl, /*fd=*/r[61], /*cmd=*/0x4b63, /*arg=*/0x200000000140ul);
  4150. memcpy((void*)0x2000000000c0, "./bus\000", 6);
  4151. res = syscall(__NR_creat, /*file=*/0x2000000000c0ul, /*mode=*/0ul);
  4152. if (res != -1)
  4153. r[69] = res;
  4154. *(uint32_t*)0x200000000200 = 9;
  4155. *(uint32_t*)0x200000000204 = 0x80;
  4156. *(uint8_t*)0x200000000208 = 0;
  4157. *(uint8_t*)0x200000000209 = 0;
  4158. *(uint8_t*)0x20000000020a = 0;
  4159. *(uint8_t*)0x20000000020b = 0;
  4160. *(uint32_t*)0x20000000020c = 0;
  4161. *(uint64_t*)0x200000000210 = 0;
  4162. *(uint64_t*)0x200000000218 = 0;
  4163. *(uint64_t*)0x200000000220 = 0;
  4164. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 0, 1);
  4165. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 1, 1);
  4166. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 2, 1);
  4167. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 3, 1);
  4168. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 4, 1);
  4169. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 5, 1);
  4170. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 6, 1);
  4171. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 7, 1);
  4172. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 8, 1);
  4173. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 9, 1);
  4174. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 10, 1);
  4175. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 11, 1);
  4176. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 12, 1);
  4177. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 13, 1);
  4178. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 14, 1);
  4179. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 15, 2);
  4180. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 17, 1);
  4181. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 18, 1);
  4182. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 19, 1);
  4183. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 20, 1);
  4184. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 21, 1);
  4185. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 22, 1);
  4186. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 23, 1);
  4187. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 24, 1);
  4188. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 25, 1);
  4189. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 26, 1);
  4190. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 27, 1);
  4191. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 28, 1);
  4192. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 29, 1);
  4193. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 30, 1);
  4194. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 31, 1);
  4195. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 32, 1);
  4196. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 33, 1);
  4197. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 34, 1);
  4198. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 35, 1);
  4199. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 36, 1);
  4200. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 37, 1);
  4201. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 38, 26);
  4202. *(uint32_t*)0x200000000230 = 0;
  4203. *(uint32_t*)0x200000000234 = 0;
  4204. *(uint64_t*)0x200000000238 = 0x200000000000;
  4205. *(uint64_t*)0x200000000240 = 0;
  4206. *(uint64_t*)0x200000000248 = 0;
  4207. *(uint64_t*)0x200000000250 = 0;
  4208. *(uint32_t*)0x200000000258 = 0;
  4209. *(uint32_t*)0x20000000025c = 0;
  4210. *(uint64_t*)0x200000000260 = 0;
  4211. *(uint32_t*)0x200000000268 = 0;
  4212. *(uint16_t*)0x20000000026c = 0;
  4213. *(uint16_t*)0x20000000026e = 0;
  4214. *(uint32_t*)0x200000000270 = 0;
  4215. *(uint32_t*)0x200000000274 = 0;
  4216. *(uint64_t*)0x200000000278 = 0;
  4217. syscall(__NR_perf_event_open, /*attr=*/0x200000000200ul, /*pid=*/0,
  4218. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  4219. memcpy((void*)0x200000000080, "./bus\000", 6);
  4220. res = syscall(__NR_open, /*file=*/0x200000000080ul, /*flags=*/0ul,
  4221. /*mode=*/0ul);
  4222. if (res != -1)
  4223. r[70] = res;
  4224. memcpy((void*)0x200000000140, "msdos\000", 6);
  4225. memcpy((void*)0x200000000180, "./file0\000", 8);
  4226. memcpy((void*)0x200000000000,
  4227. "\x00\x0f\x7f\xf7\x72\x18\x75\xd8\xba\xcc\xeb\x2f\xbb\x96\x0d\x5b\x1c"
  4228. "\x33\x98\x8e\xac\x29\x7f\x7d\xed\xa3\x42\xbf\x10\x33\x23\xf6\x99\xe8"
  4229. "\xd3\x87\x65\xae\xad\x29\x5a\xb1\xff\x55\x00\xa9\x93\x0e\x66\x77\x94"
  4230. "\x15\xd3\x78\xac\x83\x82\x3c\x71\xe2\x9a\x17\xae\x07\x0b\x2f\x6d\xd0"
  4231. "\x42\xb2\xf0\x10\xa2\x7c\xc0\xd1",
  4232. 76);
  4233. memcpy(
  4234. (void*)0x200000000200,
  4235. "\x78\x9c\xec\xdb\xbd\x8a\x13\x51\x18\x06\xe0\x6f\x62\xd4\x44\x2d\x52\x8b"
  4236. "\xc5\x80\x8d\x55\x50\xf1\x02\x14\x89\x20\x0e\x08\xca\x14\x5a\x29\x44\x41"
  4237. "\x12\x11\x4c\x33\x5a\xe5\x52\xbc\x41\x41\x52\xa5\x3b\xb2\x3b\xbb\xf9\x59"
  4238. "\x36\xc5\x42\x92\x09\x9b\xe7\x69\xf2\xc2\xcb\x81\xef\x40\x66\x86\x33\x30"
  4239. "\x9f\x1e\x7c\x1f\x0d\x7f\x4c\xbe\x8e\x9f\xcd\xa2\x93\x65\xd1\x7a\x1e\x79"
  4240. "\xcc\xb3\xe8\x45\x2b\xce\x4d\x03\x00\xb8\x4e\xe6\x29\xc5\xbf\x94\x52\xba"
  4241. "\x3d\x8d\xee\x9f\x48\x29\x35\x3d\x11\x00\xb0\x6b\x9e\xff\x00\x70\x7c\xde"
  4242. "\x7f\xf8\xf8\xe6\x45\x51\x0c\xde\xe5\x79\x27\xe2\xef\xb4\x2a\xab\xb2\xfe"
  4243. "\xad\xfb\x57\xaf\x8b\xc1\xe3\xfc\x54\x6f\xb9\x6a\x56\x55\xe5\x8d\x45\xff"
  4244. "\xa4\xee\xf3\xf5\xfe\x66\xdc\x39\xeb\x9f\xd6\x75\xd6\x5e\xeb\x6f\xc5\xa3"
  4245. "\x87\x75\x7f\x52\xbe\x7c\x5b\xac\xac\x8f\xaa\x2a\xef\xc6\x70\xf7\xdb\x07"
  4246. "\x00\x00\x80\xa3\xd0\xcf\x17\x2e\x3d\xdf\xf7\xfb\x9b\xfa\x3a\xad\xbc\x1f"
  4247. "\xb8\x70\xfe\x6f\xc7\xfd\xf6\xde\xb6\x01\x00\x5c\xc1\xe4\xd7\xef\xd1\xe7"
  4248. "\xf1\xf8\xcb\x4f\x41\xd8\x42\xf8\x76\xaf\xfe\x5f\x1d\xca\x3c\x5b\x0b\xdd"
  4249. "\xc3\x18\x63\x7f\xa1\xe9\x3b\x13\xb0\x6b\xcb\x8b\xbe\xe9\x49\x00\x00\x00"
  4250. "\x00\x00\x00\x00\x00\x00\x00\x00\x80\x4d\xf6\xf1\x39\x51\xd3\x7b\x04\x00"
  4251. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4252. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0"
  4253. "\xf8\xfc\x0f\x00\x00\xff\xff\x9d\xa1\x35\x71",
  4254. 335);
  4255. syz_mount_image(/*fs=*/0x200000000140, /*dir=*/0x200000000180, /*flags=*/0,
  4256. /*opts=*/0x200000000000, /*chdir=*/1, /*size=*/0x14f,
  4257. /*img=*/0x200000000200);
  4258. syscall(__NR_write, /*fd=*/r[69], /*data=*/0x200000000280ul, /*size=*/0x64ul);
  4259. syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x600000ul,
  4260. /*prot=*/0ul, /*flags=MAP_FIXED|MAP_PRIVATE*/ 0x12ul, /*fd=*/r[70],
  4261. /*offset=*/0ul);
  4262. memcpy((void*)0x2000000001c0, "TIPC\000", 5);
  4263. res = -1;
  4264. res = syz_genetlink_get_family_id(/*name=*/0x2000000001c0, /*fd=*/r[70]);
  4265. if (res != -1)
  4266. r[71] = res;
  4267. syz_proconfig_reset__sys_fs_cgroup_system_slice_rsyslog_service_pids_max();
  4268. memcpy((void*)0x200000000100, "/dev/cpu/#/msr\000", 15);
  4269. syz_open_dev(/*dev=*/0x200000000100, /*id=*/0, /*flags=*/0);
  4270. memcpy((void*)0x200000000080, "fd/3\000", 5);
  4271. res = -1;
  4272. res = syz_open_procfs(/*pid=*/0, /*file=*/0x200000000080);
  4273. if (res != -1)
  4274. r[72] = res;
  4275. *(uint64_t*)0x200000000600 = 0x200000000200;
  4276. memset((void*)0x200000000200, 137, 1);
  4277. *(uint64_t*)0x200000000608 = 1;
  4278. syscall(__NR_pwritev, /*fd=*/r[72], /*vec=*/0x200000000600ul, /*vlen=*/1ul,
  4279. /*off_low=*/0, /*off_high=*/0);
  4280. *(uint64_t*)0x200000000400 = 0x200000000100;
  4281. *(uint16_t*)0x200000000100 = 0x10;
  4282. *(uint16_t*)0x200000000102 = 0;
  4283. *(uint32_t*)0x200000000104 = 0;
  4284. *(uint32_t*)0x200000000108 = 0x4000;
  4285. *(uint32_t*)0x200000000408 = 0xc;
  4286. *(uint64_t*)0x200000000410 = 0x2000000003c0;
  4287. *(uint64_t*)0x2000000003c0 = 0x200000000380;
  4288. *(uint32_t*)0x200000000380 = 0x24;
  4289. *(uint16_t*)0x200000000384 = r[71];
  4290. *(uint16_t*)0x200000000386 = 0x800;
  4291. *(uint32_t*)0x200000000388 = 0x70bd2b;
  4292. *(uint32_t*)0x20000000038c = 0x25dfdbfd;
  4293. *(uint8_t*)0x200000000390 = 1;
  4294. *(uint8_t*)0x200000000391 = 0;
  4295. *(uint16_t*)0x200000000392 = 0;
  4296. *(uint32_t*)0x200000000394 = 0;
  4297. *(uint16_t*)0x200000000398 = 0x8001;
  4298. *(uint16_t*)0x20000000039a = 0;
  4299. *(uint16_t*)0x20000000039c = htobe16(8);
  4300. *(uint16_t*)0x20000000039e = htobe16(0x11);
  4301. *(uint32_t*)0x2000000003a0 = htobe32(0);
  4302. *(uint64_t*)0x2000000003c8 = 0x24;
  4303. *(uint64_t*)0x200000000418 = 1;
  4304. *(uint64_t*)0x200000000420 = 0;
  4305. *(uint64_t*)0x200000000428 = 0;
  4306. *(uint32_t*)0x200000000430 = 0x20040;
  4307. syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0x200000000400ul,
  4308. /*f=MSG_FASTOPEN|MSG_BATCH|MSG_NOSIGNAL|0x100*/ 0x20044100ul);
  4309. syz_proconfig_set__sys_fs_cgroup_system_slice_rsyslog_service_pids_max(
  4310. /*val=*/0xfffffffc);
  4311. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/1ul, /*proto=*/0);
  4312. if (res != -1)
  4313. r[73] = res;
  4314. *(uint32_t*)0x200000000080 = 1;
  4315. syscall(__NR_setsockopt, /*fd=*/r[73], /*level=*/6,
  4316. /*optname=TCP_THIN_LINEAR_TIMEOUTS|TCP_CORK*/ 0x13,
  4317. /*optval=*/0x200000000080ul, /*optlen=*/4ul);
  4318. *(uint32_t*)0x2000000000c0 = 1;
  4319. syscall(__NR_setsockopt, /*fd=*/r[73], /*level=*/6,
  4320. /*optname=TCP_THIN_LINEAR_TIMEOUTS|TCP_KEEPIDLE*/ 0x14,
  4321. /*optval=*/0x2000000000c0ul, /*optlen=*/4ul);
  4322. *(uint16_t*)0x200000000040 = 2;
  4323. *(uint16_t*)0x200000000042 = htobe16(0);
  4324. *(uint8_t*)0x200000000044 = 0xac;
  4325. *(uint8_t*)0x200000000045 = 0x14;
  4326. *(uint8_t*)0x200000000046 = 0x14;
  4327. *(uint8_t*)0x200000000047 = 0xbb;
  4328. syscall(__NR_connect, /*fd=*/r[73], /*addr=*/0x200000000040ul,
  4329. /*addrlen=*/0x10ul);
  4330. *(uint32_t*)0x200000000000 = 0;
  4331. syscall(__NR_setsockopt, /*fd=*/r[73], /*level=*/1,
  4332. /*optname=SO_RCVBUFFORCE*/ 0x21, /*optval=*/0x200000000000ul,
  4333. /*optlen=*/4ul);
  4334. *(uint64_t*)0x200000001d80 = 0;
  4335. *(uint32_t*)0x200000001d88 = 0;
  4336. *(uint64_t*)0x200000001d90 = 0x2000000001c0;
  4337. *(uint64_t*)0x2000000001c0 = 0x200000000140;
  4338. memcpy((void*)0x200000000140,
  4339. "\x31\xc5\x99\xaa\xe1\x00\x5d\xb9\x40\xf7\x14\x32\x77\x9c\x78\xb6\x43"
  4340. "\xb6\x4e\xc6\x95\x79\x59\x65\x08\xca\x0d\xd5\xb8\xd3\x37\x58\x02\x90"
  4341. "\xa8\xb0\x46\x38\xad\xb1\x52\x81\x64\x36\x96\x7a\x79\x8a\x83\xa4\x62"
  4342. "\x14\x66\x6e\xcc\xf9\x8d\xf2\x4e\xc7\x43\x89\x3e\xd5\x07\x1c\x8f\x8b"
  4343. "\xce\x37\xfe\x41\xfc\x84\xd4\x87\xe8\x21\x18\xfb\x6b\x03\x3f\xe5\x05"
  4344. "\x9f\x12\x87\xe8\xcd\x42\x17\xde\xee\x8b\x0f\x9e\xda\x36\xac\xbd\xb0"
  4345. "\x82\xcb\x50\x00\x89\xa4\xe9\x2e\xde\xfb\xc7\x34\x60\x79\xbf",
  4346. 117);
  4347. *(uint64_t*)0x2000000001c8 = 0x75;
  4348. *(uint64_t*)0x200000001d98 = 1;
  4349. *(uint64_t*)0x200000001da0 = 0;
  4350. *(uint64_t*)0x200000001da8 = 0;
  4351. *(uint32_t*)0x200000001db0 = 0;
  4352. *(uint32_t*)0x200000001db8 = 0;
  4353. *(uint64_t*)0x200000001dc0 = 0;
  4354. *(uint32_t*)0x200000001dc8 = 0;
  4355. *(uint64_t*)0x200000001dd0 = 0x200000000400;
  4356. *(uint64_t*)0x200000000400 = 0x200000000380;
  4357. memcpy((void*)0x200000000380,
  4358. "\xc8\xa5\x68\xae\xf7\xeb\x5b\x33\x25\xfa\xc5\xd5\xf0\xd0\x93\x13\x7a"
  4359. "\xaa\xca\xbc\x31\x8e\x18",
  4360. 23);
  4361. *(uint64_t*)0x200000000408 = 0x17;
  4362. *(uint64_t*)0x200000000410 = 0x200000000940;
  4363. memcpy(
  4364. (void*)0x200000000940,
  4365. "\x75\x9f\x38\xfb\x79\x37\x4a\xdd\x12\x2f\x44\xe4\x60\x20\x8b\xdc\x7f\x3f"
  4366. "\xb2\xcb\x89\xca\xf9\x60\xc1\xd2\xa5\xe8\x38\x2a\xc4\x62\xb3\xa2\x6f\x78"
  4367. "\xaf\x62\x6f\xfc\x0e\x58\x6d\xd7\x74\xa0\xb6\x25\xc2\x65\x6b\x8b\xcf\x4f"
  4368. "\xe2\xa0\xc4\x2a\xae\xac\x66\x23\xa2\xe3\x16\xea\x0b\x30\x29\xe1\x6e\xdc"
  4369. "\xa6\xba\x04\xbf\x3e\x74\xd2\xf9\xf5\x0f\x6b\x09\xfa\x05\x22\x1a\x8e\xc6"
  4370. "\xbd\x4f\x44\x4d\x35\x03\x11\x26\x67\x09\xaa\xd6\xac\xa1\x17\xcd\xb4\xda"
  4371. "\x14\xcf\x26\xbe\xd1\xf7\xf1\xa9\x09\x71\xed\x32\x0a\x98\x5f\xbc\xae\x87"
  4372. "\x55\x47\xc7\x04\x80\xdf\x77\xbd\x98\xd0\x6f\x8c\x45\x0d\x3d\x9e\x7e\x1d"
  4373. "\xe4\xe2\x17\xa8\xa6\x30\x06\xc0\x03\x71\xba\x4a\x54\x73\x0b\x0e\x59\x30"
  4374. "\xb7\xb4\xb1\x91\x83\x2d\xc9\x5d\x6b\xd9\x7d\xc5\x8e\xcf\xf9\x4a\x58\xea"
  4375. "\xe8\xfb\x79\xad\xc0\x0a\x94\x13\x55\x7b\xc7\x56\x32\xe0\x7a\xd9\x6f\xe5"
  4376. "\xe0\xb9\x99\x56\x6f\xc5\xdd\x57\x78\x70\x9a\x06\xf6\x24\xb0\x07\x3d\xbb"
  4377. "\x8e\x12\x53\x0c\xed\x80\x17\x64\xf7\x09\x93\x4b\x37\x91\x0c\x20\x04\xf9"
  4378. "\x67\x6d\xe1\xcb\x8d\x56\x4f\xc6\xcb\x89\x0b\x6b\x6d\xac\x47\xfd\xce\xa2"
  4379. "\x5a\x96\xda\x89\xea\x26\x71\x65\x3c\xc2\x56\x20\xe1\x1c\x92\x60\x06\xce"
  4380. "\x11\xf0\xa9\x78\xdb\x7e\xf8\x5d\x58\xc3\x96\x2d\x07\x41\x9c\x5b\xdb\x82"
  4381. "\xe5\x7c\xf3\x0e\xbd\x49\xc0\x18\xac\xfb\x31\x19\xb5\x82\xd7\xc5\x39\x1b"
  4382. "\xff\xb1\x68\x36\x94\x81\x95\xda\x63\xf2\x9d\x2f\x86\xce\x17\xca\xdc\x19"
  4383. "\x99\x27\xc8\xf1\x48\x2d\x93\x89\x44\x3b\x19\xbd\xa2\x3c\x23\x30\xee\x0c"
  4384. "\x5b\xb3\x4b\x87\x25\x1d\x75\x41\x43\xc5\x3c\xae\xa9\xe2\x65\xa4\x06\x0f"
  4385. "\x92\x60\x7b\x5b\x64\x5b\x6e\x98\x9e\x6f\x42\xec\xe5\x2c\x0f\x57\x59\xf4"
  4386. "\xf4\xe3\x19\x59\x35\xc3\x36\x75\xf8\x19\x61\x49\x44\xf7\x47\xcc\x4a\xe7"
  4387. "\x94\xeb\x50\xd5\x2e\x99\x92\x51\x13\x0c\xbc\x2f\x20\x38\x48\x5b\x65\x71"
  4388. "\x8a\x21\xcd\x88\x10\xf3\x38\x89\x24\x76\x83\x49\x70\xf9\x98\x20\x3a\x95"
  4389. "\xf7\xc1\x79\x24\x4c\xb4\x0b\xaa\x3b\xbb\x3a\x4a\xa6\x38\x17\x46\x37\x2c"
  4390. "\x29\x75\xa4\x68\x54\x16\x22\x04\x34\x1b\xf5\x35\x2b\x43\x5b\xfb\xc3\xc1"
  4391. "\x48\xa7\x4e\xea\x4a\x7a\xe8\x17\x10\x3b\x68\x1a\x9c\x25\x6d\xe4\x25\x87"
  4392. "\x55\x6d\x0e\x9b\xf7\xb2\x6a\xda\x33\x77\x64\xd2\x5b\x12\xca\x82\x3d\xa4"
  4393. "\xb9\xcd\x5c\xd1\xbf\xd3\xb6\x99\x11\x61\x2d\x59\x4f\x7f\xd3\xf4\xf0\x51"
  4394. "\xd6\xe4\x7c\x52\xa5\x4c\xdb\x6e\x0d\x00\x12\xf5\x6f\x7a\x0b\xa1\x78\x1e"
  4395. "\x3c\x9c\xbb\x8e\x5f\x03\x3d\xe6\x2f\x9b\xcb\x2b\x05\xa2\xe3\x35\xa1\xb9"
  4396. "\xf5\x61\x7c\xd0\x4c\x96\x70\xf7\x7b\x16\x7e\x6a\xec\x2d\x18\xc9\x31\xdc"
  4397. "\xfd\x30\x8c\xc6\xbe\x26\xc2\x29\x4b\xa3\x07\x9a\x6f\x2c\x13\xd2\x92\xae"
  4398. "\x7a\xbc\xab\x9c\xc3\xac\xe7\x92\xac\x31\xea\x7c\x86\xf7\xd0\xd2\x80\x08"
  4399. "\x90\x0e\x97\x37\x32\x8a\x39\xf1\xa7\x3f\x3a\xa4\x86\x0e\x54\x91\x1b\x8f"
  4400. "\x69\x68\xc2\x35\xd0\xf4\x0b\xc7\xca\x6b\xa7\xf7\xdc\x19\x61\x85\xe2\x35"
  4401. "\x1a\xbe\x60\x80\xb3\x68\x3b\xd6\x88\x60\x23\xa5\x80\x85\xeb\x28\x0e\x31"
  4402. "\xd8\x7b\x11\x75\x5a\x2d\x7c\xe8\x9e\x52\x90\x88\xdf\xb6\x24\x2f\xa3\x52"
  4403. "\x56\x6b\x93\xa5\xb0\x93\x46\x60\x37\x86\xbf\x28\x87\xa9\xb0\x79\xa4\x6f"
  4404. "\xcc\xdc\xac\xc4\x76\x54\x38\x1c\xdb\xca\x7b\x33\xad\xe3\x54\x17\x26\x49"
  4405. "\x51\xcf\x8b\xe5\x24\x2c\xbe\x9c\xdd\x27\x85\x13\x93\xb3\xce\xfb\xb2\xe7"
  4406. "\x40\xd1\xfe\xe7\x26\x6b\xce\x2d\x92\x90\xbd\x40\x41\x29\x1e\x0e\xe0\xb7"
  4407. "\x38\x99\x92\x63\xc7\x3e\x53\xab\x63\xfb\x5e\x61\x41\xc1\x3d\x34\x8f\x8f"
  4408. "\x10\x0c\x9d\x03\x26\x46\xb9\xbb\x4c\x64\x59\x1c\xf5\x41\xaf\xcb\x46\x2a"
  4409. "\x27\xd0\xcc\xb0\x54\x62\x33\x5f\xe6\x32\xde\xd2\xdd\x69\x6d\xdf\x14\x11"
  4410. "\x97\x9c\xce\x44\xda\x76\x1c\x72\x57\x49\xd3\xaf\xb3\x2f\x22\x0e\x35\x2f"
  4411. "\x6c\x33\xc5\x15\x65\x76\x37\xb9\x78\x3c\x85\xd2\x66\x44\x35\x75\x39\x84"
  4412. "\x36\xde\x23\xfb\xfe\x2f\x21\x54\x01\x4c\x13\x72\x15\x6d\xd7\x32\x82\x34"
  4413. "\xb4\xaf\x40\xdb\xc2\x79\xad\xb3\x56\x60\x6d\x2b\x29\x47\xd4\x49\x8d\xfd"
  4414. "\xd9\xc2\xa5\xec\xea\x1a\x1d\xaf\x7d\x48\xae\xf1\x00\x52\x50\x81\x40\x6d"
  4415. "\x46\x9e\x67\x2e\xa1\xde\x35\x81\x5c\x42\x5c\x4c\x00\x82\x5a\xcf\xb6\x90"
  4416. "\x0b\xb1\x4c\xe4\x9a\x79\x19\xda\x31\x2d\x1e\xb5\xf4\xad\x83\xd9\xf7\xde"
  4417. "\x9d\x43\xa2\x1c\xb7\x2a\x33\xfd\x69\x9f\x18\x8c\x5f\xec\x3b\x2b\x3d\x4a"
  4418. "\x4d\x19\x93\x99\x30\xd0\x53\x59\x76\xac\x04\x3d\x95\x52\x88\x03\x05\x15"
  4419. "\xd5\x12\x07\x6a\x4c\xee\xb0\x5b\x80\x48\x74\x35\xbe\x70\x17\xc6\x3c\x89"
  4420. "\xdb\x5c\xbe\x4a\xe9\xed\x2e\x68\x23\x05\x69\x28\x0e\x19\xff\xe3\x89\xfc"
  4421. "\x95\x45\x39\x53\xde\xbb\x16\x46\xa4\x17\x89\xf8\x02\x47\x62\x0e\xb1\x2f"
  4422. "\x01\x18\x41\x5d\x10\x15\xad\x38\x38\xec\xcc\x9e\x90\x55\x23\xba\xe6\x8a"
  4423. "\xe9\x9a\x3a\x4c\xc7\xd8\x4e\xcd\x7f\xd0\x01\x83\x91\x83\x91\x9a\xaa\x04"
  4424. "\xe1\x69\x2f\x5b\xec\xc1\xe5\x7f\xa5\x8e\x5a\xaa\xf3\x26\x79\x2b\x53\xb7"
  4425. "\x5a\xfd\x28\xa7\xd7\x37\x5e\x76\x9c\x8a\x56\x7c\xd1\x28\x1d\xc1\xcb\x1a"
  4426. "\xc1\x9f\x09\xa0\xab\x29\xe8\xc0\x88\x02\x3c\xb5\xe0\x3f\xa0\xc2\x15\xf5"
  4427. "\x48\xef\x1d\x47\x3f\x51\x55\x4e\xae\xf4\x49\xf1\x9d\xea\x56\x92\xbf\x7c"
  4428. "\x7f\x5e\xa3\xc1\xaf\x53\xd0\x32\xf4\xb8\x54\xce\x7e\xaa\xc8\xe4\xd5\x34"
  4429. "\x4c\xca\xe3\x08\x5d\x70\x17\xef\xbc\x00\xe4\x1f\x02\xa4\x52\x7c\x23\x9d"
  4430. "\x18\xb0\x65\xc2\xb5\xe5\x98\x8d\x0c\x4e\x4b\x8e\x1e\x59\x7c\x8d\x48\x18"
  4431. "\xf6\x79\xb9\x57\x55\x54\x7f\x0a\xa6\x2d\xad\xc3\xdb\x99\x72\x9f\x4a\x46"
  4432. "\x86\xdf\x70\x4a\x75\x8c\x98\x3d\x21\x04\xcf\xea\xa8\xa9\x9b\xf7\x24\x6e"
  4433. "\xb5\x77\x3b\xf5\x58\xcd\x3d\xb7\xdf\xa7\xeb\x91\x3b\x6d\xa6\x58\x88\x59"
  4434. "\xf7\x11\xdc\xa0\x7d\xae\x62\x28\x08\x11\xe1\x63\x7d\x8f\xf3\x1f\xf0\xca"
  4435. "\x2f\x77\x5f\x64\xbd\xe2\xef\x69\x72\x1a\x91\x31\x37\x42\xa3\x1f\x8f\x59"
  4436. "\x10\x05\xe4\x33\x98\xca\xdb\xbd\x71\x3a\x75\x48\x69\xdf\x63\x96\xed\x12"
  4437. "\xa2\xf8\x8f\x38\x9e\x01\x85\x97\xbf\x5d\xb1\xdc\x5b\x99\x7a\x3d\x19\x99"
  4438. "\x0f\x1e\xa7\xc5\x65\xb5\x7f\x75\xbb\xa2\xe5\xa5\x1a\x53\x53\x1c\x69\xb5"
  4439. "\xc6\x68\xa1\xbf\x90\xb4\x6f\x7f\x75\xb3\x7b\x57\x76\x9b\x7b\xf2\x0d\x9f"
  4440. "\x97\x22\xe4\xec\x8d\xe6\xe8\x19\x60\x7d\x85\x7c\x41\x8f\x16\x63\x8c\xe4"
  4441. "\x00\x1e\xc5\x24\x9b\x68\x01\xec\xeb\x25\xf5\x18\x92\x4c\xc1\x7e\x42\xc6"
  4442. "\x08\xcf\xb1\x95\x53\x77\x63\x34\x92\x04\x19\xf5\x1f\x70\xc2\x69\x9a\xab"
  4443. "\xf4\xf2\xdc\x65\x91\x81\x94\x8d\xbd\x3d\x11\x08\xc9\xec\x6b\x4d\xee\xa2"
  4444. "\x5b\xf1\xa6\xa4\x14\xb7\xb8\x11\xa0\x3a\xfe\xf1\x30\x51\x52\xc7\xba\xb7"
  4445. "\xf3\x5b\x57\x90\xec\xea\x95\x1b\x2a\xce\x03\x45\xd2\x81\x6c\x42\x54\x7b"
  4446. "\xbc\x69\x6d\xf7\xc6\xcd\xc9\x6a\xc2\x56\x3c\x28\x62\x62\x73\x1c\x74\x35"
  4447. "\x19\xf7\xfa\xdc\x3f\xde\x75\x9e\xd4\x6d\x86\xaf\x01\xa9\xac\x4e\x96\x85"
  4448. "\x11\x41\x1d\x33\xc0\xea\xe6\x58\x20\x8e\x38\x1f\x14\x32\x2f\xa3\x9c\x48"
  4449. "\x37\xbd\xdb\x54\x53\x38\xec\x7d\x30\xbc\xf8\xbf\xa1\xec\x14\xca\x74\x8e"
  4450. "\x98\x0a\xa5\x60\xa4\x7e\x1a\xb1\x90\x73\x43\x69\xf8\x2e\x75\xd9\x5e\x5a"
  4451. "\x4a\xc3\x56\x7a\xa5\xfd\xbf\xf7\xb7\x17\xe8\xaf\x85\xc3\x61\xfc\x78\x94"
  4452. "\x66\x40\x6c\x18\xa4\x94\x76\x34\x54\x0e\x9b\xc5\x73\x87\xee\x62\x04\xc6"
  4453. "\x2c\xca\xf4\x8f\x66\x1b\xfa\x24\x26\x97\x3b\xf8\x2c\xc1\x01\xd8\x9d\x3d"
  4454. "\x09\x98\x1e\xea\x6d\x0a\xe7\x9e\xce\x6f\x63\xfe\xaf\x10\x9c\xb0\xef\x59"
  4455. "\xad\x23\xe5\x3b\x3a\x6d\xe4\x90\x2e\x4a\x28\x12\xac\x86\x95\x83\xed\x26"
  4456. "\x79\x39\x1c\x38\x0a\x92\xc2\x2c\xbd\x25\xa7\xd2\xb0\xde\xb3\xcc\x99\x88"
  4457. "\x56\x90\x93\x87\xa0\xb3\x19\xe4\xfb\xf5\xcf\x3c\x08\xfb\x5e\x4e\xcc\xaf"
  4458. "\x2b\x80\x2a\x99\x81\x36\x0f\x85\xa7\x0e\xb8\x11\xf5\x6b\x05\xf2\x94\x43"
  4459. "\x84\x4d\x19\xf8\x7b\xfd\x21\xe5\xdf\xd5\xd2\x6b\x54\xbf\x91\x39\xf1\xfe"
  4460. "\xf1\xa2\x78\x7c\x5d\x93\x45\xcd\x2a\x35\xde\x40\xc4\x4c\x35\xf0\xc8\xab"
  4461. "\x93\xa9\xc9\x6a\x5e\xb7\xe9\x64\xb7\x20\xfc\x82\xd3\xbc\x87\x05\x24\x22"
  4462. "\x6f\x44\x67\x0d\xb0\x4f\xaa\xbd\x88\x3d\x83\xa9\xa1\xd3\x79\xe5\xb2\x0a"
  4463. "\xbe\xae\x75\xce\x42\x01\x52\xc2\x8f\x38\xd5\x44\x2b\x50\xd0\x79\xf4\xe4"
  4464. "\x88\x34\xd5\x44\x0c\x26\xe2\x72\x92\x69\x0a\x79\xd5\xee\x38\x5b\x44\x69"
  4465. "\x1e\xf3\x98\x3e\x38\x52\x24\x80\x17\x8c\x51\xda\xb9\xc9\x49\x68\x78\xea"
  4466. "\x66\xf7\x97\x6b\xc7\x26\x64\x4d\xa7\x5a\xee\xdb\x85\x9e\x27\xc0\xb8\xba"
  4467. "\xca\xb6\x4b\x46\xe8\x57\xaa\xe0\x02\x1c\x8d\xdc\x68\x92\xd6\x4f\x27\x6b"
  4468. "\x11\x66\xef\x34\xdc\xd5\xf3\xe4\xaa\xee\x43\x16\x61\x6b\x70\x8c\x25\xbf"
  4469. "\xba\x8d\xa6\x7c\xb2\xaf\x1c\xa5\x4c\x8a\xbe\x5d\xc8\x73\x03\x94\x44\x34"
  4470. "\x7a\xcb\x17\x1f\x5e\x5b\x84\xa3\x4c\x48\x26\x1b\x5d\xca\x0a\x3c\xbf\x34"
  4471. "\x85\x73\xbe\x39\x97\xce\x14\x66\x2b\x3d\x69\xd7\xbe\xb6\xf0\x57\xa4\x18"
  4472. "\x82\x19\xfd\x12\x33\x78\x2d\xba\x06\x6d\x01\x64\xaa\x95\xa4\xaa\xbb\xee"
  4473. "\x02\x3b\x2f\xa0\x33\xa5\xf1\xf8\xd2\x8b\x77\xb5\xad\x50\x33\xd9\x58\x93"
  4474. "\xd8\x7d\x5d\xe5\xca\x9e\x75\xbd\x8c\x37\x49\x6c\xba\xd2\x89\x1a\xe4\x2c"
  4475. "\xa1\xf3\xea\xdd\xc8\x6d\x94\xf0\xe0\x06\x4b\x6c\xfc\xe7\x0f\x75\xe2\x89"
  4476. "\x67\x2c\xe0\x25\xae\xe3\x5f\x7d\x28\xab\xce\x52\xcb\xf0\x75\xaf\x21\x19"
  4477. "\x86\xb8\xaf\x2c\x82\x78\x16\x7a\x3c\x16\x0b\x76\xdf\xde\x9b\x48\x77\x8e"
  4478. "\x9c\x6a\x1b\x5f\xe8\x74\xbf\x72\x52\xa5\x8a\x49\xf0\xc9\x9f\x82\xe1\xbc"
  4479. "\x64\x89\x00\xb3\x03\xd9\x89\xdf\xa7\x4e\xb4\xe7\xe5\xc7\xe2\x42\xe5\xfe"
  4480. "\x28\x0e\xd4\xe1\x4a\xd5\x67\x9a\xb5\x98\x9c\x8b\xc1\x6a\xd1\xb3\xa5\x88"
  4481. "\x46\xee\x89\x3a\x65\x1e\x1b\xc8\xcf\x11\x9c\x3d\xe0\xff\x1c\xa2\xd1\xe8"
  4482. "\xab\x9e\x13\xeb\x45\x84\x66\xfc\x89\xd9\x83\x9e\x64\xc4\x9a\x43\xe6\x2a"
  4483. "\x88\x13\xe9\x42\x22\xe7\xf3\x7d\xc2\x07\xae\x1e\x7c\xdb\x21\x06\xcc\x14"
  4484. "\x0a\x3f\x70\x4a\x00\xea\xe6\xab\xde\x92\x7e\xab\xe5\x08\x20\x1f\xee\xa8"
  4485. "\x92\x03\x2c\x32\xe2\x00\xcf\xe3\x1f\xe5\xa0\xc5\xdd\x8c\x5b\xca\xe3\xaf"
  4486. "\xd1\x35\x69\xda\x81\x5a\xfe\x0a\x55\x03\xc9\x2f\x03\x95\xa1\xb2\x46\x57"
  4487. "\x73\x9e\x3c\xa8\xb0\x39\x0a\x5f\x39\x2f\x92\xa4\xab\x0b\xfc\xc9\x80\x12"
  4488. "\xb4\xa2\x8d\xd0\xaa\x92\x9e\xe3\xb6\x8e\xa8\xc1\xe4\x25\xd9\x93\x8c\x6e"
  4489. "\x47\x3c\x23\x06\xc8\x85\xf7\x77\x24\x0a\x41\x79\x5e\xc2\xa5\xd7\x0b\x94"
  4490. "\xad\xa6\x58\x5f\x18\x92\xaf\x79\x4c\x47\xbc\x79\x8f\xa2\xfd\x8f\x6f\xaf"
  4491. "\x29\xfb\x6e\x62\x22\xaf\x62\xb7\xdf\xbe\xcc\xf4\x5b\xf9\xd2\xf6\x8a\xf7"
  4492. "\xe6\x31\x9e\x2e\xc6\x68\x3d\x77\xe4\x1b\x6c\xd0\x5a\x8f\xc3\xf8\xd6\x17"
  4493. "\x45\x98\x73\x7b\x40\xee\xca\x3d\x33\x51\xac\x44\xa3\x7b\xec\x68\x45\xfd"
  4494. "\x16\x26\x8a\x8e\xbf\xde\xf3\xc7\x26\xbf\xcf\x70\xfa\x48\x91\xae\x32\x41"
  4495. "\xfa\xcf\x63\xe0\x2f\xd1\x63\x1d\x91\xef\x9f\xd9\xba\x0b\xd0\x28\x78\x81"
  4496. "\x03\x50\x46\xce\x2b\x0c\xe4\x07\xf2\x95\xad\x82\x1c\x5b\xeb\x56\xcd\x5f"
  4497. "\xa4\x24\xaa\x3b\xd7\xe9\x2f\x70\xd5\x36\x76\x7e\xbe\x0c\xd2\x3a\x08\xa7"
  4498. "\x69\xc9\x9c\x1a\x7d\xf4\xbb\xf7\xd5\x2c\xd8\x07\x71\xcd\x12\x15\x1a\x5a"
  4499. "\x59\xf1\x95\x21\xcc\xc2\x24\xba\xb3\x2f\x13\x57\x7d\xe5\xa3\x7c\x74\xe7"
  4500. "\x46\x53\xf6\x39\x5e\x1a\x0d\x68\x9e\xf6\xa4\xd7\xa0\x6b\x7c\x29\xd3\x43"
  4501. "\x22\x8d\x8f\xd3\x51\xf6\xb6\xea\xec\xd4\x5a\x7c\x6f\xda\x95\xf3\xca\x7d"
  4502. "\x88\x39\x3b\x1d\x8d\x80\xbf\x11\xa5\x7a\xeb\x5f\xee\x4d\x31\x51\x88\xae"
  4503. "\x79\x9c\xb7\x01\x2c\x4b\x2e\x73\x06\xa1\x78\xfa\xc3\x23\x8d\xfc\x44\x38"
  4504. "\xef\x10\x11\x93\x85\x49\x21\x26\x4f\x02\xb3\xe4\x3e\xc7\xec\x1d\xfb\x3d"
  4505. "\xa5\x1f\xfa\xd8\xe3\xc2\x37\xd6\x48\xa0\xd0\xf0\x60\x3e\x93\x8d\xb4\x31"
  4506. "\x08\x9c\x6a\x2f\x69\x6f\xc7\xcc\x45\x07\x61\x9a\xac\xcf\x30\x8a\x9a\x06"
  4507. "\x9c\x7b\xef\xb9\xbc\x16\xe3\x74\xb8\x71\x51\x3c\xaf\x45\x4e\xb7\x75\x8d"
  4508. "\x97\x4b\xd5\xd1\xd0\xbd\xe7\xfa\xc1\x53\x58\x17\x7d\x4e\x37\x8e\x59\xb5"
  4509. "\xd6\xd9\xee\xf6\x2c\xd5\xfb\xbb\xc5\x02\x3d\x08\x48\x37\x9d\xda\x6e\x3f"
  4510. "\x92\x92\xbf\x22\x7a\x31\x32\xfb\xc1\xd8\xcd\xb3\x08\x26\x91\x6a\x38\x52"
  4511. "\xa1\x8e\xfb\x3f\x66\x51\x45\x0b\xeb\x80\x4f\x6a\x23\x4a\xed\x37\xba\xd4"
  4512. "\xca\x8d\xd1\xf7\xca\x35\x85\xc7\xb2\xcf\xf3\xb6\xf3\xdb\x08\xbe\xbf\xd6"
  4513. "\x13\x92\x86\x11\x17\x51\x02\x62\xbc\x9e\x3a\xbb\x2b\x01\x15\x46\xae\x5c"
  4514. "\xeb\x82\xf4\x0e\x89\x31\xad\x8e\x2c\xf6\x6e\x58\xb7\x5a\x45\x06\x20\x08"
  4515. "\x9b\x8f\xb0\x16\x64\x92\x77\x3f\x1a\x2a\x0b\x70\xdf\x50\x76\xb3\x56\xc1"
  4516. "\xad\x39\x40\xac\x66\x12\x71\xb6\xba\x51\x2d\xd3\xfe\xe2\x90\x58\x1c\xb8"
  4517. "\xda\xbe\xfb\x4a\x41\xe9\x3c\x0a\x5c\xe1\x18\x71\x8f\xf6\x9f\x5f\x98\x32"
  4518. "\x3c\x6e\x5a\x57\x2e\x36\xad\x11\x53\x4e\x93\xf4\x49\x0b\xfe\xef\x55\x6f"
  4519. "\xfc\x14\x1b\x0e\xf6\xb2\x59\x62\xd6\x7d\xf0\x32\xb1\x85\x19\xa7\xa1\x6e"
  4520. "\x77\xfa\x48\xfb\x22\xc4\x08\xe7\x58\xd9\x89\x8e\xf7\x44\x8f\x9d\xe7\x43"
  4521. "\xc6\xbf\x90\x42\xcb\xfc\xd4\x14\x7b\xc3\x96\xc6\x19\x16\x3c\x39\xa0\xdb"
  4522. "\x1d\x38\xea\x52\x09\x97\x7a\xa1\x3b\xbc\x08\x45\xdf\x98\x79\xd2\x4c\x16"
  4523. "\x3c\x6d\x05\xbb\x56\x17\x4b\x2f\x7f\x8d\xd1\xcc\xe8\x05\xbe\xd6\xae\x50"
  4524. "\x20\x08\x2e\x22\x21\xaa\x70\xbb\x78\xf9\x4b\x35\xb2\x66\x04\xb6\x9a\xbf"
  4525. "\x8a\xd0\xf7\x72\x50\x8b\x16\xd6\x2a\x04\xf1\x4c\xcf\xb4\xe5\xa6\x54\x58"
  4526. "\xd2\x76\xca\x86\xaa\x68\x10\xc1\xe1\x08\x04\xc1\x97\x94\x03\x97\xc5\x2d"
  4527. "\x25\x84\x12\xfe\xdf\x7e\x3b\x6e\xb0\x71\x30\xf7\xcd\x0a\xdd\x7d\x69\xc8"
  4528. "\x9d\xb2\x9d\x3a\x51\x55\x81\x12\x99\x93\x11\xee\xdf\x35\x8a\x8e\xe1\x44"
  4529. "\x17\x12\x79\x7c\x71\x94\xe7\x44\x3c\x7d\xb6\xa4\x78\x71\xa8\xfe\x29\x71"
  4530. "\x12\x04\x10\x8d\x24\x5e\x98\x81\xed\x63\x95\xe8\x89\xaf\x95\x8a\x8b\x4e"
  4531. "\x9c\x86\x32\x83\x6f\xb7\x2a\x25\x1f\x44\xf0\xc3\xf9\x97\x9c\x9b\xfd\x0d"
  4532. "\x4d\xd8\xaf\xb0\xea\xd4\x51\xb2\xb7\x4e\x1f\x76\x3b\x71\x62\x24\x18\x6b"
  4533. "\x21\xbd\xec\xef\x9d\x6d\xaf\xab\x1c\x50\x8e\xc7\x36\xd9\x48\x40\x45\x5d"
  4534. "\x09\x62\xd8\x9b\x0a\xc0\xe6\x97\x1e\xd5\x8b\xa9\xc1\x12\xbf\x41\x58\x6b"
  4535. "\x9e\x58\x59\x64\xce\xa2\x78\x92\x9f\x9d\xda\x22\x56\x11\xc8\x33\x62\x1c"
  4536. "\x1d\xa6\x55\x6c\x3a\x7c\xa1\xb9\x4a\x05\x66\x03\x72\x0f\x62\xd1\x17\x69"
  4537. "\x85\xce\x4f\x23\xda\x62\x4d\xcd\xbb\x07\x9d\x80\xf5\xf7\x56\xf1\x2c\xff"
  4538. "\x1c\x6d\x3c\x8c\x6f\xb9\x9f\x95\xde\x38\x4c\x7b\xca\x77\xec\xe3\xde\xa1"
  4539. "\x98\xe5\x26\x69\xa8\xff\x13\x81\xe9\x03\x48\x2d\x2a\x53\xd1\x1c\x96\x6e"
  4540. "\x26\x61\x8c\xd0\xd7\x58\x0c\xfd\x5a\x47\x60\xc4\x0b\x8e\xc7\xbf\x6d\xa1"
  4541. "\xbc\x37\xcc\x8b\xe7\x1b\xc3\x59\xad\x5e\x78\x56\x96\x9b\x0d\x6d\x66\xd3"
  4542. "\x54\xad\x28\xe6\xd8\x6a\x15\x5c\xcd\x73\xfd\x09\x27\x06\xd1\xbb\x00\x09"
  4543. "\x53\x65\x83\x63\xb5\xda\x42\x9a\x8c\x1f\xed\x07\xd3\xa3\x80\x9e\x57\x05"
  4544. "\xbf\x14\x40\xd9\xeb\x47\x30\x7a\xba\x79\xae\x75\xd0\x58\x33\x74\xb0\x0f"
  4545. "\x4f\x6e\x7c\xfd\x85\x5f\xf7\x47\xa8\x85\xb8\xa7\x37\x60\x75\x5b\xa7\x5f"
  4546. "\xbf\x11\x16\x4f\x55\x26\x3a\x62\x92\x33\xe3\xde\x1a\x04\x56\x7f\xa8\xb4"
  4547. "\xec\x00\x6f\x09\x76\xea\x6c\x16\xd6\x67\xf8\x65\xab\x0a\xf9\x2f\x7f\xec"
  4548. "\x56\xc5\xf9\x4e\xb3\x5a\x47\x55\xc8\xf4\xb2\x3c\x59\x2a\x57\xe6\xef\xad"
  4549. "\xd2\xbc\x9d\x23\x8d\xe3\x0c\xea\x10\x5d\x4a\x74\x97\x39\xe3\x01\xbf\x26"
  4550. "\x54\xca\x22\x59\xaa\x86\x37\xcd\x85\x08\xea\xbc\x55\xb5\xe0\x52\x5c\x09"
  4551. "\x1d\x9e\x27\x79\x87\x6d\xdd\xc9\x72\x40\x19\xe2\x37\xa2\x72\xcc\x67\x91"
  4552. "\x07\xc4\x7b\xd8\x1d\xe2\x18\x24\x6e\x4c\xbc\x10\x77\x9a\x94\x10\x06\x4c"
  4553. "\xa3\x85\x61\xf3\xeb\x2d\xbf\x21\x3e\xb9\x3c\x80\xa7\xc4\x75\x13\x72\x0f"
  4554. "\xa7\xe6\x89\xf0\xbe\xb0\xf8\xa0\x43\xa2\x1e\xd0\x47\x0f\xec\xbb\x95\x9c"
  4555. "\x19\x6a\x82\xa1\x24\x22\x96\xf1\x6f\x49\x37\xfa\x22\x7d\xfd\xf5\xe1\xd1"
  4556. "\x57\xe8\x43\xf8\xf4\xd5\xd1\xc7\xb3\x3c\x2c\xfa\x75\xb5\xc3\x9b\x57\x64"
  4557. "\x85\xb1\x03\xd3\x3b\xfa\xb3\xc0\x70\xd4\x33\x7b\xc3\x1d\x12\x55\x29\xf2"
  4558. "\x65\x71\xc4\xcb\x5e\xce\x98\x68\x41\x46\x50\x27\xde\x77\xd8\xca\x15\xd0"
  4559. "\x29\x6e\xdb\xea\x19\x31\x25\xbb\xfb\x15\x21\x0e\xd1\x81\xeb\x9a\xde\xdd"
  4560. "\xdc\xc1\xd1\x31\x77\x80\xbf\x1d\xf4\xfa\xde\x6e\xb3\xde\x2c\x49\x5e\x55"
  4561. "\xda\xe2\xce\x70\x83\x46\x47\x23\x30\x17\xdf\xfc\xfb\x80\x91\xb8\x3e\xa8"
  4562. "\xd5\x2a\xc6\x86\x93\x81\xf7\x55\x1f\xf7\xa4\xb7\xac\x10\x77\x25\x87\x6b"
  4563. "\xc4\x67\x30\x93\x43\xb0\xf2\x2b\xcc\xf0\x53\xf2\x66\xc4\x41\x69\xb8\x7c"
  4564. "\x45\x88\x2e\xbf\x1f\x32\x0b\x16\x93\xa1\x74\x9c\xab\xe7\xfa\xc9\xbd\x52"
  4565. "\xb9\xea\x4b\x73\x0e\x12\x1c\xa3\x1e\xd4\x69\x83\x16\x38\x94\x05\x65\xcb"
  4566. "\x27\xad\xbb\xd4\xed\x46\xf0\xc2\xde\x40\xee\x8a\xab\x3a\xa0\x24\x91\x0f"
  4567. "\x3a",
  4568. 3637);
  4569. *(uint64_t*)0x200000000418 = 0xe35;
  4570. *(uint64_t*)0x200000001dd8 = 2;
  4571. *(uint64_t*)0x200000001de0 = 0;
  4572. *(uint64_t*)0x200000001de8 = 0;
  4573. *(uint32_t*)0x200000001df0 = 0;
  4574. *(uint32_t*)0x200000001df8 = 0;
  4575. *(uint64_t*)0x200000001e00 = 0;
  4576. *(uint32_t*)0x200000001e08 = 0;
  4577. *(uint64_t*)0x200000001e10 = 0x200000000700;
  4578. *(uint64_t*)0x200000000700 = 0x200000000500;
  4579. memset((void*)0x200000000500, 91, 1);
  4580. *(uint64_t*)0x200000000708 = 1;
  4581. *(uint64_t*)0x200000001e18 = 1;
  4582. *(uint64_t*)0x200000001e20 = 0;
  4583. *(uint64_t*)0x200000001e28 = 0;
  4584. *(uint32_t*)0x200000001e30 = 0;
  4585. *(uint32_t*)0x200000001e38 = 0;
  4586. syscall(__NR_sendmmsg, /*fd=*/r[73], /*mmsg=*/0x200000001d80ul, /*vlen=*/3ul,
  4587. /*f=*/0ul);
  4588. memcpy((void*)0x200000000000, "/dev/snd/timer\000", 15);
  4589. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  4590. /*file=*/0x200000000000ul, /*flags=*/0, 0);
  4591. if (res != -1)
  4592. r[74] = res;
  4593. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x10);
  4594. if (res != -1)
  4595. r[75] = res;
  4596. memcpy((void*)0x200000000040, "ethtool\000", 8);
  4597. res = -1;
  4598. res = syz_genetlink_get_family_id(/*name=*/0x200000000040, /*fd=*/-1);
  4599. if (res != -1)
  4600. r[76] = res;
  4601. *(uint64_t*)0x200000000340 = 0;
  4602. *(uint32_t*)0x200000000348 = 0;
  4603. *(uint64_t*)0x200000000350 = 0x200000000300;
  4604. *(uint64_t*)0x200000000300 = 0x200000000080;
  4605. *(uint32_t*)0x200000000080 = 0x28;
  4606. *(uint16_t*)0x200000000084 = r[76];
  4607. *(uint16_t*)0x200000000086 = 1;
  4608. *(uint32_t*)0x200000000088 = 0;
  4609. *(uint32_t*)0x20000000008c = 0;
  4610. *(uint8_t*)0x200000000090 = 1;
  4611. *(uint8_t*)0x200000000091 = 0;
  4612. *(uint16_t*)0x200000000092 = 0;
  4613. *(uint16_t*)0x200000000094 = 4;
  4614. STORE_BY_BITMASK(uint16_t, , 0x200000000096, 1, 0, 14);
  4615. STORE_BY_BITMASK(uint16_t, , 0x200000000097, 0, 6, 1);
  4616. STORE_BY_BITMASK(uint16_t, , 0x200000000097, 1, 7, 1);
  4617. *(uint16_t*)0x200000000098 = 0x10;
  4618. STORE_BY_BITMASK(uint16_t, , 0x20000000009a, 2, 0, 14);
  4619. STORE_BY_BITMASK(uint16_t, , 0x20000000009b, 0, 6, 1);
  4620. STORE_BY_BITMASK(uint16_t, , 0x20000000009b, 1, 7, 1);
  4621. *(uint16_t*)0x20000000009c = 0xc;
  4622. STORE_BY_BITMASK(uint16_t, , 0x20000000009e, 1, 0, 14);
  4623. STORE_BY_BITMASK(uint16_t, , 0x20000000009f, 0, 6, 1);
  4624. STORE_BY_BITMASK(uint16_t, , 0x20000000009f, 1, 7, 1);
  4625. *(uint16_t*)0x2000000000a0 = 8;
  4626. *(uint16_t*)0x2000000000a2 = 1;
  4627. *(uint32_t*)0x2000000000a4 = 0x3c25443f;
  4628. *(uint64_t*)0x200000000308 = 0x28;
  4629. *(uint64_t*)0x200000000358 = 1;
  4630. *(uint64_t*)0x200000000360 = 0;
  4631. *(uint64_t*)0x200000000368 = 0;
  4632. *(uint32_t*)0x200000000370 = 0;
  4633. syscall(__NR_sendmsg, /*fd=*/r[75], /*msg=*/0x200000000340ul, /*f=*/0ul);
  4634. res = syscall(__NR_epoll_create1, /*flags=*/0ul);
  4635. if (res != -1)
  4636. r[77] = res;
  4637. memcpy((void*)0x200000000200, "/dev/autofs\000", 12);
  4638. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  4639. /*file=*/0x200000000200ul, /*flags=*/0, /*mode=*/0);
  4640. if (res != -1)
  4641. r[78] = res;
  4642. res = syscall(__NR_fcntl, /*fd=*/r[78], /*cmd=*/0ul, /*arg=*/r[77]);
  4643. if (res != -1)
  4644. r[79] = res;
  4645. res = syscall(__NR_epoll_create1, /*flags=*/0ul);
  4646. if (res != -1)
  4647. r[80] = res;
  4648. syz_sysconfig_set__proc_sys_vm_vfs_cache_pressure(/*val=*/0x80000000);
  4649. syscall(__NR_setsockopt, /*fd=*/-1, /*level=*/0x10e, /*opt=*/1, /*arg=*/0ul,
  4650. /*arglen=*/0ul);
  4651. res = -1;
  4652. res = syz_open_dev(/*dev=*/0xc, /*major=*/4, /*minor=*/1);
  4653. if (res != -1)
  4654. r[81] = res;
  4655. memcpy((void*)0x200000000000,
  4656. "\x1b\x5b\x33\x07\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4657. "\x00\x00\x00\x00\x00\x00\x00\x6d",
  4658. 25);
  4659. syscall(__NR_write, /*fd=*/r[81], /*data=*/0x200000000000ul, /*len=*/0x78ul);
  4660. syscall(__NR_connect, /*fd=*/r[79], /*addr=*/0ul, /*addrlen=*/0ul);
  4661. syscall(__NR_epoll_ctl, /*epfd=*/r[80], /*op=*/1ul, /*fd=*/r[73], /*ev=*/0ul);
  4662. *(uint32_t*)0x200000000140 = 1;
  4663. syscall(__NR_ioctl, /*fd=*/r[74], /*cmd=*/0x40045402,
  4664. /*arg=*/0x200000000140ul);
  4665. *(uint32_t*)0x200000000080 = 1;
  4666. *(uint32_t*)0x200000000084 = 0;
  4667. *(uint32_t*)0x200000000088 = 0;
  4668. *(uint32_t*)0x20000000008c = 0;
  4669. *(uint32_t*)0x200000000090 = 0;
  4670. memset((void*)0x200000000094, 0, 32);
  4671. syscall(__NR_ioctl, /*fd=*/r[74], /*cmd=*/0x40345410,
  4672. /*arg=*/0x200000000080ul);
  4673. *(uint32_t*)0x200000000440 = 0;
  4674. *(uint32_t*)0x200000000444 = 0x20000006;
  4675. *(uint32_t*)0x200000000448 = 0;
  4676. *(uint32_t*)0x20000000044c = 0;
  4677. *(uint32_t*)0x200000000450 = 0;
  4678. memset((void*)0x200000000454, 0, 60);
  4679. syscall(__NR_ioctl, /*fd=*/r[74], /*cmd=*/0x40505412,
  4680. /*arg=*/0x200000000440ul);
  4681. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x54a2, 0);
  4682. *(uint64_t*)0x200000003140 = 0x200000001400;
  4683. *(uint32_t*)0x200000003148 = 0x80;
  4684. *(uint64_t*)0x200000003150 = 0;
  4685. *(uint64_t*)0x200000003158 = 0;
  4686. *(uint64_t*)0x200000003160 = 0;
  4687. *(uint64_t*)0x200000003168 = 0;
  4688. *(uint32_t*)0x200000003170 = 0;
  4689. *(uint32_t*)0x200000003178 = 0;
  4690. syscall(__NR_recvmmsg, /*fd=*/-1, /*mmsg=*/0x200000003140ul, /*vlen=*/1ul,
  4691. /*f=*/0ul, /*timeout=*/0ul);
  4692. memcpy((void*)0x200000000680, "net/ptype\000", 10);
  4693. res = -1;
  4694. res = syz_open_procfs(/*pid=*/0, /*file=*/0x200000000680);
  4695. if (res != -1)
  4696. r[82] = res;
  4697. syscall(__NR_preadv, /*fd=*/r[82], /*vec=*/0x2000000017c0ul, /*vlen=*/0x231ul,
  4698. /*off_low=*/0x7a00, /*off_high=*/0);
  4699. memcpy((void*)0x200000000000, "./bus\000", 6);
  4700. syscall(__NR_creat, /*file=*/0x200000000000ul, /*mode=*/0ul);
  4701. *(uint32_t*)0x200000000200 = 9;
  4702. *(uint32_t*)0x200000000204 = 0x80;
  4703. *(uint8_t*)0x200000000208 = 0;
  4704. *(uint8_t*)0x200000000209 = 5;
  4705. *(uint8_t*)0x20000000020a = 0;
  4706. *(uint8_t*)0x20000000020b = 0;
  4707. *(uint32_t*)0x20000000020c = 0;
  4708. *(uint64_t*)0x200000000210 = 0;
  4709. *(uint64_t*)0x200000000218 = 0x80810;
  4710. *(uint64_t*)0x200000000220 = 0;
  4711. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 0, 1);
  4712. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 1, 1);
  4713. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 2, 1);
  4714. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 3, 1);
  4715. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 4, 1);
  4716. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 5, 1);
  4717. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 6, 1);
  4718. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 7, 1);
  4719. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 8, 1);
  4720. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 9, 1);
  4721. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 10, 1);
  4722. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 11, 1);
  4723. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 12, 1);
  4724. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 13, 1);
  4725. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 14, 1);
  4726. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 15, 2);
  4727. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 17, 1);
  4728. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 18, 1);
  4729. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 19, 1);
  4730. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 20, 1);
  4731. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 21, 1);
  4732. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 22, 1);
  4733. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 23, 1);
  4734. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 24, 1);
  4735. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 25, 1);
  4736. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 26, 1);
  4737. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 27, 1);
  4738. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 28, 1);
  4739. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 29, 1);
  4740. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 30, 1);
  4741. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 31, 1);
  4742. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 32, 1);
  4743. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 33, 1);
  4744. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 34, 1);
  4745. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 35, 1);
  4746. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 36, 1);
  4747. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 37, 1);
  4748. STORE_BY_BITMASK(uint64_t, , 0x200000000228, 0, 38, 26);
  4749. *(uint32_t*)0x200000000230 = 0;
  4750. *(uint32_t*)0x200000000234 = 0;
  4751. *(uint64_t*)0x200000000238 = 0x200000000000;
  4752. *(uint64_t*)0x200000000240 = 0;
  4753. *(uint64_t*)0x200000000248 = 0;
  4754. *(uint64_t*)0x200000000250 = 0;
  4755. *(uint32_t*)0x200000000258 = 0;
  4756. *(uint32_t*)0x20000000025c = 0;
  4757. *(uint64_t*)0x200000000260 = 0;
  4758. *(uint32_t*)0x200000000268 = 3;
  4759. *(uint16_t*)0x20000000026c = 0;
  4760. *(uint16_t*)0x20000000026e = 0;
  4761. *(uint32_t*)0x200000000270 = 0;
  4762. *(uint32_t*)0x200000000274 = 0;
  4763. *(uint64_t*)0x200000000278 = 0;
  4764. syscall(__NR_perf_event_open, /*attr=*/0x200000000200ul, /*pid=*/0,
  4765. /*cpu=*/0x20000000ul, /*group=*/-1,
  4766. /*flags=PERF_FLAG_FD_CLOEXEC|PERF_FLAG_FD_NO_GROUP*/ 9ul);
  4767. memcpy((void*)0x200000000080, "./bus\000", 6);
  4768. syscall(__NR_open, /*file=*/0x200000000080ul, /*flags=*/0ul, /*mode=*/0ul);
  4769. return 0;
  4770. }
  4771.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!