API tools faq
paste
Advertisement
xiaoy1

Untitled

xiaoy1
May 15th, 2025
28
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 472.38 KB | None | 0 0
raw download clone embed print report
  1. // autogenerated by syzkaller (https://github.com/google/syzkaller)
  2.  
  3. #define _GNU_SOURCE
  4.  
  5. #include <arpa/inet.h>
  6. #include <endian.h>
  7. #include <errno.h>
  8. #include <fcntl.h>
  9. #include <net/if.h>
  10. #include <netinet/in.h>
  11. #include <setjmp.h>
  12. #include <stdbool.h>
  13. #include <stddef.h>
  14. #include <stdint.h>
  15. #include <stdio.h>
  16. #include <stdlib.h>
  17. #include <string.h>
  18. #include <sys/ioctl.h>
  19. #include <sys/mman.h>
  20. #include <sys/mount.h>
  21. #include <sys/socket.h>
  22. #include <sys/stat.h>
  23. #include <sys/syscall.h>
  24. #include <sys/types.h>
  25. #include <unistd.h>
  26.  
  27. #include <linux/genetlink.h>
  28. #include <linux/if_addr.h>
  29. #include <linux/if_link.h>
  30. #include <linux/in6.h>
  31. #include <linux/loop.h>
  32. #include <linux/neighbour.h>
  33. #include <linux/net.h>
  34. #include <linux/netlink.h>
  35. #include <linux/rtnetlink.h>
  36. #include <linux/veth.h>
  37. static long syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(volatile long val)
  38. {
  39. char command[256];
  40. sprintf(command, "echo %ld > /proc/sys/net/ipv6/conf/sit0/accept_source_route", val);
  41. int ret = system(command);
  42. if (ret != 0) {
  43. return 0;
  44. }
  45. return 0;
  46. }
  47. static long syz_sysconfig_reset__proc_sys_net_ipv6_ip6frag_time()
  48. {
  49. char command[256];
  50. sprintf(command, "echo 60 > /proc/sys/net/ipv6/ip6frag_time");
  51. int ret = system(command);
  52. if (ret != 0) {
  53. return 0;
  54. }
  55. return 0;
  56. }
  57.  
  58. static long syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(volatile long val)
  59. {
  60. char command[256];
  61. sprintf(command, "echo %ld > /sys/devices/pci0000:00/0000:00:03.0/net/eth0/mtu", val);
  62. int ret = system(command);
  63. if (ret != 0) {
  64. return 0;
  65. }
  66. return 0;
  67. }
  68. static long syz_sysconfig_reset__proc_sys_net_ipv6_conf_eth0_accept_untracked_na()
  69. {
  70. char command[256];
  71. sprintf(command, "echo 0 > /proc/sys/net/ipv6/conf/eth0/accept_untracked_na");
  72. int ret = system(command);
  73. if (ret != 0) {
  74. return 0;
  75. }
  76. return 0;
  77. }
  78.  
  79.  
  80. #ifndef __NR_cachestat
  81. #define __NR_cachestat 451
  82. #endif
  83. #ifndef __NR_close_range
  84. #define __NR_close_range 436
  85. #endif
  86. #ifndef __NR_epoll_pwait2
  87. #define __NR_epoll_pwait2 441
  88. #endif
  89. #ifndef __NR_fsconfig
  90. #define __NR_fsconfig 431
  91. #endif
  92. #ifndef __NR_fsmount
  93. #define __NR_fsmount 432
  94. #endif
  95. #ifndef __NR_fspick
  96. #define __NR_fspick 433
  97. #endif
  98. #ifndef __NR_io_uring_enter
  99. #define __NR_io_uring_enter 426
  100. #endif
  101. #ifndef __NR_io_uring_register
  102. #define __NR_io_uring_register 427
  103. #endif
  104. #ifndef __NR_memfd_create
  105. #define __NR_memfd_create 319
  106. #endif
  107. #ifndef __NR_pidfd_getfd
  108. #define __NR_pidfd_getfd 438
  109. #endif
  110. #ifndef __NR_pwritev2
  111. #define __NR_pwritev2 328
  112. #endif
  113. #ifndef __NR_renameat2
  114. #define __NR_renameat2 316
  115. #endif
  116. #ifndef __NR_seccomp
  117. #define __NR_seccomp 317
  118. #endif
  119.  
  120. static unsigned long long procid;
  121.  
  122. #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
  123. #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \
  124. *(type*)(addr) = \
  125. htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \
  126. (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
  127.  
  128. struct csum_inet {
  129. uint32_t acc;
  130. };
  131.  
  132. static void csum_inet_init(struct csum_inet* csum)
  133. {
  134. csum->acc = 0;
  135. }
  136.  
  137. static void csum_inet_update(struct csum_inet* csum, const uint8_t* data,
  138. size_t length)
  139. {
  140. if (length == 0)
  141. return;
  142. size_t i = 0;
  143. for (; i < length - 1; i += 2)
  144. csum->acc += *(uint16_t*)&data[i];
  145. if (length & 1)
  146. csum->acc += le16toh((uint16_t)data[length - 1]);
  147. while (csum->acc > 0xffff)
  148. csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16);
  149. }
  150.  
  151. static uint16_t csum_inet_digest(struct csum_inet* csum)
  152. {
  153. return ~csum->acc;
  154. }
  155.  
  156. struct nlmsg {
  157. char* pos;
  158. int nesting;
  159. struct nlattr* nested[8];
  160. char buf[4096];
  161. };
  162.  
  163. static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
  164. const void* data, int size)
  165. {
  166. memset(nlmsg, 0, sizeof(*nlmsg));
  167. struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
  168. hdr->nlmsg_type = typ;
  169. hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
  170. memcpy(hdr + 1, data, size);
  171. nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
  172. }
  173.  
  174. static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data,
  175. int size)
  176. {
  177. struct nlattr* attr = (struct nlattr*)nlmsg->pos;
  178. attr->nla_len = sizeof(*attr) + size;
  179. attr->nla_type = typ;
  180. if (size > 0)
  181. memcpy(attr + 1, data, size);
  182. nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
  183. }
  184.  
  185. static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type,
  186. int* reply_len, bool dofail)
  187. {
  188. if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
  189. exit(1);
  190. struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
  191. hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
  192. struct sockaddr_nl addr;
  193. memset(&addr, 0, sizeof(addr));
  194. addr.nl_family = AF_NETLINK;
  195. ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0,
  196. (struct sockaddr*)&addr, sizeof(addr));
  197. if (n != (ssize_t)hdr->nlmsg_len) {
  198. if (dofail)
  199. exit(1);
  200. return -1;
  201. }
  202. n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
  203. if (reply_len)
  204. *reply_len = 0;
  205. if (n < 0) {
  206. if (dofail)
  207. exit(1);
  208. return -1;
  209. }
  210. if (n < (ssize_t)sizeof(struct nlmsghdr)) {
  211. errno = EINVAL;
  212. if (dofail)
  213. exit(1);
  214. return -1;
  215. }
  216. if (hdr->nlmsg_type == NLMSG_DONE)
  217. return 0;
  218. if (reply_len && hdr->nlmsg_type == reply_type) {
  219. *reply_len = n;
  220. return 0;
  221. }
  222. if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
  223. errno = EINVAL;
  224. if (dofail)
  225. exit(1);
  226. return -1;
  227. }
  228. if (hdr->nlmsg_type != NLMSG_ERROR) {
  229. errno = EINVAL;
  230. if (dofail)
  231. exit(1);
  232. return -1;
  233. }
  234. errno = -((struct nlmsgerr*)(hdr + 1))->error;
  235. return -errno;
  236. }
  237.  
  238. static int netlink_query_family_id(struct nlmsg* nlmsg, int sock,
  239. const char* family_name, bool dofail)
  240. {
  241. struct genlmsghdr genlhdr;
  242. memset(&genlhdr, 0, sizeof(genlhdr));
  243. genlhdr.cmd = CTRL_CMD_GETFAMILY;
  244. netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr));
  245. netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name,
  246. strnlen(family_name, GENL_NAMSIZ - 1) + 1);
  247. int n = 0;
  248. int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
  249. if (err < 0) {
  250. return -1;
  251. }
  252. uint16_t id = 0;
  253. struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN +
  254. NLMSG_ALIGN(sizeof(genlhdr)));
  255. for (; (char*)attr < nlmsg->buf + n;
  256. attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
  257. if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
  258. id = *(uint16_t*)(attr + 1);
  259. break;
  260. }
  261. }
  262. if (!id) {
  263. errno = EINVAL;
  264. return -1;
  265. }
  266. recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
  267. return id;
  268. }
  269.  
  270. const int kInitNetNsFd = 201;
  271.  
  272. static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
  273. {
  274. if (a0 == 0xc || a0 == 0xb) {
  275. char buf[128];
  276. sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
  277. (uint8_t)a2);
  278. return open(buf, O_RDWR, 0);
  279. } else {
  280. char buf[1024];
  281. char* hash;
  282. strncpy(buf, (char*)a0, sizeof(buf) - 1);
  283. buf[sizeof(buf) - 1] = 0;
  284. while ((hash = strchr(buf, '#'))) {
  285. *hash = '0' + (char)(a1 % 10);
  286. a1 /= 10;
  287. }
  288. return open(buf, a2, 0);
  289. }
  290. }
  291.  
  292. static long syz_open_procfs(volatile long a0, volatile long a1)
  293. {
  294. char buf[128];
  295. memset(buf, 0, sizeof(buf));
  296. if (a0 == 0) {
  297. snprintf(buf, sizeof(buf), "/proc/self/%s", (char*)a1);
  298. } else if (a0 == -1) {
  299. snprintf(buf, sizeof(buf), "/proc/thread-self/%s", (char*)a1);
  300. } else {
  301. snprintf(buf, sizeof(buf), "/proc/self/task/%d/%s", (int)a0, (char*)a1);
  302. }
  303. int fd = open(buf, O_RDWR);
  304. if (fd == -1)
  305. fd = open(buf, O_RDONLY);
  306. return fd;
  307. }
  308.  
  309. static long syz_init_net_socket(volatile long domain, volatile long type,
  310. volatile long proto)
  311. {
  312. return syscall(__NR_socket, domain, type, proto);
  313. }
  314.  
  315. static long syz_genetlink_get_family_id(volatile long name,
  316. volatile long sock_arg)
  317. {
  318. int fd = sock_arg;
  319. if (fd < 0) {
  320. fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
  321. if (fd == -1) {
  322. return -1;
  323. }
  324. }
  325. struct nlmsg nlmsg_tmp;
  326. int ret = netlink_query_family_id(&nlmsg_tmp, fd, (char*)name, false);
  327. if ((int)sock_arg < 0)
  328. close(fd);
  329. if (ret < 0) {
  330. return -1;
  331. }
  332. return ret;
  333. }
  334.  
  335. //% This code is derived from puff.{c,h}, found in the zlib development. The
  336. //% original files come with the following copyright notice:
  337.  
  338. //% Copyright (C) 2002-2013 Mark Adler, all rights reserved
  339. //% version 2.3, 21 Jan 2013
  340. //% This software is provided 'as-is', without any express or implied
  341. //% warranty. In no event will the author be held liable for any damages
  342. //% arising from the use of this software.
  343. //% Permission is granted to anyone to use this software for any purpose,
  344. //% including commercial applications, and to alter it and redistribute it
  345. //% freely, subject to the following restrictions:
  346. //% 1. The origin of this software must not be misrepresented; you must not
  347. //% claim that you wrote the original software. If you use this software
  348. //% in a product, an acknowledgment in the product documentation would be
  349. //% appreciated but is not required.
  350. //% 2. Altered source versions must be plainly marked as such, and must not be
  351. //% misrepresented as being the original software.
  352. //% 3. This notice may not be removed or altered from any source distribution.
  353. //% Mark Adler [email protected]
  354.  
  355. //% BEGIN CODE DERIVED FROM puff.{c,h}
  356.  
  357. #define MAXBITS 15
  358. #define MAXLCODES 286
  359. #define MAXDCODES 30
  360. #define MAXCODES (MAXLCODES + MAXDCODES)
  361. #define FIXLCODES 288
  362.  
  363. struct puff_state {
  364. unsigned char* out;
  365. unsigned long outlen;
  366. unsigned long outcnt;
  367. const unsigned char* in;
  368. unsigned long inlen;
  369. unsigned long incnt;
  370. int bitbuf;
  371. int bitcnt;
  372. jmp_buf env;
  373. };
  374. static int puff_bits(struct puff_state* s, int need)
  375. {
  376. long val = s->bitbuf;
  377. while (s->bitcnt < need) {
  378. if (s->incnt == s->inlen)
  379. longjmp(s->env, 1);
  380. val |= (long)(s->in[s->incnt++]) << s->bitcnt;
  381. s->bitcnt += 8;
  382. }
  383. s->bitbuf = (int)(val >> need);
  384. s->bitcnt -= need;
  385. return (int)(val & ((1L << need) - 1));
  386. }
  387. static int puff_stored(struct puff_state* s)
  388. {
  389. s->bitbuf = 0;
  390. s->bitcnt = 0;
  391. if (s->incnt + 4 > s->inlen)
  392. return 2;
  393. unsigned len = s->in[s->incnt++];
  394. len |= s->in[s->incnt++] << 8;
  395. if (s->in[s->incnt++] != (~len & 0xff) ||
  396. s->in[s->incnt++] != ((~len >> 8) & 0xff))
  397. return -2;
  398. if (s->incnt + len > s->inlen)
  399. return 2;
  400. if (s->outcnt + len > s->outlen)
  401. return 1;
  402. for (; len--; s->outcnt++, s->incnt++) {
  403. if (s->in[s->incnt])
  404. s->out[s->outcnt] = s->in[s->incnt];
  405. }
  406. return 0;
  407. }
  408. struct puff_huffman {
  409. short* count;
  410. short* symbol;
  411. };
  412. static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
  413. {
  414. int first = 0;
  415. int index = 0;
  416. int bitbuf = s->bitbuf;
  417. int left = s->bitcnt;
  418. int code = first = index = 0;
  419. int len = 1;
  420. short* next = h->count + 1;
  421. while (1) {
  422. while (left--) {
  423. code |= bitbuf & 1;
  424. bitbuf >>= 1;
  425. int count = *next++;
  426. if (code - count < first) {
  427. s->bitbuf = bitbuf;
  428. s->bitcnt = (s->bitcnt - len) & 7;
  429. return h->symbol[index + (code - first)];
  430. }
  431. index += count;
  432. first += count;
  433. first <<= 1;
  434. code <<= 1;
  435. len++;
  436. }
  437. left = (MAXBITS + 1) - len;
  438. if (left == 0)
  439. break;
  440. if (s->incnt == s->inlen)
  441. longjmp(s->env, 1);
  442. bitbuf = s->in[s->incnt++];
  443. if (left > 8)
  444. left = 8;
  445. }
  446. return -10;
  447. }
  448. static int puff_construct(struct puff_huffman* h, const short* length, int n)
  449. {
  450. int len;
  451. for (len = 0; len <= MAXBITS; len++)
  452. h->count[len] = 0;
  453. int symbol;
  454. for (symbol = 0; symbol < n; symbol++)
  455. (h->count[length[symbol]])++;
  456. if (h->count[0] == n)
  457. return 0;
  458. int left = 1;
  459. for (len = 1; len <= MAXBITS; len++) {
  460. left <<= 1;
  461. left -= h->count[len];
  462. if (left < 0)
  463. return left;
  464. }
  465. short offs[MAXBITS + 1];
  466. offs[1] = 0;
  467. for (len = 1; len < MAXBITS; len++)
  468. offs[len + 1] = offs[len] + h->count[len];
  469. for (symbol = 0; symbol < n; symbol++)
  470. if (length[symbol] != 0)
  471. h->symbol[offs[length[symbol]]++] = symbol;
  472. return left;
  473. }
  474. static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode,
  475. const struct puff_huffman* distcode)
  476. {
  477. static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13,
  478. 15, 17, 19, 23, 27, 31, 35, 43, 51, 59,
  479. 67, 83, 99, 115, 131, 163, 195, 227, 258};
  480. static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2,
  481. 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
  482. static const short dists[30] = {
  483. 1, 2, 3, 4, 5, 7, 9, 13, 17, 25,
  484. 33, 49, 65, 97, 129, 193, 257, 385, 513, 769,
  485. 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577};
  486. static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3,
  487. 4, 4, 5, 5, 6, 6, 7, 7, 8, 8,
  488. 9, 9, 10, 10, 11, 11, 12, 12, 13, 13};
  489. int symbol;
  490. do {
  491. symbol = puff_decode(s, lencode);
  492. if (symbol < 0)
  493. return symbol;
  494. if (symbol < 256) {
  495. if (s->outcnt == s->outlen)
  496. return 1;
  497. if (symbol)
  498. s->out[s->outcnt] = symbol;
  499. s->outcnt++;
  500. } else if (symbol > 256) {
  501. symbol -= 257;
  502. if (symbol >= 29)
  503. return -10;
  504. int len = lens[symbol] + puff_bits(s, lext[symbol]);
  505. symbol = puff_decode(s, distcode);
  506. if (symbol < 0)
  507. return symbol;
  508. unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
  509. if (dist > s->outcnt)
  510. return -11;
  511. if (s->outcnt + len > s->outlen)
  512. return 1;
  513. while (len--) {
  514. if (dist <= s->outcnt && s->out[s->outcnt - dist])
  515. s->out[s->outcnt] = s->out[s->outcnt - dist];
  516. s->outcnt++;
  517. }
  518. }
  519. } while (symbol != 256);
  520. return 0;
  521. }
  522. static int puff_fixed(struct puff_state* s)
  523. {
  524. static int virgin = 1;
  525. static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
  526. static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
  527. static struct puff_huffman lencode, distcode;
  528. if (virgin) {
  529. lencode.count = lencnt;
  530. lencode.symbol = lensym;
  531. distcode.count = distcnt;
  532. distcode.symbol = distsym;
  533. short lengths[FIXLCODES];
  534. int symbol;
  535. for (symbol = 0; symbol < 144; symbol++)
  536. lengths[symbol] = 8;
  537. for (; symbol < 256; symbol++)
  538. lengths[symbol] = 9;
  539. for (; symbol < 280; symbol++)
  540. lengths[symbol] = 7;
  541. for (; symbol < FIXLCODES; symbol++)
  542. lengths[symbol] = 8;
  543. puff_construct(&lencode, lengths, FIXLCODES);
  544. for (symbol = 0; symbol < MAXDCODES; symbol++)
  545. lengths[symbol] = 5;
  546. puff_construct(&distcode, lengths, MAXDCODES);
  547. virgin = 0;
  548. }
  549. return puff_codes(s, &lencode, &distcode);
  550. }
  551. static int puff_dynamic(struct puff_state* s)
  552. {
  553. static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5,
  554. 11, 4, 12, 3, 13, 2, 14, 1, 15};
  555. int nlen = puff_bits(s, 5) + 257;
  556. int ndist = puff_bits(s, 5) + 1;
  557. int ncode = puff_bits(s, 4) + 4;
  558. if (nlen > MAXLCODES || ndist > MAXDCODES)
  559. return -3;
  560. short lengths[MAXCODES];
  561. int index;
  562. for (index = 0; index < ncode; index++)
  563. lengths[order[index]] = puff_bits(s, 3);
  564. for (; index < 19; index++)
  565. lengths[order[index]] = 0;
  566. short lencnt[MAXBITS + 1], lensym[MAXLCODES];
  567. struct puff_huffman lencode = {lencnt, lensym};
  568. int err = puff_construct(&lencode, lengths, 19);
  569. if (err != 0)
  570. return -4;
  571. index = 0;
  572. while (index < nlen + ndist) {
  573. int symbol;
  574. int len;
  575. symbol = puff_decode(s, &lencode);
  576. if (symbol < 0)
  577. return symbol;
  578. if (symbol < 16)
  579. lengths[index++] = symbol;
  580. else {
  581. len = 0;
  582. if (symbol == 16) {
  583. if (index == 0)
  584. return -5;
  585. len = lengths[index - 1];
  586. symbol = 3 + puff_bits(s, 2);
  587. } else if (symbol == 17)
  588. symbol = 3 + puff_bits(s, 3);
  589. else
  590. symbol = 11 + puff_bits(s, 7);
  591. if (index + symbol > nlen + ndist)
  592. return -6;
  593. while (symbol--)
  594. lengths[index++] = len;
  595. }
  596. }
  597. if (lengths[256] == 0)
  598. return -9;
  599. err = puff_construct(&lencode, lengths, nlen);
  600. if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
  601. return -7;
  602. short distcnt[MAXBITS + 1], distsym[MAXDCODES];
  603. struct puff_huffman distcode = {distcnt, distsym};
  604. err = puff_construct(&distcode, lengths + nlen, ndist);
  605. if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
  606. return -8;
  607. return puff_codes(s, &lencode, &distcode);
  608. }
  609. static int puff(unsigned char* dest, unsigned long* destlen,
  610. const unsigned char* source, unsigned long sourcelen)
  611. {
  612. struct puff_state s = {
  613. .out = dest,
  614. .outlen = *destlen,
  615. .outcnt = 0,
  616. .in = source,
  617. .inlen = sourcelen,
  618. .incnt = 0,
  619. .bitbuf = 0,
  620. .bitcnt = 0,
  621. };
  622. int err;
  623. if (setjmp(s.env) != 0)
  624. err = 2;
  625. else {
  626. int last;
  627. do {
  628. last = puff_bits(&s, 1);
  629. int type = puff_bits(&s, 2);
  630. err = type == 0 ? puff_stored(&s)
  631. : (type == 1 ? puff_fixed(&s)
  632. : (type == 2 ? puff_dynamic(&s) : -1));
  633. if (err != 0)
  634. break;
  635. } while (!last);
  636. }
  637. *destlen = s.outcnt;
  638. return err;
  639. }
  640.  
  641. //% END CODE DERIVED FROM puff.{c,h}
  642.  
  643. #define ZLIB_HEADER_WIDTH 2
  644.  
  645. static int puff_zlib_to_file(const unsigned char* source,
  646. unsigned long sourcelen, int dest_fd)
  647. {
  648. if (sourcelen < ZLIB_HEADER_WIDTH)
  649. return 0;
  650. source += ZLIB_HEADER_WIDTH;
  651. sourcelen -= ZLIB_HEADER_WIDTH;
  652. const unsigned long max_destlen = 132 << 20;
  653. void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ,
  654. MAP_PRIVATE | MAP_ANON, -1, 0);
  655. if (ret == MAP_FAILED)
  656. return -1;
  657. unsigned char* dest = (unsigned char*)ret;
  658. unsigned long destlen = max_destlen;
  659. int err = puff(dest, &destlen, source, sourcelen);
  660. if (err) {
  661. munmap(dest, max_destlen);
  662. errno = -err;
  663. return -1;
  664. }
  665. if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
  666. munmap(dest, max_destlen);
  667. return -1;
  668. }
  669. return munmap(dest, max_destlen);
  670. }
  671.  
  672. static int setup_loop_device(unsigned char* data, unsigned long size,
  673. const char* loopname, int* loopfd_p)
  674. {
  675. int err = 0, loopfd = -1;
  676. int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
  677. if (memfd == -1) {
  678. err = errno;
  679. goto error;
  680. }
  681. if (puff_zlib_to_file(data, size, memfd)) {
  682. err = errno;
  683. goto error_close_memfd;
  684. }
  685. loopfd = open(loopname, O_RDWR);
  686. if (loopfd == -1) {
  687. err = errno;
  688. goto error_close_memfd;
  689. }
  690. if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
  691. if (errno != EBUSY) {
  692. err = errno;
  693. goto error_close_loop;
  694. }
  695. ioctl(loopfd, LOOP_CLR_FD, 0);
  696. usleep(1000);
  697. if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
  698. err = errno;
  699. goto error_close_loop;
  700. }
  701. }
  702. close(memfd);
  703. *loopfd_p = loopfd;
  704. return 0;
  705.  
  706. error_close_loop:
  707. close(loopfd);
  708. error_close_memfd:
  709. close(memfd);
  710. error:
  711. errno = err;
  712. return -1;
  713. }
  714.  
  715. static void reset_loop_device(const char* loopname)
  716. {
  717. int loopfd = open(loopname, O_RDWR);
  718. if (loopfd == -1) {
  719. return;
  720. }
  721. if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
  722. }
  723. close(loopfd);
  724. }
  725.  
  726. static long syz_mount_image(volatile long fsarg, volatile long dir,
  727. volatile long flags, volatile long optsarg,
  728. volatile long change_dir,
  729. volatile unsigned long size, volatile long image)
  730. {
  731. unsigned char* data = (unsigned char*)image;
  732. int res = -1, err = 0, need_loop_device = !!size;
  733. char* mount_opts = (char*)optsarg;
  734. char* target = (char*)dir;
  735. char* fs = (char*)fsarg;
  736. char* source = NULL;
  737. char loopname[64];
  738. if (need_loop_device) {
  739. int loopfd;
  740. memset(loopname, 0, sizeof(loopname));
  741. snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
  742. if (setup_loop_device(data, size, loopname, &loopfd) == -1)
  743. return -1;
  744. close(loopfd);
  745. source = loopname;
  746. }
  747. mkdir(target, 0777);
  748. char opts[256];
  749. memset(opts, 0, sizeof(opts));
  750. if (strlen(mount_opts) > (sizeof(opts) - 32)) {
  751. }
  752. strncpy(opts, mount_opts, sizeof(opts) - 32);
  753. if (strcmp(fs, "iso9660") == 0) {
  754. flags |= MS_RDONLY;
  755. } else if (strncmp(fs, "ext", 3) == 0) {
  756. bool has_remount_ro = false;
  757. char* remount_ro_start = strstr(opts, "errors=remount-ro");
  758. if (remount_ro_start != NULL) {
  759. char after = *(remount_ro_start + strlen("errors=remount-ro"));
  760. char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
  761. has_remount_ro = ((before == '\0' || before == ',') &&
  762. (after == '\0' || after == ','));
  763. }
  764. if (strstr(opts, "errors=panic") || !has_remount_ro)
  765. strcat(opts, ",errors=continue");
  766. } else if (strcmp(fs, "xfs") == 0) {
  767. strcat(opts, ",nouuid");
  768. }
  769. res = mount(source, target, fs, flags, opts);
  770. if (res == -1) {
  771. err = errno;
  772. goto error_clear_loop;
  773. }
  774. res = open(target, O_RDONLY | O_DIRECTORY);
  775. if (res == -1) {
  776. err = errno;
  777. goto error_clear_loop;
  778. }
  779. if (change_dir) {
  780. res = chdir(target);
  781. if (res == -1) {
  782. err = errno;
  783. }
  784. }
  785.  
  786. error_clear_loop:
  787. if (need_loop_device)
  788. reset_loop_device(loopname);
  789. errno = err;
  790. return res;
  791. }
  792.  
  793. uint64_t r[197] = {0xffffffffffffffff,
  794. 0xffffffffffffffff,
  795. 0xffffffffffffffff,
  796. 0xffffffffffffffff,
  797. 0xffffffffffffffff,
  798. 0xffffffffffffffff,
  799. 0x0,
  800. 0x0,
  801. 0xffffffffffffffff,
  802. 0xffffffffffffffff,
  803. 0xffffffffffffffff,
  804. 0xffffffffffffffff,
  805. 0xffffffffffffffff,
  806. 0xffffffffffffffff,
  807. 0xffffffffffffffff,
  808. 0xffffffffffffffff,
  809. 0xffffffffffffffff,
  810. 0xffffffffffffffff,
  811. 0x0,
  812. 0xffffffffffffffff,
  813. 0xffffffffffffffff,
  814. 0xffffffffffffffff,
  815. 0xffffffffffffffff,
  816. 0xffffffffffffffff,
  817. 0xffffffffffffffff,
  818. 0xffffffffffffffff,
  819. 0xffffffffffffffff,
  820. 0x0,
  821. 0xffffffffffffffff,
  822. 0xffffffffffffffff,
  823. 0xffffffffffffffff,
  824. 0xffffffffffffffff,
  825. 0xffffffffffffffff,
  826. 0xffffffffffffffff,
  827. 0xffffffffffffffff,
  828. 0xffffffffffffffff,
  829. 0xffffffffffffffff,
  830. 0xffffffffffffffff,
  831. 0xffffffffffffffff,
  832. 0xffffffffffffffff,
  833. 0x0,
  834. 0x0,
  835. 0xffffffffffffffff,
  836. 0xffffffffffffffff,
  837. 0xffffffffffffffff,
  838. 0xffffffffffffffff,
  839. 0x0,
  840. 0x0,
  841. 0xffffffffffffffff,
  842. 0x0,
  843. 0xffffffffffffffff,
  844. 0xffffffffffffffff,
  845. 0xffffffffffffffff,
  846. 0xffffffffffffffff,
  847. 0xffffffffffffffff,
  848. 0xffffffffffffffff,
  849. 0xffffffffffffffff,
  850. 0xffffffffffffffff,
  851. 0x0,
  852. 0x0,
  853. 0xffffffffffffffff,
  854. 0xffffffffffffffff,
  855. 0xffffffffffffffff,
  856. 0x0,
  857. 0xffffffffffffffff,
  858. 0xffffffffffffffff,
  859. 0x0,
  860. 0xffffffffffffffff,
  861. 0xffffffffffffffff,
  862. 0xffffffffffffffff,
  863. 0xffffffffffffffff,
  864. 0xffffffffffffffff,
  865. 0xffffffffffffffff,
  866. 0xffffffffffffffff,
  867. 0xffffffffffffffff,
  868. 0xffffffffffffffff,
  869. 0xffffffffffffffff,
  870. 0xffffffffffffffff,
  871. 0xffffffffffffffff,
  872. 0xffffffffffffffff,
  873. 0xffffffffffffffff,
  874. 0xffffffffffffffff,
  875. 0xffffffffffffffff,
  876. 0xffffffffffffffff,
  877. 0xffffffffffffffff,
  878. 0xffffffffffffffff,
  879. 0xffffffffffffffff,
  880. 0xffffffffffffffff,
  881. 0xffffffffffffffff,
  882. 0xffffffffffffffff,
  883. 0xffffffffffffffff,
  884. 0xffffffffffffffff,
  885. 0xffffffffffffffff,
  886. 0xffffffffffffffff,
  887. 0xffffffffffffffff,
  888. 0xffffffffffffffff,
  889. 0xffffffffffffffff,
  890. 0xffffffffffffffff,
  891. 0xffffffffffffffff,
  892. 0xffffffffffffffff,
  893. 0x0,
  894. 0x0,
  895. 0xffffffffffffffff,
  896. 0x0,
  897. 0xffffffffffffffff,
  898. 0xffffffffffffffff,
  899. 0xffffffffffffffff,
  900. 0xffffffffffffffff,
  901. 0xffffffffffffffff,
  902. 0xffffffffffffffff,
  903. 0xffffffffffffffff,
  904. 0xffffffffffffffff,
  905. 0xffffffffffffffff,
  906. 0xffffffffffffffff,
  907. 0xffffffffffffffff,
  908. 0x0,
  909. 0xffffffffffffffff,
  910. 0x0,
  911. 0x0,
  912. 0x0,
  913. 0x0,
  914. 0xffffffffffffffff,
  915. 0x0,
  916. 0x0,
  917. 0x0,
  918. 0x0,
  919. 0xffffffffffffffff,
  920. 0x0,
  921. 0xffffffffffffffff,
  922. 0x0,
  923. 0x0,
  924. 0x0,
  925. 0xffffffffffffffff,
  926. 0x0,
  927. 0x0,
  928. 0x0,
  929. 0xffffffffffffffff,
  930. 0xffffffffffffffff,
  931. 0xffffffffffffffff,
  932. 0xffffffffffffffff,
  933. 0x0,
  934. 0xffffffffffffffff,
  935. 0x0,
  936. 0xffffffffffffffff,
  937. 0xffffffffffffffff,
  938. 0xffffffffffffffff,
  939. 0xffffffffffffffff,
  940. 0xffffffffffffffff,
  941. 0xffffffffffffffff,
  942. 0xffffffffffffffff,
  943. 0xffffffffffffffff,
  944. 0xffffffffffffffff,
  945. 0xffffffffffffffff,
  946. 0xffffffffffffffff,
  947. 0xffffffffffffffff,
  948. 0x0,
  949. 0xffffffffffffffff,
  950. 0x0,
  951. 0xffffffffffffffff,
  952. 0xffffffffffffffff,
  953. 0xffffffffffffffff,
  954. 0xffffffffffffffff,
  955. 0xffffffffffffffff,
  956. 0xffffffffffffffff,
  957. 0xffffffffffffffff,
  958. 0xffffffffffffffff,
  959. 0x0,
  960. 0xffffffffffffffff,
  961. 0xffffffffffffffff,
  962. 0xffffffffffffffff,
  963. 0x0,
  964. 0x0,
  965. 0xffffffffffffffff,
  966. 0xffffffffffffffff,
  967. 0xffffffffffffffff,
  968. 0xffffffffffffffff,
  969. 0xffffffffffffffff,
  970. 0xffffffffffffffff,
  971. 0xffffffffffffffff,
  972. 0xffffffffffffffff,
  973. 0xffffffffffffffff,
  974. 0xffffffffffffffff,
  975. 0xffffffffffffffff,
  976. 0xffffffffffffffff,
  977. 0xffffffffffffffff,
  978. 0xffffffffffffffff,
  979. 0xffffffffffffffff,
  980. 0xffffffffffffffff,
  981. 0xffffffffffffffff,
  982. 0xffffffffffffffff,
  983. 0xffffffffffffffff,
  984. 0xffffffffffffffff,
  985. 0xffffffffffffffff,
  986. 0xffffffffffffffff,
  987. 0xffffffffffffffff,
  988. 0xffffffffffffffff,
  989. 0xffffffffffffffff};
  990.  
  991. int main(void)
  992. {
  993. syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
  994. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  995. /*offset=*/0ul);
  996. syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
  997. /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
  998. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  999. /*offset=*/0ul);
  1000. syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
  1001. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  1002. /*offset=*/0ul);
  1003. const char* reason;
  1004. (void)reason;
  1005. intptr_t res = 0;
  1006. if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  1007. }
  1008. memcpy((void*)0x200000007f80, "./bus\000", 6);
  1009. res = syscall(
  1010. __NR_open, /*file=*/0x200000007f80ul,
  1011. /*flags=O_SYNC|O_NOCTTY|O_NOATIME|O_DIRECT|O_CREAT|0x2*/ 0x145142ul,
  1012. /*mode=*/0ul);
  1013. if (res != -1)
  1014. r[0] = res;
  1015. syscall(__NR_ftruncate, /*fd=*/r[0], /*len=*/0x2007ffbul);
  1016. syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul,
  1017. /*prot=PROT_WRITE*/ 2ul,
  1018. /*flags=MAP_STACK|MAP_POPULATE|MAP_FIXED|MAP_SHARED*/ 0x28011ul,
  1019. /*fd=*/r[0], /*offset=*/0ul);
  1020. memcpy((void*)0x200000000540, "syztnl1\000\000\000\000\000\000\000\000\000",
  1021. 16);
  1022. *(uint64_t*)0x200000000550 = 0x200000002800;
  1023. memcpy((void*)0x200000002800, "syztnl1\000\000\000\000\000\000\000\000\000",
  1024. 16);
  1025. *(uint32_t*)0x200000002810 = 0;
  1026. *(uint16_t*)0x200000002814 = htobe16(0);
  1027. *(uint16_t*)0x200000002816 = htobe16(0);
  1028. *(uint32_t*)0x200000002818 = htobe32(0);
  1029. *(uint32_t*)0x20000000281c = htobe32(0);
  1030. STORE_BY_BITMASK(uint8_t, , 0x200000002820, 5, 0, 4);
  1031. STORE_BY_BITMASK(uint8_t, , 0x200000002820, 4, 4, 4);
  1032. STORE_BY_BITMASK(uint8_t, , 0x200000002821, 0, 0, 2);
  1033. STORE_BY_BITMASK(uint8_t, , 0x200000002821, 0, 2, 6);
  1034. *(uint16_t*)0x200000002822 = htobe16(0x14);
  1035. *(uint16_t*)0x200000002824 = htobe16(0);
  1036. *(uint16_t*)0x200000002826 = htobe16(0);
  1037. *(uint8_t*)0x200000002828 = 0;
  1038. *(uint8_t*)0x200000002829 = 0;
  1039. *(uint16_t*)0x20000000282a = htobe16(0);
  1040. *(uint32_t*)0x20000000282c = htobe32(0xe0000001);
  1041. *(uint32_t*)0x200000002830 = htobe32(0xe0000001);
  1042. struct csum_inet csum_1;
  1043. csum_inet_init(&csum_1);
  1044. csum_inet_update(&csum_1, (const uint8_t*)0x200000002820, 20);
  1045. *(uint16_t*)0x20000000282a = csum_inet_digest(&csum_1);
  1046. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x89f2, /*arg=*/0x200000000540ul);
  1047. syscall(__NR_mbind, /*addr=*/0x200000001000ul, /*len=*/0x800000ul,
  1048. /*mode=*/0ul, /*nodemask=*/0ul, /*maxnode=*/0ul,
  1049. /*flags=MPOL_MF_MOVE*/ 2ul);
  1050. *(uint16_t*)0x200000000000 = 1;
  1051. *(uint64_t*)0x200000000008 = 0x200000000040;
  1052. *(uint16_t*)0x200000000040 = 6;
  1053. *(uint8_t*)0x200000000042 = 0x99;
  1054. *(uint8_t*)0x200000000043 = -1;
  1055. *(uint32_t*)0x200000000044 = 8;
  1056. syscall(__NR_seccomp, /*op=*/1ul, /*flags=*/0ul, /*arg=*/0x200000000000ul);
  1057. memcpy((void*)0x2000000002c0, "./file0\000", 8);
  1058. syscall(__NR_open, /*file=*/0x2000000002c0ul,
  1059. /*flags=O_SYNC|O_NONBLOCK|O_CLOEXEC|O_WRONLY*/ 0x181801ul,
  1060. /*mode=S_IXGRP|S_IWGRP*/ 0x18ul);
  1061. memcpy((void*)0x2000000000c0, "vfat\000", 5);
  1062. memcpy((void*)0x200000000300, "./file0\000", 8);
  1063. memcpy(
  1064. (void*)0x200000000800,
  1065. "\x78\x9c\xec\xdc\xcb\x6b\x13\x5f\x14\xc0\xf1\xd3\xf4\x95\xa6\xb4\xc9\xe2"
  1066. "\xc7\x4f\x14\xa4\x07\xdd\xe8\x66\x68\xa3\x6b\x31\x48\x0b\x62\xc0\x52\x1b"
  1067. "\xf1\x01\xc2\xb4\x9d\x68\xc8\x98\x94\x4c\xa8\x44\xc4\xea\xca\xad\xf8\x47"
  1068. "\xb8\x28\x5d\x76\x57\xd0\xfe\x03\xdd\xb8\xd3\x8d\x1b\x77\xdd\x08\x2e\xec"
  1069. "\x42\x1c\xc9\x3c\xfa\x4c\x69\x69\x9b\x4c\xdb\x7c\x3f\x10\xee\x4d\xee\x3d"
  1070. "\x33\xf7\x4e\x26\xe1\xdc\x21\x93\xb5\x07\xef\x9f\x17\xf3\x8e\x91\x37\xab"
  1071. "\x12\x8b\xab\x74\x88\x88\xac\x8b\xa4\x24\x26\xa1\x8e\xa0\x8c\x79\xf5\x1e"
  1072. "\xd9\xea\x8d\x5c\xed\xff\xf5\xf5\xe2\xbd\x87\x8f\xee\x64\xb2\xd9\xd1\x09"
  1073. "\xd5\xb1\xcc\xe4\xb5\xb4\xaa\x0e\x0e\x7d\x7a\xf1\xaa\x2f\xe8\xb6\xdc\x2b"
  1074. "\xab\xa9\x27\x6b\x3f\xd3\x3f\x56\xff\x5f\x3d\xbf\xf6\x77\xf2\x59\xc1\xd1"
  1075. "\x82\xa3\xa5\x72\x55\x4d\x9d\x2a\x7f\xaf\x9a\x53\xb6\xa5\x33\x05\xa7\x68"
  1076. "\xa8\x8e\xdb\x96\xe9\x58\x5a\x28\x39\x56\xc5\x6f\x2f\xfb\xed\x79\xbb\x3c"
  1077. "\x3b\x5b\x53\xb3\x34\x33\x90\x98\xad\x58\x8e\xa3\x66\xa9\xa6\x45\xab\xa6"
  1078. "\xd5\xb2\x56\x2b\x35\x35\x9f\x9a\x85\x92\x1a\x86\xa1\x03\x09\xc1\x7e\x72"
  1079. "\x0b\x13\x13\x66\xe6\x90\xc1\xd3\xc7\x3c\x18\x34\x49\xa5\x92\x31\x3b\x45"
  1080. "\xa4\x6f\x57\x4b\x6e\x21\x92\x01\x01\x00\x80\x48\xed\xcc\xff\x63\xf5\x94"
  1081. "\xfe\xf8\xf2\xff\xc5\x4b\x2b\xd5\xfe\xfb\x4b\x83\x41\xfe\xbf\xdc\xd3\x28"
  1082. "\xff\xbf\xfe\xcd\xdf\xd6\xb6\xfc\x3f\x2e\x22\x4d\xcf\xff\x77\x67\x44\xed"
  1083. "\xe5\x48\xf9\x3f\x4e\x89\x7a\xfe\x9f\x08\x3e\xbf\x9e\xb7\x8f\x17\x87\xbd"
  1084. "\x0a\xf9\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1085. "\x00\x00\xa7\xc1\xba\xeb\x26\x5d\xd7\x4d\x86\x65\xf8\xe8\x15\x91\xb8\x88"
  1086. "\x84\xcf\xa3\x1e\x27\x9a\x83\xf7\xbf\xbd\x6d\xde\xb8\xd7\x35\x28\x62\xbf"
  1087. "\x9b\xcb\xcd\xe5\xfc\x32\xe8\xb0\x22\x22\xb6\x58\x32\x2c\x49\xf9\xe3\x9d"
  1088. "\x0f\x81\x7a\x3d\xbc\x17\x50\xeb\x52\xf2\xd9\x9e\x0f\xe2\xe7\xe7\x72\x9d"
  1089. "\x5e\x4b\x26\x2f\x05\x2f\x7e\x44\x92\x92\xda\x19\xef\xba\x63\xb7\xb3\xa3"
  1090. "\x23\xea\xdb\x1e\xdf\x2d\x89\xad\xf1\x69\x49\xca\x7f\x8d\xe3\xd3\x0d\xe3"
  1091. "\x7b\xe4\xca\xe5\x2d\xf1\x86\x24\xe5\xcb\xb4\x94\xc5\x96\x19\xef\xbc\xde"
  1092. "\x8c\x7f\x3d\xa2\x7a\xeb\x6e\x76\x47\x7c\x9f\xd7\x0f\x00\x00\x00\x00\x80"
  1093. "\xb3\xc0\xd0\x0d\x0d\xd7\xef\x86\xb1\x57\xbb\x1f\xbf\xb1\xbe\x6e\x78\x7d"
  1094. "\xc0\x5f\x5f\x0f\x37\x5c\x9f\x77\xc9\x85\xae\x68\xe7\x0e\x00\x00\x00\x00"
  1095. "\x40\xbb\x70\x6a\x2f\x8b\xa6\x6d\x5b\x95\x33\x57\x09\x67\x78\xd0\xa8\xf0"
  1096. "\xb7\x0c\x91\x8c\x39\xdc\xf9\xc9\x38\x74\x07\xa8\xc4\x0e\x35\xd4\x21\x11"
  1097. "\xb1\xf5\xa8\x7b\x0f\x2f\x1b\xed\xd5\x47\xc6\xa3\x3a\x2c\xe7\x3e\x7c\xfc"
  1098. "\x7d\x7c\x1b\xbc\xb1\x14\xdf\x67\xa6\x4d\xab\x74\xb7\xf6\x5b\x08\x00\x00"
  1099. "\x00\x40\x2b\x6c\x26\xfd\xe1\x2b\x37\xa3\x1d\x10\x00\x00\x00\x00\x00\x00"
  1100. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6d"
  1101. "\xa8\x15\x7f\x27\x16\xf5\x1c\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1102. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x93"
  1103. "\xe2\x5f\x00\x00\x00\xff\xff\x7b\x91\x12\x85",
  1104. 695);
  1105. syz_mount_image(/*fs=*/0x2000000000c0, /*dir=*/0x200000000300, /*flags=*/0,
  1106. /*opts=*/0x200000000ac0, /*chdir=*/5, /*size=*/0x2b7,
  1107. /*img=*/0x200000000800);
  1108. memcpy((void*)0x200000000100, "net_prio.prioidx\000", 17);
  1109. syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000100ul,
  1110. /*flags=*/0x275a, /*mode=*/0);
  1111. syscall(__NR_getsockopt, /*fd=*/-1, /*level=*/0, /*optname=*/0x10,
  1112. /*optval=*/0ul, /*optlen=*/0ul);
  1113. memcpy((void*)0x200000000080, "./bus\000", 6);
  1114. res =
  1115. syscall(__NR_open, /*file=*/0x200000000080ul,
  1116. /*flags=O_SYNC|O_NOCTTY|O_NOATIME|O_CREAT|FASYNC|0x2*/ 0x143142ul,
  1117. /*mode=*/0ul);
  1118. if (res != -1)
  1119. r[1] = res;
  1120. *(uint32_t*)0x200000000140 = 0;
  1121. syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x40086602,
  1122. /*arg=*/0x200000000140ul);
  1123. *(uint64_t*)0x200000000100 = -1;
  1124. *(uint64_t*)0x200000000108 = -1;
  1125. syscall(__NR_setrlimit, /*res=RLIMIT_FSIZE*/ 1ul, /*rlim=*/0x200000000100ul);
  1126. memcpy((void*)0x200000000040, "./bus\000", 6);
  1127. res = syscall(__NR_creat, /*file=*/0x200000000040ul, /*mode=*/0ul);
  1128. if (res != -1)
  1129. r[2] = res;
  1130. syscall(__NR_lseek, /*fd=*/r[2], /*offset=*/0x7ffffcul, /*whence=*/0ul);
  1131. syscall(__NR_write, /*fd=*/r[2], /*data=*/0x2000000001c0ul, /*len=*/0xfd14ul);
  1132. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/2ul, /*proto=*/0);
  1133. if (res != -1)
  1134. r[3] = res;
  1135. *(uint16_t*)0x200000000000 = 0xa;
  1136. *(uint16_t*)0x200000000002 = htobe16(0xe22);
  1137. *(uint32_t*)0x200000000004 = htobe32(0);
  1138. memset((void*)0x200000000008, 0, 16);
  1139. *(uint32_t*)0x200000000018 = 0;
  1140. syscall(__NR_bind, /*fd=*/r[3], /*addr=*/0x200000000000ul,
  1141. /*addrlen=*/0x1cul);
  1142. *(uint32_t*)0x200000000040 = 0;
  1143. syscall(__NR_setsockopt, /*fd=*/r[3], /*level=*/0x11, /*optname=*/0x64,
  1144. /*optval=*/0x200000000040ul, /*optlen=*/4ul);
  1145. syscall(__NR_ftruncate, /*fd=*/r[1], /*len=*/0x2c451b81ul);
  1146. memcpy((void*)0x200000000400, "./bus\000", 6);
  1147. res = syscall(__NR_open, /*file=*/0x200000000400ul,
  1148. /*flags=O_NOATIME|O_RDWR*/ 0x40002ul, /*mode=*/0ul);
  1149. if (res != -1)
  1150. r[4] = res;
  1151. syscall(__NR_close, /*fd=*/r[2]);
  1152. syscall(__NR_fallocate, /*fd=*/r[4],
  1153. /*mode=FALLOC_FL_PUNCH_HOLE|FALLOC_FL_KEEP_SIZE*/ 3ul,
  1154. /*off=*/0x802000ul, /*len=*/0x4010000bffeul);
  1155. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0x88);
  1156. if (res != -1)
  1157. r[5] = res;
  1158. *(uint32_t*)0x200000000280 = 5;
  1159. res = syscall(__NR_getsockopt, /*fd=*/r[5], /*level=*/1, /*optname=*/0x11,
  1160. /*optval=*/0x200000000240ul, /*optlen=*/0x200000000280ul);
  1161. if (res != -1)
  1162. r[6] = *(uint32_t*)0x200000000244;
  1163. *(uint32_t*)0x200000000080 = 0xe8;
  1164. res = syscall(__NR_getsockopt, /*fd=*/r[5], /*level=*/0, /*optname=*/0x11,
  1165. /*optval=*/0x200000000140ul, /*optlen=*/0x200000000080ul);
  1166. if (res != -1)
  1167. r[7] = *(uint32_t*)0x200000000174;
  1168. syscall(__NR_setreuid, /*ruid=*/r[7], /*euid=*/r[6]);
  1169. syscall(__NR_madvise, /*addr=*/0x200000ff9000ul, /*len=*/0xffffffffdf006ffful,
  1170. /*advice=*/0ul);
  1171. *(uint32_t*)0x200000000380 = 0x14;
  1172. syscall(__NR_accept4, /*fd=*/r[0], /*peer=*/0x200000000340ul,
  1173. /*peerlen=*/0x200000000380ul,
  1174. /*flags=SOCK_NONBLOCK|0xe407305877c48183*/ 0xe407305877c48983ul);
  1175. res = -1;
  1176. res = syz_open_dev(/*dev=*/0xc, /*major=*/4, /*minor=*/1);
  1177. if (res != -1)
  1178. r[8] = res;
  1179. *(uint64_t*)0x2000000021c0 = 0x200000000080;
  1180. memcpy(
  1181. (void*)0x200000000080,
  1182. "\xee\xd6\x07\x05\x97\x03\xf2\xbc\xa1\xa2\xd2\x39\xe7\x9d\x8c\x1e\x95\xb6"
  1183. "\x44\x99\x85\x74\xf6\x93\x60\x2d\xfc\xb8\x32\xcd\x60\x99\xd0\x3a\x7c\x7e"
  1184. "\xa1\x05\x36\x1d\x2a\x09\x7a\x90\xcb\x0e\x87\x86\xbd\x0f\xf3\xc8\x4c\x72"
  1185. "\x30\x40\x9d\x40\x12\x66\x21\x6c\xbe\x55\xe6\x9d\x7d\xa8\x9d\x96\xb7\x9a"
  1186. "\xf5\x6b\xaa\x96\x46\xf0\x98\x6e\xf7\x46\x9b\xf3\x98\x90\xcb\x92\x41\xed"
  1187. "\x47\x87\x58\xdc\xc8\xbe\xae\x60\xee\xed\x76\x0e\xd6\x2a\xf7\x8b\xa1\x91"
  1188. "\xb5\xfd\xb9\xd4\x88\x82\x8f\x56\x2d\x84\x0f\x97\x15\x9f\x22\x4f\x4a\x9b"
  1189. "\xea\xcb\x76\x15\x10\x18\x07\x26\x04\x6f\xfa\xa3\x1d\x70\xa4\xc5\x36\xe4"
  1190. "\x81\xdf\xc1\xe0\x8d\xb2\x40\xee\x89\x67\xfc\x1b\x2f\xa7\x46\xa4\xec\x13"
  1191. "\xdd\x24\xc1\xcf\xa2\x67\x79\x72\x5b\x99\x68\xb5\xc7\x55\x41\x87\xec\x1a"
  1192. "\xc5\x11\xf5\xe2\x0c\x35\xd5\x6e\x9f\x41\xfb\x6c\xf0\xb0\x39\x7a\xd5\x84"
  1193. "\xa9\x0b\x99\x68\xae\xbb\x94\x10\x31\x09\x90\x08\x2c\x02\x57\xaa\xc8\x98"
  1194. "\x2f\x12\x1f\x3a\xa9\xdf\x9c\x22\xfc\xf5\x49\xb8\x4f\x46\x77\x2a\x27\xa5"
  1195. "\x7e\x24\x86\x62\xbe\x3b\x7a\xe9\x10\x02\x04\xe8\xf7\x5d\xcd\x89\x11\xac"
  1196. "\xdd\x37\x6b\x38\xb6\x42\xd1\xa9\x15\x11\x89\x4e\xda\x2f\x5f\xa5\xe6\xf7"
  1197. "\xb2\xd1\x20\xd8\xba\x82\xb6\xa3\x93\x55\xbb\x4d\x13\xf2\x86\x88\xb4\xb0"
  1198. "\x95\x6d\x7f\x7f\x7f\xb8\xbf\x06\x7a\xf6\x40\xc9\xed\x4a\x1c\x65\x73\xb9"
  1199. "\x41\xb6\x41\x75\xe8\x7a\xa4\x16\x40\x52\xa9\xd9\x4e\xd8\x1f\x87\xec\x60"
  1200. "\x69\xb8\x4c\x5a\xae\xf4\x67\xed\xba\xda\xbb\xe8\x45\xa7\xd7\x5a\xf3\x39"
  1201. "\x99\x89\x9d\xfa\x88\x7c\x67\x00\x7e\x8c\xec\x6e\xad\x9f\x6c\xb3\xd2\xb5"
  1202. "\x6d\xff\x0f\x3a\x0d\x06\xa7\x2d\x0c\x56\x0e\x31\x8a\xc4\x9c\x2f\xb6\x83"
  1203. "\xb6\x4a\x51\x2f\x09\xcc\x3d\xc4\xe7\xdf\x6d\x58\xe3\x1b\x81\x63\x7d\x90"
  1204. "\xe2\xf0\x12\x3f\xd0\x21\x42\x72\x3c\x97\x5e\x89\xb2\x96\x86\x57\x71\xa0"
  1205. "\x93\x3e\x25\x91\x15\x82\x10\xe7\x93\x14\x32\x25\xf4\x67\x1b\x50\xc0\x2e"
  1206. "\xfa\xa0\x32\xed\xfe\xf7\x93\x9a\x17\x75\x3f\x72\x43\x88\xa2\xd6\xba\x88"
  1207. "\x21\xc3\xce\x4c\x40\x7a\xc7\x4d\x35\x1d\x35\x0c\xd2\xb9\x8a\x8a\x63\xdb"
  1208. "\xb0\x0b\x7c\x68\x59\xb1\x1a\x64\x0e\x34\xa3\x38\x73\x63\x09\xe3\xc0\x80"
  1209. "\x47\xf1\x80\x4b\x77\xdd\x13\x51\xa1\xfa\x66\xfe\x6b\x80\x59\xf9\xe6\x31"
  1210. "\xfb\x44\xfa\xf6\xc4\xa2\xbd\xd7\x16\xd9\x3d\x66\x9d\xc1\x4d\xba\xa4\x2e"
  1211. "\xf1\x28\x67\x1b\xba\x50\xc7\xcf\x25\x84\xea\x93\x0e\x1f\xfc\xb7\x11\x84"
  1212. "\xe5\xa9\x29\xdb\xf7\xc7\xdb\xc0\x6d\x80\x4e\x6c\x1f\x53\x6a\x3a\x1b\x33"
  1213. "\x6a\x7a\x55\x39\xa8\x87\x9c\xa4\xea\x3c\xbe\x4e\x25\x47\x22\xf4\x3f\x07"
  1214. "\x08\x61\xd1\xd0\xdf\x18\xcb\xfc\xe8\x53\x84\x21\x34\x54\x7e\xd3\x7a\xd6"
  1215. "\xc2\xd7\x57\xf7\x6f\x8a\x29\x94\x3d\x57\x38\xd5\xe7\xaa\xbf\x4c\xad\x6f"
  1216. "\x5d\xe6\xf5\x3a\x2b\x6f\x33\x6f\x19\xf4\x1e\x14\x42\x31\x08\x32\x14\x62"
  1217. "\x47\x33\xe3\x6a\xb7\x42\x08\x6d\x9f\x78\x68\x89\xd5\xaf\x36\xc0\xe2\xc6"
  1218. "\xa7\x31\x14\x81\x58\xd8\xb6\xc6\xdb\x31\x8d\x33\x52\x9d\x98\x81\x5b\x93"
  1219. "\xca\x9e\xfd\xa1\x46\xf8\xdc\x4e\xc9\xdf\x08\xf4\x32\x53\xf5\x5c\x2d\xcc"
  1220. "\x48\x0a\x0e\x8b\x85\xc1\x84\xad\x13\xdb\x79\xd4\x01\x79\xad\x4c\x43\xe3"
  1221. "\x0f\x6f\x8e\xe8\x8e\xa9\xfb\xd5\x22\x8b\x26\xb9\x07\xf4\x6f\xfc\x5c\x2b"
  1222. "\x59\x4a\xde\x4f\x48\xde\xe4\x56\x1a\xe9\x9c\x7f\xb8\x1f\xd7\x49\xcf\x9a"
  1223. "\xa3\x6a\x01\xb5\x7b\x77\x0b\x77\x21\xbf\x29\x44\x18\x24\x17\x35\x44\x97"
  1224. "\x95\x01\x6e\xd0\x59\x7d\x66\xa6\x84\x5a\xf6\x8d\x0d\x44\x23\x2c\x4f\xfb"
  1225. "\x61\x60\xa4\x57\xde\x63\xab\x8b\xf8\xfe\x5f\x02\xf4\x03\x77\x93\xa3\x59"
  1226. "\xf0\x79\x9c\x90\x6a\x62\x87\xaa\x00\x00\x4a\xfa\x09\x94\x9e\xa7\x87\xaa"
  1227. "\x73\xa6\x94\x16\xb3\xb9\xe3\x24\xca\x33\x6b\x35\x19\x7e\x7f\x3f\x8d\x14"
  1228. "\x19\xb8\x56\x67\x6f\x9e\xf2\xf7\xce\x14\xce\x12\xe2\x3c\x72\xac\xa9\xe1"
  1229. "\x2f\xba\xf1\x18\x63\xd5\xb9\xd7\x75\x99\x86\xfa\x00\x62\x59\x9f\x8c\x35"
  1230. "\x16\x4b\x7f\xd7\xe9\xe1\x45\x49\xba\x88\x3a\x24\x4f\xea\xa6\x07\x82\x79"
  1231. "\xcf\x64\x12\xf1\x3c\xb0\x88\x3f\x62\xba\xf7\xcd\xa4\xb4\x81\xc2\xb0\x88"
  1232. "\xeb\xd3\x69\xc1\x2a\x24\x33\xa4\x8c\x24\xd3\x13\x31\xa9\x40\x16\x25\x1f"
  1233. "\x3b\x86\xdd\xe8\x84\xbd\x5a\xa7\xb1\xd5\x4d\xc8\x92\xf6\xeb\x9f\xf8\x47"
  1234. "\x76\xc3\x81\x84\x78\xb9\x8a\x8b\x9f\xb4\xa9\xbd\x18\xa2\x7e\xcf\x4e\x7d"
  1235. "\xd9\x95\xcd\xc6\x96\xfb\xfa\x32\x60\xf1\x60\xe5\x90\xe6\xd3\x11\xb4\xba"
  1236. "\x53\xeb\x11\x1c\xc6\x9c\x1a\x18\x6e\x98\x05\xd8\x0f\xdc\x03\x58\x24\x78"
  1237. "\xc9\x9a\xef\x40\x29\x4c\xa7\x2b\xf9\x65\xba\x97\x7a\x7f\x6f\xca\x5f\xa8"
  1238. "\x6a\x11\x0d\xe0\x02\x60\x3f\x2d\x0e\x92\xce\x93\x60\xbd\x83\x3d\xb6\x2c"
  1239. "\xb8\x54\x7e\x28\x15\xa1\xf5\x4d\xe4\x81\xf7\x45\x88\xf1\x2e\x40\x31\x22"
  1240. "\x23\xe3\x95\x79\xd5\xe3\xc9\x21\xeb\x4e\x62\xb2\x86\x80\xc6\xc3\x50\xb8"
  1241. "\x0d\x6a\xa6\x25\x97\xd1\x9d\x3c\x1c\x12\x35\x64\xdb\xfa\x06\x86\xfd\xf8"
  1242. "\x58\xa1\x0f\x81\xda\x38\x4e\x26\x1c\xed\x07\x8b\xb3\xb2\x26\x9a\xc9\xf6"
  1243. "\x1c\xa0\x66\xbb\xb2\xbc\x65\xdb\x1f\x4b\xf1\xb4\x45\xca\x57\xdc\x32\x37"
  1244. "\x4e\x67\xb9\x45\x93\x2f\x7f\x01\x96\x06\x92\x19\xc7\x77\x23\x67\x7d\x13"
  1245. "\xef\x54\x05\x3b\xd0\x6a\x6b\xf7\x00\x41\x01\xcb\x0d\x1f\xce\x78\xc5\x9e"
  1246. "\xce\x5e\x3a\x3c\xe4\x61\x5d\x5b\x03\xf2\x79\x7e\xed\x62\x48\xfa\xed\x2a"
  1247. "\x49\x4c\x2c\xd5\x10\x28\x0f\x4f\x6b\x56\x99\xcc\x2c\xdb\x74\x03\x7a\x20"
  1248. "\x2f\xf1\x1c\x24\xd9\x61\x09\xb8\x12\xd9\x7a\x2b\xab\x0f\xa0\xea\xed\x5b"
  1249. "\x29\x21\xdb\xb3\x1b\xb9\x5a\x5f\x63\x4a\xd8\x4d\x23\x06\xa4\x0e\xdc\xaa"
  1250. "\x3f\x81\xed\xf2\x89\xec\xda\xd9\x2c\x03\x64\x74\x54\xa7\x19\x74\x50\x8b"
  1251. "\x53\xbc\x28\xf2\x63\x79\xa6\x9b\x4c\x51\xd9\x50\x5e\xac\x0a\x23\x5d\x5c"
  1252. "\x31\xda\x3f\xa5\xcc\x7d\x74\x7c\xea\x40\xac\x54\xf8\x84\x35\x78\x21\xb6"
  1253. "\xc3\x3c\xf6\x34\xf0\x16\xd5\x35\xb3\x34\x8a\x3b\x5e\x17\x9e\x6f\x48\x08"
  1254. "\xfe\x3a\xda\xcb\x30\xf7\xfd\x17\x1a\xa2\x9a\x28\x65\x07\xb5\x16\xda\xbd"
  1255. "\xea\x2d\xf7\x45\x6e\xbc\x32\xdd\xd8\x39\x1e\x47\x79\xbb\xfc\x65\xd0\x0e"
  1256. "\xa1\x34\x0e\x27\x54\x43\xa4\x4f\xf1\x74\x85\xeb\xac\xd8\xcf\xdd\xb0\x82"
  1257. "\xfe\x09\x6f\x7a\x61\x38\xc5\xf3\x5d\x66\x5b\x60\x85\x9d\x8c\x22\x82\x80"
  1258. "\x17\x30\x9d\xa1\xfa\x5c\x48\xbf\x00\x88\x07\x6e\x46\x52\x15\xe9\x21\x35"
  1259. "\x3f\xde\xc2\x46\x65\x18\x48\x88\x33\xf7\x94\x3a\x5f\x82\x93\x63\x07\x8d"
  1260. "\xc9\x05\xbd\xf0\x54\x4f\x36\xd9\xff\x0a\x9e\x87\xec\x74\x71\xa2\x36\x81"
  1261. "\x31\xa9\xc3\x99\x91\xa5\x72\xfd\xe0\xdc\x9b\x91\x07\x93\x36\x43\xc9\xb8"
  1262. "\x99\xe0\x21\x18\x61\xfb\xe7\xf2\x64\x81\xfb\x15\x38\xc9\x86\x1d\xf4\xd8"
  1263. "\xd8\x33\xf7\xa4\x8a\xa2\x1f\xd9\xc4\x62\x58\x9f\x0e\x90\x77\x2b\xe7\x89"
  1264. "\xcb\x32\xa4\xe3\xaa\x16\xd8\x6a\xa4\x01\x67\xe5\xc4\xa8\xb1\x36\xf7\xe0"
  1265. "\xbf\x65\xe9\xa1\x3c\xe5\xc0\x2e\xa0\x5c\x9b\xdc\x8b\x50\x48\xbd\x68\x43"
  1266. "\x98\x84\x30\xe0\xe0\xfb\x06\x95\x22\xe7\xb2\x72\x70\x15\xd6\x3c\x94\x8f"
  1267. "\xe1\xb8\x03\xe3\xb0\x8d\x6d\x5e\x73\x5f\x1b\xe2\x88\x23\x17\x7a\x08\xae"
  1268. "\x31\xab\x41\x63\xf0\x9f\xf2\x09\xb8\x54\x05\x02\xb2\x64\xd1\x2b\xdd\x35"
  1269. "\x6a\x43\x3b\x5f\x2c\x3b\xb0\xc0\xde\xd1\x28\xce\x5d\xed\x14\x76\x23\x7b"
  1270. "\xb3\xf4\xd5\x58\xc5\xfc\x1e\x7e\x98\x36\x36\xfc\xb2\xe7\xe2\x69\xfb\x26"
  1271. "\xb1\x78\x3a\x9a\x99\xc8\xbe\xcf\xc2\x14\x1a\x50\x1c\xf0\xfd\xba\xb9\xd1"
  1272. "\x3d\xef\xb0\x0c\x9b\x3e\x0d\xc1\xf5\x48\x31\x13\x93\x14\xb5\x03\xc5\xa2"
  1273. "\xc3\x77\xce\xfb\xb2\x95\xe6\x82\x4d\x77\x00\x32\xaa\x2b\x51\xdc\xcc\xea"
  1274. "\xcd\xeb\x57\x2a\x2c\x25\xf9\xec\x99\x0e\x4b\x83\xaf\xa2\xa4\x06\xa7\x2a"
  1275. "\x35\xa4\xca\xe6\x17\xf2\x54\x2f\x4a\x3d\x60\xfc\x02\xf6\x29\xfb\xf5\x4c"
  1276. "\xda\x85\xa8\x4e\x97\xca\x24\x44\x57\x98\x97\xaa\xd3\xb7\x31\x6d\x4e\xe8"
  1277. "\x00\x2f\x93\xb8\x2b\x13\xcd\xa7\xc5\x3e\xce\x97\xb9\x4a\x7c\xf1\x0f\x1a"
  1278. "\x4c\x73\xda\x6f\x3a\x89\xbe\x51\x19\x42\x41\x42\x75\x47\xf3\x13\xcc\x47"
  1279. "\x95\x53\x81\xcb\x74\xa5\xaf\xb7\x35\xa6\xe3\x69\x9f\x36\x43\xfe\xe5\x96"
  1280. "\x98\x55\x3c\xc3\x58\x63\x1f\x2a\x47\x08\x28\x8d\x86\xe5\x29\xb8\x25\x58"
  1281. "\xe5\x78\x93\x03\xdb\xc9\xad\x0d\xd7\x7a\x98\x9d\x07\xe1\x63\x8d\x39\xb0"
  1282. "\x9e\x9e\x47\xf3\x91\x7e\x0f\x5b\x9d\x0e\x48\x61\xbb\x44\x04\x63\xd7\x33"
  1283. "\x33\x63\x0e\x95\xf5\x1a\xb0\x13\xa6\x96\x17\x95\xfe\x44\x83\x9f\x57\x5a"
  1284. "\x17\xb8\x0e\x96\x46\xa0\xd3\x80\xe2\xca\x35\x2e\x5c\x7c\x8a\x85\xe0\x78"
  1285. "\xef\xca\x17\x00\x46\xaf\xa8\x23\xa9\x29\xa1\xf6\x92\x68\xd7\xf1\x8c\xae"
  1286. "\xe6\x70\xa2\x9c\xb9\xe7\xee\x92\x4d\xf3\x48\xe3\xcb\xdd\x8c\x13\x24\xed"
  1287. "\xd0\x8f\x07\xf1\x24\x3b\x48\xfa\x55\xab\x30\x3e\x51\x30\x4e\x6e\xdf\xe5"
  1288. "\xfb\xc3\xb9\xde\x1a\x69\x24\x17\x9c\x9b\x99\x27\x34\xea\x5f\xa2\x71\xc0"
  1289. "\x99\xfe\xc8\xa5\x24\x76\x72\xa6\xe0\xf5\x51\x69\x1d\xec\xb8\xbe\xc9\xf9"
  1290. "\x49\x4c\x7a\x26\x19\x50\xd1\xc4\xcb\x24\x0c\xfa\xc0\x5e\x05\x72\x71\x8a"
  1291. "\x33\xba\x40\x38\xec\x03\xaf\x1c\x68\xb0\x67\xda\x19\xaf\xda\x71\x58\x2c"
  1292. "\xca\x97\xa8\x01\xb8\x9b\x27\x72\x66\xe2\x91\xe7\x74\x0e\x76\x7b\x91\xe1"
  1293. "\x0a\x57\xa2\x80\x6a\x6f\xa9\x99\x0c\x51\xb5\x21\xd0\x0a\x47\x33\x38\x47"
  1294. "\x63\x03\x21\x94\x5d\x1f\x53\x60\x1a\x21\x59\x6c\x28\x14\x13\x63\xcf\xd4"
  1295. "\xa4\x57\x94\x78\x32\xd7\x54\x5f\xf6\x56\x6e\x10\xc1\xc1\x6d\xa8\xfe\x8a"
  1296. "\xb4\x0d\x4a\x4a\xfa\x8f\x19\x13\x92\x33\x2a\xcb\x53\x71\xd1\xff\x86\xed"
  1297. "\x2f\x58\x8a\x62\x01\xa0\x93\xa0\x0f\x86\x86\x84\x98\x14\x93\x60\x28\xae"
  1298. "\x79\xaf\x9d\xd8\x64\x75\x7b\xb9\xc2\x61\x4a\x9e\x76\xd6\xfa\xe7\xe6\xc0"
  1299. "\x84\x17\x88\xb7\x15\xaa\x73\xd2\xf0\x1c\x3d\x4b\x0d\xcd\xb3\x8c\x5c\x6b"
  1300. "\x81\xe6\x0d\x12\xb1\xca\x72\xb6\xc4\x7f\x5f\x3e\xb8\x83\xaf\x96\x4b\x87"
  1301. "\x7e\xfa\x0c\x5a\xcf\xbd\x7f\x41\x0a\x06\x0c\x56\xa1\x79\x8f\x0c\x40\x7c"
  1302. "\xb3\x16\xf7\x88\xe3\x0c\xf3\xd6\x9f\x19\x25\x33\xe1\x9a\x81\x8c\x8f\x7a"
  1303. "\xa9\x90\xa6\xd9\x94\xe2\xad\x77\x56\x38\x8e\xc0\x17\x4c\x1c\x0a\x42\x24"
  1304. "\x9e\x90\x3f\x32\x35\xfe\xa2\xd6\x5d\x54\x0f\xdc\x1c\x03\xe1\x57\x86\x52"
  1305. "\x87\x87\xc8\x0c\x61\x94\x76\x36\x41\xcf\x7f\x85\xf5\x49\xea\x70\x6a\xa1"
  1306. "\xb0\x7e\x4b\x29\x03\x71\x4b\x7f\x17\x64\x20\x2e\x53\x2b\x52\xe7\xaa\x8c"
  1307. "\x06\x3f\xae\x17\x0e\xa9\x33\x62\xc7\x79\x4f\x32\xcd\x5e\xd3\xcb\x39\xa2"
  1308. "\xa1\x8a\xcd\xa3\x66\xed\x03\x1a\x11\x4e\x9f\xb4\x7b\xea\xc6\x9b\xf0\x5f"
  1309. "\x25\x8d\x77\xad\x41\x81\x91\x60\x16\x7c\x5b\x0f\x6d\x34\xf1\xd0\x63\xab"
  1310. "\x2e\xf3\x19\xfc\xef\x2c\x23\x05\x8f\x85\xcc\x45\x3f\x6e\x40\x54\x7a\x99"
  1311. "\xbc\xcb\x31\x7a\x4c\x19\xe2\xb3\xd9\x95\x05\xa2\x4e\x77\x3f\x2e\xe1\x0b"
  1312. "\x88\x44\x3f\x48\x9b\xcb\xa4\x76\xe7\x86\xb4\xdc\xce\x1c\xd8\x19\xe0\x08"
  1313. "\x06\xd7\x66\xaf\x56\x80\x42\x04\xab\xbf\xb8\xa7\xf8\xe2\xf3\xb3\x99\x52"
  1314. "\x4a\x06\xea\xcb\x20\xb1\x45\x9c\x8f\x9c\x8a\x15\x74\x23\xc4\xa0\xd1\x8e"
  1315. "\x56\x09\x79\x59\x61\xa6\xb0\xb8\xac\xd6\x43\xfe\x30\xfd\xdd\x00\x77\x40"
  1316. "\x14\x5a\xe3\x1b\x08\x55\xbb\x8b\x02\x83\xa4\xe1\x39\x40\xb9\xaf\x0f\x84"
  1317. "\x27\xf0\x90\x59\xac\x0f\x1e\xe1\x50\x77\x75\xf6\x74\x3d\xeb\xef\x31\xc8"
  1318. "\x2c\x63\xfa\x8c\x5a\xdb\x08\xf0\x5e\x38\xfc\x37\xb0\x7d\x8a\x2f\x4d\x62"
  1319. "\xb9\xeb\x47\x48\xb9\xe0\x28\xc7\x66\x7a\xc8\xea\x03\xf6\x4c\xbe\x9f\x9a"
  1320. "\x3e\x75\xe4\xd5\x7b\x11\xf0\x2c\x72\x02\x4a\x65\xbc\x4f\x14\xfd\x3a\x0e"
  1321. "\xab\xb3\x9b\x06\x2a\x7c\x68\x54\xa2\x99\xee\xf7\x49\x1b\xf1\x0c\x09\x6c"
  1322. "\x50\xcf\xa4\xa3\xda\x48\x3f\x42\x93\x92\x05\x38\x3a\xe8\x31\x96\x04\xf7"
  1323. "\x42\xab\x49\x82\x80\x1f\x0c\x83\xda\xbb\xd9\xda\x48\xe8\x00\xf5\x10\xdf"
  1324. "\xec\xc2\x24\xf0\xb1\x83\xa8\x01\xdf\x96\xd2\x87\x06\x8f\xca\xad\x6c\xdd"
  1325. "\xd4\x12\xc7\x96\xa4\x81\xd6\x09\xdb\xfd\x77\xe8\xb2\x96\xdc\xe8\x6f\xf8"
  1326. "\xef\xa1\x0b\x23\xae\xc2\x61\xc0\x27\x58\x2f\x6a\x77\x0f\xf9\xf0\xf7\xa9"
  1327. "\x9d\x8b\xa4\x94\x95\xf4\x69\x6c\xd6\xec\xa9\x20\xce\x17\xe0\xf0\xb1\x35"
  1328. "\x38\x33\x68\x20\xf8\xc0\x1c\x7e\x95\x55\x67\x7a\x94\x5c\xfe\x8c\x5b\x25"
  1329. "\x8b\xee\xb2\x41\x5c\x58\xdc\xe1\x73\xb3\x45\x8e\x27\x3e\x23\xbf\x6e\xbe"
  1330. "\x2f\xea\xa2\xe9\x3d\xa4\x24\xb5\x18\x81\xb7\x32\xc4\x73\x56\xbb\x60\xde"
  1331. "\xa0\x0a\xe1\x24\xe1\x6a\xa0\xa0\x6a\x4f\xeb\x2a\x32\x1e\x91\xd7\x18\x1d"
  1332. "\x25\x8a\x3e\xe9\x52\xda\xf8\x23\xe5\x18\xc9\x36\x37\xfa\x0e\xfc\xf5\x01"
  1333. "\x9a\xa4\x9a\x1c\x7f\x38\xd7\x68\xa9\xbb\x7d\xbb\xa3\x7e\x1e\xbe\x90\x3b"
  1334. "\xf9\xbf\x19\x7e\x6b\xa7\x87\x72\x64\xd8\x5e\xb2\x01\x46\xe5\x10\x50\x1c"
  1335. "\x7c\x1e\xdb\x48\x7c\xf1\x2b\x1d\x8a\x7f\x39\xb2\x7f\xfd\x7c\xb4\xd8\xf8"
  1336. "\x09\x2e\xe5\x4a\xcd\xc1\x39\x0b\x17\xea\xe1\x31\x14\x97\x87\xf0\xf5\x85"
  1337. "\xef\xb6\xe3\xa7\x07\x32\x63\xf2\x95\x5c\x4d\xd6\xb6\xa4\xc9\x79\x1a\x66"
  1338. "\x94\xa6\xce\x9f\x00\x59\x5e\x9c\x22\xed\xda\x61\x0d\x60\x62\x11\xf5\x62"
  1339. "\x8a\x87\x16\x2d\x92\xa3\x75\xa7\xcd\x92\x71\x4a\x37\x83\x06\x52\xb9\xcd"
  1340. "\x1f\xb8\x5d\xeb\x77\xe8\xc4\xf7\xac\x28\xf0\x86\x8a\x7e\x27\x61\xae\xeb"
  1341. "\x91\xa3\x5a\xb7\x1b\x5a\x55\x7c\x21\x35\x8c\x60\xfb\xd0\xf5\x44\xb2\x60"
  1342. "\xde\xfb\xc3\xae\xda\x44\x48\x11\xdf\x2f\x08\xc7\x4c\xcf\xad\x45\xc4\x21"
  1343. "\x71\x42\x95\x4f\xaf\xc4\x2f\x66\xf4\x0d\x4e\xf9\x00\x95\x6e\xad\x58\xee"
  1344. "\xb8\x7e\x2b\x1a\x74\x7f\x86\x9b\xc7\x1c\x36\xed\x4c\x01\x5a\x59\xb9\x6f"
  1345. "\xd8\x50\x72\x09\x80\xa7\x8b\x8b\x1b\x63",
  1346. 2944);
  1347. *(uint64_t*)0x2000000021c8 = 0xb80;
  1348. syscall(__NR_writev, /*fd=*/r[8], /*vec=*/0x2000000021c0ul, /*vlen=*/1ul);
  1349. syscall(__NR_msgget, /*key=*/0x798e2636ul, /*flags=*/9ul);
  1350. memcpy((void*)0x200000000000, "/dev/sr0\000", 9);
  1351. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  1352. /*file=*/0x200000000000ul, /*flags=O_NONBLOCK*/ 0x800,
  1353. /*mode=*/0);
  1354. if (res != -1)
  1355. r[9] = res;
  1356. res = syscall(__NR_socket, /*domain=AF_NETLINK*/ 0x10ul,
  1357. /*type=SOCK_RAW*/ 3ul, /*proto=*/0);
  1358. if (res != -1)
  1359. r[10] = res;
  1360. *(uint64_t*)0x200000000000 = 0;
  1361. *(uint32_t*)0x200000000008 = 0;
  1362. *(uint64_t*)0x200000000010 = 0x200000000080;
  1363. *(uint64_t*)0x200000000080 = 0x2000000002c0;
  1364. memcpy((void*)0x2000000002c0,
  1365. "\x1c\x00\x00\x00\x31\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a"
  1366. "\x00\x00\x00\x08\x00\x01",
  1367. 23);
  1368. *(uint64_t*)0x200000000088 = 0x1c;
  1369. *(uint64_t*)0x200000000018 = 1;
  1370. *(uint64_t*)0x200000000020 = 0;
  1371. *(uint64_t*)0x200000000028 = 0;
  1372. *(uint32_t*)0x200000000030 = 0;
  1373. syscall(__NR_sendmsg, /*fd=*/r[10], /*msg=*/0x200000000000ul, /*f=*/0ul);
  1374. syscall(__NR_ioctl, /*fd=*/r[9], /*cmd=*/0x1279, /*arg=*/0ul);
  1375. syscall(__NR_shmget, /*key=*/0ul, /*size=*/0xfffffffffefffffful,
  1376. /*flags=*/0ul, /*unused=*/0x200000ffc000ul);
  1377. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
  1378. if (res != -1)
  1379. r[11] = res;
  1380. memcpy((void*)0x2000000060c0, "/dev/sg#\000", 9);
  1381. res = -1;
  1382. res = syz_open_dev(/*dev=*/0x2000000060c0, /*id=*/0, /*flags=*/0);
  1383. if (res != -1)
  1384. r[12] = res;
  1385. *(uint8_t*)0x200000000040 = 0;
  1386. syscall(__NR_prctl, /*option=*/0x3bul, /*mode=*/1ul, /*offset=*/0ul,
  1387. /*len=*/0ul, /*selector=*/0x200000000040ul);
  1388. syscall(__NR_recvmsg, /*fd=*/-1, /*msg=*/0ul, /*f=*/0ul, 0);
  1389. *(uint16_t*)0x200000000000 = 0xa;
  1390. *(uint16_t*)0x200000000002 = htobe16(0);
  1391. *(uint32_t*)0x200000000004 = htobe32(0);
  1392. memset((void*)0x200000000008, 0, 16);
  1393. *(uint32_t*)0x200000000018 = 0;
  1394. syscall(__NR_bind, /*fd=*/-1, /*addr=*/0x200000000000ul, /*addrlen=*/0x1cul);
  1395. memcpy((void*)0x200000000000, "./file0\000", 8);
  1396. syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000000ul,
  1397. /*mode=*/0ul);
  1398. memcpy((void*)0x200000000180, "./file0\000", 8);
  1399. res = syscall(__NR_creat, /*file=*/0x200000000180ul, /*mode=*/0ul);
  1400. if (res != -1)
  1401. r[13] = res;
  1402. memcpy((void*)0x200000000000, "./file0\000", 8);
  1403. memcpy((void*)0x200000000040, "9p\000", 3);
  1404. memcpy((void*)0x2000000001c0, "trans=fd,", 9);
  1405. memcpy((void*)0x2000000001c9, "rfdno", 5);
  1406. *(uint8_t*)0x2000000001ce = 0x3d;
  1407. sprintf((char*)0x2000000001cf, "0x%016llx", (long long)r[13]);
  1408. *(uint8_t*)0x2000000001e1 = 0x2c;
  1409. memcpy((void*)0x2000000001e2, "wfdno", 5);
  1410. *(uint8_t*)0x2000000001e7 = 0x3d;
  1411. sprintf((char*)0x2000000001e8, "0x%016llx", (long long)r[13]);
  1412. *(uint8_t*)0x2000000001fa = 0x2c;
  1413. *(uint8_t*)0x2000000001fb = 0;
  1414. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000000ul,
  1415. /*type=*/0x200000000040ul, /*flags=*/0ul, /*opts=*/0x2000000001c0ul);
  1416. memcpy((void*)0x20000001c000, "./file0\000", 8);
  1417. memcpy((void*)0x200000000b80, "configfs\000", 9);
  1418. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x20000001c000ul,
  1419. /*type=*/0x200000000b80ul, /*flags=*/0ul, /*data=*/0ul);
  1420. memcpy((void*)0x200000000040, "./file0\000", 8);
  1421. syscall(__NR_lchown, /*file=*/0x200000000040ul, /*uid=*/0, /*gid=*/-1);
  1422. res = syscall(__NR_fcntl, /*fd=*/r[12], /*cmd=*/0ul, /*arg=*/r[12]);
  1423. if (res != -1)
  1424. r[14] = res;
  1425. syscall(__NR_ioctl, /*fd=*/r[14], /*cmd=*/0x2282, /*arg=*/0x200000000000ul);
  1426. *(uint64_t*)0x2000000003c0 = 0x200000000180;
  1427. memcpy((void*)0x200000000180,
  1428. "\x39\x00\x00\x00\x13\x00\x03\x47\x00\xbb\x65\xe1\xc3\xe4\xff\xff\x01"
  1429. "\x00\x00\x00\x01\x00\x00\x00\x56\x00\x00\x00\x25\x00\x00\x00\x19\x00"
  1430. "\x04\x00\x04\x00\x00\x00\x07\xfd\x17\xe5\xff\xff\x08\x00\x04\x00\x00"
  1431. "\x00\x00\x00\x00\x00\x00",
  1432. 57);
  1433. *(uint64_t*)0x2000000003c8 = 0x39;
  1434. syscall(__NR_writev, /*fd=*/r[11], /*vec=*/0x2000000003c0ul,
  1435. /*vlen=*/0x10000000000002a5ul);
  1436. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0);
  1437. if (res != -1)
  1438. r[15] = res;
  1439. syscall(__NR_fcntl, /*fd=*/-1, /*cmd=*/8ul, /*pid=*/-1);
  1440. syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x10);
  1441. *(uint16_t*)0x200000000000 = 0xa;
  1442. *(uint16_t*)0x200000000002 = htobe16(2);
  1443. *(uint32_t*)0x200000000004 = htobe32(0);
  1444. memset((void*)0x200000000008, 0, 16);
  1445. *(uint32_t*)0x200000000018 = 0;
  1446. syscall(__NR_bind, /*fd=*/r[15], /*addr=*/0x200000000000ul,
  1447. /*addrlen=*/0x1cul);
  1448. *(uint16_t*)0x200000b63fe4 = 0xa;
  1449. *(uint16_t*)0x200000b63fe6 = htobe16(2);
  1450. *(uint32_t*)0x200000b63fe8 = htobe32(0);
  1451. *(uint64_t*)0x200000b63fec = htobe64(0);
  1452. *(uint64_t*)0x200000b63ff4 = htobe64(1);
  1453. *(uint32_t*)0x200000b63ffc = 0;
  1454. syscall(
  1455. __NR_sendto, /*fd=*/r[15], /*buf=*/0ul, /*len=*/0x1eul,
  1456. /*f=MSG_FASTOPEN|MSG_PROBE|MSG_OOB|MSG_NOSIGNAL|MSG_MORE|MSG_DONTWAIT|0x2000800*/
  1457. 0x2200c851ul, /*addr=*/0x200000b63fe4ul, /*addrlen=*/0x1cul);
  1458. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/6);
  1459. if (res != -1)
  1460. r[16] = res;
  1461. *(uint64_t*)0x200000000200 = 0;
  1462. *(uint32_t*)0x200000000208 = 0;
  1463. *(uint64_t*)0x200000000210 = 0x2000000001c0;
  1464. *(uint64_t*)0x2000000001c0 = 0x200000000240;
  1465. *(uint32_t*)0x200000000240 = 0xb8;
  1466. *(uint16_t*)0x200000000244 = 0x19;
  1467. *(uint16_t*)0x200000000246 = 1;
  1468. *(uint32_t*)0x200000000248 = 0;
  1469. *(uint32_t*)0x20000000024c = 0;
  1470. *(uint32_t*)0x200000000250 = htobe32(0x7f000001);
  1471. memset((void*)0x200000000260, 0, 16);
  1472. *(uint16_t*)0x200000000270 = htobe16(0);
  1473. *(uint16_t*)0x200000000272 = htobe16(0);
  1474. *(uint16_t*)0x200000000274 = htobe16(0);
  1475. *(uint16_t*)0x200000000276 = htobe16(0);
  1476. *(uint16_t*)0x200000000278 = 0;
  1477. *(uint8_t*)0x20000000027a = 0;
  1478. *(uint8_t*)0x20000000027b = 0;
  1479. *(uint8_t*)0x20000000027c = 0;
  1480. *(uint32_t*)0x200000000280 = 0;
  1481. *(uint32_t*)0x200000000284 = -1;
  1482. *(uint64_t*)0x200000000288 = 0;
  1483. *(uint64_t*)0x200000000290 = 0;
  1484. *(uint64_t*)0x200000000298 = 0;
  1485. *(uint64_t*)0x2000000002a0 = 0;
  1486. *(uint64_t*)0x2000000002a8 = 0;
  1487. *(uint64_t*)0x2000000002b0 = 0;
  1488. *(uint64_t*)0x2000000002b8 = 0;
  1489. *(uint64_t*)0x2000000002c0 = 0;
  1490. *(uint64_t*)0x2000000002c8 = 0;
  1491. *(uint64_t*)0x2000000002d0 = 0;
  1492. *(uint64_t*)0x2000000002d8 = 0;
  1493. *(uint64_t*)0x2000000002e0 = 0;
  1494. *(uint32_t*)0x2000000002e8 = 0;
  1495. *(uint32_t*)0x2000000002ec = 0;
  1496. *(uint8_t*)0x2000000002f0 = 0;
  1497. *(uint8_t*)0x2000000002f1 = 0;
  1498. *(uint8_t*)0x2000000002f2 = 0;
  1499. *(uint8_t*)0x2000000002f3 = 0;
  1500. *(uint64_t*)0x2000000001c8 = 0xb8;
  1501. *(uint64_t*)0x200000000218 = 1;
  1502. *(uint64_t*)0x200000000220 = 0;
  1503. *(uint64_t*)0x200000000228 = 0;
  1504. *(uint32_t*)0x200000000230 = 0;
  1505. syscall(__NR_sendmsg, /*fd=*/r[16], /*msg=*/0x200000000200ul, /*f=*/0ul);
  1506. memcpy(
  1507. (void*)0x200000000080,
  1508. "\x44\xf9\xb1\x08\xb1\xcd\xc8\x85\xc9\xc5\x33\xd2\x1f\x47\x4b\xec\x8b\xfe"
  1509. "\xf1\xdf\x1e\x2d\xa7\x1e\x57\x8d\xc6\xb9\x1d\x09\xf7\xab\x15\x37\x85\x71"
  1510. "\xd8\xe2\x75\x46\x09\x00\x11\x00\x6e\x75\x43\x69\x14\xab\x71\x75\x28\xee"
  1511. "\x4b\x7a\x9b\xea\xf9\x08\xd1\x11\x37\xc1\x19\x03\x06\x4e\x83\xb4\x95\x1f"
  1512. "\x4d\x43\x3a\x54\x04\x97\x0c\x85\xd9\x2d\x70\x83\xfd\x38\x84\x4c\xbb\x0c"
  1513. "\x6c\x5e\xb5\x08\xdd\xc2\xdc\x7a\x59\x0a\xa7\x94\x1b\x1e\x9e\xeb\x5a\x68"
  1514. "\x81\x38\xde\xa0\x9b\x77\x6c\xbf\xa7\x84\xcb\xf5\x50\xbf\x30\x74\xfb\x0d"
  1515. "\x77\x5d\xa4\xdf\x5a\x3f\x48\xbb\xdf\x45\x2e\xeb\x6b\x92\x3d\xa9\xd0\xe2"
  1516. "\x5b\x80\xf7\x6a\x87\x36\x64\xb5\x75\x34\x44\xfe\x05\xf3\x3e\x5f\x91\x04"
  1517. "\x55\x40\x83\x6c\x3c\xd6\xaf\x10\xf0\xcd\x01\x8f\x0c\x6f\x57\xf9\x26\xac"
  1518. "\x95\x9a\x56\x28\xc4\x50\x88\xfb\xe0\xc8\x7f\xbe\x6c\xbc\xda\x46\x62\xd2"
  1519. "\xa1\x2f\x6d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
  1520. 215);
  1521. syscall(__NR_sendto, /*fd=*/r[15], /*buf=*/0x200000000080ul, /*len=*/0xd7ul,
  1522. /*f=MSG_FASTOPEN|MSG_OOB|MSG_DONTWAIT|MSG_CONFIRM*/ 0x20000841ul,
  1523. /*addr=*/0ul, /*addrlen=*/0ul);
  1524. memcpy((void*)0x200000000000, "vfat\000", 5);
  1525. memcpy((void*)0x200000000300, "./file0\000", 8);
  1526. memcpy(
  1527. (void*)0x200000000800,
  1528. "\x78\x9c\xec\xdc\xcb\x6b\x13\x5f\x14\xc0\xf1\xd3\xf4\x95\xa6\xb4\xc9\xe2"
  1529. "\xc7\x4f\x14\xa4\x07\xdd\xe8\x66\x68\xa3\x6b\x31\x48\x0b\x62\xc0\x52\x1b"
  1530. "\xf1\x01\xc2\xb4\x9d\x68\xc8\x98\x94\x4c\xa8\x44\xc4\xea\xca\xad\xf8\x47"
  1531. "\xb8\x28\x5d\x76\x57\xd0\xfe\x03\xdd\xb8\xd3\x8d\x1b\x77\xdd\x08\x2e\xec"
  1532. "\x42\x1c\xc9\x3c\xfa\x4c\x69\x69\x9b\x4c\xdb\x7c\x3f\x10\xee\x4d\xee\x3d"
  1533. "\x33\xf7\x4e\x26\xe1\xdc\x21\x93\xb5\x07\xef\x9f\x17\xf3\x8e\x91\x37\xab"
  1534. "\x12\x8b\xab\x74\x88\x88\xac\x8b\xa4\x24\x26\xa1\x8e\xa0\x8c\x79\xf5\x1e"
  1535. "\xd9\xea\x8d\x5c\xed\xff\xf5\xf5\xe2\xbd\x87\x8f\xee\x64\xb2\xd9\xd1\x09"
  1536. "\xd5\xb1\xcc\xe4\xb5\xb4\xaa\x0e\x0e\x7d\x7a\xf1\xaa\x2f\xe8\xb6\xdc\x2b"
  1537. "\xab\xa9\x27\x6b\x3f\xd3\x3f\x56\xff\x5f\x3d\xbf\xf6\x77\xf2\x59\xc1\xd1"
  1538. "\x82\xa3\xa5\x72\x55\x4d\x9d\x2a\x7f\xaf\x9a\x53\xb6\xa5\x33\x05\xa7\x68"
  1539. "\xa8\x8e\xdb\x96\xe9\x58\x5a\x28\x39\x56\xc5\x6f\x2f\xfb\xed\x79\xbb\x3c"
  1540. "\x3b\x5b\x53\xb3\x34\x33\x90\x98\xad\x58\x8e\xa3\x66\xa9\xa6\x45\xab\xa6"
  1541. "\xd5\xb2\x56\x2b\x35\x35\x9f\x9a\x85\x92\x1a\x86\xa1\x03\x09\xc1\x7e\x72"
  1542. "\x0b\x13\x13\x66\xe6\x90\xc1\xd3\xc7\x3c\x18\x34\x49\xa5\x92\x31\x3b\x45"
  1543. "\xa4\x6f\x57\x4b\x6e\x21\x92\x01\x01\x00\x80\x48\xed\xcc\xff\x63\xf5\x94"
  1544. "\xfe\xf8\xf2\xff\xc5\x4b\x2b\xd5\xfe\xfb\x4b\x83\x41\xfe\xbf\xdc\xd3\x28"
  1545. "\xff\xbf\xfe\xcd\xdf\xd6\xb6\xfc\x3f\x2e\x22\x4d\xcf\xff\x77\x67\x44\xed"
  1546. "\xe5\x48\xf9\x3f\x4e\x89\x7a\xfe\x9f\x08\x3e\xbf\x9e\xb7\x8f\x17\x87\xbd"
  1547. "\x0a\xf9\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1548. "\x00\x00\xa7\xc1\xba\xeb\x26\x5d\xd7\x4d\x86\x65\xf8\xe8\x15\x91\xb8\x88"
  1549. "\x84\xcf\xa3\x1e\x27\x9a\x83\xf7\xbf\xbd\x6d\xde\xb8\xd7\x35\x28\x62\xbf"
  1550. "\x9b\xcb\xcd\xe5\xfc\x32\xe8\xb0\x22\x22\xb6\x58\x32\x2c\x49\xf9\xe3\x9d"
  1551. "\x0f\x81\x7a\x3d\xbc\x17\x50\xeb\x52\xf2\xd9\x9e\x0f\xe2\xe7\xe7\x72\x9d"
  1552. "\x5e\x4b\x26\x2f\x05\x2f\x7e\x44\x92\x92\xda\x19\xef\xba\x63\xb7\xb3\xa3"
  1553. "\x23\xea\xdb\x1e\xdf\x2d\x89\xad\xf1\x69\x49\xca\x7f\x8d\xe3\xd3\x0d\xe3"
  1554. "\x7b\xe4\xca\xe5\x2d\xf1\x86\x24\xe5\xcb\xb4\x94\xc5\x96\x19\xef\xbc\xde"
  1555. "\x8c\x7f\x3d\xa2\x7a\xeb\x6e\x76\x47\x7c\x9f\xd7\x0f\x00\x00\x00\x00\x80"
  1556. "\xb3\xc0\xd0\x0d\x0d\xd7\xef\x86\xb1\x57\xbb\x1f\xbf\xb1\xbe\x6e\x78\x7d"
  1557. "\xc0\x5f\x5f\x0f\x37\x5c\x9f\x77\xc9\x85\xae\x68\xe7\x0e\x00\x00\x00\x00"
  1558. "\x40\xbb\x70\x6a\x2f\x8b\xa6\x6d\x5b\x95\x33\x57\x09\x67\x78\xd0\xa8\xf0"
  1559. "\xb7\x0c\x91\x8c\x39\xdc\xf9\xc9\x38\x74\x07\xa8\xc4\x0e\x35\xd4\x21\x11"
  1560. "\xb1\xf5\xa8\x7b\x0f\x2f\x1b\xed\xd5\x47\xc6\xa3\x3a\x2c\xe7\x3e\x7c\xfc"
  1561. "\x7d\x7c\x1b\xbc\xb1\x14\xdf\x67\xa6\x4d\xab\x74\xb7\xf6\x5b\x08\x00\x00"
  1562. "\x00\x40\x2b\x6c\x26\xfd\xe1\x2b\x37\xa3\x1d\x10\x00\x00\x00\x00\x00\x00"
  1563. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6d"
  1564. "\xa8\x15\x7f\x27\x16\xf5\x1c\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1565. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x93"
  1566. "\xe2\x5f\x00\x00\x00\xff\xff\x7b\x91\x12\x85",
  1567. 695);
  1568. syz_mount_image(/*fs=*/0x200000000000, /*dir=*/0x200000000300, /*flags=*/0,
  1569. /*opts=*/0x200000000ac0, /*chdir=*/0x45, /*size=*/0x2b7,
  1570. /*img=*/0x200000000800);
  1571. memcpy((void*)0x200000000000, ".\000", 2);
  1572. res = syscall(__NR_fspick, /*dfd=*/0xffffff9c, /*path=*/0x200000000000ul,
  1573. /*flags=*/0ul);
  1574. if (res != -1)
  1575. r[17] = res;
  1576. memcpy((void*)0x2000000006c0, "posixacl\000", 9);
  1577. syscall(__NR_fsconfig, /*fd=*/r[17], /*cmd=*/0ul, /*key=*/0x2000000006c0ul,
  1578. /*value=*/0ul, /*aux=*/0ul);
  1579. res = -1;
  1580. res = syz_genetlink_get_family_id(/*name=*/0, /*fd=*/-1);
  1581. if (res != -1)
  1582. r[18] = res;
  1583. memcpy((void*)0x200000000000, "./file0\000", 8);
  1584. res = syscall(__NR_open, /*file=*/0x200000000000ul,
  1585. /*flags=O_NONBLOCK|O_DIRECT|O_RDWR*/ 0x4802ul, /*mode=*/0ul);
  1586. if (res != -1)
  1587. r[19] = res;
  1588. memcpy(
  1589. (void*)0x200000000600,
  1590. "\x34\xfd\x98\xaa\x1d\x0e\x7a\xde\xc9\x37\xa5\xf3\x31\xa7\x5f\x48\x79\x34"
  1591. "\xf5\x02\x42\xa0\x75\x19\x44\x93\x69\x72\x89\x6c\x29\xa5\x06\x8c\x8e\xcb"
  1592. "\xa1\xaa\x0a\x4e\x2a\x63\x1b\x51\x80\xe1\xfb\xde\x79\xf4\x50\x2d\xc4\xc4"
  1593. "\xa1\xfb\xa9\xdc\xd9\xed\x83\xe6\x39\xae\xfa\x1b\x87\x63\x1c\x33\xd1\xa8"
  1594. "\x2c\xb0\xc0\x03\x56\x76\xdd\xfe\xb0\xfe\x79\x84\xd7\x51\x9b\x0f\x83\x9d"
  1595. "\x49\x7f\xc9\xd6\x4e\xf1\x4d\x1d\xe2\x22\x20\xff\x26\x23\xdf\x49\x50\x13"
  1596. "\x4b\x9f\xb7\x34\xa5\x2a\xda\xd9\x5f\x13\x1c\xce\x36\x72\xa9\xd7\xd7\xb4"
  1597. "\x00\xd2\xc6\x28\x10\xb5\xf2\x03\x51\x63\x93\x30\x94\x81\x07\xbf\x8d\x45"
  1598. "\x34\xa0\x3a\xc3\x89\x45\x5c\x54\xd8\xeb\x4d\x60\x9b\x3e\x85\x8b\x72\x13"
  1599. "\xb3\x8e\xb0\x1f\x0e\xea\xba\x37\x39\xae\x92\x79\x16\xe2\x8d\xa6\xa7\x9a"
  1600. "\x3f\xd5\xe3\x2d\x30\xab\x30\xbf\x95\x9d\x45\x96\xe5\xff\xbf\xf6\x78\x9a"
  1601. "\x65\x0b\x9e\x7d\x24\x8d\x1b\xa8\x68\x01\x23\x36\xa4\xf3\xef\x8f\xab\x07"
  1602. "\xa8\xf5\xb8\x1b\xb0\xbc\x45\xb2\x17\x45\x38\x31\x5c\xa1\x2b\x7c\x72\x3b"
  1603. "\x21\x57\x56\x25\x64\xa8\xa1\xf1\x9d\x28\x17\x9f\x8c\x56\x54\x48\xe0\xe9"
  1604. "\x21\xb8\xc3\xe6\xfc\x4a\xda\xaf\xa8\xb9\x29\xad\x07\x7f\x63\x33\x25\xb6"
  1605. "\xa6\xf7\x1a\x58\x6c\xab\xc4\x88\x3e\x03\xe1\x93\x15\xf9\x46\xb2\x77\x85"
  1606. "\x85\x93\xa7\x36\x7e\x23\x22\x02\xfe\x9a\xd6\x56\xc6\x76\x8a\x15\x17\xda"
  1607. "\x7f\x04\x98\xb4\x8c\xb0\x78\xe9\x29\xfb\x11\xdb\x0c\xc5\x51\xf7\x54\xbf"
  1608. "\xfc\x48\x59\xdd\x89\xa3\x96\x91\x5c\xc8\x09\xb0\x7d\x44\x85\x73\x09\x84"
  1609. "\x09\xea\x21\x37\x10\x56\xf6\x7e\xf4\x11\x4e\xc1\x05\x47\xf4\x98\xd2\x45"
  1610. "\x13\xfe\x59\x43\x08\xbf\x02\x28\x68\xad\x21\xe8\x5b\xba\x81\x19\x42\xfd"
  1611. "\xc4\x51\x61\xa1\xa8\xa7\xfe\x00\xd5\xc6\xb0\x5e\xd7\x95\x4f\x63\x1b\xbd"
  1612. "\x12\xa5\xc9\xa5\xcf\xa5\x96\x5e\x05\x95\xde\x60\x8b\x04\xeb\xe0\x2b\x3f"
  1613. "\xcb\xf3\xb9\xf5\x78\x07\xa1\xa7\xad\x85\x28\x99\x2e\x2e\xc6\x59\x49\xda"
  1614. "\x2f\x4a\x04\x78\xdf\xd3\xae\x52\x63\x9c\x15\xd8\xae\xaa\x35\x1d\xa6\xd3"
  1615. "\x93\xb5\x8c\x77\x21\x68\xfa\xe6\x04\xd0\x97\xfe\xf4\xd6\xb9\x36\x0e\xb1"
  1616. "\x69\xa0\xb0\xee\x70\xcd\xc2\x24\x35\xa0\x03\xe6\x86\x98\xf6\x1b\x3b\x63"
  1617. "\xb1\xf5\x10\x11\xbc\x8f\x4e\xf9\x44\xc1\xde\x82\x17\x85\xf6\x70\x12\x4a"
  1618. "\x1c\x6e\xd1\x83\x35\xd6\x34\x12",
  1619. 512);
  1620. syscall(__NR_write, /*fd=*/r[19], /*buf=*/0x200000000600ul,
  1621. /*count=*/0x200ul);
  1622. memcpy((void*)0x200000001240, "iso9660\000", 8);
  1623. memcpy((void*)0x200000001280, "./file0\000", 8);
  1624. *(uint8_t*)0x200000000740 = 0;
  1625. memcpy(
  1626. (void*)0x2000000047c0,
  1627. "\x78\x9c\xec\xdd\x6b\x70\xdc\x57\x7d\xf0\xf1\xdf\x7f\x7d\x53\x1c\x08\x0e"
  1628. "\x21\x17\x12\xf3\xb0\x71\x12\x48\x42\xe2\x48\x72\x62\xc7\x24\x5c\x14\x69"
  1629. "\x65\x6f\x22\x69\x85\x56\x0a\x31\xb7\xe0\xc4\xb2\x11\x91\xed\x60\x87\x40"
  1630. "\xcc\x25\x09\x97\x00\xcf\xc3\xe5\x01\x9e\xa7\xf7\x0b\xb4\x85\xba\xb4\x25"
  1631. "\xa5\x14\x5a\x66\x3a\x9d\xe9\xbb\xb6\x2f\xfa\x02\x3a\xc3\x8b\xbe\x6e\x3a"
  1632. "\xd3\x19\x06\xd3\x0b\xbd\x70\x49\xe7\xec\x1e\xc9\x8a\x13\x5b\x4e\x6c\x59"
  1633. "\xae\xcf\xe7\xe3\x81\x5d\x4b\x67\xf7\x7f\xfe\xc2\xe8\xbb\x67\xb5\xda\x13"
  1634. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1635. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x54\x83\x43\xbd"
  1636. "\xbd\x7d\x55\x8c\x34\xc7\xa6\xee\xa9\x1f\xdf\xe0\xd0\x44\x6b\xf4\x04\x9f"
  1637. "\x9f\xbb\xbf\xef\x54\x9d\x7b\xfd\xce\xa2\xc7\x8d\xa8\xd2\x7f\xa2\xa7\x27"
  1638. "\x2e\xeb\x7e\xe8\xb2\x17\x57\xf3\x9f\x7d\x49\xfa\xef\x0d\x71\x71\xf7\xde"
  1639. "\x2e\x8e\x9e\x74\xd9\x13\x87\xce\xbf\x64\xdd\x6d\x17\xad\xac\xcd\xdd\xfe"
  1640. "\x04\x13\x3a\x23\x0e\x3e\x72\xe8\x81\x9d\xb3\xb3\xd3\x07\x96\x7b\x22\xcb"
  1641. "\x64\x5b\x63\xac\xd9\x6e\x35\x47\x07\xb6\x35\xea\xcd\x76\xab\xbe\x75\xf3"
  1642. "\xe6\xde\x9b\xb6\x0f\xb7\xeb\xc3\xcd\x91\x46\x7b\x47\x7b\xb2\x31\x5a\x1f"
  1643. "\x9c\x68\x0c\x4c\xb6\x26\xea\xd7\x0e\x5e\x57\xef\xdb\xba\x75\x53\xbd\xb1"
  1644. "\x71\x47\x6b\x6a\x6c\xdb\xd0\xc0\x48\x63\xee\x83\x5b\x6e\xec\xef\xed\xdd"
  1645. "\x5c\xbf\x73\xe3\x78\x63\x60\xa2\xdd\x1a\xbb\xe9\xce\x8d\xed\xc1\xed\xcd"
  1646. "\x91\x91\xe6\xd8\xb6\xce\x98\xf4\xe9\x34\x66\x4b\xfa\x87\x78\x57\x73\xb2"
  1647. "\x3e\xd9\x18\x18\xad\xd7\x77\xcf\xcc\x4e\x6f\x5a\x6c\x92\x69\x50\xdf\xc9"
  1648. "\x0c\xea\x5f\x6c\x50\x7f\x6f\x7f\x7f\x5f\x5f\x7f\x7f\xdf\xe6\x5b\xb6\xde"
  1649. "\xb2\xa5\xb7\x77\xe5\xb3\x3e\xd0\x7b\x8c\x78\xd6\x88\xe5\xff\x47\xcb\xf2"
  1650. "\x5a\x92\xef\xe3\xf0\x42\xd4\x72\xff\x63\x24\x9a\x31\x16\x53\x71\x4f\xd4"
  1651. "\x9f\xf3\xcf\x60\x0c\xc5\x44\xb4\x62\xf4\x38\x9f\xcf\xe6\xfa\x7f\x4d\x75"
  1652. "\xe2\xe3\x2e\xec\xff\xfa\xee\x87\xd6\x5f\x78\xb4\xff\x17\x45\xa7\xff\x97"
  1653. "\x76\xef\xed\xd2\xe3\xf5\xff\x38\x73\x39\x73\x7f\x0e\xc6\x23\x71\x28\x1e"
  1654. "\x88\x9d\x31\x1b\xb3\x31\x1d\x07\x96\x7d\x46\x67\xf6\xcf\xb6\x68\xc4\x58"
  1655. "\x34\xa3\x1d\xad\x68\xc6\x68\x0c\x74\x3e\x52\xcf\x1f\xa9\xc7\xd6\xd8\x1c"
  1656. "\x9b\xa3\x37\xee\x8d\xed\x31\x1c\xed\xa8\xc7\x70\x34\x63\x24\x1a\xd1\x8e"
  1657. "\x1d\xd1\x8e\xc9\x68\x74\xfe\x45\x0d\xc6\x44\x34\x62\x20\x26\xa3\x15\x13"
  1658. "\x51\x8f\x6b\x63\x30\xae\x8b\x7a\xf4\xc5\xd6\xd8\x1a\x9b\xa2\x1e\x8d\xd8"
  1659. "\x18\x3b\xa2\x15\x53\x31\x16\xdb\x62\x28\x06\x3a\xf7\xb2\x3b\x66\x3a\x5f"
  1660. "\xf7\x4d\x27\x98\xe3\xfc\xa0\xbe\x93\x19\xd4\x7f\x82\x41\xdd\x98\xaf\xc8"
  1661. "\xff\x48\xf5\x9f\x17\x62\x09\xbe\x8b\xc3\x0b\xf3\xf4\x5c\xff\x01\x80\x72"
  1662. "\xdc\xd1\x18\xd0\x7f\x00\x28\xcc\x58\x7b\xa2\xb7\x5f\xff\x01\xa0\x28\x93"
  1663. "\xd6\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1664. "\x00\x00\x00\x00\x00\x70\xba\x55\x51\x8b\xde\x88\xf8\xd6\x9e\x23\xd5\xc2"
  1665. "\x9d\x29\x7b\x3a\x1b\xfe\x1f\xf7\x66\xab\xab\xce\x2d\x6b\x51\x75\xf7\xf2"
  1666. "\x8d\x9e\xcd\x9b\xb6\x0c\x0e\xf7\x0d\x0f\xf5\xf6\xf6\xf6\xf6\x6d\x19\xec"
  1667. "\x3b\x23\xb3\x9f\x77\x61\xb4\xda\x93\x03\xf5\xc1\xfd\x7b\x1f\x3c\x30\x7d"
  1668. "\xf0\xe0\xf4\xae\xfa\xd4\xbe\x99\xfb\xf7\xef\x9a\x3e\xe9\x7b\x38\xd5\xdb"
  1669. "\x3f\x4f\xb7\xaf\x7b\x6a\xcd\xf9\x97\xac\xbb\x6d\x6b\xfa\xcb\xf5\x7b\xa6"
  1670. "\xf7\xcd\x1c\xdc\x3f\xb3\x77\xe7\x9e\x25\x3b\x20\x00\x2c\xb0\x32\x6a\xf1"
  1671. "\x54\x44\xbc\xf2\xc9\x23\xd5\x95\xb9\xe5\x71\xfd\xd4\xd0\x70\x7d\xe4\xee"
  1672. "\x7a\x73\xdf\xee\xfd\x0b\xc6\xd6\xe6\xb6\x09\x38\xc5\x56\x2e\xf2\xd8\x62"
  1673. "\xa9\xad\x3e\xa3\x47\xd3\x76\x00\xce\x42\xab\xa2\x16\xf7\x45\xc4\xe1\x2f"
  1674. "\x1d\xa9\x36\xa4\xc6\xe7\xc7\x00\xb5\xd7\x74\x36\x06\x5c\xee\xe9\x1d\x57"
  1675. "\xe7\x79\x87\x2a\x22\xcd\x59\x63\x01\xe0\xf9\x59\x1d\xb5\x68\x45\xc4\xae"
  1676. "\x0b\xbf\x5e\x5d\x15\x11\x2b\xe2\x1c\x58\xdf\xf7\xa4\xc7\x04\x9d\x93\x98"
  1677. "\x1a\x1a\xee\x9c\xc8\xec\xcc\xce\x7d\x0f\x45\xe7\x39\x8c\x15\xdd\x51\xeb"
  1678. "\x8e\xbd\xd1\xdc\x73\x1f\x67\xf9\x63\x89\x75\x11\x6f\x4c\x73\x5d\x6d\xcf"
  1679. "\x46\x00\x5e\xb8\x35\x51\x8b\x6f\x44\xc4\xde\x97\xf4\xc4\xd5\x9d\x9f\x07"
  1680. "\x00\x00\xe7\xba\x9e\xa8\x45\xf7\x75\x7f\x47\xaa\x6b\x96\x7b\x32\x00\x00"
  1681. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1682. "\x00\x70\x8e\xa8\xa2\x16\x9f\x8b\x88\x43\x3f\x3a\x52\xf5\x2e\xf8\xf8\xa9"
  1683. "\xed\xff\x7f\x6b\xdf\xcd\x67\x64\xf6\xf3\xec\xff\x0f\x00\xcf\xc3\xca\xa8"
  1684. "\xc5\x8f\xf3\xfe\xff\x7d\xf6\xff\x3f\xfd\xb4\x1d\x80\xb3\xd0\xaa\xa8\xc5"
  1685. "\x81\xbc\xff\x7f\xbf\xfd\xff\x01\xa0\x08\xab\xa3\x16\xf7\xe6\xfd\xff\x37"
  1686. "\xd9\xff\xff\xec\x7f\x2c\x61\xff\x7f\x00\x4e\x83\x35\x51\x8b\xbf\xcc\xfb"
  1687. "\xff\xdf\x6c\xff\x7f\x00\x28\x42\x4f\xd4\xa2\xfb\xba\xbf\x23\xd5\x2d\xcb"
  1688. "\x3d\x19\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1689. "\x00\x00\x00\x00\x00\x38\x47\x9c\x17\xb5\xf8\xc7\x88\xf8\xf3\x77\x3f\xdc"
  1690. "\xd9\x57\x66\xe1\xbe\xf4\x0b\x77\x98\x79\xf1\x22\xdb\xcd\xa4\x4f\x6f\xcc"
  1691. "\xd7\x4f\x66\x4f\xbe\xd5\x79\xaf\xc1\x5a\x95\xfe\x9c\xc6\x13\x02\x00\x16"
  1692. "\xd5\x13\xb5\xb8\xbd\x73\xed\x48\x35\xb0\xdc\x93\x01\x00\x00\x00\x00\x00"
  1693. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1694. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1695. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1696. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1697. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1698. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1699. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1700. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1701. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1702. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1703. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1704. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1705. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1706. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1707. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1708. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1709. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1710. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1711. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1712. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1713. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xce\x6a\xb5\xa8\xc5"
  1714. "\xdf\x46\x44\xf5\xfd\x23\x55\x54\x11\xf1\x58\x44\x3d\xba\x97\xbd\xcb\x3d"
  1715. "\x39\x00\x60\x69\x54\xb5\xf8\x87\x88\x78\xc5\xdf\x1d\x49\xf5\x8f\xdb\xd7"
  1716. "\x3d\xb5\xe6\xfc\x4b\xd6\xdd\xb6\x35\x22\x56\xc4\x8a\xce\x43\x82\x6a\xe1"
  1717. "\xf8\x56\x7b\x72\xa0\x3e\xb8\x7f\xef\x83\x07\xa6\x0f\x1e\x9c\xde\x55\x9f"
  1718. "\xda\x37\x73\xff\xfe\x5d\xd3\x27\x7b\xb8\x9e\xc1\xa1\x89\xd6\xe8\x52\x9c"
  1719. "\xc8\x49\x59\xbd\xc4\xf3\x5f\x7d\xca\x33\xec\x49\x8f\xc9\x16\xb8\xbe\x33"
  1720. "\xe1\xa9\xa1\xe1\xce\xa4\x67\x67\x76\xee\x7b\x28\x7d\xb8\x56\xad\x38\xe5"
  1721. "\x43\x01\x50\xae\x9e\xa8\xc5\x4f\x3b\xd7\x8e\x54\xd5\x72\x4f\x06\x00\x38"
  1722. "\x23\x56\x55\xb5\xf8\xfb\x88\xf8\xa7\x37\x1c\x9e\x5f\x77\xae\xec\xae\xf9"
  1723. "\x57\x76\xff\xd6\x3b\xbf\x1c\xfd\xca\xcb\x8e\xae\x4d\x7b\xf2\x83\x85\xb9"
  1724. "\xc7\x0c\x73\xcf\x1b\x5c\x74\x82\xeb\xcf\xf9\xf8\xe2\xfa\x3d\xd3\xfb\x66"
  1725. "\x0e\xee\x9f\xd9\xbb\x73\xcf\x62\x8b\xf0\x9e\x7c\x5c\x2b\x5f\x00\x38\x35"
  1726. "\x55\x55\x8b\xbf\x8a\x88\x6d\xf7\x5d\xd6\xe9\x6a\x15\x6b\x9f\xfd\x1c\x74"
  1727. "\x1e\xf7\xc3\x88\xd8\xf2\xf9\x7a\x1e\x17\x6b\xd3\xb8\xb9\x27\xbc\xd7\x74"
  1728. "\xe2\xde\xb3\x7b\x66\x76\x7a\xe3\xfd\xfb\x67\x77\xa5\xf1\x5f\x88\x88\xbf"
  1729. "\xfe\xea\xfa\x3c\xbe\xb6\x3a\x8d\xcf\x0f\x2a\x62\xd5\xd1\xf1\xbd\x69\xec"
  1730. "\x93\x11\xf1\xfd\x6f\xcd\x8d\x8d\xce\xd8\x35\x79\x6c\xcf\xd1\xb1\x7d\x69"
  1731. "\xec\x96\x88\xd8\xf9\xcd\x67\x8e\xed\xc9\x63\xcf\x3b\x3a\xb6\x3f\x8d\xdd"
  1732. "\x10\x11\xb3\x5f\x7c\xe6\xd8\xf3\xf2\xd8\xb5\x47\xc7\x6e\x5a\xda\xaf\x32"
  1733. "\x00\x9c\x5d\xd2\xfa\xff\xb5\x11\xb1\xa9\x7d\x78\xbe\xcd\x27\x5a\xff\xcf"
  1734. "\xad\xe1\x1f\xcb\x97\x4b\xbd\xfe\x5f\xb5\xe0\x46\x3d\xf9\xb8\xab\x4e\xc3"
  1735. "\x79\x03\x40\xc9\xd2\x1a\xf9\x6f\xf2\xfa\x7f\xd5\x22\xeb\xff\xef\x46\xc4"
  1736. "\x93\x3f\x5f\x9f\xc7\x75\xd7\xd2\x6b\xf3\xe7\xcf\x3f\x66\x3d\xbf\x2f\x22"
  1737. "\x1e\xfe\xde\x33\xc7\x9e\x9f\xc7\xbe\x68\xc1\x7a\xfe\x8c\x9e\x2c\x00\xd0"
  1738. "\x91\xd6\xff\x4f\x44\xc4\xf7\x7e\x76\x78\xfe\xb9\xfc\xbc\xfe\xcf\xcb\xec"
  1739. "\xa3\xeb\xff\x8f\xad\x3b\xba\x86\xdf\x95\x2f\x97\x7a\xfd\xbf\xe6\x98\xf5"
  1740. "\x7f\x3a\xee\xcb\x4f\xc3\x79\x03\x40\xc9\x52\xff\x7f\x12\x11\xdf\x3d\x70"
  1741. "\x78\xfe\xe7\xed\x27\xd3\xff\xb9\x75\xff\x52\xf7\xbf\xe7\x98\xfe\xa7\xe3"
  1742. "\x5e\x7e\x1a\xce\x1b\x00\x4a\x96\xfa\xff\x54\x44\x7c\xf3\x03\x87\xe7\x5f"
  1743. "\x43\x77\x4c\xff\x1f\x9f\x1b\xbb\xb0\xff\xd7\x5e\x95\x6f\x9f\xff\xbe\x54"
  1744. "\xfd\x3f\xef\x98\xfe\xa7\xe3\x5e\x71\x3a\x4e\x1c\x00\x0a\x96\xfa\xff\xf9"
  1745. "\x88\xf8\xf6\x86\xc3\xf3\xaf\x8b\x3f\x99\xf5\xff\x99\xea\xff\x5a\xfd\x07"
  1746. "\x80\xd3\x2e\xf5\xff\xd6\x88\xf8\xec\x91\xc3\xf3\xcf\xe9\x9f\x4c\xff\x2f"
  1747. "\xcf\xbf\x1d\xb0\xd4\xcf\xff\x9f\x7f\x4c\xff\xd3\x71\xeb\xa7\xe3\xc4\x01"
  1748. "\xa0\x60\xab\xf2\xeb\xff\xfb\x9e\xfa\xd2\xfc\xeb\xf3\x4f\xa6\xff\xc7\x5a"
  1749. "\xaa\xfe\xbf\xc8\x9b\x12\x02\xc0\x69\x57\xc5\xc5\x55\xb7\xcc\xab\xe2\x92"
  1750. "\xce\xb5\xe1\xe6\x48\xc3\xce\x3f\x00\x00\x00\x70\x2e\xe9\xec\xef\x77\xf1"
  1751. "\xdc\xd3\xfd\xd5\x25\x51\x59\xff\x03\x00\x00\xc0\xb9\xa6\x8a\x4b\xf3\xcf"
  1752. "\xff\xd7\xc6\x65\xdd\x6b\xbb\x63\x26\x66\x63\x3a\x3c\x09\x00\x00\x00\x00"
  1753. "\xe7\x88\xce\xcf\xff\x2f\xed\x6e\xe7\x1b\x51\x5d\x16\x95\xf5\x3f\x00\x00"
  1754. "\x00\x9c\x6b\x3e\xd9\xf9\xfd\xff\xce\xef\x00\x74\xde\xfe\xbf\x27\x0e\x75"
  1755. "\xde\xae\x67\x65\xad\xf3\xdc\x40\x55\x45\x7b\x7c\x4d\xf5\x17\x3f\x8c\x89"
  1756. "\x89\x55\xd5\xe3\xe3\xf7\x5c\x5d\xed\x1d\x48\xe3\x06\xf6\xae\xe8\xde\xc1"
  1757. "\x8a\x63\xef\x71\x72\xf8\xf2\xea\x82\x7c\x27\x9d\x8b\xcd\x2b\xf3\xdf\x06"
  1758. "\x1b\xeb\xab\x97\x77\x8f\x36\xbf\x85\xdf\x0f\xf2\xc5\xee\xc5\xe6\x51\x9d"
  1759. "\x86\x09\xc4\xa7\xe3\xf2\xee\x51\x2e\xcf\xfb\x17\xee\x9a\xfb\x4c\xf7\x28"
  1760. "\x6b\x87\x9b\x23\x8d\x8d\x83\xad\x91\xdb\xfa\x62\x60\xe0\x82\xda\x64\xe3"
  1761. "\x9e\xc9\xf7\xee\x9b\x79\x7f\x74\x4e\xff\x53\x63\xa3\x17\x54\xb1\x7b\x66"
  1762. "\x76\x7a\xe3\xfd\xfb\x67\x77\x75\xe6\xd2\xd9\x1c\xe1\xf1\xbd\xf9\x5d\x8a"
  1763. "\xba\x17\x4f\x3f\x7d\x32\x73\x79\xa8\xf3\x7e\x0b\x9d\xdf\xb9\x78\xce\x33"
  1764. "\x5e\xd5\xf9\x45\x8c\x7c\xdc\xb5\xdd\xe3\xf6\x2e\x3c\xff\xfc\xbe\x4c\xc7"
  1765. "\xee\xd4\x7c\xa2\x63\x3e\x11\x57\x74\x8f\x79\x45\x7e\xaf\xc7\xb5\xcf\x3c"
  1766. "\xff\x9e\x74\xcc\xbe\x8d\xc7\x3b\xfb\x3c\x8b\xbe\xe3\x9e\xf9\xc9\xce\x62"
  1767. "\x7d\x77\x16\xeb\xbb\xef\x22\x7d\xd5\xb5\xcf\x31\x8b\xfe\xc5\x66\xd1\xbf"
  1768. "\x70\x16\x2f\xe8\x6b\x71\x12\xb3\xd8\xb4\xd8\x2c\x36\x9d\xe2\x2c\x00\x96"
  1769. "\xcb\xee\x45\x2a\x54\x3d\x3b\xfc\x2f\xe0\xbb\xdc\x99\xa9\xfb\x13\x71\x65"
  1770. "\xf7\x28\x57\x76\xdf\x9d\x78\xe5\xe5\xcf\xf1\x1d\xbd\x77\xb1\xef\xe8\xbd"
  1771. "\xa7\x58\xb7\xaf\xc5\x86\xee\x2c\x36\xcc\x0d\x3e\x5e\x63\xd3\x71\x3f\x73"
  1772. "\x4c\x55\xbf\x9c\x6e\xf0\xe5\xe3\x1e\xb7\x3d\xd2\x5f\xa5\x2f\xe1\x8a\x87"
  1773. "\xf6\x3e\x18\x97\x1c\x7c\xe4\xd0\x8d\x9d\x37\x4e\xdc\x33\xbd\xaf\xbf\x7f"
  1774. "\xd3\xe6\xde\x9b\x7b\x7b\x6f\xe9\x8f\x55\x9d\xd3\xc8\x17\xda\x03\xc0\x73"
  1775. "\xd8\xd0\x79\xfd\x7f\xe7\x35\x00\xc7\xe9\xff\xa2\x23\xaa\x9b\x17\x59\x55"
  1776. "\xbf\x74\xfe\x25\x05\x1b\xe3\xfe\xd8\x1f\xb3\xb1\x2b\x6e\xe8\xfc\xb6\x41"
  1777. "\xe7\x15\x07\xcf\x79\xaf\x6b\x17\xbc\x0c\xe1\x86\x45\x56\xad\x47\xc7\xf6"
  1778. "\xc5\x0d\x8b\xac\xea\x8e\x8e\xed\x7f\x1e\x63\x37\x9d\xf1\xff\x5d\x00\x60"
  1779. "\x29\x6d\x58\xa4\xc3\x27\xd3\xff\x1b\x16\x59\x77\x3f\xb3\xe5\x27\x5e\x1d"
  1780. "\x2f\x6c\x39\x00\xb0\x34\x1a\x13\x3f\xa8\xd6\x4e\x7e\xa2\x9a\x98\x68\x8e"
  1781. "\xdf\xdb\xb7\x75\x6b\xdf\xc0\xe4\xf6\x46\x7d\xa2\x35\x78\x57\x7d\xa2\x39"
  1782. "\xb4\xad\x51\x6f\x8e\x4d\x36\x26\x06\xb7\x0f\x8c\x6d\x6b\xd4\xc7\x27\x5a"
  1783. "\x93\xad\xc1\xd6\x48\xba\x72\x77\x73\xa8\xd1\xae\xb7\xa7\xc6\xc7\x5b\x13"
  1784. "\x93\xf5\xe1\xd6\x44\x7d\xbc\xd5\x6e\xde\x53\x1f\x6e\x8e\x34\xea\xed\x1d"
  1785. "\xed\xc9\xc6\x68\xbd\xdd\x18\x1d\x18\x9b\x6c\x3e\xda\x1e\x1f\x69\x0c\xb4"
  1786. "\x1b\xf5\xc1\xd6\xd8\xe4\xc0\xe0\x64\x7d\xa8\xd9\x1e\xac\x8f\x4f\xdd\x31"
  1787. "\xd2\x6c\x6f\x6f\x4c\x74\x6e\xdc\x1e\x6f\x0c\x36\x87\x9b\x83\x03\x93\xcd"
  1788. "\xd6\x58\xbd\xdd\x9a\x9a\x18\x6c\x6c\xac\xd7\xdb\x8d\xc6\x82\x81\xcd\xa1"
  1789. "\xc6\xd8\x64\x73\xb8\x99\xae\x8e\xd5\xc7\x27\x9a\xa3\x03\x13\x3b\xea\x77"
  1790. "\xb7\x46\xa6\x46\x1b\xf5\xa1\x46\x7b\x70\xa2\x39\x3e\xd9\xea\xde\xe1\xdc"
  1791. "\xb1\x9a\x63\xc3\xad\x89\xd1\xce\xdd\x6e\x5c\xee\x2f\x36\x00\x9c\x25\x0e"
  1792. "\x3e\x72\xe8\x81\x9d\xb3\xb3\xd3\x07\x96\xf0\xca\x72\x9f\x23\x00\xf0\x4c"
  1793. "\x8b\x54\x7a\xf5\x19\x9f\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1794. "\xf0\x2c\x67\xe2\xf7\xff\x5c\x71\xe5\x7f\xde\x95\xa7\x9f\x7e\xfa\xd1\xf4"
  1795. "\xff\x90\xb3\x65\x3e\x67\xfa\xca\x72\x7f\x67\x02\x96\x5a\x2d\x6a\x71\x24"
  1796. "\x22\xaa\xef\x1f\xa9\x3a\xef\xcc\xf7\x58\x44\x3d\xba\x97\x36\x00\x06\x80"
  1797. "\x73\x53\xea\xff\x8f\x72\xff\xaf\xd2\x7f\x00\x28\x42\xea\xff\x3f\xe7\xfe"
  1798. "\x5f\xad\xff\x00\x50\x84\xd4\xff\x7f\xc9\xfd\xbf\x46\xff\x01\xa0\x08\xa9"
  1799. "\xff\xff\x9a\xfb\xff\x2a\xfd\x07\x80\x22\xa4\xfe\xff\x5b\xee\xff\xab\xf5"
  1800. "\x1f\x00\x8a\x90\xfa\xff\xe3\xdc\xff\x6b\xf5\x1f\x00\x8a\x90\xfa\xff\xef"
  1801. "\xb9\xff\xd7\xe9\x3f\x00\x14\x21\xf5\xff\x3f\x72\xff\xaf\xd7\x7f\x00\x28"
  1802. "\x42\xea\xff\x7f\xe6\xfe\xbf\x46\xff\x01\xa0\x08\xa9\xff\xff\x95\xfb\x7f"
  1803. "\x83\xfe\x03\x40\x11\x52\xff\x7f\x92\xfb\x7f\xa3\xfe\x03\x40\x11\x52\xff"
  1804. "\x7f\x9a\xfb\xbf\x51\xff\x01\xa0\x08\xa9\xff\x3f\xcb\xfd\xbf\x49\xff\x01"
  1805. "\xa0\x08\xa9\xff\x3f\xcf\xfd\xef\xd5\x7f\x00\x28\x42\xea\xff\xd3\xb9\xff"
  1806. "\x7d\xfa\x0f\x00\x45\x48\xfd\x8f\xdc\xff\x7e\xfd\x07\x80\x22\xa4\xfe\x57"
  1807. "\xb9\xff\x9b\xf4\x1f\x00\x8a\x50\xcb\xcf\x00\xa4\xfe\xdf\xac\xff\x00\x50"
  1808. "\x84\x54\xff\x15\xb9\xff\xb7\xe8\x3f\x00\x14\x21\xf5\x7f\x65\xee\xff\x66"
  1809. "\xfd\x07\x80\x22\xa4\xfe\xaf\xca\xfd\xdf\xa2\xff\x00\x50\x84\xd4\xff\xd5"
  1810. "\xb9\xff\xb7\xea\x3f\x00\x14\x21\xf5\x7f\x4d\xee\xff\x56\xfd\x07\x80\x22"
  1811. "\xa4\xfe\xf7\xe4\xfe\xbf\x56\xff\x01\xa0\x08\xa9\xff\xe7\xe5\xfe\xdf\xa6"
  1812. "\xff\x00\x50\x84\xd4\xff\xb5\xb9\xff\xb7\xeb\x3f\x00\x14\x21\xf5\xff\xfc"
  1813. "\xdc\xff\xd7\xe9\x3f\x00\x14\x21\xf5\xff\x45\xb9\xff\xaf\xd7\x7f\x00\x28"
  1814. "\x42\xea\xff\x8b\x73\xff\xdf\xa0\xff\x00\x50\x84\xd4\xff\x0b\x72\xff\xdf"
  1815. "\xa8\xff\x00\x50\x84\xd4\xff\x97\xe4\xfe\x0f\xe8\x3f\x00\x14\x21\xf5\x7f"
  1816. "\x5d\xee\xff\x1d\xfa\x0f\x00\x45\x48\xfd\xbf\x30\xf7\x7f\x50\xff\x01\xa0"
  1817. "\x08\xa9\xff\x2f\xcd\xfd\x1f\xd2\x7f\x00\x28\x42\xea\xff\x45\xb9\xff\x0d"
  1818. "\xfd\x07\x80\x22\xa4\xfe\xbf\x2c\xf7\x7f\x58\xff\x01\xa0\x08\xa9\xff\x17"
  1819. "\xe7\xfe\x6f\xd3\x7f\x00\x28\x42\xea\xff\x25\xb9\xff\xdb\xf5\x1f\x00\x8a"
  1820. "\x90\xfa\x7f\x69\xee\x7f\x53\xff\x01\xa0\x08\xa9\xff\x97\xe5\xfe\xdf\xa9"
  1821. "\xff\x00\x50\x84\xd4\xff\x97\xe7\xfe\xdf\xa5\xff\x00\x50\x84\xd4\xff\xcb"
  1822. "\x73\xff\x47\xf4\x1f\x00\x8a\x90\xfa\x7f\x45\xee\xff\xa8\xfe\x03\x40\x11"
  1823. "\x52\xff\xd7\xe7\xfe\x8f\xe9\x3f\x00\x14\x21\xf5\xff\x15\xb9\xff\x2d\xfd"
  1824. "\x07\x80\x22\xa4\xfe\xff\xaf\xdc\xff\x71\xfd\x07\x80\x22\xa4\xfe\xbf\x32"
  1825. "\xf7\xff\x4d\xfa\x0f\x00\x45\x48\xfd\xaf\xe7\xfe\x4f\xe8\x3f\x00\x14\x21"
  1826. "\xf5\xff\xca\xdc\xff\xb6\xfe\x03\x40\x11\x52\xff\x37\xe4\xfe\x4f\xea\x3f"
  1827. "\x00\x14\x21\xf5\xff\xaa\xdc\xff\x29\xfd\x07\x80\x22\xa4\xfe\x5f\x9d\xfb"
  1828. "\x7f\xb7\xfe\x03\x40\x11\x52\xff\xaf\xc9\xfd\x7f\xb3\xfe\x03\x40\x11\x52"
  1829. "\xff\x5f\x95\xfb\x7f\x8f\xfe\x03\x40\x11\x52\xff\x5f\x9d\xfb\xbf\x43\xff"
  1830. "\x01\xa0\x08\xa9\xff\xd7\xe6\xfe\xbf\x45\xff\x01\xa0\x08\xa9\xff\xd7\xe5"
  1831. "\xfe\xbf\x55\xff\x01\xa0\x08\xa9\xff\xd7\xe7\xfe\xbf\x4d\xff\x01\xa0\x08"
  1832. "\xa9\xff\xaf\xc9\xfd\x7f\xbb\xfe\x03\x40\x11\x52\xff\x6f\xc8\xfd\x7f\x87"
  1833. "\xfe\x03\x40\x11\x52\xff\x6f\xcc\xfd\xbf\x57\xff\x01\xa0\x08\xa9\xff\x1b"
  1834. "\x73\xff\xdf\xa9\xff\x00\x50\x84\xd4\xff\x9b\x72\xff\x77\xea\x3f\x00\x14"
  1835. "\x21\xf5\xbf\x37\xf7\xff\x3e\xfd\x07\x80\x22\xa4\xfe\xf7\xe5\xfe\xdf\xaf"
  1836. "\xff\x00\x50\x84\xd4\xff\xfe\xdc\xff\x5d\xfa\x0f\x00\x45\x48\xfd\xdf\x94"
  1837. "\xfb\x3f\xad\xff\x00\x50\x84\xd4\xff\x9b\x73\xff\x77\xeb\x3f\x00\x14\x21"
  1838. "\xf5\xff\x96\xdc\xff\x3d\xfa\x0f\x00\x45\x48\xfd\xdf\x1c\x11\xab\x22\xe2"
  1839. "\x5d\xfa\x0f\x00\x45\x48\xfd\xdf\x92\xd7\xff\x33\xfa\x0f\x00\x45\x48\xfd"
  1840. "\xbf\x35\xf7\xff\xdd\xfa\x0f\x00\x45\x48\xfd\xdf\x9a\xfb\xff\x80\xfe\x03"
  1841. "\x40\x11\x52\xff\x5f\x9b\xfb\x3f\xab\xff\x00\x50\x84\xd4\xff\xdb\x72\xff"
  1842. "\xf7\xea\x3f\x00\x14\x21\xf5\xff\xf6\xdc\xff\x7d\xfa\x0f\x00\x45\x48\xfd"
  1843. "\x7f\x5d\xee\xff\x7e\xfd\x07\x80\x22\xa4\xfe\xbf\x3e\xf7\xff\x41\xfd\x07"
  1844. "\x80\x22\xa4\xfe\xbf\x21\xf7\xff\x3d\xfa\x0f\x00\x45\x48\xfd\x7f\x63\xee"
  1845. "\xff\x01\xfd\x07\x80\x22\xa4\xfe\x0f\xe4\xfe\x1f\xd4\x7f\x00\x28\x42\xea"
  1846. "\xff\x1d\xb9\xff\x0f\xe9\x3f\x00\x14\x21\xf5\x7f\x30\xf7\xff\xbd\xfa\x0f"
  1847. "\x00\x45\x48\xfd\x1f\xca\xfd\x7f\x58\xff\x01\xa0\x08\xa9\xff\x8d\xdc\xff"
  1848. "\xf7\xe9\x3f\x00\x14\x21\xf5\x7f\x38\xf7\xff\xfd\xfa\x0f\x00\x45\x48\xfd"
  1849. "\xdf\x96\xfb\xff\x88\xfe\x03\x40\x11\x52\xff\xb7\xe7\xfe\x1f\xd2\x7f\x00"
  1850. "\x28\x42\xea\x7f\x33\xf7\xff\x03\xfa\x0f\x00\x45\x48\xfd\xbf\x33\xf7\xff"
  1851. "\x83\xfa\x0f\x00\x45\x48\xfd\xbf\x2b\xf7\xff\x43\xfa\x0f\x00\x45\x48\xfd"
  1852. "\x1f\xc9\xfd\xff\xb0\xfe\x03\x40\x11\x52\xff\x47\x73\xff\x1f\xd5\x7f\x00"
  1853. "\x28\x42\xea\xff\x58\xee\xff\x63\xfa\x0f\x00\x45\x48\xfd\x6f\xe5\xfe\x3f"
  1854. "\xae\xff\x00\x50\x84\xd4\xff\xf1\xdc\xff\x8f\xe8\x3f\x00\x14\x21\xf5\xff"
  1855. "\x4d\xb9\xff\x1f\xd5\x7f\x00\x28\x42\xea\xff\x44\xee\xff\xc7\xf4\x1f\x00"
  1856. "\x8a\x90\xfa\xdf\xce\xfd\xff\xb8\xfe\x03\x40\x11\x52\xff\x27\x73\xff\x9f"
  1857. "\xd0\x7f\x00\x28\x42\xea\xff\x54\xee\xff\x27\xf4\x1f\x00\x8a\x90\xfa\x7f"
  1858. "\x77\xee\xff\x27\xf5\x1f\x00\x8a\x90\xfa\xff\xe6\xdc\xff\x4f\xe9\x3f\x00"
  1859. "\x14\x21\xf5\xff\x9e\xdc\xff\xff\xad\xff\x00\x50\x84\xd4\xff\x1d\xb9\xff"
  1860. "\xff\x47\xff\x01\xa0\x08\xa9\xff\x6f\xc9\xfd\xff\xb4\xfe\x03\x40\x11\x52"
  1861. "\xff\xdf\x9a\xfb\xff\x19\xfd\x07\x80\x22\xa4\xfe\xbf\x2d\xf7\xff\xb3\xfa"
  1862. "\x0f\x00\x45\x48\xfd\x7f\x7b\xee\xff\xe7\xf4\x1f\x00\x8a\x90\xfa\xff\x8e"
  1863. "\xdc\xff\xff\xab\xff\x00\x50\x84\xd4\xff\x7b\x73\xff\x3f\xaf\xff\x00\x50"
  1864. "\x84\xd4\xff\x77\xe6\xfe\x7f\x41\xff\x01\xa0\x08\xa9\xff\x3b\x73\xff\xbf"
  1865. "\xa8\xff\x00\x50\x84\xd4\xff\xfb\x72\xff\xff\x9f\xfe\x03\x40\x11\x52\xff"
  1866. "\xef\xcf\xfd\xff\xff\xfa\x0f\x00\x45\x48\xfd\xdf\x95\xfb\xff\x0b\xfa\x0f"
  1867. "\x00\x45\x48\xfd\x9f\xce\xfd\xff\x45\xfd\x07\x80\x22\xa4\xfe\xef\xce\xfd"
  1868. "\xff\x25\xfd\x07\x80\x22\xa4\xfe\xef\xc9\xfd\xff\x65\xfd\x07\x80\x22\xa4"
  1869. "\xfe\xbf\x2b\xf7\xff\x57\xf4\x1f\x00\x8a\x90\xfa\x3f\x93\xfb\xff\xab\xfa"
  1870. "\x0f\x00\x45\x48\xfd\x7f\x77\xee\xff\xaf\xe9\x3f\x00\x14\x21\xf5\xff\x81"
  1871. "\xdc\xff\x5f\xd7\x7f\x00\x28\x42\xea\xff\x6c\xee\xff\x6f\xe8\x3f\x00\x14"
  1872. "\x21\xf5\x7f\x6f\xee\xff\x6f\xea\x3f\x00\x14\x21\xf5\x7f\x5f\xee\xff\x97"
  1873. "\xf4\x1f\x00\x8a\x90\xfa\xbf\x3f\xf7\xff\xcb\xfa\x0f\x00\x45\x48\xfd\x7f"
  1874. "\x30\xf7\xff\xb7\xf4\x1f\x00\x8a\x90\xfa\xff\x9e\xdc\xff\xdf\xd6\x7f\x00"
  1875. "\x28\x42\xea\xff\x81\xdc\xff\xdf\xd1\x7f\x00\x28\x42\xea\xff\xc1\xdc\xff"
  1876. "\xaf\xe8\x3f\x00\x14\x21\xf5\xff\xa1\xdc\xff\xaf\xea\x3f\x00\x14\x21\xf5"
  1877. "\xff\xbd\xb9\xff\xbf\xab\xff\x00\x50\x84\xd4\xff\x87\x73\xff\x0f\xeb\x3f"
  1878. "\x00\x14\x21\xf5\xff\x7d\xb9\xff\xbf\xa7\xff\x00\x50\x84\xd4\xff\xf7\xe7"
  1879. "\xfe\x7f\x4d\xff\x01\xa0\x08\xa9\xff\x8f\xe4\xfe\xff\xbe\xfe\x03\x40\x11"
  1880. "\x52\xff\x0f\xe5\xfe\xff\x81\xfe\x03\x40\x11\x52\xff\x3f\x90\xfb\xff\x87"
  1881. "\xfa\x0f\x00\x45\x48\xfd\xff\x60\xee\xff\xd7\xf5\x1f\x00\x8a\x90\xfa\xff"
  1882. "\xa1\xdc\xff\x27\xf5\x1f\x00\x8a\x90\xfa\xff\xe1\xdc\xff\x3f\xd2\x7f\x00"
  1883. "\x28\x42\xea\xff\xa3\xb9\xff\xdf\xd0\x7f\x00\x28\x42\xea\xff\x63\xb9\xff"
  1884. "\x7f\xac\xff\x00\x50\x84\xd4\xff\xc7\x73\xff\xbf\xa9\xff\x00\x50\x84\xd4"
  1885. "\xff\x8f\xe4\xfe\xff\x89\xfe\x03\x40\x11\x52\xff\x3f\x9a\xfb\xff\x2d\xfd"
  1886. "\x07\x80\x22\xa4\xfe\x7f\x2c\xf7\xff\xdb\xfa\x0f\x00\x45\x48\xfd\xff\x78"
  1887. "\xee\xff\x9f\xea\x3f\x00\x14\x21\xf5\xff\x89\xdc\xff\x3f\xd3\x7f\x00\x28"
  1888. "\xc2\x7f\x07\x00\x00\xff\xff\x81\x63\x0f\x16",
  1889. 4709);
  1890. syz_mount_image(/*fs=*/0x200000001240, /*dir=*/0x200000001280, /*flags=*/0,
  1891. /*opts=*/0x200000000740, /*chdir=*/1, /*size=*/0x1265,
  1892. /*img=*/0x2000000047c0);
  1893. memcpy((void*)0x200000000000, "/dev/rfkill\000", 12);
  1894. res = syscall(
  1895. __NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000000ul,
  1896. /*flags=O_TRUNC|O_CLOEXEC|O_APPEND|O_RDWR*/ 0x80602, /*mode=*/0);
  1897. if (res != -1)
  1898. r[20] = res;
  1899. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x10);
  1900. if (res != -1)
  1901. r[21] = res;
  1902. res = syscall(__NR_epoll_create1, /*flags=*/0ul);
  1903. if (res != -1)
  1904. r[22] = res;
  1905. syscall(__NR_epoll_pwait2, /*epfd=*/r[22], /*events=*/0x200000000000ul,
  1906. /*maxevents=*/1ul, /*timeout=*/0ul, /*sigmask=*/0ul, /*size=*/0ul);
  1907. *(uint32_t*)0x200000001100 = 0x20000016;
  1908. *(uint64_t*)0x200000001104 = 0;
  1909. syscall(__NR_epoll_ctl, /*epfd=*/r[22], /*op=*/1ul, /*fd=*/r[21],
  1910. /*ev=*/0x200000001100ul);
  1911. *(uint32_t*)0x200000000040 = 0;
  1912. *(uint8_t*)0x200000000044 = 6;
  1913. *(uint8_t*)0x200000000045 = 3;
  1914. *(uint8_t*)0x200000000046 = 0;
  1915. *(uint8_t*)0x200000000047 = 0;
  1916. syscall(__NR_write, /*fd=*/r[20], /*data=*/0x200000000040ul, /*len=*/8ul);
  1917. memcpy((void*)0x200000000080, "ext3\000", 5);
  1918. memcpy((void*)0x200000000480, "./file0\000", 8);
  1919. memcpy((void*)0x200000000900, "init_itable", 11);
  1920. *(uint8_t*)0x20000000090b = 0x2c;
  1921. memcpy((void*)0x20000000090c, "resgid", 6);
  1922. *(uint8_t*)0x200000000912 = 0x2c;
  1923. sprintf((char*)0x200000000913, "0x%016llx", (long long)0xee00);
  1924. *(uint8_t*)0x200000000925 = 0x2c;
  1925. memcpy((void*)0x200000000926, "bh", 2);
  1926. *(uint8_t*)0x200000000928 = 0x2c;
  1927. memcpy((void*)0x200000000929, "noload", 6);
  1928. *(uint8_t*)0x20000000092f = 0x2c;
  1929. memcpy((void*)0x200000000930, "errors=remount-ro", 17);
  1930. *(uint8_t*)0x200000000941 = 0x2c;
  1931. memcpy((void*)0x200000000942, "usrjquota=", 10);
  1932. *(uint8_t*)0x20000000094c = 0x2c;
  1933. *(uint8_t*)0x20000000094d = 0;
  1934. memcpy(
  1935. (void*)0x200000000980,
  1936. "\x78\x9c\xec\xdb\xcd\x6f\x14\x65\x18\x00\xf0\x67\x66\xbb\xe5\xdb\x56\xc4"
  1937. "\x0f\x10\xb4\x8a\x46\xe2\x47\x4b\xcb\x87\x1c\xbc\x68\x34\xf1\xa0\x89\x89"
  1938. "\x1e\x30\x9e\xea\xb6\x10\xa4\x50\x43\x6b\x22\xa4\x51\xf4\x80\x47\x43\xa2"
  1939. "\x67\xe3\xd1\x44\xff\x01\x4f\x7a\x31\xea\xc9\xc4\xab\xde\x0d\x09\x31\xbd"
  1940. "\x80\x9e\xd6\xcc\xce\x4c\x59\xda\xdd\x42\xe9\xb6\x5b\xd9\xdf\x2f\x99\xf6"
  1941. "\x7d\x77\xde\xcd\xfb\x3c\x33\xf3\xee\xbe\x33\xb3\x13\x40\xcf\x1a\xca\xfe"
  1942. "\x24\x11\xdb\x23\xe2\x8f\x88\x18\xc8\xab\x37\x37\x18\xca\xff\x5d\x9f\x9f"
  1943. "\xab\xfd\x33\x3f\x57\x4b\xa2\x5e\x7f\xf3\xef\xa4\xd1\xee\xda\xfc\x5c\xad"
  1944. "\x6c\x5a\xbe\x6f\x5b\x5e\xa9\xd7\x8b\xfa\xa6\x16\xfd\x5e\x7a\x27\x62\x7c"
  1945. "\x6a\x6a\xf2\x5c\x51\x1f\x99\x3d\xf3\xfe\xc8\xcc\xf9\x0b\xcf\x9d\x3a\x33"
  1946. "\x7e\x72\xf2\xe4\xe4\xd9\xb1\x63\xc7\x0e\x1f\xda\xd7\x7f\x74\xec\x48\x47"
  1947. "\xf2\xcc\xf2\xba\xb6\xe7\xa3\xe9\xbd\xbb\x5f\x7d\xfb\xf2\xeb\xb5\xe3\x97"
  1948. "\xdf\xfd\xe5\xdb\x2c\xde\xed\xc5\xfa\xe6\x3c\x3a\x65\x28\xdf\xba\x2d\x3d"
  1949. "\xd9\xe9\xce\xba\x6c\x47\x53\x39\xe9\xeb\x62\x20\xac\x48\x25\x22\xb2\xdd"
  1950. "\x55\x6d\x8c\xff\x81\xa8\xc4\x96\x85\x75\x03\xf1\xca\xa7\x5d\x0d\x0e\x58"
  1951. "\x53\xf5\x7a\xbd\xde\xea\xfb\xb9\x70\xb1\x0e\xdc\xb5\xb2\xb9\x5a\xb7\x63"
  1952. "\x00\xba\x23\xff\x9a\x2f\xcf\xdc\xe7\x6a\x6b\x71\x1e\xbc\x91\x5d\x7d\x31"
  1953. "\x3f\x01\xca\xf2\xbe\x5e\x2c\xf9\x9a\xbe\x48\x8b\x36\xd5\x45\xe7\xb7\x9d"
  1954. "\x34\x14\x11\xc7\x2f\xfe\xfb\x55\xb6\xc4\x1a\x5d\x87\x00\x00\x68\xf6\x43"
  1955. "\x36\xff\x79\x36\x9f\x77\x94\x4b\xbe\x26\x8d\x07\x9a\xda\xdd\x53\xdc\x43"
  1956. "\x19\x8c\x88\x7b\x23\x62\x67\x44\xdc\x17\x11\xbb\x22\xe2\xfe\x88\x46\xdb"
  1957. "\x07\x23\xe2\xa1\x15\xf6\xbf\xf8\x0e\xc9\xd2\xf9\x4f\x7a\xe5\x8e\x12\xbb"
  1958. "\x4d\xd9\xfc\xef\x85\xe2\xde\xd6\xcd\xf3\xbf\x72\xf6\x17\x83\x95\xa2\xb6"
  1959. "\xa3\x91\x7f\x35\x39\x71\x6a\x6a\xf2\x60\xb1\x4d\x0e\x44\x75\x53\x56\x1f"
  1960. "\x5d\xa6\x8f\x1f\x5f\xfe\xfd\xf3\x76\xeb\x9a\xe7\x7f\xd9\x72\xbd\x2f\x22"
  1961. "\xf2\xb9\xe0\x77\x45\x93\xc3\x5f\x2e\xba\x40\x37\x31\x3e\x3b\xbe\xca\xb4"
  1962. "\x17\x5c\xfd\x24\x62\x4f\x5f\xab\xfc\x93\x28\x6f\xe3\x64\x67\x07\xbb\x23"
  1963. "\x62\xcf\x1d\xf6\x71\xea\xe9\x6f\xf6\xb6\x5b\xb7\x24\xff\xf9\xb9\x5a\x39"
  1964. "\x17\xbe\xa5\x0e\xdc\x67\xaa\x7f\x1d\xf1\x54\xbe\xff\x2f\xc6\xa2\xfc\x4b"
  1965. "\x49\xdb\xfb\x93\xa3\xcf\x1f\x1d\x3b\x32\xb2\x39\xa6\x26\x0f\x8e\x94\x47"
  1966. "\xc5\x52\xbf\xfe\x76\xe9\x8d\x76\xfd\xaf\x2a\xff\x0e\xc8\xf6\xff\xd6\x96"
  1967. "\xc7\xff\x42\xfe\x83\xc9\xe6\x88\x99\xf3\x17\x4e\x37\xee\xd7\xce\xac\xbc"
  1968. "\x8f\x4b\x7f\x7e\xd6\xf6\x9c\xe6\xd6\xf9\xa7\x57\xfa\x5a\x1c\xff\xfd\xc9"
  1969. "\x5b\x8d\x72\x7f\xf1\xda\x87\xe3\xb3\xb3\xe7\x46\x23\xfa\x93\xd7\x96\xbe"
  1970. "\x3e\x76\xe3\xbd\x65\xbd\x6c\x9f\xe5\x7f\x60\x7f\xeb\xf1\xbf\x33\x6e\x6c"
  1971. "\x89\x87\x23\x22\x3b\x88\xf7\x45\xc4\x23\x11\xf1\x68\x11\xfb\x63\x11\xf1"
  1972. "\x78\x44\xec\x5f\x26\xff\x9f\x5f\x7a\xe2\xbd\x95\xe7\xbf\xcc\x55\xf9\x0e"
  1973. "\xca\xf2\x9f\xb8\xd5\xfe\x8f\xe6\xfd\xbf\xf2\x42\xe5\xf4\x4f\xdf\xaf\x3c"
  1974. "\xff\x52\xb6\xff\x0f\x37\x4a\x07\x8a\x57\x6e\xe7\xf3\xef\x46\x14\x95\x65"
  1975. "\x63\x5f\xcd\xb6\x03\x00\x00\x80\xff\x8b\xb4\xf1\x1b\xf8\x24\x1d\x5e\x28"
  1976. "\xa7\xe9\xf0\x70\xfe\x1b\xfe\x5d\xb1\x35\x9d\x9a\x9e\x99\x7d\xe6\xc4\xf4"
  1977. "\x07\x67\x27\xf2\xdf\xca\x0f\x46\x35\x2d\xaf\x74\x0d\x34\x5d\x0f\x1d\x2d"
  1978. "\xae\x0d\x97\xf5\xb1\x45\xf5\x43\xc5\x75\xe3\x2f\x2a\x5b\x1a\xf5\xe1\xda"
  1979. "\xf4\xd4\x44\xb7\x93\x87\x1e\xb7\xad\xcd\xf8\xcf\xfc\x55\xe9\x76\x74\xc0"
  1980. "\x9a\xf3\xbc\x16\xf4\x2e\xe3\x1f\x7a\x97\xf1\x0f\xbd\xeb\xb6\xc6\x7f\x92"
  1981. "\xac\x7d\x20\xc0\xba\x6b\x31\xfe\xab\x65\xa1\x3e\xb0\xce\xc1\x00\xeb\xaa"
  1982. "\xd5\xf7\xff\xc7\x5d\x88\x03\x58\x7f\xce\xff\xa1\x77\x19\xff\xd0\xbb\x8c"
  1983. "\x7f\xe8\x5d\xc6\x3f\xf4\xa4\xb6\xcf\xc6\xa7\xab\x7a\xe4\xbf\x0b\x85\xec"
  1984. "\x43\xac\xf5\x13\xfe\x1b\x25\xc2\x0e\x14\xaa\x1b\x23\x8c\xac\x10\xe9\x86"
  1985. "\x08\xe3\xee\x2f\xf4\xc5\x1a\x77\xb1\xa9\xe5\xaa\x6e\x7f\x32\x01\x00\x00"
  1986. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1987. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1988. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1989. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1990. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1991. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1992. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1993. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1994. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1995. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1996. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1997. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  1998. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x74\xc6\x7f\x01\x00\x00\xff\xff\xf2"
  1999. "\x8f\xd9\x8a",
  2000. 1137);
  2001. syz_mount_image(
  2002. /*fs=*/0x200000000080, /*dir=*/0x200000000480,
  2003. /*flags=MS_I_VERSION|MS_SLAVE|MS_PRIVATE|MS_POSIXACL|MS_RELATIME|MS_NOSUID|0xc0400004*/
  2004. 0xc0ed0006, /*opts=*/0x200000000900, /*chdir=*/-1, /*size=*/0x471,
  2005. /*img=*/0x200000000980);
  2006. memcpy((void*)0x200000000000, "/dev/loop#\000", 11);
  2007. res = -1;
  2008. res = syz_open_dev(/*dev=*/0x200000000000, /*id=*/0, /*flags=*/0);
  2009. if (res != -1)
  2010. r[23] = res;
  2011. memcpy((void*)0x2000000000c0, "vfat\000", 5);
  2012. memcpy((void*)0x2000000001c0, "./file0\000", 8);
  2013. *(uint16_t*)0x200000000080 = 0;
  2014. sprintf((char*)0x200000000082, "%023llo", (long long)-1);
  2015. memcpy(
  2016. (void*)0x200000000480,
  2017. "\x78\x9c\xec\xdc\xcf\x4f\x13\x41\x14\xc0\xf1\x47\x29\xa5\x2d\xa1\xed\xc1"
  2018. "\x68\x34\x31\x4c\xf4\xa2\x97\x0d\x54\xcf\xc6\xc6\x40\x62\x6c\x22\x01\x6a"
  2019. "\x04\x13\x93\x05\xb6\xda\x74\x6d\x49\xb7\xc1\xd4\x18\xd1\x93\x57\xe3\x1f"
  2020. "\xe1\x81\x70\xe4\x46\xa2\xfc\x03\x5c\xbc\xe9\xc5\x8b\x37\x2e\x26\x1e\xe4"
  2021. "\x60\x5c\xb3\xbf\x68\x0b\x05\x4c\xa1\x14\xe1\xfb\x49\xc8\xbe\xee\xcc\x5b"
  2022. "\x66\x32\x85\xbc\x69\x76\xbb\xf9\xf0\xdd\xb3\x62\xde\xd2\xf2\x7a\x55\x42"
  2023. "\x51\x25\x3d\x22\x22\x5b\x22\x29\x09\x49\xa0\xc7\x3f\x86\xdc\x38\x22\x8d"
  2024. "\x5e\xcb\xf5\x81\x9f\x5f\x2e\x4f\x4e\xcf\xdc\xcb\x64\xb3\xa3\x13\x4a\x8d"
  2025. "\x65\xa6\x6e\xa4\x95\x52\x89\xa1\x8f\xcf\x5f\xc6\xfc\x6e\x6b\xfd\xb2\x91"
  2026. "\x7a\xbc\xf9\x23\xfd\x7d\xe3\xfc\xc6\xc5\xcd\x3f\x53\x4f\x0b\x96\x2a\x58"
  2027. "\xaa\x54\xae\x2a\x5d\xcd\x96\xbf\x55\xf5\x59\xd3\x50\xf3\x05\xab\xa8\x29"
  2028. "\x35\x6e\x1a\xba\x65\xa8\x42\xc9\x32\x2a\x5e\x7b\xd9\x6b\xcf\x9b\xe5\x85"
  2029. "\x85\x9a\xd2\x4b\xf3\x83\xf1\x85\x8a\x61\x59\x4a\x2f\xd5\x54\xd1\xa8\xa9"
  2030. "\x6a\x59\x55\x2b\x35\xa5\x3f\xd1\x0b\x25\xa5\x69\x9a\x1a\x8c\x0b\x0e\x92"
  2031. "\x5b\x9e\x98\xd0\x33\x6d\x26\xcf\x1d\xf1\x60\xd0\x21\x95\x4a\x46\xef\x15"
  2032. "\x91\xd8\xae\x96\xdc\x72\x57\x06\x04\x00\x00\xba\x6a\x67\xfd\x1f\x72\x4a"
  2033. "\xfa\xb6\xea\x7f\x49\xb8\xf5\xbf\xd3\xb9\x5e\xff\xaf\x5c\x59\xaf\x0e\x3c"
  2034. "\x58\x4d\xf8\xf5\xff\x5a\xa4\x55\xfd\x7f\xf3\xab\x77\xad\xa6\xfa\x3f\x2a"
  2035. "\x22\x1d\xaf\xff\x77\x57\x44\x67\xcb\xa1\xea\x7f\x9c\x0c\x43\x91\x5d\xa7"
  2036. "\x7a\x9a\x5e\x39\xf5\x7f\xdc\xff\xfb\x75\xbd\x79\xb4\x32\xec\x06\xd4\xff"
  2037. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfc"
  2038. "\x0f\xb6\x6c\x3b\x69\xdb\x76\x32\x38\x06\x3f\xf5\x47\x08\xfc\xd7\x38\x95"
  2039. "\xf6\x5a\xff\x7e\x11\x89\x3a\xab\x6f\xb3\xfe\xa7\xd9\xe4\xf4\x8c\x44\xdd"
  2040. "\x07\xf7\xc2\x09\x11\xf3\xed\x62\x6e\x31\xe7\x1d\xfd\x0e\xeb\x22\x62\x8a"
  2041. "\x21\xc3\x92\x94\xdf\xee\xfb\xc1\xe7\xc4\xc1\x93\x47\xca\x91\x92\x4f\xe6"
  2042. "\x92\x9f\xbf\xb4\x98\xeb\x75\x5b\x32\x79\x29\xb8\xf9\x23\x92\x94\xd4\xce"
  2043. "\x7c\xdb\x1e\xbb\x9b\x1d\x1d\x51\x9e\xe6\xfc\x3e\x89\x37\xe6\xa7\x25\x29"
  2044. "\xe7\x5a\xe7\xa7\x5b\xe6\x47\xe4\xda\xd5\x86\x7c\x4d\x92\xf2\x79\x4e\xca"
  2045. "\x62\xca\xbc\xfb\xbe\xae\xe7\xbf\x1a\x51\xea\xce\xfd\xec\x8e\xfc\x98\xdb"
  2046. "\x0f\x00\x00\x00\x00\x80\xd3\x40\x53\xdb\x5a\xee\xdf\x35\x6d\xaf\x76\x2f"
  2047. "\x7f\x7b\x7f\xdd\xf2\xf3\x01\x6f\x7f\x3d\xdc\x72\x7f\x1e\x4e\x5e\x0a\x77"
  2048. "\x77\xee\x00\x00\x00\x00\x00\x9c\x15\x56\xed\x45\x51\x37\x4d\xa3\xb2\x4f"
  2049. "\x10\x93\x83\xfb\xb4\x1f\x84\xdb\x4b\xef\xdb\xaf\x4f\x6f\xc3\x0c\xff\xf5"
  2050. "\x82\x11\xf7\x7e\x17\x91\xce\xcd\x74\x9f\x20\xb8\x91\xa2\xa9\x29\xea\x9f"
  2051. "\x6c\xef\xca\xc1\xfc\x3b\x33\xe6\x90\xb4\x93\x35\xe4\x8c\x47\x1d\xf6\xb7"
  2052. "\x07\x1f\x1b\xed\xd5\x47\xc6\xbb\xb0\x82\x6e\x70\xe1\xfd\x87\x5f\x47\x77"
  2053. "\xc1\x5b\xab\xd1\x03\x66\xda\xb1\xa0\xef\x38\xfe\xf7\x00\x00\x00\x00\x38"
  2054. "\x5e\xf5\xa2\x3f\x38\x73\xbb\xbb\x03\x02\x00\x00\x00\x00\x00\x00\x00\x00"
  2055. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x0c\x3a\x8e"
  2056. "\xaf\x13\xeb\xf6\x1c\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2057. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x93\xe2\x6f"
  2058. "\x00\x00\x00\xff\xff\x7f\xe1\x04\x71",
  2059. 747);
  2060. syz_mount_image(
  2061. /*fs=*/0x2000000000c0, /*dir=*/0x2000000001c0,
  2062. /*flags=MS_I_VERSION|MS_STRICTATIME|MS_NODEV|0x200*/ 0x1800204,
  2063. /*opts=*/0x200000000080, /*chdir=*/8, /*size=*/0x2eb,
  2064. /*img=*/0x200000000480);
  2065. memcpy((void*)0x200000000300, "./bus\000", 6);
  2066. res = syscall(__NR_creat, /*file=*/0x200000000300ul, /*mode=*/0ul);
  2067. if (res != -1)
  2068. r[24] = res;
  2069. memcpy((void*)0x200000000440, "./bus\000", 6);
  2070. res = syscall(__NR_open, /*file=*/0x200000000440ul, /*flags=*/0ul,
  2071. /*mode=*/0ul);
  2072. if (res != -1)
  2073. r[25] = res;
  2074. res = syscall(__NR_dup3, /*oldfd=*/r[25], /*newfd=*/r[24], /*flags=*/0ul);
  2075. if (res != -1)
  2076. r[26] = res;
  2077. res = syscall(__NR_io_setup, /*n=*/6, /*ctx=*/0x200000000240ul);
  2078. if (res != -1)
  2079. r[27] = *(uint64_t*)0x200000000240;
  2080. *(uint64_t*)0x200000000000 = 0x2000000000c0;
  2081. *(uint64_t*)0x2000000000c0 = 0xf04aef;
  2082. *(uint32_t*)0x2000000000c8 = 0x3d8;
  2083. *(uint32_t*)0x2000000000cc = 8;
  2084. *(uint16_t*)0x2000000000d0 = 0;
  2085. *(uint16_t*)0x2000000000d2 = 0;
  2086. *(uint32_t*)0x2000000000d4 = r[26];
  2087. *(uint64_t*)0x2000000000d8 = 0;
  2088. *(uint64_t*)0x2000000000e0 = 0;
  2089. *(uint64_t*)0x2000000000e8 = 0;
  2090. *(uint64_t*)0x2000000000f0 = 0;
  2091. *(uint32_t*)0x2000000000f8 = 0;
  2092. *(uint32_t*)0x2000000000fc = -1;
  2093. syscall(__NR_io_submit, /*ctx=*/r[27], /*nr=*/1ul,
  2094. /*iocbpp=*/0x200000000000ul);
  2095. *(uint32_t*)0x200000000040 = 0x18;
  2096. *(uint32_t*)0x200000000044 = 2;
  2097. *(uint32_t*)0x200000000048 = 0;
  2098. *(uint32_t*)0x20000000004c = 0;
  2099. *(uint32_t*)0x200000000050 = 0;
  2100. *(uint32_t*)0x200000000054 = 0;
  2101. *(uint32_t*)0x200000000058 = 0;
  2102. *(uint32_t*)0x20000000005c = 0;
  2103. syscall(__NR_open_by_handle_at, /*mountdirfd=*/r[23],
  2104. /*handle=*/0x200000000040ul, /*flags=*/0ul);
  2105. *(uint64_t*)0x200000000140 = 0x200000000000;
  2106. *(uint16_t*)0x200000000000 = 0x10;
  2107. *(uint16_t*)0x200000000002 = 0;
  2108. *(uint32_t*)0x200000000004 = 0;
  2109. *(uint32_t*)0x200000000008 = 0x1000000;
  2110. *(uint32_t*)0x200000000148 = 0xc;
  2111. *(uint64_t*)0x200000000150 = 0x200000000100;
  2112. *(uint64_t*)0x200000000100 = 0x2000000009c0;
  2113. *(uint32_t*)0x2000000009c0 = 0x1ac;
  2114. *(uint16_t*)0x2000000009c4 = r[18];
  2115. *(uint16_t*)0x2000000009c6 = 0;
  2116. *(uint32_t*)0x2000000009c8 = 0x70bd2a;
  2117. *(uint32_t*)0x2000000009cc = 0x25dfdbfe;
  2118. *(uint8_t*)0x2000000009d0 = 0x28;
  2119. *(uint8_t*)0x2000000009d1 = 0;
  2120. *(uint16_t*)0x2000000009d2 = 0;
  2121. *(uint16_t*)0x2000000009d4 = 4;
  2122. *(uint16_t*)0x2000000009d6 = 0x5f;
  2123. *(uint16_t*)0x2000000009d8 = 0xa;
  2124. *(uint16_t*)0x2000000009da = 6;
  2125. memset((void*)0x2000000009dc, 0, 6);
  2126. *(uint16_t*)0x2000000009e4 = 0xa;
  2127. *(uint16_t*)0x2000000009e6 = 6;
  2128. memset((void*)0x2000000009e8, 80, 6);
  2129. *(uint16_t*)0x2000000009f0 = 0x29;
  2130. *(uint16_t*)0x2000000009f2 = 0x2a;
  2131. *(uint8_t*)0x2000000009f4 = 0x3e;
  2132. *(uint8_t*)0x2000000009f5 = 1;
  2133. *(uint8_t*)0x2000000009f6 = 3;
  2134. *(uint8_t*)0x2000000009f7 = 0x76;
  2135. *(uint8_t*)0x2000000009f8 = 6;
  2136. *(uint8_t*)0x2000000009f9 = 0;
  2137. *(uint8_t*)0x2000000009fa = 4;
  2138. *(uint16_t*)0x2000000009fb = 0xe;
  2139. *(uint16_t*)0x2000000009fd = 6;
  2140. *(uint8_t*)0x2000000009ff = 0x75;
  2141. *(uint8_t*)0x200000000a00 = 0x18;
  2142. *(uint16_t*)0x200000000a01 = 1;
  2143. *(uint16_t*)0x200000000a03 = 0x20;
  2144. *(uint16_t*)0x200000000a05 = 5;
  2145. *(uint16_t*)0x200000000a07 = 0x19;
  2146. memcpy((void*)0x200000000a09,
  2147. "\x57\xbc\x27\xf7\xb2\x41\x3a\x32\xdc\x18\x82\x61\x20\xa1\xf8\x58",
  2148. 16);
  2149. *(uint16_t*)0x200000000a1c = 4;
  2150. *(uint16_t*)0x200000000a1e = 0x5f;
  2151. *(uint16_t*)0x200000000a20 = 6;
  2152. *(uint16_t*)0x200000000a22 = 0x36;
  2153. *(uint16_t*)0x200000000a24 = 1;
  2154. *(uint16_t*)0x200000000a28 = 0xa;
  2155. *(uint16_t*)0x200000000a2a = 6;
  2156. memcpy((void*)0x200000000a2c, "\x26\x10\x0f\x80\x79\x22", 6);
  2157. *(uint16_t*)0x200000000a34 = 0x12e;
  2158. *(uint16_t*)0x200000000a36 = 0x2a;
  2159. *(uint8_t*)0x200000000a38 = 0x7e;
  2160. *(uint8_t*)0x200000000a39 = 0x15;
  2161. STORE_BY_BITMASK(uint8_t, , 0x200000000a3a, 0, 0, 1);
  2162. STORE_BY_BITMASK(uint8_t, , 0x200000000a3a, 5, 1, 7);
  2163. *(uint8_t*)0x200000000a3b = -1;
  2164. *(uint8_t*)0x200000000a3c = 0;
  2165. *(uint8_t*)0x200000000a3d = 8;
  2166. *(uint8_t*)0x200000000a3e = 2;
  2167. *(uint8_t*)0x200000000a3f = 0x11;
  2168. *(uint8_t*)0x200000000a40 = 0;
  2169. *(uint8_t*)0x200000000a41 = 0;
  2170. *(uint8_t*)0x200000000a42 = 0;
  2171. *(uint32_t*)0x200000000a43 = 1;
  2172. *(uint32_t*)0x200000000a47 = 2;
  2173. *(uint32_t*)0x200000000a4b = 8;
  2174. *(uint8_t*)0x200000000a4f = 6;
  2175. *(uint8_t*)0x200000000a50 = 2;
  2176. *(uint16_t*)0x200000000a51 = 9;
  2177. *(uint8_t*)0x200000000a53 = 3;
  2178. *(uint8_t*)0x200000000a54 = 1;
  2179. *(uint8_t*)0x200000000a55 = 0x30;
  2180. *(uint8_t*)0x200000000a56 = 0x37;
  2181. *(uint8_t*)0x200000000a57 = 0xb7;
  2182. *(uint8_t*)0x200000000a58 = 0x67;
  2183. *(uint8_t*)0x200000000a59 = 3;
  2184. memcpy((void*)0x200000000a5a,
  2185. "\x60\x0c\x80\xa8\x1d\x63\x77\xce\xf6\x7b\x2a\xd6\xac\x45\x9e\x68",
  2186. 16);
  2187. memcpy((void*)0x200000000a6a,
  2188. "\x6e\xe3\x83\x44\x6e\x80\xbe\xbb\x60\x97\xaa\x4c\xff\xd9\x12\x80\xac"
  2189. "\x73\x32\x29\x49\xe3\x67\xf6\xdd\x22\x97\xb0\x9e\x70\xd3\x84",
  2190. 32);
  2191. memcpy((void*)0x200000000a8a,
  2192. "\x57\xe8\x43\x7d\x37\xce\x2d\x70\xeb\x05\xdc\x35\x09\xe8\xaa\x26\x9b"
  2193. "\x29\xc3\x7a\x93\x2b\x21\x3e\xa6\x47\x6b\x12\x29\x4e\x52\xf0",
  2194. 32);
  2195. *(uint8_t*)0x200000000aaa = 3;
  2196. *(uint8_t*)0x200000000aab = 0x23;
  2197. memcpy(
  2198. (void*)0x200000000aac,
  2199. "\x82\xba\xdc\xbf\x55\x17\xa3\x76\x3f\x45\x09\x7a\xbd\x3e\x05\xcb\x6c\x8d"
  2200. "\x4a\xf4\xe1\xd1\xbe\x32\xb2\xe5\x73\x48\x29\xdd\x28\xf1\x7e\x58\x4a",
  2201. 35);
  2202. *(uint8_t*)0x200000000acf = 2;
  2203. *(uint8_t*)0x200000000ad0 = 0x1e;
  2204. memcpy((void*)0x200000000ad1,
  2205. "\xbd\x3d\x9a\x33\x7b\x87\xa1\x13\x61\x87\x12\xaa\xa3\xbe\xe2\x9d\x2a"
  2206. "\xcc\x5c\xba\xd0\xe6\x0b\xef\x80\x58\x0a\xb2\x92\x12",
  2207. 30);
  2208. *(uint8_t*)0x200000000aef = 1;
  2209. *(uint8_t*)0x200000000af0 = 0x1e;
  2210. memcpy((void*)0x200000000af1,
  2211. "\x35\xc1\xfc\x8a\xbf\xce\x88\xd3\x64\xc2\xc0\xbe\x2c\x5e\xb1\xdc\xa7"
  2212. "\x4c\x2d\x11\xae\x67\xa4\xca\x48\x0e\xac\x33\x0e\xb9",
  2213. 30);
  2214. *(uint8_t*)0x200000000b0f = 0x76;
  2215. *(uint8_t*)0x200000000b10 = 6;
  2216. *(uint8_t*)0x200000000b11 = 0x81;
  2217. *(uint8_t*)0x200000000b12 = 0x80;
  2218. *(uint16_t*)0x200000000b13 = 0x36;
  2219. *(uint16_t*)0x200000000b15 = 4;
  2220. *(uint8_t*)0x200000000b17 = 0x3e;
  2221. *(uint8_t*)0x200000000b18 = 1;
  2222. *(uint8_t*)0x200000000b19 = 3;
  2223. *(uint8_t*)0x200000000b1a = 0x83;
  2224. *(uint8_t*)0x200000000b1b = 0x1f;
  2225. STORE_BY_BITMASK(uint8_t, , 0x200000000b1c, 0, 0, 6);
  2226. STORE_BY_BITMASK(uint8_t, , 0x200000000b1c, 0, 6, 1);
  2227. STORE_BY_BITMASK(uint8_t, , 0x200000000b1c, 0, 7, 1);
  2228. *(uint8_t*)0x200000000b1d = 0x80;
  2229. *(uint8_t*)0x200000000b1e = 0xb;
  2230. *(uint8_t*)0x200000000b1f = 8;
  2231. *(uint8_t*)0x200000000b20 = 2;
  2232. *(uint8_t*)0x200000000b21 = 0x11;
  2233. *(uint8_t*)0x200000000b22 = 0;
  2234. *(uint8_t*)0x200000000b23 = 0;
  2235. *(uint8_t*)0x200000000b24 = 0;
  2236. *(uint32_t*)0x200000000b25 = 2;
  2237. *(uint32_t*)0x200000000b29 = 0x800;
  2238. *(uint32_t*)0x200000000b2d = 7;
  2239. memset((void*)0x200000000b31, 255, 6);
  2240. *(uint32_t*)0x200000000b37 = 0x80000000;
  2241. *(uint8_t*)0x200000000b3b = 0x83;
  2242. *(uint8_t*)0x200000000b3c = 0x25;
  2243. STORE_BY_BITMASK(uint8_t, , 0x200000000b3d, 0, 0, 6);
  2244. STORE_BY_BITMASK(uint8_t, , 0x200000000b3d, 1, 6, 1);
  2245. STORE_BY_BITMASK(uint8_t, , 0x200000000b3d, 0, 7, 1);
  2246. *(uint8_t*)0x200000000b3e = 4;
  2247. *(uint8_t*)0x200000000b3f = 5;
  2248. *(uint8_t*)0x200000000b40 = 8;
  2249. *(uint8_t*)0x200000000b41 = 2;
  2250. *(uint8_t*)0x200000000b42 = 0x11;
  2251. *(uint8_t*)0x200000000b43 = 0;
  2252. *(uint8_t*)0x200000000b44 = 0;
  2253. *(uint8_t*)0x200000000b45 = 1;
  2254. *(uint32_t*)0x200000000b46 = 0x8410;
  2255. *(uint8_t*)0x200000000b4a = 8;
  2256. *(uint8_t*)0x200000000b4b = 2;
  2257. *(uint8_t*)0x200000000b4c = 0x11;
  2258. *(uint8_t*)0x200000000b4d = 0;
  2259. *(uint8_t*)0x200000000b4e = 0;
  2260. *(uint8_t*)0x200000000b4f = 0;
  2261. *(uint32_t*)0x200000000b50 = 0x40;
  2262. *(uint32_t*)0x200000000b54 = 0x400;
  2263. memset((void*)0x200000000b58, 255, 6);
  2264. *(uint32_t*)0x200000000b5e = 0x7d;
  2265. *(uint16_t*)0x200000000b64 = 6;
  2266. *(uint16_t*)0x200000000b66 = 0x36;
  2267. *(uint16_t*)0x200000000b68 = 9;
  2268. *(uint64_t*)0x200000000108 = 0x1ac;
  2269. *(uint64_t*)0x200000000158 = 1;
  2270. *(uint64_t*)0x200000000160 = 0;
  2271. *(uint64_t*)0x200000000168 = 0;
  2272. *(uint32_t*)0x200000000170 = 0x4000000;
  2273. syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0x200000000140ul,
  2274. /*f=MSG_ZEROCOPY*/ 0x4000000ul);
  2275. memcpy((void*)0x200000000000, "/proc/sys/net/ipv4/tcp_wmem\000", 28);
  2276. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  2277. /*file=*/0x200000000000ul, /*flags=*/1, /*mode=*/0);
  2278. if (res != -1)
  2279. r[28] = res;
  2280. syscall(__NR_fstat, /*fd=*/r[28], /*statbuf=*/0x200000000040ul);
  2281. memcpy((void*)0x2000000000c0, "./file0\000", 8);
  2282. res = syscall(__NR_creat, /*file=*/0x2000000000c0ul, /*mode=S_IXGRP*/ 8ul);
  2283. if (res != -1)
  2284. r[29] = res;
  2285. *(uint64_t*)0x200000000100 = 1;
  2286. syscall(__NR_fcntl, /*fd=*/r[28], /*cmd=*/0x40cul, /*hint=*/0x200000000100ul);
  2287. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/9);
  2288. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/9);
  2289. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/7);
  2290. syscall(__NR_ioctl, /*fd=*/r[29], /*cmd=*/0x5451, 0);
  2291. memcpy((void*)0x200000000140, "./file0\000", 8);
  2292. *(uint64_t*)0x200000000280 = 0;
  2293. *(uint64_t*)0x200000000400 = 0;
  2294. syscall(__NR_execve, /*file=*/0x200000000140ul, /*argv=*/0x200000000280ul,
  2295. /*envp=*/0x200000000400ul);
  2296. *(uint64_t*)0x200000000540 = 0x200000000440;
  2297. *(uint16_t*)0x200000000440 = 0x10;
  2298. *(uint16_t*)0x200000000442 = 0;
  2299. *(uint32_t*)0x200000000444 = 0;
  2300. *(uint32_t*)0x200000000448 = 0x8000000;
  2301. *(uint32_t*)0x200000000548 = 0xc;
  2302. *(uint64_t*)0x200000000550 = 0x200000000500;
  2303. *(uint64_t*)0x200000000500 = 0x200000000480;
  2304. *(uint32_t*)0x200000000480 = 0x60;
  2305. *(uint8_t*)0x200000000484 = 1;
  2306. *(uint8_t*)0x200000000485 = 4;
  2307. *(uint16_t*)0x200000000486 = 0x301;
  2308. *(uint32_t*)0x200000000488 = 0;
  2309. *(uint32_t*)0x20000000048c = 0;
  2310. *(uint8_t*)0x200000000490 = 5;
  2311. *(uint8_t*)0x200000000491 = 0;
  2312. *(uint16_t*)0x200000000492 = htobe16(1);
  2313. *(uint16_t*)0x200000000494 = 8;
  2314. STORE_BY_BITMASK(uint16_t, , 0x200000000496, 5, 0, 14);
  2315. STORE_BY_BITMASK(uint16_t, , 0x200000000497, 1, 6, 1);
  2316. STORE_BY_BITMASK(uint16_t, , 0x200000000497, 0, 7, 1);
  2317. *(uint32_t*)0x200000000498 = htobe32(4);
  2318. *(uint16_t*)0x20000000049c = 0xa;
  2319. *(uint16_t*)0x20000000049e = 2;
  2320. *(uint32_t*)0x2000000004a0 = htobe32(0xae);
  2321. *(uint8_t*)0x2000000004a4 = 0;
  2322. *(uint8_t*)0x2000000004a5 = 0;
  2323. *(uint16_t*)0x2000000004a8 = 6;
  2324. STORE_BY_BITMASK(uint16_t, , 0x2000000004aa, 6, 0, 14);
  2325. STORE_BY_BITMASK(uint16_t, , 0x2000000004ab, 1, 6, 1);
  2326. STORE_BY_BITMASK(uint16_t, , 0x2000000004ab, 0, 7, 1);
  2327. *(uint16_t*)0x2000000004ac = htobe16(6);
  2328. *(uint16_t*)0x2000000004b0 = 6;
  2329. STORE_BY_BITMASK(uint16_t, , 0x2000000004b2, 6, 0, 14);
  2330. STORE_BY_BITMASK(uint16_t, , 0x2000000004b3, 1, 6, 1);
  2331. STORE_BY_BITMASK(uint16_t, , 0x2000000004b3, 0, 7, 1);
  2332. *(uint16_t*)0x2000000004b4 = htobe16(6);
  2333. *(uint16_t*)0x2000000004b8 = 0xa;
  2334. *(uint16_t*)0x2000000004ba = 2;
  2335. *(uint32_t*)0x2000000004bc = htobe32(0x401);
  2336. *(uint8_t*)0x2000000004c0 = 1;
  2337. *(uint8_t*)0x2000000004c1 = 0;
  2338. *(uint16_t*)0x2000000004c4 = 0xa;
  2339. *(uint16_t*)0x2000000004c6 = 2;
  2340. *(uint32_t*)0x2000000004c8 = htobe32(0);
  2341. *(uint8_t*)0x2000000004cc = 2;
  2342. *(uint8_t*)0x2000000004cd = 0;
  2343. *(uint16_t*)0x2000000004d0 = 6;
  2344. STORE_BY_BITMASK(uint16_t, , 0x2000000004d2, 6, 0, 14);
  2345. STORE_BY_BITMASK(uint16_t, , 0x2000000004d3, 1, 6, 1);
  2346. STORE_BY_BITMASK(uint16_t, , 0x2000000004d3, 0, 7, 1);
  2347. *(uint16_t*)0x2000000004d4 = htobe16(4);
  2348. *(uint16_t*)0x2000000004d8 = 5;
  2349. *(uint16_t*)0x2000000004da = 1;
  2350. *(uint8_t*)0x2000000004dc = 3;
  2351. *(uint64_t*)0x200000000508 = 0x60;
  2352. *(uint64_t*)0x200000000558 = 1;
  2353. *(uint64_t*)0x200000000560 = 0;
  2354. *(uint64_t*)0x200000000568 = 0;
  2355. *(uint32_t*)0x200000000570 = 0x200008c0;
  2356. syscall(__NR_sendmsg, /*fd=*/r[29], /*msg=*/0x200000000540ul,
  2357. /*f=MSG_PROBE|MSG_NOSIGNAL|MSG_EOR|MSG_CONFIRM*/ 0x4890ul);
  2358. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/7);
  2359. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/5);
  2360. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(
  2361. /*val=*/0xffffff01);
  2362. memcpy((void*)0x200000000580, "/dev/snd/seq\000", 13);
  2363. syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000580ul,
  2364. /*flags=O_TRUNC|O_LARGEFILE|O_CREAT|O_CLOEXEC*/ 0x88240, 0);
  2365. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/2);
  2366. syscall(__NR_ftruncate, /*fd=*/r[28], /*len=*/1ul);
  2367. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/3);
  2368. memcpy((void*)0x2000000005c0, "net/stat\000", 9);
  2369. res = -1;
  2370. res = syz_open_procfs(/*pid=*/0, /*file=*/0x2000000005c0);
  2371. if (res != -1)
  2372. r[30] = res;
  2373. res = syscall(__NR_socketpair, /*domain=AF_KCM*/ 0x29ul,
  2374. /*type=SOCK_CLOEXEC*/ 0x80000ul, /*proto=*/8,
  2375. /*fds=*/0x200000000600ul);
  2376. if (res != -1) {
  2377. r[31] = *(uint32_t*)0x200000000600;
  2378. r[32] = *(uint32_t*)0x200000000604;
  2379. }
  2380. syscall(__NR_ioctl, /*fd=*/r[32], /*cmd=*/0x8905, /*arg=*/0x200000000640ul);
  2381. *(uint16_t*)0x200000000680 = 1;
  2382. memcpy((void*)0x200000000682,
  2383. "./"
  2384. "file0\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  2385. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  2386. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  2387. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  2388. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  2389. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000",
  2390. 108);
  2391. syscall(__NR_bind, /*fd=*/r[30], /*addr=*/0x200000000680ul,
  2392. /*addrlen=*/0x6eul);
  2393. syscall(__NR_ioctl, /*fd=*/r[29], /*cmd=*/0x2401, /*flags=*/7ul);
  2394. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/1);
  2395. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(
  2396. /*val=*/0x7f2da2e6);
  2397. *(uint32_t*)0x200000000700 = -1;
  2398. *(uint32_t*)0x200000000704 = 0;
  2399. *(uint32_t*)0x200000000708 = 0x3cd;
  2400. *(uint32_t*)0x20000000070c = 0x69e9;
  2401. *(uint32_t*)0x200000000710 = 0x200;
  2402. *(uint32_t*)0x200000000714 = 1;
  2403. *(uint32_t*)0x200000000718 = 1;
  2404. *(uint32_t*)0x20000000071c = 6;
  2405. syscall(__NR_ioctl, /*fd=*/r[30], /*cmd=*/0xc02063a0,
  2406. /*arg=*/0x200000000700ul);
  2407. *(uint32_t*)0x200000000740 = r[28];
  2408. memcpy(
  2409. (void*)0x200000000748,
  2410. "\x12\xfc\x2d\x0e\xff\x30\xc3\xe5\xf4\x05\x31\x15\xfe\xef\xcc\x02\x99\x3b"
  2411. "\x9f\x38\x5b\xe8\x67\xf5\xa6\x2f\x9f\x2a\x3f\xe9\x62\x4e\x0f\xa8\xd7\x7c"
  2412. "\xd1\x43\x0e\x48\x4b\x1c\x8b\x8d\x72\x83\xe0\x60\x91\x7e\x13\x67\xd1\xc0"
  2413. "\x75\x70\xfb\x99\x1a\x91\x2b\x9c\x21\xfa\x8d\xa7\x3b\xdf\xeb\x28\x65\x0e"
  2414. "\xd4\xba\xa1\x08\xa5\x91\xe9\x60\x7f\xa1\xaf\x81\x6e\xa7\x95\x6d\x74\x4b"
  2415. "\xfc\xb4\x19\x24\x89\x15\x4b\x45\xfe\x75\x91\xce\xa4\x8d\x70\x2c\xa1\x78"
  2416. "\x36\x29\x82\x8f\xc6\x1d\xa3\xfe\x69\x3f\xb4\x9d\x3b\xc9\x64\x2f\xbe\x11"
  2417. "\x62\x28\xd5\x2d\x73\xa4\x0b\xe4\x27\x74\x5c\x8a\x16\xb9\x9b\xfb\x84\xfe"
  2418. "\xc7\x6a\xa3\xc4\x7a\x2d\xbf\xf4\xfd\xfa\x61\x45\x69\x16\x21\xf0\x85\x3a"
  2419. "\x15\x53\x0b\x43\xf0\x78\xd0\x87\x5b\x4c\x7e\xf0\x31\x61\x89\x80\x08\x14"
  2420. "\xf2\x82\x57\xde\x67\x1f\xff\xd7\xe7\x6d\x55\x9a\x59\x01\xd4\x47\x41\x82"
  2421. "\x38\x0f\x9a\x96\x73\x62\xe8\x80\x64\x24\xbd\x6c\x9a\xaf\x52\x8b\x67\xea"
  2422. "\x06\x6a\x64\x5d\xf8\x84\xda\x65\xa5\x8a\xcc\x17\x1a\xee\x3a\x46\xa9\xd0"
  2423. "\x8b\x0a\xc6\x08\xc9\xf5\x08\xba\x9b\x33\x9d\x0d\x2a\x02\x9a\xfb\xc8\x2c"
  2424. "\x1a\xfc\xba\x37\x8c\xea\x75\xfd\x8c\x86\x0a\x17\xd2\x40\xd9\xda\x43\xcb"
  2425. "\xb4\xd6\xf0\x03\x45\x30\x3a\x81\xe1\x31\x09\x67\xa1\x18\xc8\x3c\xc5\x0d"
  2426. "\x4c\x15\x90\xca\x4b\x49\x2c\xee\x25\xbf\xcf\xe0\x0e\x2d\x0e\xb0\x47\xa8"
  2427. "\x44\xf3\x70\x0c\x22\x9e\x9d\xe6\x46\x3c\x67\x9c\x2b\x59\x25\xa7\x64\x5f"
  2428. "\xde\x6a\xa7\x61\xc3\x7b\x5a\x75\x09\xe1\x12\xe4\xd4\x48\xda\x54\xf3\xee"
  2429. "\x08\x96\x45\x25\x47\x82\x98\x33\x73\x20\x62\xa3\xc8\xd5\x2c\x05\xc8\x1a"
  2430. "\x5e\x0b\x8e\xb4\x0f\xa7\xb0\x83\xe3\xff\x28\x29\xe9\xde\x2d\x44\x02\xa1"
  2431. "\xc4\xe4\xf6\x42\x74\x27\x8f\xb1\x2a\xbe\x5f\x46\x4d\xee\x3c\xb7\x54\x46"
  2432. "\x14\x97\xae\xf9\xc6\x1b\x42\x1f\x98\xaf\x74\x07\x79\xbf\x13\x83\x5d\x60"
  2433. "\x2b\x6c\x83\xdf\x4c\xd6\x37\xe4\x2d\x62\xd1\x19\xcb\x66\x0c\x2b\x37\x9b"
  2434. "\x19\xa3\x10\x90\x90\xad\xaf\x3c\xdd\x78\x6c\x88\x99\x05\x19\xe7\xb4\xaf"
  2435. "\xb4\xcc\x47\x2d\x61\x95\x9c\xe7\xad\x28\x29\x40\x2a\x33\x05\x4a\x54\xbe"
  2436. "\xe0\xc8\x39\xbe\xa9\x45\x9b\xea\xc6\x8d\x1e\x19\xdb\x9d\xda\x49\x6c\x94"
  2437. "\x60\x0d\xcc\x47\x91\xbd\xd0\x6a\xe8\xa2\xb9\x72\xd5\x6c\x5b\xdb\xbd\x72"
  2438. "\x92\x58\x7e\x18\x4e\x97\x6a\xde\x0d\xbe\x4f\x91\xc8\x76\x82\xb2\xa5\xdf"
  2439. "\x95\x7e\xc5\xc8\x2c\x1b\x4f\xbd\x5c\x19\xf5\xaa\x66\xc8\xce\x29\xb8\x7f"
  2440. "\x4c\xb2\xb4\x96\xdf\x12\x73\x9b\xa2\x2d\x3d\x21\x5c\x13\x7c\xd7\x04\x41"
  2441. "\xf3\x9a\x2c\xa2\x5d\xae\x2c\x3d\x94\x59\x62\x7f\x91\x76\x2c\x2b\x8f\x25"
  2442. "\x9a\x36\xe8\xc6\xc1\x1e\x1f\x8a\x67\x26\x73\x77\xee\x9f\x88\x2c\xf3\x17"
  2443. "\x75\x4c\x87\x3f\x83\x40\x61\xd5\xac\x4d\x21\xa7\x98\x24\xe1\x01\x56\xda"
  2444. "\x84\xb6\xd3\xfd\x9c\x77\x3a\x45\x71\x65\x36\x0d\x5c\x01\xdc\x23\xbe\x94"
  2445. "\xfb\x6f\x49\xfe\x36\xcd\x9d\x71\xf5\xbf\x2b\xbb\x7b\xfa\x6c\xf8\x26\x79"
  2446. "\x61\x8e\x2f\x37\x67\xd7\xa2\x06\xa6\xa3\x18\xfc\x7f\xd4\xb7\x48\x88\x57"
  2447. "\x49\x80\xe2\x36\x92\x3b\xa0\x01\xfa\x2d\x47\xfe\xbd\x48\xc2\x1b\xc7\xb9"
  2448. "\x15\x46\xc1\xab\x0e\x32\x61\xbb\x7e\xcd\x51\xa1\xad\xcd\xcd\xe4\x8a\x96"
  2449. "\x40\x83\xe0\x18\x18\xa2\x5f\x35\x3b\x1f\x68\x7f\xf0\xa2\xb1\x1b\x94\xe0"
  2450. "\x05\x57\xae\x1e\x0b\xfb\xca\x9d\x5f\x01\x17\x6b\x3a\x8b\x69\x00\x61\x79"
  2451. "\xee\x5f\xa3\x07\x3c\x96\x48\xbf\xff\x36\xe5\x4b\x8b\xe6\x83\x7f\x62\x54"
  2452. "\x77\x2b\x89\x5e\x07\x2e\x8c\xfb\xd4\xf1\x5a\x6e\xdd\xce\xc6\xe1\xaf\x4c"
  2453. "\x54\x8d\xf9\xee\xa5\xfd\x08\x80\xf9\xf4\x5f\x16\xd3\x42\x14\x1f\x55\xea"
  2454. "\xd2\xa4\xb7\x7c\xec\x1a\x63\x85\x1d\x23\x05\x9e\x9c\x2d\xb9\x01\x5e\x42"
  2455. "\x8c\xa1\xff\xb1\xd7\x71\x03\x7a\xc1\xc5\x27\x09\x18\x44\x8b\xc0\x71\x74"
  2456. "\x5b\xde\xa7\x98\x25\xf9\xb9\x77\x9d\x66\x84\x3d\x2a\xed\x89\x58\x7e\xf5"
  2457. "\x21\x97\xdf\x36\x6a\x85\xd3\xeb\x20\xb9\x86\x2f\x52\x8d\x73\xa8\xd7\x15"
  2458. "\x17\x68\x15\x02\xd2\x91\x57\x55\x80\x3b\xb0\xef\x18\xd5\x7e\x88\x28\x26"
  2459. "\x32\x90\x5b\x66\xe8\xdc\x64\x3d\x8f\x03\x81\x36\x72\x82\x22\xec\xcb\x27"
  2460. "\x6d\xea\x82\x21\x2e\x19\xde\x44\xfb\xac\x21\x3d\x68\x70\xae\xec\x07\x8f"
  2461. "\x96\xc3\x60\xa7\xca\x96\xd3\x93\x31\xc8\xae\x0a\x02\xf7\x66\x27\x36\x7a"
  2462. "\xc3\xe2\xcc\x52\x61\xf5\x1b\x66\x83\x7a\x56\xee\x1c\x50\x94\x03\x6e\x09"
  2463. "\x9d\x60\xed\x88\x67\x23\x4f\xd6\x07\x8d\xc1\x47\xe7\xb0\xad\x3c\x82\xdc"
  2464. "\x8c\x3a\x19\x24\x82\x09\x41\x02\x80\x8c\x79\x3d\xc0\x2d\x63\xe6\xe4\x26"
  2465. "\x43\x24\x91\x30\x16\x0d\x64\x58\xe9\x07\x54\xb4\x47\x2b\x03\xe8\x84\x2f"
  2466. "\x1b\xa3\x98\x87\x0e\x17\x0f\xb6\x55\x5c\x43\x5d\x96\x11\xb8\x0e\xc5\xcf"
  2467. "\x55\x99\x39\xa4\x8d\x5a\x77\xd2\x94\x99\x26\x0c\x8c\x74\x12\xed\x5f\x57"
  2468. "\x8e\x5e\x88\x31\x05\x65\x77\x3f\x02\x22\x68\xad\xa3\x13\xe2\x1a\x6f\x75"
  2469. "\xb5\xf1\xd2\x7f\xcd\xe0\xbd\x17\x4e\x68\xd0\x71\xe2\xe5\x66\xd5\xec\x62"
  2470. "\x47\xfa\x2c\x53\x2e\x1e\xca\xb3\x0f\xdd\xc3\x2d\x5a\x87\x17\xe5\x8b\x1d"
  2471. "\x7e\x41\xde\x44\x81\x60\x0a\xfa\x65\x15\x53\x5a\xd8\x17\x96\xa8\x06\xd8"
  2472. "\xef\xe9\xd3\x2f\x56\x2e\xc8\x32\xfc\x56\x9e\xc6\x99\x1b\xae\x17\x56\x9f"
  2473. "\xc3\x26\xd2\x73\x81\x0a\xac\x39\x5a\x25\x7f\x39\xbb\xfd\xa1\xcd\x6c\x5d"
  2474. "\x9a\x9b\xc2\xd4\xbd\x99\x88\x44\xf0\xe0\x14\x93\x44\x74\xd1\x9f\x24\x80"
  2475. "\x9b\xf7\x65\x01\x43\xe4\xa0\xc0\x8f\x0b\x70\x8a\xd1\xbc\x74\x50\x36\x70"
  2476. "\x0a\x26\x1a\xfe\xea\xd3\x1e\xb8\x36\x5c\xc0\x24\xe0\x23\x56\x8a\x37\xea"
  2477. "\x68\x97\x50\x6f\x30\xee\xfa\xf9\x19\xfd\x68\xda\x54\xdb\xa5\xef\x4d\x30"
  2478. "\x7a\xa8\x4f\x0f\xc6\x23\x95\xc3\x24\x2b\xfa\xc5\x21\xbd\xb6\x31\xaf\xe3"
  2479. "\x0a\x1f\x4e\x81\xfa\x45\xdf\xfe\x03\xae\xfa\xa6\x06\xdb\xcb\xef\x65\xcb"
  2480. "\xbe\x87\x2d\xe9\xc8\xaa\x2c\x96\xe2\x1c\xa1\x72\x5e\x9e\x34\x2a\x62\x96"
  2481. "\x24\x25\x31\x16\xd1\xe0\x85\xcc\x60\xd1\xd1\x1d\x16\x58\xa3\x57\xbd\xc6"
  2482. "\x40\x27\x8b\xd4\x66\x8b\x46\x3b\x28\x44\xb6\x1f\x2f\x67\x8f\x6d\x8c\x2b"
  2483. "\x8f\xbe\x8c\xc9\x7e\xf1\xb0\xf5\x08\x28\x5a\x96\x02\x6d\x05\x52\x32\xed"
  2484. "\x15\x39\x12\x14\xf2\xe9\xeb\x07\x6c\x26\x17\xaf\xe1\xbe\xd0\x86\xed\xa2"
  2485. "\x6c\x34\x22\x46\x30\x12\x9f\xb9\x04\x4d\x32\x72\x32\x3b\x59\xe3\xe6\x1e"
  2486. "\x13\x17\x19\x52\x33\x39\xb3\x5e\x2e\xd1\xdc\x15\x61\xa8\xe7\xd2\x05\x3c"
  2487. "\xa5\x0e\x59\xe9\xdd\x32\x45\x29\x71\xdc\x52\x51\x41\x70\x6b\x50\x98\x9b"
  2488. "\x32\xb9\x24\xe0\x49\xd7\x11\x1e\x38\x65\x3a\xb9\x67\x0b\xda\xbb\xaf\x79"
  2489. "\x3e\x6f\xd7\x5c\x60\xe9\xde\xd5\xdd\x14\x05\x62\x55\x70\x72\xeb\x0c\xf6"
  2490. "\x98\xde\xf7\x39\x5e\xe9\x3f\x6e\xd2\x2a\x18\x0e\x01\x92\x22\xb1\xf3\xde"
  2491. "\xd6\x0a\x5c\x2b\xe0\xa0\x2e\x3c\x61\x91\x61\x0d\x71\xd7\x8c\xf5\x25\x28"
  2492. "\x1b\x8e\x3f\xe9\xd3\x01\x5f\x49\xc4\x78\x82\x41\x23\x9a\x6b\xb0\x41\x8d"
  2493. "\xcc\xb2\x6e\x0a\xab\xd0\x45\x38\xa5\xb7\xb0\xf0\x53\x67\xaf\xa4\xde\xe5"
  2494. "\x4b\x8e\x28\x05\xcc\x70\xbe\x63\xb5\x8e\xea\x0b\x3d\x91\x6a\x66\x83\x96"
  2495. "\x86\x38\x5f\xef\x50\xdb\xf4\xca\xa1\x93\xbe\x18\x96\x64\x55\x2b\xf0\x95"
  2496. "\x1f\x7e\xfc\xa8\xa0\x88\x05\xed\x30\x1a\xd0\xce\xda\x6e\x7e\x03\xe1\x0b"
  2497. "\x7b\x0c\x9d\x47\xb5\x4c\x1b\x4e\x3b\xf3\x78\xaa\x21\x42\x5a\x49\x8b\x12"
  2498. "\x76\xce\x2d\x0f\x4b\x06\x07\x3e\x1f\x14\xdc\xed\x4f\x9e\xbb\x93\x9d\x1b"
  2499. "\x5f\x96\x46\xff\x41\x67\xc8\x3a\x15\xef\xf0\xf1\x56\x33\x52\x7a\x46\xdf"
  2500. "\x9e\xfc\x58\xc1\x91\x65\xa3\xc7\x23\x57\xc8\xca\x1d\x88\x0b\x6b\xdf\xe7"
  2501. "\x3d\x5d\xf0\xa7\xb1\x3f\x5e\xc0\xae\xc5\x4b\x8d\x28\x6a\x74\xea\xd9\xed"
  2502. "\x38\x7d\x7b\xa7\x31\xc1\x96\x81\x46\x27\x44\xe0\x52\x07\x42\x13\xf0\x39"
  2503. "\x30\x56\xb2\x80\x21\xf4\x52\x2c\xbc\x77\xf4\x25\xc8\x81\xb3\x94\x5f\x08"
  2504. "\xd9\x7a\x2c\x4e\x4d\x9b\x8a\xba\x71\xf5\xba\x68\x32\x84\xa4\x34\xb5\xf3"
  2505. "\x4b\x17\xf1\xfe\xf3\x4b\x93\x37\x00\xd6\x17\xd8\x02\x08\xf7\xd5\xc1\x79"
  2506. "\xe0\xbb\x10\xd2\x61\xfb\xf1\x79\xbb\xdc\x54\xb7\x30\x24\x33\x43\x4b\x0e"
  2507. "\x00\xd2\x62\x76\xb3\xbf\x22\x8e\xfe\x00\x16\x30\xd5\x1c\xdd\xe6\x6f\x28"
  2508. "\x4a\xc9\xd2\xbd\x93\x83\x9e\xf0\x45\x16\xd8\xca\x38\x4b\xe7\xb9\x69\xf3"
  2509. "\x89\x7f\xa5\xda\x9a\x99\x90\x9e\x2c\x33\xb3\xec\xff\xf4\x32\x57\x8f\x54"
  2510. "\x3a\xa2\x4f\xbc\x94\x1f\x14\x30\xfe\x4b\x55\xd9\x7d\x26\xb0\xe6\xd4\x85"
  2511. "\x19\xea\x8f\x39\x7b\x65\x82\xf5\x63\xaa\xdd\x7e\x4b\x4b\x77\x29\x7e\x44"
  2512. "\x26\x77\xce\x9f\x38\x97\x0d\xd7\x0a\xd1\x80\xeb\xd7\x82\xca\x6f\xc4\x54"
  2513. "\x8e\x6b\x11\x7a\x7c\x28\xb6\x52\xe1\xd2\x2e\x84\xe0\x9a\x74\x7c\x88\x83"
  2514. "\x3d\xca\xb2\x42\xb2\xe7\x72\xa0\x05\xfc\x64\x77\x85\x14\x16\x88\x4a\x24"
  2515. "\x5a\xcc\xac\xfe\xce\x29\xde\xa7\xbe\x47\x1f\xe0\x1d\x09\xf1\xa9\x5c\x72"
  2516. "\xf6\x25\x22\x65\xa2\xa7\xc6\xe1\xa6\xee\x2d\x3b\xf0\xdb\x4c\xb4\x34\xf2"
  2517. "\xdb\x8a\xe2\x40\xa6\xd5\x3e\x33\x2f\x9b\xd3\x78\x15\x5a\x19\x65\x1b\x35"
  2518. "\xfc\xdc\x40\x9d\x7c\xca\x30\x03\xb3\x23\xb3\xaa\x1a\x60\x59\xea\xc7\xe3"
  2519. "\xa6\xfe\xc2\xde\xc8\x5e\xc0\x7f\xd6\xe3\x9e\x57\x13\xcd\x80\x4b\xd6\xd7"
  2520. "\x6d\x69\x51\x7a\xe9\xcd\x13\x55\xf3\x7b\x09\x06\x12\xbd\xe7\x5c\xf1\xd4"
  2521. "\x08\x06\xa3\x51\x97\x63\x23\xa2\x6c\x5d\xc9\x54\x77\x86\x70\x55\x05\x7d"
  2522. "\x1a\x5d\x2c\x39\x37\x9c\x2f\x1b\xcb\xfc\x49\xae\x79\x55\xa0\xad\x79\x3e"
  2523. "\xd0\x4d\xfe\x27\xdd\xd8\x1f\xe8\xf4\x10\xdc\x52\x0d\x70\xa8\x2f\x84\x46"
  2524. "\xa2\xa8\x61\x5b\xa9\xbd\xe9\x9b\x2b\xb2\x4f\x20\x11\x8a\xf7\x5b\x1f\x12"
  2525. "\xf7\xbd\x91\x9c\x34\xb0\xc9\x06\xf7\xa0\x25\x24\x73\x71\x67\xbd\x0f\x83"
  2526. "\xe7\x33\xcf\xdd\x63\x11\x7a\x9f\xff\xed\xa5\xa4\x38\xa9\x30\xb9\x56\x23"
  2527. "\xfa\xc4\x7d\xcc\x2f\x7e\x8f\x8b\xff\xbc\x7b\xe8\xb6\xcb\x7a\x00\x87\x97"
  2528. "\xdf\x83\xb7\x44\xf9\xfc\x85\xb9\xb9\x21\xb8\x65\x69\xb5\xbd\x40\x8a\xc4"
  2529. "\x58\x7c\x4e\xdf\x5d\x70\x5a\x49\x4c\xc7\xcb\xf6\x92\x83\xf6\x82\xbc\xb6"
  2530. "\x10\x4f\x11\x8b\xe6\x7c\xcd\xa8\x98\x5c\xaa\x9f\x52\x9a\xed\xba\x50\xa7"
  2531. "\xf6\x78\xc0\x32\x19\x9b\x0f\xc3\xea\x21\x2a\x31\x01\xa3\x09\x1e\xea\x97"
  2532. "\xbb\x3b\x31\xfa\x9f\xbe\x2d\xf5\x74\xfa\xc6\xcd\xb7\x32\x0f\x5b\x59\x5b"
  2533. "\xcc\xe4\x6f\x12\xcb\x31\x8e\xd3\xfd\x82\x7d\xfa\x02\x51\xa6\x72\x21\xeb"
  2534. "\x4f\x6b\xab\xca\x56\x8a\xa8\xe6\xe6\xcc\xea\xb5\xca\xdb\xb5\x04\x75\x32"
  2535. "\x8a\x34\x97\x1c\x2e\x9d\x07\x11\x37\x88\x3f\xcd\x68\x42\x83\x8d\x64\x18"
  2536. "\x1d\x87\x55\x4e\x2e\xe7\x31\xe9\x6a\x66\xb6\x5c\x96\xfa\xaa\x2a\x06\x92"
  2537. "\x4a\x58\xaa\xd7\xd5\x21\x5e\x00\x1d\xe3\xb0\x2a\x05\x22\x28\xa6\xa4\xed"
  2538. "\x49\x03\xf8\x41\x42\xb9\x90\x0f\x5c\xc3\x1c\xa9\x04\x27\x6a\xfe\x6f\x9b"
  2539. "\x7b\x18\x7d\xa3\x7f\x79\x34\xac\xc5\xe0\x70\xed\x2c\x2f\xdb\x21\x5c\x58"
  2540. "\x56\x11\x8b\xb3\x9a\xe5\x53\x65\xd5\xfd\x49\x43\xaf\x26\xf6\xd6\xe7\x1b"
  2541. "\x7c\x31\x11\xe6\x34\xe5\x0e\x38\x2e\x58\x85\x6f\x16\xef\x6e\x0a\x66\xc4"
  2542. "\x3c\xf4\x13\x40\xda\x55\x96\x67\xca\x77\x45\x68\xaf\x04\x68\x5c\xa6\x14"
  2543. "\x99\x18\x35\x0c\xb6\x6b\x30\xf8\xf1\xb7\x11\x49\x76\xf3\x07\xb9\x72\x52"
  2544. "\x60\x9e\xf5\x57\xc7\xa3\xb8\xda\x97\x0b\x30\x20\x4d\xe5\xe1\x21\xbc\x71"
  2545. "\xe7\x3f\xab\x73\xf9\xee\x0a\x31\xc7\x44\xd2\x16\xa1\xd1\x16\x21\x39\x25"
  2546. "\x52\x5e\x7e\x00\x49\x41\x1e\xf0\x1d\xda\x32\xaf\x76\xb9\x9d\x12\x1d\x85"
  2547. "\x46\xa1\xe9\x9d\x0e\x60\x7f\x7f\x59\xa2\x72\xfc\x7d\x04\x97\x6a\x75\xc2"
  2548. "\x43\xcc\xfb\xd2\xe1\xd3\x8a\x51\x45\xa4\x5c\x48\xa7\xd8\xc6\xae\x50\x75"
  2549. "\x9b\x00\x92\x0d\xb2\xca\xab\x73\x94\x9a\x8f\x43\x3e\xe0\xdb\xed\x41\x57"
  2550. "\xac\x3c\x13\x30\x23\xc4\x57\x1f\x78\x53\xc6\x6c\x7b\x1b\x57\x4b\x83\x29"
  2551. "\x63\xa3\x4c\x4d\x23\x28\xc7\x44\x41\x4b\x4e\x86\x9b\xb3\x39\xd7\x97\x27"
  2552. "\xf4\x36\x95\xfe\x7b\x5d\x81\xef\x81\xb8\xea\xe5\xc6\x56\x29\xc7\x00\xf0"
  2553. "\x04\x64\x6c\x1f\xe6\x97\x99\x56\x87\x10\x5a\x32\x9b\x8a\x12\x55\xa1\x53"
  2554. "\xcb\x83\xf1\x6f\x94\x87\xa9\x91\x36\x1c\x09\xb6\xb4\x78\xf4\xcf\x80\x73"
  2555. "\x85\x80\xfb\xc2\x6f\x55\x08\x12\x6b\xc4\xba\xdb\x7a\x63\xa0\xdc\x5f\x2e"
  2556. "\x72\x16\x37\x47\x2e\x5b\x94\xae\x3b\xae\xe6\xa7\x96\x55\xbc\x15\x17\x4b"
  2557. "\xe3\x86\xac\x30\x05\xef\x92\xe8\xc6\x3f\x96\x4e\xbd\xe7\x11\x11\x60\x12"
  2558. "\x1a\x8f\xaf\xc5\xcb\x84\x2c\xc7\xf5\x27\x54\x11\xc9\x09\x07\x07\x90\x3b"
  2559. "\x6a\x3b\x58\x57\x3f\x1b\x7b\x3b\x14\x20\x98\xa6\x8e\x18\x54\x1c\xc3\x44"
  2560. "\x33\x37\x11\xe7\x2d\x51\x18\x32\x98\x3b\xea\x1d\x68\xcd\xda\x1e\x9e\x45"
  2561. "\xa0\xc9\xb1\x51\x1a\xfa\xe9\x00\x0c\x98\xf0\xa5\x71\x12\x32\x2d\xfe\x96"
  2562. "\x0e\xa3\x3f\x00\xc2\xa2\x02\x78\x15\x3c\xbf\xe4\x67\xca\x79\xcc\xe4\xf4"
  2563. "\xdb\xcf\x0c\x8f\x93\xc7\xc8\x73\x57\x80\xd3\x02\x5b\x6c\x97\xb8\x63\xac"
  2564. "\x2b\x1d\x1d\x33\x5d\x3d\xad\x05\x64\x98\x2e\xe4\x41\x85\xbb\xff\x13\xf4"
  2565. "\x88\x51\x1a\x97\x5d\x3e\x62\x24\x68\x60\x3e\x62\xeb\x81\xa7\xac\x16\xf6"
  2566. "\x0a\xb0\x1f\xd7\x9d\x13\x1a\xda\x5b\xd7\x9f\x9b\xa6\x1b\x6a\x0a\xc5\x05"
  2567. "\x08\x25\xfa\xf2\xb9\x13\xf8\x7d\xae\x28\x61\xa2\xa3\x3a\x50\x72\x20\x7f"
  2568. "\x52\xa9\xd7\xeb\x31\x56\xd5\xb1\x72\x4e\x5b\xfc\x43\xe5\x67\x32\xa6\x41"
  2569. "\xf2\xa9\x64\x03\x0b\x30\x3c\xfd\xca\x2d\x1f\x9b\x34\x27\x3e\x0a\xc7\x23"
  2570. "\xb6\xb2\x5d\xef\xe6\xb1\x1f\x05\x50\xb2\x3d\x72\x57\x05\x33\x24\x3b\x75"
  2571. "\xfd\xbd\x2e\x90\xf9\xe7\x71\x33\x7d\xbd\x54\xdf\x9c\x2f\xaa\x8f\x97\xff"
  2572. "\xce\xa7\x5b\x3f\x49\xc9\xda\x09\x17\xfc\xe6\x35\xdb\x12\x67\x3b\x8b\x90"
  2573. "\x8a\x94\xbf\xe0\x6f\x20\xb2\xf7\xb4\x08\xe9\x52\x80\xab\x22\x55\xbd\xa2"
  2574. "\xec\xe3\xa0\x3f\x39\xa1\x9a\xef\x41\x72\x11\xfc\x3c\x14\xd8\xa0\xfe\x88"
  2575. "\x02\xd2\x7d\x61\x90\x96\x56\x43\x41\x86\x3c\xfe\xff\x27\x12\x7c\x0d\xb5"
  2576. "\x73\x35\xac\x6a\x41\xf6\xba\xca\xfe\x51\x5c\xb3\xac\x8a\xbd\xa6\x1f\xe9"
  2577. "\x99\x2e\x8f\x00\x5a\x51\x49\x38\x96\x09\x31\x87\x8e\x1f\x82\x5c\x21\x41"
  2578. "\x6f\x9d\xcf\x72\xdb\x3c\xb0\xe0\xad\xaa\x95\x14\xf2\xbb\x42\x06\xe0\x91"
  2579. "\xa7\x6d\xde\xf2\x62\xf0\x4a\xfe\x0f\xc3\x26\x9e\xbe\x81\x43\xc0\x86\x04"
  2580. "\x40\x31\xe4\xa6\x2b\x4d\x46\xd3\xf8\xff\x36\x85\xe6\x85\x04\xd4\x1e\xb6"
  2581. "\x0d\x95\x76\x63\x53\x91\xd4\x1b\x17\xb1\x44\xd0\x9a\xe3\x67\xa2\xee\x4c"
  2582. "\xde\x4f\x56\x4e\xca\x57\x3b\x61\xeb\xbe\x2c\xff\x9d\xfd\xa3\x35\x47\x03"
  2583. "\x3c\xcc\xf2\xe6\x43\x66\x2e\x70\x37\xb0\x9f\xb3\xa6\x07\x39\x56\x15\x8a"
  2584. "\xf7\xfd\x61\x6a\xfd\x2b\x6f\x86\x4b\x94\x48\x4d\x56\x82\x3e\x80\x74\x61"
  2585. "\x33\x8f\x67\xf8\xfd\xab\x75\x82\x64\x59\xdc\xe8\xd9\x31\xa9\xed\x03\xae"
  2586. "\x81\xbd\x65\x7f\x76\x19\x75\xc0\x3e\x9a\xfb\x7e\xae\x59\x44\x08\x4f\x91"
  2587. "\x26\x31\x55\x56\xb8\xb6\x72\xe5\x53\xed\x5f\xb9\x50\xb2\xb9\xcc\x81\xfb"
  2588. "\xc3\x34\x22\xc1\xb0\xc8\x96\x24\x99\xa7\xc6\x35\x7b\x6e\xd2\x7b\x6e\x91"
  2589. "\xab\xc5\xb4\x58\xa8\x5b\x1b\xb3\x05\x3b\xcc\xa1\xa1\x84\x13\x73\x5b\x06"
  2590. "\xfb\x93\x36\x3d\x81\x63\x09\x26\xec\x13\x58\x58\xd2\x20\x84\xab\x58\x18"
  2591. "\x6c\xa0\x9d\x39\x74\x43\xb9\xff\xde\xcb\xdc\x5f\x63\x77\x42\x5c\x50\x88"
  2592. "\x2b\x4c\xb1\x8f\x56\xe4\x11\x24\x5a\x51\x3f\x26\x44\x9b\xc3\xe6\x77\xc2"
  2593. "\x77\x9d\x7d\x84\xbd\x68\x18\x69\x54\x05\xfc\x70\xee\xc9\x4c\x03\xa2\x6f"
  2594. "\x58\xf8\xc3\x3f\xa8\xc9\x10\xca\xbd\x24\x1c\xad\x08\xc7\x67\x6f\xd2\x5d"
  2595. "\xba\x6f\x05\x4d\xc9\xd5\x4c\x9c\x60\x79\x01\xf6\x96\x45\x29\x26\x85\xc6"
  2596. "\x77\x21\x2e\x23\xd1\x35\x48\xba\x5c\x4e\xe7\xfc\xa6\x1f\xa0\xa6\x73\xfb"
  2597. "\x69\xb7\xc0\x36\xcf\x2a\x51\x25\xc3\xd2\x19\x4e\x6b\x57\x1c\xbb\x31\x00"
  2598. "\x73\xf4\x08\xa1\x64\x21\xcb\x85\xec\xe9\x6f\x4b\xa4\x28\x04\xc0\x9f\x96"
  2599. "\x95\x78\xaf\x5f\x5e\xa0\xcd\xe8\xac\x17\x33\x61\x8a\x52\xfd\x76\x5a\xdc"
  2600. "\x93\x8f\x3c\x8e\x66\x07\x93\xa4\xc7\xe0\x8d\x29\x5e\xe5\x0d\xd4\x24\x63"
  2601. "\x00\xfc\x2c\x30\xe6\xc7\x21\x19\x53\xc6\x33\x5e\x1a\x4e\x28\x85\x44\x75"
  2602. "\x5f\x25\x43\x98\x80\xb0\x53\xfb\x9b\xda\x17\xfa\x2f\x52\x62\xb4\xb5\xc4"
  2603. "\xfd\xbe\xf8\x8d\x62\x41\x5c\xe5\xef\xd5\x2f\x61\xca\x7c\xe7\xd8\x5e\xb9"
  2604. "\x2c\x8e\x97\xfb\x78\xf1\xca\xff\x60\x4f\xd8\x40\xb1\xca\x5f\xcf\x14\x0d"
  2605. "\x5b\xcd\x39\x79\x51\x8b\x1d\x1d\x93\xb4\xb5\x84\x12\x27\x00\x2e\x5f\xce"
  2606. "\x75\x32\x22\x83\x9d\x84\x6f\x4f\x55\x20\x3a\x69\x5c\x67\xf3\x22\x57\xb2"
  2607. "\x7d\x02\x80\xdf\x54\x9a\xe1\xd6\x8f\x34\x7a\x17\xf3\x2c\x0a\xe5\xdb\xfc"
  2608. "\x87\x11\xb2\xb9\x0f\x8e\x80\xfa\x7c\xf1\x09\x53\x8d\xff\x43\x6b\x2a\xdc"
  2609. "\x99\xf9\xb3\x99\x7f\x00\x3e\xa7\xf1\x23\x46\xcb\xd9\x90\xe3\xb5\x31\xa9"
  2610. "\x66\x8d\x28\xb8\xc0\x62\x00\x76\x5f\x09\x43\x7f\x63\x9b\x25\x26\x45\x83"
  2611. "\x77\xcf\xff\x0d\x2a\x5f\xab\x60\x55\xcb\x17\x7e\x8f\x56\x99\x76\x92\x7b"
  2612. "\xe3\x24\xdb\x16\x61\x55\x4b\xc1\xe5\x93\x2c\xa4\x64\xc1\xbc\x4a\x4a\x7e"
  2613. "\xac\x7b\xfe\x82\xb8\x2f\x3f\x23\xa2\x0e\x45\x72\xee\xb0\x7c\x89\xce\x30"
  2614. "\x0d\xe5\x6a\x8d\x77\xe5\xe5\x44\x25\xd1\xbd\xcb\xcd\x40\xf7\x01\xb6\x51"
  2615. "\x08\x2f\xf7\xab\x40\x80\x5f\x01\xea\xfb\x46\xb5\x2c\x6c\x78\xb5\x33\xd8"
  2616. "\x2b\x5f\xc4\xeb\xbb\x58\x2f\x83\xc5\xc4\x4f\x9a\xc9\x6f\x2b\x0c\x34\x6b"
  2617. "\xec\x73\xe6\x97\xd5\xe3\x4c\x26\xb8\x8c\x52\xb1\x64\x0f\xf8\x91\xbc\x5f"
  2618. "\xdf\x24\x4b\x48\x52\x40\xda\xb9\xc3\x9a\x66\x63\x36\x62\xf0\x31\x74\xe5"
  2619. "\x84\xd4\x3b\x91\xe7\x74\xe3\x51\x23\x74\xec\x64\xfe\x5a\xfe\x16\x49\xd5"
  2620. "\xe9\x89\xcd\x99\x68\x35\xf8\xff\xe4\x62\x25\xe3\x45\xdc\xb5\x68\x7e\xb9"
  2621. "\xe4\xd1\xb3\xc8\x20\x81\x3c\xed\x36\x28\x1c\xd7\x1c\xfd\x9e\x7e\x28\xa4"
  2622. "\xeb\xee\xd7\x16\xaa\x46\x15\xd0\x09\xb4\x52\xfe\xc6\x25\xdd\xa8\x84\xb2"
  2623. "\x40\xf7\xb0\x8d\x4d\x7e\x5a\xb1\x13\x93\x6d\xd8\xf7\x05\xe7\xc4\x3d\xc4"
  2624. "\xcf\x33\x03\x86\x0c\x0c\xf2\x51\x20\xc3\x53\x49\x3b\xb2\x6b\x77\xc9\x57"
  2625. "\xf8\xeb\xa8\x44\x58\x04\x18\x24\xd9\x43\xd2\xaf\x92\x6f\xcc\x14\x2a\x7b"
  2626. "\x0a\x57\xa8\xd1\x20\x3e\x33\x6f\xfb\x6f\x46\xcc\x8d\x8f\x1b\x0c\xdb\x57"
  2627. "\xde\xab\xe5\x38\x29\xd8\x87\x4f\x1e\x97\xc4\x88\x03\x84\x9c\x28\x01\x64"
  2628. "\x13\x5b\x49\x6a\xa0\x1b\x30\xc0\xf6\xa7\x92\x75\x6c\xff\xe1\xf4\xfd\x46"
  2629. "\x5f\x1a\xcd\x6e\x5f\x6c\x83\x0d\x2b\x0e\x6a\xab\x98\x34\xed\xfb\x63\xc9"
  2630. "\x36\xfe\x0c\x64\x7d\xde\xa7\xe7\xa0\xff\xa7\x5e\xf7\xb0\x6d\xec\xa2\x48"
  2631. "\xdf\x85\xfd\xef\x32\xde\x3a\x26\xb0\x4c\x3f\xf6\xc5\xc2\x8f\xd1\x10\x90"
  2632. "\x2e\x00\xf1\xd9\x5c\x55\xe2\x7a\x0b\x51\xe6\x57\x23\xe7\x29\x13\x6f\x56"
  2633. "\x31\x8a\x48\x8c\x3b\x7e\xaa\xdc\x93\xd8\x2f\x1e\x77\xfa\xf2\x72\xf1\x57"
  2634. "\x38\x08\x8a\x4c\xb4\xc8\xba\x45\x59\xf1\x26\x48\xd7\xed\x60\x2a\x8b\xe4"
  2635. "\xde\x6a\xee\x3c\x4f\x01\xf8\x82\x83\x20\x85\x29\xd8\x85\x08\x89\x75\x36"
  2636. "\x19\xd1\xb5\x80\xab\xcb\xc3\x4f\xd3\x9f\xa2\xeb\xed\x19\x95\x15\x8a\x00"
  2637. "\xbf\x84",
  2638. 4088);
  2639. syscall(__NR_ioctl, /*fd=*/r[31], /*cmd=*/0x5000940a,
  2640. /*arg=*/0x200000000740ul);
  2641. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/3);
  2642. *(uint64_t*)0x2000000018c0 = 0x200000001740;
  2643. *(uint16_t*)0x200000001740 = 0x10;
  2644. *(uint16_t*)0x200000001742 = 0;
  2645. *(uint32_t*)0x200000001744 = 0;
  2646. *(uint32_t*)0x200000001748 = 0x2000000;
  2647. *(uint32_t*)0x2000000018c8 = 0xc;
  2648. *(uint64_t*)0x2000000018d0 = 0x200000001880;
  2649. *(uint64_t*)0x200000001880 = 0x200000001780;
  2650. *(uint32_t*)0x200000001780 = 0xd4;
  2651. *(uint16_t*)0x200000001784 = 0;
  2652. *(uint16_t*)0x200000001786 = 2;
  2653. *(uint32_t*)0x200000001788 = 0x70bd28;
  2654. *(uint32_t*)0x20000000178c = 0x25dfdbfd;
  2655. *(uint8_t*)0x200000001790 = 0xf;
  2656. *(uint8_t*)0x200000001791 = 0;
  2657. *(uint16_t*)0x200000001792 = 0;
  2658. *(uint16_t*)0x200000001794 = 0xe;
  2659. *(uint16_t*)0x200000001796 = 1;
  2660. memcpy((void*)0x200000001798, "netdevsim\000", 10);
  2661. *(uint16_t*)0x2000000017a4 = 0xf;
  2662. *(uint16_t*)0x2000000017a6 = 2;
  2663. memcpy((void*)0x2000000017a8, "netdevsim", 9);
  2664. *(uint8_t*)0x2000000017b1 = 0x30;
  2665. *(uint8_t*)0x2000000017b2 = 0;
  2666. *(uint16_t*)0x2000000017b4 = 8;
  2667. *(uint16_t*)0x2000000017b6 = 0xb;
  2668. *(uint32_t*)0x2000000017b8 = 1;
  2669. *(uint16_t*)0x2000000017bc = 6;
  2670. *(uint16_t*)0x2000000017be = 0x11;
  2671. *(uint16_t*)0x2000000017c0 = 7;
  2672. *(uint16_t*)0x2000000017c4 = 0xe;
  2673. *(uint16_t*)0x2000000017c6 = 1;
  2674. memcpy((void*)0x2000000017c8, "netdevsim\000", 10);
  2675. *(uint16_t*)0x2000000017d4 = 0xf;
  2676. *(uint16_t*)0x2000000017d6 = 2;
  2677. memcpy((void*)0x2000000017d8, "netdevsim", 9);
  2678. *(uint8_t*)0x2000000017e1 = 0x30;
  2679. *(uint8_t*)0x2000000017e2 = 0;
  2680. *(uint16_t*)0x2000000017e4 = 8;
  2681. *(uint16_t*)0x2000000017e6 = 0xb;
  2682. *(uint32_t*)0x2000000017e8 = 0;
  2683. *(uint16_t*)0x2000000017ec = 6;
  2684. *(uint16_t*)0x2000000017ee = 0x11;
  2685. *(uint16_t*)0x2000000017f0 = 3;
  2686. *(uint16_t*)0x2000000017f4 = 0xe;
  2687. *(uint16_t*)0x2000000017f6 = 1;
  2688. memcpy((void*)0x2000000017f8, "netdevsim\000", 10);
  2689. *(uint16_t*)0x200000001804 = 0xf;
  2690. *(uint16_t*)0x200000001806 = 2;
  2691. memcpy((void*)0x200000001808, "netdevsim", 9);
  2692. *(uint8_t*)0x200000001811 = 0x30;
  2693. *(uint8_t*)0x200000001812 = 0;
  2694. *(uint16_t*)0x200000001814 = 8;
  2695. *(uint16_t*)0x200000001816 = 0xb;
  2696. *(uint32_t*)0x200000001818 = 4;
  2697. *(uint16_t*)0x20000000181c = 6;
  2698. *(uint16_t*)0x20000000181e = 0x11;
  2699. *(uint16_t*)0x200000001820 = 0xdb81;
  2700. *(uint16_t*)0x200000001824 = 0xe;
  2701. *(uint16_t*)0x200000001826 = 1;
  2702. memcpy((void*)0x200000001828, "netdevsim\000", 10);
  2703. *(uint16_t*)0x200000001834 = 0xf;
  2704. *(uint16_t*)0x200000001836 = 2;
  2705. memcpy((void*)0x200000001838, "netdevsim", 9);
  2706. *(uint8_t*)0x200000001841 = 0x30;
  2707. *(uint8_t*)0x200000001842 = 0;
  2708. *(uint16_t*)0x200000001844 = 8;
  2709. *(uint16_t*)0x200000001846 = 0xb;
  2710. *(uint32_t*)0x200000001848 = 3;
  2711. *(uint16_t*)0x20000000184c = 6;
  2712. *(uint16_t*)0x20000000184e = 0x11;
  2713. *(uint16_t*)0x200000001850 = 0x14;
  2714. *(uint64_t*)0x200000001888 = 0xd4;
  2715. *(uint64_t*)0x2000000018d8 = 1;
  2716. *(uint64_t*)0x2000000018e0 = 0;
  2717. *(uint64_t*)0x2000000018e8 = 0;
  2718. *(uint32_t*)0x2000000018f0 = 0x48004;
  2719. syscall(__NR_sendmsg, /*fd=*/r[30], /*msg=*/0x2000000018c0ul,
  2720. /*f=MSG_DONTWAIT*/ 0x40ul);
  2721. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/9);
  2722. syz_sysconfig_set__proc_sys_net_ipv6_conf_sit0_accept_source_route(/*val=*/3);
  2723. syscall(
  2724. __NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xff5000ul, /*prot=*/0ul,
  2725. /*flags=MAP_POPULATE|MAP_NORESERVE|MAP_NONBLOCK|MAP_HUGETLB|MAP_FIXED|0x2000000000821*/
  2726. 0x200000005c831ul, /*fd=*/-1, /*offset=*/0ul);
  2727. memcpy((void*)0x2000000001c0, "mounts\000", 7);
  2728. res = -1;
  2729. res = syz_open_procfs(/*pid=*/0, /*file=*/0x2000000001c0);
  2730. if (res != -1)
  2731. r[33] = res;
  2732. memcpy((void*)0x200000002b80,
  2733. "\276\375\031m\373\020\323\316`\261\325-g\245\354v\225\305:O`"
  2734. "\231\227\233_\037S\341\266\341*"
  2735. "\267\337\322E\347\\\301\360\225\217W\2229L\321\222="
  2736. "o\315\2239\202K\203\335\256\367\242\302\306\230\305\330\251\245|("
  2737. "M\2316\241\314\223$\275\3775AwUB\302)\265\356$"
  2738. "\345\223\016T\231\273\225\336\031\n,\361\236f\256\2531@"
  2739. "d\350\033h\201h1\033#k6",
  2740. 116);
  2741. syscall(__NR_memfd_create, /*name=*/0x200000002b80ul,
  2742. /*flags=MFD_HUGETLB|MFD_CLOEXEC*/ 5ul);
  2743. res = -1;
  2744. res = syz_open_dev(/*dev=*/0xc, /*major=*/4, /*minor=*/1);
  2745. if (res != -1)
  2746. r[34] = res;
  2747. memcpy((void*)0x200000000100, "#! ", 3);
  2748. memcpy((void*)0x200000000103, "./file0", 7);
  2749. *(uint8_t*)0x20000000010a = 0xa;
  2750. memcpy((void*)0x20000000010b, "\xb3\x29\x0d", 3);
  2751. syscall(__NR_write, /*fd=*/r[34], /*data=*/0x200000000100ul, /*len=*/0xeul);
  2752. for (int i = 0; i < 64; i++) {
  2753. syscall(__NR_write, /*fd=*/r[34], /*data=*/0x200000000100ul, /*len=*/0xeul);
  2754. }
  2755. *(uint16_t*)0x200000000080 = 4;
  2756. *(uint64_t*)0x200000000088 = 0x200000000040;
  2757. *(uint16_t*)0x200000000040 = 1;
  2758. *(uint8_t*)0x200000000042 = 0xf7;
  2759. *(uint8_t*)0x200000000043 = 6;
  2760. *(uint32_t*)0x200000000044 = 9;
  2761. *(uint16_t*)0x200000000048 = 0x800;
  2762. *(uint8_t*)0x20000000004a = 7;
  2763. *(uint8_t*)0x20000000004b = 8;
  2764. *(uint32_t*)0x20000000004c = 2;
  2765. *(uint16_t*)0x200000000050 = 0xc2;
  2766. *(uint8_t*)0x200000000052 = 3;
  2767. *(uint8_t*)0x200000000053 = 0x40;
  2768. *(uint32_t*)0x200000000054 = 8;
  2769. *(uint16_t*)0x200000000058 = 0xdf1;
  2770. *(uint8_t*)0x20000000005a = 0x40;
  2771. *(uint8_t*)0x20000000005b = 3;
  2772. *(uint32_t*)0x20000000005c = 0x3721;
  2773. res = syscall(__NR_seccomp, /*op=*/1ul,
  2774. /*flags=SECCOMP_FILTER_FLAG_NEW_LISTENER*/ 8ul,
  2775. /*arg=*/0x200000000080ul);
  2776. for (int i = 0; i < 64; i++) {
  2777. syscall(__NR_seccomp, /*op=*/1ul,
  2778. /*flags=SECCOMP_FILTER_FLAG_NEW_LISTENER*/ 8ul,
  2779. /*arg=*/0x200000000080ul);
  2780. }
  2781. if (res != -1)
  2782. r[35] = res;
  2783. syscall(__NR_dup3, /*oldfd=*/r[35], /*newfd=*/r[33], /*flags=*/0ul);
  2784. for (int i = 0; i < 64; i++) {
  2785. syscall(__NR_dup3, /*oldfd=*/r[35], /*newfd=*/r[33], /*flags=*/0ul);
  2786. }
  2787. syscall(__NR_sendfile, /*fdout=*/r[35], /*fdin=*/r[35], /*off=*/0ul,
  2788. /*count=*/0x100000002ul);
  2789. for (int i = 0; i < 64; i++) {
  2790. syscall(__NR_sendfile, /*fdout=*/r[35], /*fdin=*/r[35], /*off=*/0ul,
  2791. /*count=*/0x100000002ul);
  2792. }
  2793. syscall(__NR_mprotect, /*addr=*/0x200000000000ul, /*len=*/0x800000ul,
  2794. /*prot=PROT_SEM|PROT_EXEC*/ 0xcul);
  2795. syscall(__NR_mremap, /*addr=*/0x200000000000ul, /*len=*/0x600000ul,
  2796. /*newlen=*/0x600000ul, /*flags=MREMAP_FIXED|MREMAP_MAYMOVE*/ 3ul,
  2797. /*newaddr=*/0x200000a00000ul);
  2798. res = -1;
  2799. res = syz_init_net_socket(/*domain=*/0x10, /*type=*/3, /*proto=*/0x10);
  2800. if (res != -1)
  2801. r[36] = res;
  2802. memcpy((void*)0x200000000000, "NLBL_UNLBL\000", 11);
  2803. res = -1;
  2804. res = syz_genetlink_get_family_id(/*name=*/0x200000000000, /*fd=*/r[36]);
  2805. if (res != -1)
  2806. r[37] = res;
  2807. res = -1;
  2808. res = syz_init_net_socket(/*domain=*/0x10, /*type=*/3, /*proto=*/0x10);
  2809. if (res != -1)
  2810. r[38] = res;
  2811. *(uint64_t*)0x200000000200 = 0;
  2812. *(uint32_t*)0x200000000208 = 0;
  2813. *(uint64_t*)0x200000000210 = 0x200000000140;
  2814. *(uint64_t*)0x200000000140 = 0x2000000000c0;
  2815. memcpy((void*)0x2000000000c0, "\x44\xdd\x9b\x9b", 4);
  2816. *(uint16_t*)0x2000000000c4 = r[37];
  2817. memcpy((void*)0x2000000000c6,
  2818. "\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x14\x00\x03"
  2819. "\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2820. "\x14\x00\x02\x00\xfc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2821. "\x00\x00\x00\x08\x00\x04\x00\x7f\x00\x00\x01",
  2822. 62);
  2823. *(uint64_t*)0x200000000148 = 0x44;
  2824. *(uint64_t*)0x200000000218 = 1;
  2825. *(uint64_t*)0x200000000220 = 0;
  2826. *(uint64_t*)0x200000000228 = 0;
  2827. *(uint32_t*)0x200000000230 = 0;
  2828. syscall(__NR_sendmsg, /*fd=*/r[38], /*msg=*/0x200000000200ul, /*f=*/0ul);
  2829. memcpy((void*)0x200000000000, "/dev/vcsa#\000", 11);
  2830. res = -1;
  2831. res = syz_open_dev(/*dev=*/0x200000000000, /*id=*/6, /*flags=*/0);
  2832. if (res != -1)
  2833. r[39] = res;
  2834. *(uint64_t*)0x200000000380 = 0x200000000280;
  2835. *(uint64_t*)0x200000000388 = 0xed;
  2836. syscall(__NR_preadv, /*fd=*/r[39], /*vec=*/0x200000000380ul, /*vlen=*/1ul,
  2837. /*off_low=*/8, /*off_high=*/0);
  2838. res = syscall(__NR_geteuid);
  2839. if (res != -1)
  2840. r[40] = res;
  2841. res =
  2842. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0xb704, /*arg=*/0x200000000040ul);
  2843. if (res != -1)
  2844. r[41] = *(uint32_t*)0x200000000040;
  2845. memcpy((void*)0x200000000180, "vfat\000", 5);
  2846. memcpy((void*)0x200000000000, "./file0\000", 8);
  2847. memcpy((void*)0x2000000002c0, "uni_xlate=1", 11);
  2848. *(uint8_t*)0x2000000002cb = 0x2c;
  2849. memcpy((void*)0x2000000002cc, "errors=continue", 15);
  2850. *(uint8_t*)0x2000000002db = 0x2c;
  2851. memcpy((void*)0x2000000002dc, "utf8=0", 6);
  2852. *(uint8_t*)0x2000000002e2 = 0x2c;
  2853. memcpy((void*)0x2000000002e3, "nocase", 6);
  2854. *(uint8_t*)0x2000000002e9 = 0x2c;
  2855. memcpy((void*)0x2000000002ea, "nonumtail=0", 11);
  2856. *(uint8_t*)0x2000000002f5 = 0x2c;
  2857. memcpy((void*)0x2000000002f6, "utf8=1", 6);
  2858. *(uint8_t*)0x2000000002fc = 0x2c;
  2859. memcpy((void*)0x2000000002fd, "uid", 3);
  2860. *(uint8_t*)0x200000000300 = 0x3d;
  2861. sprintf((char*)0x200000000301, "0x%016llx", (long long)0);
  2862. *(uint8_t*)0x200000000313 = 0x2c;
  2863. memcpy((void*)0x200000000314, "rodir", 5);
  2864. *(uint8_t*)0x200000000319 = 0x2c;
  2865. memcpy((void*)0x20000000031a, "nfs", 3);
  2866. *(uint8_t*)0x20000000031d = 0x2c;
  2867. memcpy((void*)0x20000000031e, "shortname=lower", 15);
  2868. *(uint8_t*)0x20000000032d = 0x2c;
  2869. memcpy((void*)0x20000000032e, "fmask", 5);
  2870. *(uint8_t*)0x200000000333 = 0x3d;
  2871. sprintf((char*)0x200000000334, "%023llo", (long long)2);
  2872. *(uint8_t*)0x20000000034b = 0x2c;
  2873. memcpy((void*)0x20000000034c, "shortname=win95", 15);
  2874. *(uint8_t*)0x20000000035b = 0x2c;
  2875. memcpy((void*)0x20000000035c, "nfs", 3);
  2876. *(uint8_t*)0x20000000035f = 0x2c;
  2877. memcpy((void*)0x200000000360, "nonumtail=0", 11);
  2878. *(uint8_t*)0x20000000036b = 0x2c;
  2879. memcpy((void*)0x20000000036c, "utf8=0", 6);
  2880. *(uint8_t*)0x200000000372 = 0x2c;
  2881. memcpy((void*)0x200000000373, "uni_xlate=1", 11);
  2882. *(uint8_t*)0x20000000037e = 0x2c;
  2883. memcpy((void*)0x20000000037f, "nonumtail=0", 11);
  2884. *(uint8_t*)0x20000000038a = 0x2c;
  2885. memcpy((void*)0x20000000038b, "obj_type", 8);
  2886. *(uint8_t*)0x200000000393 = 0x3d;
  2887. memcpy((void*)0x200000000394, "%,*@(!(:#\254[", 11);
  2888. *(uint8_t*)0x20000000039f = 0x2c;
  2889. memcpy((void*)0x2000000003a0, "mask", 4);
  2890. *(uint8_t*)0x2000000003a4 = 0x3d;
  2891. memcpy((void*)0x2000000003a5, "MAY_EXEC", 8);
  2892. *(uint8_t*)0x2000000003ad = 0x2c;
  2893. memcpy((void*)0x2000000003ae, "uid", 3);
  2894. *(uint8_t*)0x2000000003b1 = 0x3d;
  2895. sprintf((char*)0x2000000003b2, "%020llu", (long long)r[40]);
  2896. *(uint8_t*)0x2000000003c6 = 0x2c;
  2897. memcpy((void*)0x2000000003c7, "uid<", 4);
  2898. sprintf((char*)0x2000000003cb, "%020llu", (long long)r[41]);
  2899. *(uint8_t*)0x2000000003df = 0x2c;
  2900. memcpy((void*)0x2000000003e0, "dont_appraise", 13);
  2901. *(uint8_t*)0x2000000003ed = 0x2c;
  2902. memcpy((void*)0x2000000003ee, "uid>", 4);
  2903. sprintf((char*)0x2000000003f2, "%020llu", (long long)r[40]);
  2904. *(uint8_t*)0x200000000406 = 0x2c;
  2905. memcpy((void*)0x200000000407, "uid<", 4);
  2906. sprintf((char*)0x20000000040b, "%020llu", (long long)r[41]);
  2907. *(uint8_t*)0x20000000041f = 0x2c;
  2908. *(uint8_t*)0x200000000420 = 0;
  2909. memcpy(
  2910. (void*)0x200000002300,
  2911. "\x78\x9c\xec\xdd\x3f\x6b\x23\x47\x14\x00\xf0\xb7\xb2\x2c\x29\x49\x21\x15"
  2912. "\xa9\x42\x20\x0b\x49\x91\xca\xd8\x6e\xd3\xc8\x04\x1b\x4c\x54\x25\xa8\x48"
  2913. "\x52\x24\x26\xb6\x21\x58\x22\x60\x83\x21\x7f\x88\xe2\x2a\x6d\x9a\x94\xf9"
  2914. "\x04\x81\x40\xba\xfb\x12\xd7\xdc\x37\x38\xb8\xf6\xe0\xba\x73\x61\xd8\x63"
  2915. "\xa5\xdd\x93\xec\x93\x65\xeb\xb0\xec\xfb\xf3\xfb\x35\x1e\xcf\xce\x9b\x79"
  2916. "\x33\x1e\x6c\x5c\xec\xd3\xf7\x1f\xf6\x0f\x76\xd3\xd8\x3f\xf9\xed\x61\x34"
  2917. "\x1a\x49\x54\xda\xd1\x8e\xd3\x24\x5a\x51\x89\xd2\x1f\x71\x4e\xfb\xaf\x00"
  2918. "\x00\x5e\x67\xa7\x59\x16\x4f\xb2\x91\x79\xe2\x92\x88\x68\x2c\x2e\x2d\x00"
  2919. "\x60\x81\xe6\xfe\xfb\xff\xff\xc2\x53\x02\x00\x16\xec\xab\xaf\xbf\xf9\x62"
  2920. "\xa3\xd3\xd9\xfc\x32\x4d\x1b\xb1\xd5\xff\xf3\xb8\x9b\xff\x67\x9f\x7f\x1d"
  2921. "\x3d\xdf\xd8\x8f\x1f\xa3\x17\x7b\xb1\x1a\xcd\x38\x8b\xc8\x9e\x1b\xb5\xb7"
  2922. "\xb2\x2c\x1b\x54\xd3\x5c\x2b\x3e\xe9\x0f\x8e\xbb\x79\x64\xff\xbb\xfb\xc5"
  2923. "\xfc\x1b\x8f\x23\x86\xf1\x6b\xd1\x8c\xd6\xb0\xeb\x7c\xfc\x76\x67\x73\x2d"
  2924. "\x1d\x99\x88\x1f\xe4\x79\xbc\x5b\xac\xdf\xce\xe3\xd7\xa3\x19\xef\x4f\x59"
  2925. "\x7f\xbb\xb3\xb9\x3e\x25\x3e\xba\xb5\xf8\xf4\xe3\x89\xfc\x57\xa2\x19\x0f"
  2926. "\x7e\x88\x9f\xa2\x17\xbb\xc3\x24\xc6\xf1\xbf\xaf\xa5\xe9\xe7\xd9\xdf\x4f"
  2927. "\x7f\xfd\x36\x4f\x2f\x8f\x4f\x06\xc7\xdd\xfa\x70\xdc\x58\xb6\x74\xcb\x3f"
  2928. "\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2929. "\xde\x60\x2b\x45\xed\x9c\x7a\x0c\xeb\xf7\xe4\x5d\x45\xfd\x9d\xa5\xb3\xfc"
  2930. "\x9b\xe5\x48\x4b\xad\xf3\xf5\x79\x46\xf1\x49\x39\xd1\x85\xfa\x40\x83\x2c"
  2931. "\xfe\x29\xeb\xeb\xac\xa6\x69\x9a\x15\x03\xc7\xf1\xd5\xf8\xa0\x1a\xd5\xbb"
  2932. "\xd9\x35\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc"
  2933. "\x5a\x8e\x7e\xfe\xe5\x60\xa7\xd7\xdb\x3b\xbc\x91\x46\x59\x0d\xa0\x7c\xad"
  2934. "\xff\x65\xe7\x69\x4f\xf4\x7c\x14\xb3\x07\xd7\xc7\x6b\x55\x8a\xe6\x8c\x99"
  2935. "\x63\xa9\x1c\x93\x44\xcc\x4c\x23\xdf\xc4\x0d\x1d\xcb\x55\x8d\x77\x2e\xcb"
  2936. "\xf9\xdf\xff\xe6\x9d\xb0\x71\xf5\x98\xe5\x59\xe7\x73\x33\x8d\xf2\x76\x1d"
  2937. "\xec\x24\xd3\xcf\xb0\x1e\x65\x4f\xa3\xbc\x24\xf7\x26\xc7\xd4\xe2\x9a\x6b"
  2938. "\xd5\x2e\x7b\x94\xcd\x75\xfd\x6a\x53\x1f\x35\xe7\xde\x7b\xed\xbd\x61\x63"
  2939. "\x30\x63\x4c\x24\xb3\x12\xfb\xec\xd1\xe8\xe4\x8a\x9e\xe4\xe2\x2e\x6a\xc3"
  2940. "\x53\x9d\x1a\xbe\x5c\x34\x26\xc2\x2f\xdc\x8d\xb9\xee\xf3\x8b\xbf\x2b\x12"
  2941. "\xd5\x3a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x60\xa1"
  2942. "\xc6\x2f\xfd\x4e\x79\x78\x32\x33\xb4\x92\xd5\x17\x96\x16\x00\x00\x00\x00"
  2943. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2944. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\xdc\xaa\xf1\xe7\xff\xcf\xd1\x18\x14"
  2945. "\xc1\xd7\x18\x5c\x8b\xc3\xa3\x3b\xde\x22\x00\x00\x00\x00\x00\x00\x00\x00"
  2946. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  2947. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6f\x81\x67\x01\x00"
  2948. "\x00\xff\xff\xc3\x51\x62\x02",
  2949. 673);
  2950. syz_mount_image(
  2951. /*fs=*/0x200000000180, /*dir=*/0x200000000000,
  2952. /*flags=MS_I_VERSION|MS_NOSUID|MS_NOEXEC|MS_DIRSYNC*/ 0x80008a,
  2953. /*opts=*/0x2000000002c0, /*chdir=*/7, /*size=*/0x2a1,
  2954. /*img=*/0x200000002300);
  2955. memcpy((void*)0x200000000000, "./file0\000", 8);
  2956. syscall(__NR_creat, /*file=*/0x200000000000ul, /*mode=*/0ul);
  2957. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0x88);
  2958. if (res != -1)
  2959. r[42] = res;
  2960. *(uint16_t*)0x200000000040 = 1;
  2961. *(uint64_t*)0x200000000048 = 0x200000000000;
  2962. *(uint16_t*)0x200000000000 = 6;
  2963. *(uint8_t*)0x200000000002 = 0;
  2964. *(uint8_t*)0x200000000003 = 0;
  2965. *(uint32_t*)0x200000000004 = 0x7fc00100;
  2966. res = syscall(__NR_seccomp, /*op=*/1ul,
  2967. /*flags=SECCOMP_FILTER_FLAG_NEW_LISTENER*/ 8ul,
  2968. /*arg=*/0x200000000040ul);
  2969. if (res != -1)
  2970. r[43] = res;
  2971. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0xc0182101, /*arg=*/0ul);
  2972. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/1ul, /*proto=*/0);
  2973. if (res != -1)
  2974. r[44] = res;
  2975. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0);
  2976. if (res != -1)
  2977. r[45] = res;
  2978. *(uint32_t*)0x200000000080 = 0xbd9;
  2979. syscall(__NR_setsockopt, /*fd=*/r[45], /*level=*/1,
  2980. /*optname=SO_TIMESTAMPING_NEW*/ 0x41, /*optval=*/0x200000000080ul,
  2981. /*optlen=*/4ul);
  2982. *(uint32_t*)0x200000000000 = 0x918;
  2983. syscall(__NR_setsockopt, /*fd=*/r[45], /*level=*/1,
  2984. /*optname=SO_TIMESTAMPING_OLD*/ 0x25, /*optval=*/0x200000000000ul,
  2985. /*optlen=*/4ul);
  2986. *(uint32_t*)0x2000000000c0 = 0;
  2987. syscall(__NR_getsockopt, /*fd=*/r[44], /*level=*/1, /*optname=*/0x26,
  2988. /*optval=*/0ul, /*optlen=*/0x2000000000c0ul);
  2989. res = syscall(__NR_ioctl, /*fd=*/r[43], /*cmd=*/0xc0502100,
  2990. /*arg=*/0x200000000280ul);
  2991. if (res != -1)
  2992. r[46] = *(uint64_t*)0x200000000280;
  2993. *(uint64_t*)0x200000000240 = r[46];
  2994. *(uint64_t*)0x200000000248 = 0;
  2995. *(uint32_t*)0x200000000250 = 0;
  2996. *(uint32_t*)0x200000000254 = 0;
  2997. syscall(__NR_ioctl, /*fd=*/r[43], /*cmd=*/0xc0182101,
  2998. /*arg=*/0x200000000240ul);
  2999. res = syscall(__NR_ioctl, /*fd=*/r[43], /*cmd=*/0xc0502100,
  3000. /*arg=*/0x200000000400ul);
  3001. if (res != -1)
  3002. r[47] = *(uint64_t*)0x200000000400;
  3003. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
  3004. if (res != -1)
  3005. r[48] = res;
  3006. *(uint64_t*)0x200000000140 = r[47];
  3007. *(uint32_t*)0x200000000148 = 2;
  3008. *(uint32_t*)0x20000000014c = r[48];
  3009. *(uint32_t*)0x200000000150 = 0;
  3010. *(uint32_t*)0x200000000154 = 0;
  3011. syscall(__NR_ioctl, /*fd=*/r[43], /*cmd=*/0x40182103,
  3012. /*arg=*/0x200000000140ul);
  3013. *(uint32_t*)0x200000000280 = 5;
  3014. res = syscall(__NR_getsockopt, /*fd=*/r[42], /*level=*/1, /*optname=*/0x11,
  3015. /*optval=*/0x200000000240ul, /*optlen=*/0x200000000280ul);
  3016. if (res != -1)
  3017. r[49] = *(uint32_t*)0x200000000244;
  3018. syscall(__NR_setreuid, /*ruid=*/0, /*euid=*/r[49]);
  3019. memcpy((void*)0x200000000080, "./file0\000", 8);
  3020. syscall(__NR_utimes, /*filename=*/0x200000000080ul, /*times=*/0ul);
  3021. memcpy((void*)0x200000000440, "ext4\000", 5);
  3022. memcpy((void*)0x200000000480, "./file0\000", 8);
  3023. *(uint8_t*)0x200000000000 = 0;
  3024. memcpy(
  3025. (void*)0x200000001900,
  3026. "\x78\x9c\xec\xdc\x4b\x6f\x1c\x45\x1e\x00\xf0\x7f\xf7\xd8\x79\x6c\xe2\xb5"
  3027. "\x37\xbb\x0b\xe4\x01\x18\x02\xc2\xe2\x61\xc7\xce\xf3\xc0\x05\x04\x52\x2e"
  3028. "\x20\x24\x38\x84\xa3\xb1\x9d\x28\xc4\x49\x50\x6c\x24\x12\x59\xc4\x20\x14"
  3029. "\x8e\x28\x9f\x00\x38\x22\xf1\x09\x38\xc1\x05\xf1\xb8\x80\xb8\x82\xb8\x22"
  3030. "\xa4\x08\xf9\x92\xc0\x01\x35\xea\x99\x6e\x67\x62\x7b\x9c\x19\x7b\xec\x49"
  3031. "\x32\xbf\x9f\xd4\x49\x55\x77\x4d\x57\xfd\xbb\xbb\xec\xea\x2a\x8d\x03\xe8"
  3032. "\x5a\x83\xf9\x3f\x49\xc4\xce\x88\xf8\x39\x22\xfa\x6b\xd9\x5b\x0b\x0c\xd6"
  3033. "\xfe\xbb\xb1\x30\x37\xf1\xe7\xc2\xdc\x44\x12\x59\xf6\xea\x1f\x49\xb5\xdc"
  3034. "\xf5\x85\xb9\x89\xb2\x68\xf9\xb9\x1d\x45\x66\x28\x8d\x48\x3f\x48\x62\xef"
  3035. "\x0a\xf5\xce\x5c\xbc\x74\x66\x7c\x7a\x7a\xea\x42\x91\x1f\x99\x3d\xfb\xd6"
  3036. "\xc8\xcc\xc5\x4b\xcf\x9c\x3e\x3b\x7e\x6a\xea\xd4\xd4\xb9\xb1\x63\xc7\x0e"
  3037. "\x1d\xdc\x7e\xf4\xc8\xd8\xe1\xb6\xc4\xd9\x97\xb7\x75\xcf\xbb\xe7\xf7\xed"
  3038. "\x3e\xfe\xfa\xd5\x97\x26\x4e\x5c\x7d\xe3\xdb\xcf\xf3\xf6\x66\xc5\xf1\xfa"
  3039. "\x38\x6a\x06\xd6\x5d\xe7\x60\x0c\xde\x7a\x2d\xeb\x3c\xbe\xee\xb3\xdf\x59"
  3040. "\xfa\xea\xd2\x49\x4f\x07\x1b\x42\x4b\x2a\x11\x91\xdf\xae\xde\x6a\xff\xef"
  3041. "\x8f\x4a\xdc\xbc\x79\xfd\xf1\xe2\xfb\x1d\x6d\x1c\xb0\xa1\xb2\x2c\xcb\xb6"
  3042. "\x2e\xdb\x5b\x29\x13\xf3\x19\x70\x0f\x4b\xa2\xd3\x2d\x00\x3a\xa3\xfc\x45"
  3043. "\x7f\x7d\x21\x7f\x53\x9d\x9b\x58\xfe\x1e\x7c\x6f\xbb\xf6\x5c\xed\x55\x3f"
  3044. "\x8f\xfb\x46\xb1\xd5\x8e\xf4\x44\x9a\xbf\xc3\x0f\xd4\xde\x8d\xd2\x0d\xaa"
  3045. "\xff\x7f\x11\x71\x62\xfe\xaf\x8f\xf3\x2d\x56\x9c\x87\x00\x00\x68\xaf\x2f"
  3046. "\xf3\xf1\xcf\xd3\xb5\x71\x47\xb9\xd5\x8e\xa4\x71\x5f\x5d\xb9\x7f\x17\x6b"
  3047. "\x43\x03\x11\xf1\x9f\x88\xd8\x15\x11\xff\x2d\xc6\x2f\xff\x8f\xa8\x96\xbd"
  3048. "\x3f\x22\x1e\x58\x5e\x45\xa3\x25\x90\xaa\xc1\x25\xf9\xe5\xe3\x9f\x1f\xb7"
  3049. "\xaf\x39\xb8\x26\xe4\xe3\xbf\x67\x8b\xb5\xad\x5b\xc7\x7f\x8b\x23\xbe\x81"
  3050. "\x4a\x91\xeb\xab\xc6\xdf\x9b\x9c\x3c\x3d\x3d\x75\xa0\xb8\x26\x43\xd1\xbb"
  3051. "\x35\xcf\x8f\xae\x52\xc7\x57\x2f\xfc\xf4\x51\xa3\x63\x83\x75\xe3\xbf\x7c"
  3052. "\xcb\xeb\x2f\xc7\x82\x45\x3b\x7e\xef\x59\x32\x41\x37\x39\x3e\x3b\xbe\x9e"
  3053. "\x98\xeb\x5d\x7b\x2f\x62\x4f\xcf\x4a\xf1\x27\x8b\x2b\x01\xf9\x0d\xdc\x1d"
  3054. "\x11\x7b\xd6\x70\xfe\xfc\x9a\x9d\x7e\xf2\xb3\x7d\x8d\x8e\xdf\x3e\xfe\x55"
  3055. "\xb4\x61\x9d\x29\xfb\x34\xe2\x89\xda\xfd\x9f\x8f\x25\xf1\x97\x92\x86\xeb"
  3056. "\x93\xa3\x47\x8f\x8c\x1d\x1e\xd9\x16\xd3\x53\x07\x46\xca\xa7\x62\xb9\xef"
  3057. "\x7e\xb8\xf2\x4a\xa3\xfa\xf3\xf8\x5f\xfe\xfe\xe6\x35\x68\x29\xfe\x36\xc8"
  3058. "\xef\xff\xbf\x56\x7c\xfe\x17\xe3\x1f\x48\xea\xd7\x6b\x67\x5a\xaf\xe3\xca"
  3059. "\x2f\x1f\x36\x7c\xa7\x59\xeb\xf3\xbf\x25\x79\xad\x9a\xde\x52\xec\x7b\x67"
  3060. "\x7c\x76\xf6\xc2\x68\xc4\x96\x64\x7e\xf9\xfe\xb1\x9b\x9f\x2d\xf3\x65\xf9"
  3061. "\x3c\xfe\xa1\xfd\x2b\xf7\xff\x5d\x11\x7f\x7f\x52\x7c\x6e\x6f\x44\xe4\x0f"
  3062. "\xf1\x83\x11\xf1\x50\x44\x3c\x5c\xb4\xfd\x91\x88\x78\x34\x22\xf6\xaf\x12"
  3063. "\xff\x37\xcf\x3f\xf6\xe6\xda\xe3\xdf\x58\x79\xfc\x93\x2d\xdd\xff\x8b\x97"
  3064. "\x92\x32\x71\xa6\xb9\x44\xe5\xcc\xd7\x5f\x34\xaa\xbf\xb9\xfb\x7f\xa8\x9a"
  3065. "\x1a\x2a\xf6\x4c\x8e\xcf\x6e\xbb\x5d\x5c\xcd\x36\x70\x3d\xd7\x0e\x00\x00"
  3066. "\x00\xee\x16\x69\x44\xec\x8c\x24\x1d\x5e\x4c\xa7\xe9\xf0\x70\xc4\x8e\xc5"
  3067. "\x19\x94\x99\xd9\xa7\x4e\x9e\x7f\xfb\xdc\x64\xed\x3b\x02\x03\xd1\x9b\x96"
  3068. "\x33\x5d\xfd\x75\xf3\xa1\xa3\xc5\xdc\x70\x99\x1f\x5b\x92\x3f\x58\x9d\x37"
  3069. "\xce\xb2\x2c\xdb\x5e\xcd\x0f\x4f\x9c\x9f\xee\xeb\x70\xec\xd0\xed\x76\x34"
  3070. "\xe8\xff\xb9\xdf\x2a\x9d\x6e\x1d\xb0\xe1\x5a\x5a\x47\x5b\x75\x39\x17\xb8"
  3071. "\xdb\xac\x7d\x1d\x3d\x6b\x6b\x3b\x80\xcd\xe7\xfb\xda\xd0\xbd\xf4\x7f\xe8"
  3072. "\x5e\x4d\xf7\xff\xde\x8d\x6d\x07\xb0\xf9\x56\xea\xff\x97\x23\x6e\x74\xa0"
  3073. "\x29\xc0\x26\x33\xfe\x87\xee\xa5\xff\x43\xf7\xd2\xff\xa1\x7b\xe9\xff\xd0"
  3074. "\x95\x9a\xff\x16\x7f\x6b\x89\x5d\xc7\x37\xea\xcc\x77\x46\xe2\xd7\x34\xa2"
  3075. "\x3d\x27\xac\x6c\x7a\xe3\xb7\x45\x3b\xce\x13\xe9\x6d\xcb\xf4\xb4\xf0\x87"
  3076. "\x18\x36\x37\x91\xde\x19\xcd\xa8\x25\xb6\x46\x44\xb3\x85\x2f\xb7\xe9\xa9"
  3077. "\x5b\x25\x91\xd6\xaa\xe8\xf4\x4f\x26\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3078. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3079. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3080. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3081. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3082. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3083. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3084. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3085. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3086. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3087. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3088. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3089. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3090. "\x00\x00\x80\xf6\xf8\x27\x00\x00\xff\xff\x9b\x66\xe0\xc9",
  3091. 1166);
  3092. syz_mount_image(/*fs=*/0x200000000440, /*dir=*/0x200000000480, /*flags=*/0,
  3093. /*opts=*/0x200000000000, /*chdir=*/1, /*size=*/0x48c,
  3094. /*img=*/0x200000001900);
  3095. memcpy((void*)0x200000000040, "./file0\000", 8);
  3096. syscall(__NR_open, /*file=*/0x200000000040ul, /*flags=*/0ul, /*mode=*/0ul);
  3097. memcpy((void*)0x200000000140, "/dev/sg#\000", 9);
  3098. res = -1;
  3099. res = syz_open_dev(/*dev=*/0x200000000140, /*id=*/0x100000, /*flags=*/0);
  3100. if (res != -1)
  3101. r[50] = res;
  3102. *(uint64_t*)0x200000000000 = 0xb5;
  3103. syscall(__NR_ioctl, /*fd=*/r[50], /*cmd=FIOASYNC*/ 0x5452,
  3104. /*v=*/0x200000000000ul);
  3105. memcpy((void*)0x2000000060c0, "/dev/sg#\000", 9);
  3106. res = -1;
  3107. res = syz_open_dev(/*dev=*/0x2000000060c0, /*id=*/0, /*flags=*/0);
  3108. if (res != -1)
  3109. r[51] = res;
  3110. res = syscall(__NR_fcntl, /*fd=*/r[51], /*cmd=*/0ul, /*arg=*/r[51]);
  3111. if (res != -1)
  3112. r[52] = res;
  3113. syscall(__NR_ioctl, /*fd=*/r[52], /*cmd=*/0x2275, /*arg=*/0x200000000000ul);
  3114. memcpy((void*)0x2000000004c0, "ext4\000", 5);
  3115. memcpy((void*)0x200000000100, "./file0\000", 8);
  3116. *(uint8_t*)0x200000000000 = 0;
  3117. memcpy(
  3118. (void*)0x200000000a00,
  3119. "\x78\x9c\xec\xdd\xcf\x6f\x1b\x59\x1d\x00\xf0\xef\x4c\xe2\x26\x4d\xb3\x9b"
  3120. "\x2c\xec\x01\x10\xb0\x65\x59\x28\xa8\xaa\x93\xb8\xbb\xd1\x6a\x25\xa4\xe5"
  3121. "\x02\x42\xab\x95\x10\x2b\x4e\x1c\xba\x21\x71\xa2\x28\x76\x1c\xc5\x4e\x69"
  3122. "\xd2\x1e\xd2\xff\x01\x89\x4a\x9c\xe0\x4f\xe0\x80\xc4\x01\xa9\x27\xee\xdc"
  3123. "\xe0\xc6\xa5\x1c\x90\x0a\x94\xa2\x06\x89\x83\xd1\x8c\x9d\xe6\x47\xed\xa4"
  3124. "\xb4\xa9\x67\x15\x7f\x3e\xd2\xeb\xcc\x9b\x71\xe7\xfb\x7d\x4e\xe6\x3d\xfb"
  3125. "\x45\xf6\x0b\x60\x68\x5d\x8e\x88\xdd\x88\xb8\x10\x11\x9f\x46\xc4\x54\xf7"
  3126. "\x78\xd2\x2d\xf1\x61\xa7\x64\x8f\x7b\xf2\xe8\xce\xe2\xde\xa3\x3b\x8b\x49"
  3127. "\xb4\xdb\x9f\xfc\x23\xc9\xcf\x67\xc7\x2e\x1e\xfa\x3f\x99\x4b\xdd\x6b\x8e"
  3128. "\x47\xc4\x8f\xbe\x1f\xf1\xd3\xe4\xd9\xb8\xcd\xed\x9d\xb5\x85\x5a\xad\xba"
  3129. "\xd9\xad\xcf\xb4\xea\x1b\x33\xcd\xed\x9d\x6b\xab\xf5\x85\x95\xea\x4a\x75"
  3130. "\xbd\x52\x99\x9f\x9b\x9f\x7d\xff\xfa\x7b\x95\x33\x6a\x69\x7b\xea\xad\xfa"
  3131. "\x6f\x1e\x7e\x6f\xf5\xa3\x1f\xff\xfe\x77\x5f\x79\xf0\xc7\xdd\x6f\xdf\xce"
  3132. "\xd2\x9a\xec\xe6\x9d\xb5\xe3\x8c\x02\x1d\xd1\x69\x7a\x29\x8f\xb3\x6f\x34"
  3133. "\x22\x3e\x7a\x15\xc1\x0a\x30\xd2\x6d\xcf\x85\xa2\x13\xe1\x85\xa4\x11\xf1"
  3134. "\xb9\x88\x78\x3b\xbf\xff\xa7\x62\x24\xff\x69\x02\x00\xe7\x59\xbb\x3d\x15"
  3135. "\xed\xa9\xc3\x75\x00\xe0\xbc\x4b\xf3\x39\xb0\x24\x2d\x77\xe7\x02\x26\x23"
  3136. "\x4d\xcb\xe5\xce\x1c\xde\x9b\x31\x91\xd6\x1a\xcd\xd6\xd5\xe5\xc6\xd6\xfa"
  3137. "\x52\x67\xae\x6c\x3a\x4a\xe9\xf2\x6a\xad\x3a\xdb\x9d\x2b\x9c\x8e\x52\x92"
  3138. "\xd5\xe7\xf2\xfd\x83\x7a\xe5\x58\xfd\x7a\x44\xbc\x11\x11\x3f\x1f\xbb\x98"
  3139. "\xd7\xcb\x8b\x8d\xda\x52\x91\x2f\x7c\x00\x60\x88\x5d\x3a\x36\xfe\xff\x7b"
  3140. "\xac\x33\xfe\x03\x00\xe7\xdc\x78\xd1\x09\x00\x00\x03\x67\xfc\x07\x80\xe1"
  3141. "\x63\xfc\x07\x80\xe1\x63\xfc\x07\x80\xe1\x63\xfc\x07\x80\xe1\xd3\x6f\xfc"
  3142. "\x6f\xb7\x07\x9c\x08\x00\x30\x30\xc7\xc6\xff\x52\x51\x79\x00\x00\x03\xf1"
  3143. "\xc3\x8f\x3f\xce\x4a\x7b\xaf\xfb\xfd\xd7\x4b\x37\xb7\xb7\xd6\x1a\x37\xaf"
  3144. "\x2d\x55\x9b\x6b\xe5\xfa\xd6\x62\x79\xb1\xb1\xb9\x51\x5e\x69\x34\x56\xf2"
  3145. "\xef\xec\xa9\x9f\x76\xbd\x5a\xa3\xb1\x31\xf7\x6e\x6c\xdd\x9a\x69\x55\x9b"
  3146. "\xad\x99\xe6\xf6\xce\x8d\x7a\x63\x6b\xbd\x75\x23\xff\x5e\xef\x1b\x55\xaf"
  3147. "\x2d\x00\xa0\x78\x6f\xbc\x75\xff\xcf\x49\x44\xec\x7e\x70\x31\x2f\x71\x68"
  3148. "\x2d\x07\x63\x35\x9c\x6f\x69\xd1\x09\x00\x85\x19\x29\x3a\x01\xa0\x30\x56"
  3149. "\xfb\x82\xe1\xe5\x3d\x3e\xd0\x63\x89\xde\x23\xfa\x7e\x44\xe8\xde\xd9\xe7"
  3150. "\x02\x0c\xc6\x95\x2f\x9a\xff\x87\x61\x75\xd2\xfc\xff\x77\x06\x98\x07\x30"
  3151. "\x78\xe6\xff\x61\x78\xbd\xe0\xfc\x7f\xb2\x7b\xd6\x89\x00\x03\xd7\x6e\x27"
  3152. "\xd6\xfc\x07\x80\x21\x63\x8e\x1f\xf0\xf7\x7f\x00\x00\x00\x00\x00\x00\x00"
  3153. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf8"
  3154. "\xff\x4d\xe6\x25\x49\xcb\xdd\xb5\xc0\x27\x6f\x5f\x4a\xcb\xe5\x88\xd7\x22"
  3155. "\x62\x3a\x4a\xed\x58\xad\x55\x67\x23\xe2\xf5\x88\xf8\xd3\x58\x69\x6c\x79"
  3156. "\xb5\x56\x9d\x2b\x3a\x69\x00\xe0\x25\xa5\x7f\x4b\xba\xeb\x7f\x5d\x99\x7a"
  3157. "\x67\xf2\xf8\xd9\x0b\xc9\x7f\xc6\xf2\x6d\x44\xfc\xec\x97\x9f\xfc\xe2\xd6"
  3158. "\x42\xab\xb5\x39\x97\x1d\xff\xe7\xd3\xe3\xad\x7b\xdd\xe3\x95\x22\xf2\x07"
  3159. "\x00\x4e\xb3\x3f\x4e\xef\x8f\xe3\xfb\x9e\x3c\xba\xb3\xb8\x5f\x06\x99\xcf"
  3160. "\xc3\xef\x76\x16\x17\xcd\xe2\xee\x75\x4b\xe7\xcc\x68\x8c\xe6\xdb\xf1\x28"
  3161. "\x45\xc4\xc4\xe3\xa4\x5b\xef\xc8\x5e\xaf\x8c\x9c\x41\xfc\xdd\xbb\x11\xf1"
  3162. "\x85\x5e\xed\x4f\xf2\xb9\x91\xe9\xee\xca\xa7\xc7\xe3\x67\xb1\x5f\x1b\x68"
  3163. "\xfc\xf4\x48\xfc\x34\x3f\xd7\xd9\x66\xcf\xc5\xe7\xcf\x20\x17\x18\x36\xf7"
  3164. "\xb3\xfe\xe7\xc3\x5e\xf7\x5f\x1a\x97\xf3\x6d\xef\xfb\x7f\x3c\xef\xa1\x5e"
  3165. "\xde\x7e\xff\xb7\xf7\x4c\xff\x97\x3e\xed\xff\x46\xfa\xf4\x7f\x97\x9f\x37"
  3166. "\xc6\xbb\x7f\xf8\x41\xdf\x73\x77\x23\xbe\x34\xda\x2b\x7e\xf2\x34\x7e\xd2"
  3167. "\x27\xfe\x3b\xbd\x2e\xd8\xa3\x53\xfe\xcb\x97\xbf\xfa\x76\xbf\xf8\xed\x5f"
  3168. "\x45\x5c\x89\x9e\xf1\xef\x3f\x3e\x14\x6b\xa6\x55\xdf\x98\x69\x6e\xef\x5c"
  3169. "\x5b\xad\x2f\xac\x54\x57\xaa\xeb\x95\xca\xfc\xdc\xfc\xec\xfb\xd7\xdf\xab"
  3170. "\xcc\x2c\xaf\xd6\xaa\xb3\x9d\x7f\x7b\xc6\xf8\xfb\x07\x57\x5f\x3f\xa9\xfd"
  3171. "\x13\x11\xff\x9a\xe8\x54\x8f\xb4\x7f\xfc\x94\xf6\x7f\xe3\xe8\xa5\xfa\xfe"
  3172. "\x3a\xfc\xfa\xbf\x9f\xfe\xe4\x6b\x27\xc4\xff\xd6\xd7\x0f\xda\x7f\xf0\xf4"
  3173. "\xa5\xf1\xe6\x09\xf1\xb3\x31\xf1\x9b\xfd\x02\x1e\xb3\x30\xf1\xdb\xbe\xcb"
  3174. "\x77\x67\xf1\x97\x7a\x3f\xff\xa7\xfe\xfc\xaf\x3e\x67\xfc\x07\x7f\xdd\x59"
  3175. "\x7a\xce\x87\x02\x00\x03\xd0\xdc\xde\x59\x5b\xa8\xd5\xaa\x9b\xe7\x73\x27"
  3176. "\x7b\x7b\x7c\xc2\x63\x4a\x51\x78\x86\x47\x76\x46\x3f\x1b\x69\xd8\x39\xd8"
  3177. "\x49\x4e\xfa\xfd\x39\xcf\x3b\x45\xf7\x4c\xc0\xab\x76\x70\xd3\x17\x9d\x09"
  3178. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd0\xcf\x20\x3e\x4e\x54\x74"
  3179. "\x1b\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3180. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3181. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3182. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3183. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3184. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3185. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3186. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3187. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3188. "\x00\x00\x00\x00\x00\x00\x00\x38\xbf\xfe\x17\x00\x00\xff\xff\x86\xb0\xd4"
  3189. "\xfb",
  3190. 1261);
  3191. syz_mount_image(/*fs=*/0x2000000004c0, /*dir=*/0x200000000100, /*flags=*/0,
  3192. /*opts=*/0x200000000000, /*chdir=*/0x24, /*size=*/0x4ed,
  3193. /*img=*/0x200000000a00);
  3194. memcpy((void*)0x200000000080, "cgroup.controllers\000", 19);
  3195. res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000080ul,
  3196. /*flags=*/0x275a, /*mode=*/0);
  3197. if (res != -1)
  3198. r[53] = res;
  3199. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/6);
  3200. if (res != -1)
  3201. r[54] = res;
  3202. *(uint64_t*)0x2000000001c0 = 0;
  3203. *(uint32_t*)0x2000000001c8 = 0;
  3204. *(uint64_t*)0x2000000001d0 = 0x200000000040;
  3205. *(uint64_t*)0x200000000040 = 0x2000000000c0;
  3206. *(uint32_t*)0x2000000000c0 = 0xb8;
  3207. *(uint16_t*)0x2000000000c4 = 0x19;
  3208. *(uint16_t*)0x2000000000c6 = 1;
  3209. *(uint32_t*)0x2000000000c8 = 0;
  3210. *(uint32_t*)0x2000000000cc = 0;
  3211. *(uint8_t*)0x2000000000d0 = 0xfc;
  3212. *(uint8_t*)0x2000000000d1 = 1;
  3213. memset((void*)0x2000000000d2, 0, 13);
  3214. *(uint8_t*)0x2000000000df = 0;
  3215. *(uint8_t*)0x2000000000e0 = 0xfe;
  3216. *(uint8_t*)0x2000000000e1 = 0x88;
  3217. memset((void*)0x2000000000e2, 0, 12);
  3218. *(uint8_t*)0x2000000000ee = 0;
  3219. *(uint8_t*)0x2000000000ef = 1;
  3220. *(uint16_t*)0x2000000000f0 = htobe16(0);
  3221. *(uint16_t*)0x2000000000f2 = htobe16(0);
  3222. *(uint16_t*)0x2000000000f4 = htobe16(0);
  3223. *(uint16_t*)0x2000000000f6 = htobe16(0);
  3224. *(uint16_t*)0x2000000000f8 = 0xa;
  3225. *(uint8_t*)0x2000000000fa = 0;
  3226. *(uint8_t*)0x2000000000fb = 0;
  3227. *(uint8_t*)0x2000000000fc = 0;
  3228. *(uint32_t*)0x200000000100 = 0;
  3229. *(uint32_t*)0x200000000104 = -1;
  3230. *(uint64_t*)0x200000000108 = 0;
  3231. *(uint64_t*)0x200000000110 = 0;
  3232. *(uint64_t*)0x200000000118 = 0;
  3233. *(uint64_t*)0x200000000120 = 0;
  3234. *(uint64_t*)0x200000000128 = 0;
  3235. *(uint64_t*)0x200000000130 = 0;
  3236. *(uint64_t*)0x200000000138 = 0;
  3237. *(uint64_t*)0x200000000140 = 0;
  3238. *(uint64_t*)0x200000000148 = 0;
  3239. *(uint64_t*)0x200000000150 = 0;
  3240. *(uint64_t*)0x200000000158 = 0;
  3241. *(uint64_t*)0x200000000160 = 0;
  3242. *(uint32_t*)0x200000000168 = 0;
  3243. *(uint32_t*)0x20000000016c = 0x6e6bb9;
  3244. *(uint8_t*)0x200000000170 = 1;
  3245. *(uint8_t*)0x200000000171 = 0;
  3246. *(uint8_t*)0x200000000172 = 0;
  3247. *(uint8_t*)0x200000000173 = 0;
  3248. *(uint64_t*)0x200000000048 = 0xb8;
  3249. *(uint64_t*)0x2000000001d8 = 1;
  3250. *(uint64_t*)0x2000000001e0 = 0;
  3251. *(uint64_t*)0x2000000001e8 = 0;
  3252. *(uint32_t*)0x2000000001f0 = 0;
  3253. syscall(__NR_sendmsg, /*fd=*/r[54], /*msg=*/0x2000000001c0ul, /*f=*/0ul);
  3254. memcpy((void*)0x200000000140, "#! ", 3);
  3255. memcpy((void*)0x200000000143, "./file0", 7);
  3256. *(uint8_t*)0x20000000014a = 0x20;
  3257. memcpy((void*)0x20000000014b, "ext4\000", 5);
  3258. *(uint8_t*)0x200000000150 = 0x20;
  3259. memcpy((void*)0x200000000151, "cgroup.controllers\000", 19);
  3260. *(uint8_t*)0x200000000164 = 0x20;
  3261. memcpy((void*)0x200000000165, "ext4\000", 5);
  3262. *(uint8_t*)0x20000000016a = 0x20;
  3263. memset((void*)0x20000000016b, 36, 1);
  3264. *(uint8_t*)0x20000000016c = 0x20;
  3265. memset((void*)0x20000000016d, 0, 1);
  3266. *(uint8_t*)0x20000000016e = 0x20;
  3267. memcpy((void*)0x20000000016f, "\\^}\332%&!,", 8);
  3268. *(uint8_t*)0x200000000177 = 0x20;
  3269. memset((void*)0x200000000178, 0, 1);
  3270. *(uint8_t*)0x200000000179 = 0x20;
  3271. memcpy((void*)0x20000000017a, "cgroup.controllers\000", 19);
  3272. *(uint8_t*)0x20000000018d = 0xa;
  3273. memcpy(
  3274. (void*)0x20000000018e,
  3275. "\x36\x7e\x3a\xa8\xac\x82\xb3\x58\xf8\x0e\x95\xa2\xb5\x36\x01\xf9\x13\x5c"
  3276. "\xe4\x3c\x22\xc3\xb3\x10\x92\xa2\xd9\x6c\x81\x0e\xae\xdf\xae\xc6\x28\x15"
  3277. "\xab\xe9\xd4\x07\x61\x41\x1c\x21\x56\xba\x43\xa9\x29\x8d\x4a\xaf\xb0\x9d"
  3278. "\x25\xa7\xd5\x26\x5c\x41\x75\xc4\x31\x74\xfe\x23\x2b\xfe\xde\x2f\x15\x9a"
  3279. "\x9a\x29\xef\x31\x81\x6a\x28\x67\x7d\x6e\x95\x55\x61\x96\x3a\x34\xf8\xa6"
  3280. "\x83\x89\xe2\xc5\x81\xa3\x57\xe4\x53\x92\x9f\x8d\xb7\x72\xb8\xa7\xb0\x90"
  3281. "\x3a\xb0\x4b\x9d\x4b\xd2\x92\xc7\xc4\xba\x99\xd1\x33\xb3\x66\xe8\x90\x26"
  3282. "\x07\x42\x9a\x82\x44\x9c\xf5\x34\x98\x94\x55\x36\xdd\xdc\x64\xfd\x73\x92"
  3283. "\x46\x9b\xf8\xf0\x3c\x5a\x7d\xa9\x05\xa6\x27\x92\x3b\xdf\xf7\x94\xce\xfd"
  3284. "\x97\x8d\xf5\xc2\xaf\xdb\xd5\x62\x1a\x6e\x53\xa2\x70\x52\xc3\x37\x44\x1c"
  3285. "\x4c\x08\x60\x6a\x19\xc3\x15\x16\x49\x61\xf7\xe9\x86\x84\x01\x89\xed\xf6"
  3286. "\xa7\x6d\xee\x04\xbc\x7f\xa8\x92\xdb\x9f\x63\xb6\x13\x7a\x12\xe9\xd4\xfa"
  3287. "\x23\x2f\xfb\x23\xb5\x12",
  3288. 222);
  3289. syscall(__NR_write, /*fd=*/r[53], /*data=*/0x200000000140ul, /*len=*/0x12cul);
  3290. memcpy((void*)0x200000000280,
  3291. "\x00\x00\x00\x00\x4c\x90\x02\x00\x00\x00\x00\x00\x03\x00\x01\x00\x00"
  3292. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3293. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3294. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x23\x7b\x47\xd2"
  3295. "\x1d\xff\xb2\x92\xc8\x8b\x82\x20\x00\x00\x40\x00\x00\x00\x00\x00\x2e"
  3296. "\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3297. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3298. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3299. "\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3300. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3301. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3302. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
  3303. 204);
  3304. syscall(__NR_ioctl, /*fd=*/r[53], /*cmd=*/0xc0c0583b,
  3305. /*arg=*/0x200000000280ul);
  3306. res = syscall(__NR_socket, /*domain=*/2ul, /*type=SOCK_DGRAM*/ 2ul,
  3307. /*proto=*/0);
  3308. if (res != -1)
  3309. r[55] = res;
  3310. *(uint32_t*)0x200000356ffc = 0xffffff40;
  3311. syscall(__NR_setsockopt, /*fd=*/r[55], /*level=*/1,
  3312. /*optname=SO_REUSEPORT*/ 0xf, /*optval=*/0x200000356ffcul,
  3313. /*optlen=*/4ul);
  3314. *(uint16_t*)0x200000000000 = 2;
  3315. *(uint16_t*)0x200000000002 = htobe16(0x6e24);
  3316. *(uint32_t*)0x200000000004 = htobe32(0);
  3317. syscall(__NR_bind, /*fd=*/r[55], /*addr=*/0x200000000000ul,
  3318. /*addrlen=*/0x10ul);
  3319. memcpy((void*)0x200000000440, "ext4\000", 5);
  3320. memcpy((void*)0x200000000480, "./file0\000", 8);
  3321. *(uint8_t*)0x200000000000 = 0;
  3322. memcpy(
  3323. (void*)0x200000000500,
  3324. "\x78\x9c\xec\xdc\x4d\x6f\x15\x55\x1c\x07\xe0\xdf\x4c\x5b\x08\x2f\x5a\x34"
  3325. "\xbe\x56\x94\x0a\x2a\x15\xb4\xa5\xa8\xd5\x85\x1b\xf6\x26\x2e\x64\xe7\xaa"
  3326. "\xa1\x85\x10\x0b\x18\x5a\x13\x21\x2c\x34\xc1\xb8\x91\x85\x89\x71\x69\xe2"
  3327. "\x07\x30\x91\x9d\x89\x1b\x76\x6e\x59\xf0\x01\x58\x1a\x0c\x31\x2c\xb4\xd1"
  3328. "\xc4\xd4\xcc\xed\x1d\x7a\x69\x7b\x0b\x85\xd6\x6b\x98\xe7\x49\xe6\xde\x73"
  3329. "\xe6\x9c\x9b\x73\x66\x4e\xfe\x73\xef\x3d\x73\x32\x01\x1a\x6b\xb8\x7a\x29"
  3330. "\x92\x9d\x49\xae\x25\x19\x5c\xcc\xde\x59\x61\x78\xf1\xed\xcf\x5b\x17\x8e"
  3331. "\xcd\xdf\xba\x70\xac\xc8\xc2\xc2\x07\xbf\x17\xad\x7a\xd5\xbe\xba\x6a\xfd"
  3332. "\xb9\x1d\xd5\x4b\x99\x8c\x94\x49\x79\xb1\xc8\x73\xab\xb4\x3b\x7b\xee\xfc"
  3333. "\x47\x93\x33\x33\xd3\x67\xdb\xf9\xb1\xb9\x53\x1f\x8f\xcd\x9e\x3b\xff\xfa"
  3334. "\xc9\x53\x93\x27\xa6\x4f\x4c\x9f\x1e\x9f\x98\x38\x74\x68\xe2\xed\x89\xb7"
  3335. "\xde\xd9\xb0\x63\x1d\x9a\xfc\xf1\xbb\xdf\x2e\xbd\xff\xf5\xb7\x5f\x7c\x38"
  3336. "\xb6\x67\xa8\xdc\x5b\xf5\x77\x67\xbb\xac\xf3\x38\x36\xca\x70\x86\xef\x3c"
  3337. "\x97\x1d\x5e\xd9\xe8\xc6\x7a\xec\xc9\x8e\x74\xd1\xdf\xc3\x8e\xb0\x2e\x7d"
  3338. "\x49\xaa\xe1\x1a\x68\xc5\xff\x60\xfa\xb2\x34\x78\x83\xf9\xe5\x7a\x4f\x3b"
  3339. "\x07\x6c\xaa\x85\xca\xd6\xae\xc5\x9f\x2d\x00\x0f\xb1\x22\xbd\xee\x01\xd0"
  3340. "\x1b\xf5\x17\x7d\xf5\xff\xb7\xde\xfe\xab\xdf\x1e\xf4\xde\xcd\x23\x8b\x7f"
  3341. "\x00\xeb\xb9\x9d\xf9\xdb\xe3\xdf\x9f\xb2\x5d\x67\x60\xd9\xff\xfb\x8d\x34"
  3342. "\x9c\xe4\xc2\xf5\xf9\xc1\x6a\xcb\x26\xcd\xc3\x00\x00\x00\x00\x34\xd9\x95"
  3343. "\x23\x49\x5e\x5b\x6d\xfe\xaf\xcc\x53\x1d\xf5\xaa\xf4\xd3\x49\x9e\x49\xf2"
  3344. "\x6c\x92\xa1\xa4\xb5\xae\x67\x77\x92\xe7\x93\xbc\x90\x64\x4f\xbd\x9e\x68"
  3345. "\x1d\x96\xd7\x5f\x39\xff\x53\xde\xb8\xaf\x03\xe3\x9e\xdc\x3c\x92\xbc\x9b"
  3346. "\x64\x7e\xc5\xfc\x5f\x3d\xfb\x97\x5d\x7d\xed\xdc\x23\x55\x26\x03\xc5\xf1"
  3347. "\x93\x33\xd3\x87\x92\x3c\x9a\x64\x24\x03\x5b\xab\xfc\xf8\x1a\x6d\x4c\xfe"
  3348. "\xf0\xc7\x4f\xdd\xca\xaa\xf1\xbf\xf6\x73\xdf\x60\xbd\x55\xed\x57\xef\x4b"
  3349. "\x35\xca\x1b\xfd\xcb\xee\x4f\x4f\x4d\xce\x4d\x3e\xc8\x31\xb3\xe4\xe6\xe7"
  3350. "\xc9\x50\xff\x6a\xe3\x5f\xdc\x5e\x09\x54\x24\x79\x31\xc9\xde\xfb\x6c\xe3"
  3351. "\xe2\xa5\xdd\x97\xbb\x95\xdd\x7d\xfc\xd9\x4c\x0b\xdf\x27\xfb\x57\x8d\xff"
  3352. "\xa5\x95\x8b\xc5\xda\xeb\x33\xc7\x5a\xd7\x83\xb1\xfa\xaa\xb0\xd2\xd5\x85"
  3353. "\xe1\xf9\x6e\xed\x1b\xff\xde\xaa\xe2\x7f\xfb\xda\xe3\xbf\xab\xe8\x5c\xaf"
  3354. "\x3b\xbb\xfe\x36\x2e\x0f\xfc\xf5\x4f\xb7\xb2\xfb\xbd\xfe\x6f\x29\x8e\xb6"
  3355. "\x3a\xb8\xa5\xbd\xef\xd3\xc9\xb9\xb9\xb3\xe3\xc9\x96\xe2\xbd\x95\xfb\x0f"
  3356. "\xaf\xbf\xcf\x0f\xab\xfa\x7c\xd4\xe7\xab\x1a\xff\x91\x7d\xab\x7f\xff\x3f"
  3357. "\xde\xfe\x4c\x75\x42\xf7\x25\x79\x29\xc9\xcb\xed\xb5\xcb\xfb\x5b\xdf\xfd"
  3358. "\xc9\xab\x49\x0e\x24\x39\xb8\x46\x9b\x5f\x1e\xf8\xea\x4a\xb7\x32\xf1\xdf"
  3359. "\x5b\xd5\xf8\x4f\xad\x2b\xfe\xd7\x9f\xf8\x7b\xdb\xd1\xab\xdd\xda\xef\xbc"
  3360. "\xff\x5b\x6d\x55\xfb\xf5\xbd\xe0\x45\x55\xfc\xbf\xd9\xea\xcc\x48\x7b\x8f"
  3361. "\xdf\x7f\x77\x77\xaf\x03\xd4\xeb\x7e\x02\x00\x00\x00\x00\x00\x00\xb0\x31"
  3362. "\xca\xd6\x33\xf0\x8a\x72\xf4\x76\xba\x2c\x47\x47\x17\x9f\xe1\xf7\x44\xb6"
  3363. "\x97\x33\x67\x66\xe7\x0e\x1e\x3f\xf3\xc9\xe9\xa9\xc5\x67\xe5\xed\xca\x40"
  3364. "\x59\xaf\xf4\x1a\xec\x58\x0f\x3a\xde\x4a\x2f\xe5\x0f\x2f\xcb\xbf\x91\xe4"
  3365. "\xb1\x24\xdf\xf4\x6d\x6b\xe5\x47\x8f\x9d\x99\x99\xea\xf5\xc1\x43\xc3\xed"
  3366. "\xe8\x12\xff\x95\x5f\xfb\x7a\xdd\x3b\x60\xd3\x79\x5e\x2b\x34\x97\xf8\x87"
  3367. "\xe6\x12\xff\xd0\x5c\xe2\x1f\x9a\x4b\xfc\x43\x73\x89\x7f\x68\x2e\xf1\x0f"
  3368. "\xcd\x25\xfe\xa1\xb9\xc4\x3f\x34\x97\xf8\x87\x46\x7a\x90\xe7\xfa\x49\x48"
  3369. "\x48\x3c\xac\x89\x5e\x5f\x99\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3370. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3371. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3372. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3373. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3374. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3375. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3376. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3377. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3378. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3379. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3380. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3381. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x1f\xfe\x0d\x00\x00\xff"
  3382. "\xff\xbc\xb0\xdc\x06",
  3383. 1049);
  3384. syz_mount_image(/*fs=*/0x200000000440, /*dir=*/0x200000000480, /*flags=*/0,
  3385. /*opts=*/0x200000000000, /*chdir=*/1, /*size=*/0x419,
  3386. /*img=*/0x200000000500);
  3387. *(uint32_t*)0x20000001d000 = 0;
  3388. *(uint32_t*)0x20000001d004 = 0x80;
  3389. *(uint8_t*)0x20000001d008 = 0;
  3390. *(uint8_t*)0x20000001d009 = 0;
  3391. *(uint8_t*)0x20000001d00a = 0;
  3392. *(uint8_t*)0x20000001d00b = 0;
  3393. *(uint32_t*)0x20000001d00c = 0;
  3394. *(uint64_t*)0x20000001d010 = 0x18a;
  3395. *(uint64_t*)0x20000001d018 = 0;
  3396. *(uint64_t*)0x20000001d020 = 0;
  3397. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 0, 1);
  3398. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 1, 1);
  3399. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 2, 1);
  3400. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 3, 1);
  3401. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 4, 1);
  3402. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 5, 1);
  3403. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 6, 1);
  3404. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 7, 1);
  3405. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 8, 1);
  3406. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 9, 1);
  3407. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 10, 1);
  3408. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 11, 1);
  3409. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 12, 1);
  3410. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 13, 1);
  3411. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 14, 1);
  3412. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 15, 2);
  3413. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 17, 1);
  3414. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 18, 1);
  3415. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 19, 1);
  3416. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 20, 1);
  3417. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 21, 1);
  3418. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 22, 1);
  3419. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 23, 1);
  3420. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 24, 1);
  3421. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 25, 1);
  3422. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 26, 1);
  3423. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 27, 1);
  3424. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 28, 1);
  3425. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 29, 1);
  3426. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 30, 1);
  3427. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 31, 1);
  3428. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 32, 1);
  3429. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 33, 1);
  3430. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 34, 1);
  3431. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 35, 1);
  3432. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 36, 1);
  3433. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 37, 1);
  3434. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 38, 26);
  3435. *(uint32_t*)0x20000001d030 = 0;
  3436. *(uint32_t*)0x20000001d034 = 0;
  3437. *(uint64_t*)0x20000001d038 = 0;
  3438. *(uint64_t*)0x20000001d040 = 0;
  3439. *(uint64_t*)0x20000001d048 = 0;
  3440. *(uint64_t*)0x20000001d050 = 0;
  3441. *(uint32_t*)0x20000001d058 = 0;
  3442. *(uint32_t*)0x20000001d05c = 0;
  3443. *(uint64_t*)0x20000001d060 = 0;
  3444. *(uint32_t*)0x20000001d068 = 0;
  3445. *(uint16_t*)0x20000001d06c = 0;
  3446. *(uint16_t*)0x20000001d06e = 0;
  3447. *(uint32_t*)0x20000001d070 = 0;
  3448. *(uint32_t*)0x20000001d074 = 0;
  3449. *(uint64_t*)0x20000001d078 = 0;
  3450. res = syscall(__NR_perf_event_open, /*attr=*/0x20000001d000ul, /*pid=*/0,
  3451. /*cpu=*/0ul, /*group=*/-1, /*flags=*/0ul);
  3452. if (res != -1)
  3453. r[56] = res;
  3454. *(uint64_t*)0x200000000080 = 0x1ff;
  3455. syscall(__NR_ioctl, /*fd=*/r[56], /*cmd=FIOASYNC*/ 0x5452,
  3456. /*v=*/0x200000000080ul);
  3457. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0);
  3458. if (res != -1)
  3459. r[57] = res;
  3460. *(uint32_t*)0x200000000180 = 7;
  3461. syscall(__NR_setsockopt, /*fd=*/r[57], /*level=*/6,
  3462. /*optname=TCP_FASTOPEN_NO_COOKIE*/ 0x22, /*optval=*/0x200000000180ul,
  3463. /*optlen=*/4ul);
  3464. syscall(__NR_shutdown, /*fd=*/r[57], /*how=*/0ul);
  3465. *(uint32_t*)0x200000000140 = 1;
  3466. syscall(__NR_setsockopt, /*fd=*/r[57], /*level=*/6,
  3467. /*optname=TCP_FASTOPEN_NO_COOKIE*/ 0x22, /*optval=*/0x200000000140ul,
  3468. /*optlen=*/4ul);
  3469. *(uint16_t*)0x200000000040 = 0xa;
  3470. *(uint16_t*)0x200000000042 = htobe16(0);
  3471. *(uint32_t*)0x200000000044 = htobe32(0);
  3472. memset((void*)0x200000000048, 0, 10);
  3473. memset((void*)0x200000000052, 255, 2);
  3474. *(uint32_t*)0x200000000054 = htobe32(0x7f000001);
  3475. *(uint32_t*)0x200000000058 = 0;
  3476. syscall(__NR_connect, /*fd=*/r[57], /*addr=*/0x200000000040ul,
  3477. /*addrlen=*/0x1cul);
  3478. res = syscall(__NR_io_setup, /*n=*/0xa, /*ctx=*/0x200000000080ul);
  3479. if (res != -1)
  3480. r[58] = *(uint64_t*)0x200000000080;
  3481. *(uint64_t*)0x2000000002c0 = 0x200000000000;
  3482. *(uint64_t*)0x200000000000 = 0x180a;
  3483. *(uint32_t*)0x200000000008 = 0;
  3484. *(uint32_t*)0x20000000000c = 0;
  3485. *(uint16_t*)0x200000000010 = 5;
  3486. *(uint16_t*)0x200000000012 = 0;
  3487. *(uint32_t*)0x200000000014 = r[57];
  3488. *(uint64_t*)0x200000000018 = 0;
  3489. *(uint64_t*)0x200000000020 = 0;
  3490. *(uint64_t*)0x200000000028 = 0;
  3491. *(uint64_t*)0x200000000030 = 0;
  3492. *(uint32_t*)0x200000000038 = 0;
  3493. *(uint32_t*)0x20000000003c = -1;
  3494. syscall(__NR_io_submit, /*ctx=*/r[58], /*nr=*/1ul,
  3495. /*iocbpp=*/0x2000000002c0ul);
  3496. *(uint64_t*)0x200000000680 = 0;
  3497. *(uint32_t*)0x200000000688 = 0x21;
  3498. *(uint32_t*)0x20000000068c = 0;
  3499. *(uint32_t*)0x200000000690 = 0;
  3500. syscall(__NR_timer_create, /*id=*/0ul, /*ev=*/0x200000000680ul,
  3501. /*timerid=*/0x200000000100ul);
  3502. syscall(__NR_read, /*fd=*/-1, /*data=*/0x200000000040ul, /*len=*/8ul);
  3503. *(uint64_t*)0x20000006b000 = 0;
  3504. *(uint64_t*)0x20000006b008 = 8;
  3505. *(uint64_t*)0x20000006b010 = 0;
  3506. *(uint64_t*)0x20000006b018 = 9;
  3507. syscall(__NR_timer_settime, /*timerid=*/0, /*flags=*/0ul,
  3508. /*new=*/0x20000006b000ul, /*old=*/0ul);
  3509. res = syscall(__NR_timer_create, /*id=*/0ul, /*ev=*/0ul,
  3510. /*timerid=*/0x200000000200ul);
  3511. if (res != -1)
  3512. r[59] = *(uint32_t*)0x200000000200;
  3513. syscall(__NR_timer_settime, /*timerid=*/r[59], /*flags=*/0ul, /*new=*/0ul,
  3514. /*old=*/0x200000000600ul);
  3515. syscall(__NR_dup2, /*oldfd=*/-1, /*newfd=*/-1);
  3516. res = syscall(__NR_pipe, /*pipefd=*/0x2000000000c0ul);
  3517. if (res != -1)
  3518. r[60] = *(uint32_t*)0x2000000000c4;
  3519. syscall(__NR_write, /*fd=*/r[60], /*data=*/0x200000000000ul,
  3520. /*len=*/0xfffffeccul);
  3521. memcpy((void*)0x200000000640, ".\000", 2);
  3522. res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000640ul,
  3523. /*flags=*/0, /*mode=*/0);
  3524. if (res != -1)
  3525. r[61] = res;
  3526. syscall(__NR_splice, /*fdin=*/r[61], /*offin=*/0ul, /*fdout=*/r[60],
  3527. /*offout=*/0ul, /*len=*/0x597bul, /*f=*/0ul);
  3528. res = syscall(__NR_inotify_init1, /*flags=*/0ul);
  3529. if (res != -1)
  3530. r[62] = res;
  3531. memcpy((void*)0x200000001240, "./file0\000", 8);
  3532. res = syscall(__NR_inotify_add_watch, /*fd=*/r[62], /*file=*/0x200000001240ul,
  3533. /*mask=IN_MODIFY|IN_DELETE_SELF|IN_DELETE*/ 0x602ul);
  3534. if (res != -1)
  3535. r[63] = res;
  3536. syscall(__NR_inotify_rm_watch, /*fd=*/r[62], /*wd=*/r[63]);
  3537. *(uint16_t*)0x200000000140 = 0;
  3538. *(uint16_t*)0x200000000142 = 1;
  3539. *(uint64_t*)0x200000000148 = 0x3f;
  3540. *(uint64_t*)0x200000000150 = 5;
  3541. *(uint32_t*)0x200000000158 = 0;
  3542. *(uint32_t*)0x20000000015c = 0;
  3543. memset((void*)0x200000000160, 0, 16);
  3544. syscall(__NR_ioctl, /*fd=*/r[56], /*cmd=*/0x40305828,
  3545. /*arg=*/0x200000000140ul);
  3546. memcpy((void*)0x200000000080, "./file0\000", 8);
  3547. memcpy((void*)0x200000000200, "trusted.overlay.upper\000", 22);
  3548. syscall(__NR_setxattr, /*path=*/0x200000000080ul, /*name=*/0x200000000200ul,
  3549. /*val=*/0x2000000000c0ul, /*size=*/0x7c8ul, /*flags=*/0ul);
  3550. res = syscall(__NR_socket, /*domain=*/2ul, /*type=SOCK_DGRAM*/ 2ul,
  3551. /*proto=*/0);
  3552. if (res != -1)
  3553. r[64] = res;
  3554. *(uint32_t*)0x200000356ffc = 0xffffff40;
  3555. syscall(__NR_setsockopt, /*fd=*/r[64], /*level=*/1,
  3556. /*optname=SO_REUSEPORT*/ 0xf, /*optval=*/0x200000356ffcul,
  3557. /*optlen=*/4ul);
  3558. syz_sysconfig_reset__proc_sys_net_ipv6_ip6frag_time();
  3559. memcpy((void*)0x200000000140, "./file0\000", 8);
  3560. syscall(__NR_mkdir, /*path=*/0x200000000140ul, /*mode=*/0ul);
  3561. memcpy((void*)0x200000000040, "./file0\000", 8);
  3562. memcpy((void*)0x200000000580, "cgroup2\000", 8);
  3563. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000040ul,
  3564. /*type=*/0x200000000580ul, /*flags=*/0ul, /*data=*/0ul);
  3565. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0x88);
  3566. if (res != -1)
  3567. r[65] = res;
  3568. *(uint32_t*)0x200000000280 = 5;
  3569. res = syscall(__NR_getsockopt, /*fd=*/r[65], /*level=*/1, /*optname=*/0x11,
  3570. /*optval=*/0x200000000240ul, /*optlen=*/0x200000000280ul);
  3571. if (res != -1)
  3572. r[66] = *(uint32_t*)0x200000000244;
  3573. syscall(__NR_setreuid, /*ruid=*/r[66], /*euid=*/r[66]);
  3574. memcpy((void*)0x200000000640, "./file0\000", 8);
  3575. syscall(__NR_chmod, /*file=*/0x200000000640ul, /*mode=*/0ul);
  3576. *(uint32_t*)0x200000000080 = 1;
  3577. *(uint32_t*)0x200000000084 = 1;
  3578. *(uint32_t*)0x200000000088 = 0x18;
  3579. *(uint32_t*)0x20000000008c = -1;
  3580. *(uint32_t*)0x200000000090 = 2;
  3581. memcpy((void*)0x200000000098, "./file0/file0\000", 14);
  3582. res = syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0xc018937e,
  3583. /*arg=*/0x200000000080ul);
  3584. if (res != -1)
  3585. r[67] = *(uint32_t*)0x20000000008c;
  3586. *(uint32_t*)0x200000000180 = 0x74;
  3587. *(uint8_t*)0x200000000184 = 0x29;
  3588. *(uint16_t*)0x200000000185 = 1;
  3589. *(uint32_t*)0x200000000187 = 0;
  3590. *(uint8_t*)0x20000000018b = 0x10;
  3591. *(uint32_t*)0x20000000018c = 0;
  3592. *(uint64_t*)0x200000000190 = 1;
  3593. *(uint64_t*)0x200000000198 = 0;
  3594. *(uint8_t*)0x2000000001a0 = 3;
  3595. *(uint16_t*)0x2000000001a1 = 0xd;
  3596. memcpy((void*)0x2000000001a3, "./file0/file0", 13);
  3597. *(uint8_t*)0x2000000001b0 = 2;
  3598. *(uint32_t*)0x2000000001b1 = 1;
  3599. *(uint64_t*)0x2000000001b5 = 4;
  3600. *(uint64_t*)0x2000000001bd = 7;
  3601. *(uint8_t*)0x2000000001c5 = 4;
  3602. *(uint16_t*)0x2000000001c6 = 7;
  3603. memcpy((void*)0x2000000001c8, "./file0", 7);
  3604. *(uint8_t*)0x2000000001cf = 0x20;
  3605. *(uint32_t*)0x2000000001d0 = 1;
  3606. *(uint64_t*)0x2000000001d4 = 1;
  3607. *(uint64_t*)0x2000000001dc = 0x20;
  3608. *(uint8_t*)0x2000000001e4 = 0x1f;
  3609. *(uint16_t*)0x2000000001e5 = 0xd;
  3610. memcpy((void*)0x2000000001e7, "./file0/file0", 13);
  3611. syscall(__NR_write, /*fd=*/r[67], /*data=*/0x200000000180ul, /*size=*/0x74ul);
  3612. memcpy((void*)0x200000000000, "./file0/file0\000", 14);
  3613. syscall(__NR_faccessat, /*dirfd=*/-1, /*pathname=*/0x200000000000ul,
  3614. /*mode=S_IXGRP|S_IWGRP*/ 0x18ul);
  3615. memcpy((void*)0x200000000800, "./control\000", 10);
  3616. res = syscall(__NR_creat, /*file=*/0x200000000800ul, /*mode=*/0ul);
  3617. if (res != -1)
  3618. r[68] = res;
  3619. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0);
  3620. if (res != -1)
  3621. r[69] = res;
  3622. syscall(__NR_setsockopt, /*fd=*/r[69], /*level=*/0x29,
  3623. /*optname=IPV6_AUTOFLOWLABEL*/ 0x46, /*optval=*/0ul, /*optlen=*/0ul);
  3624. *(uint32_t*)0x200000000200 = 1;
  3625. syscall(__NR_setsockopt, /*fd=*/r[69], /*level=*/6,
  3626. /*optname=TCP_FASTOPEN_NO_COOKIE*/ 0x22, /*optval=*/0x200000000200ul,
  3627. /*optlen=*/4ul);
  3628. memset((void*)0x200000000240, 196, 1);
  3629. *(uint16_t*)0x200000b63fe4 = 0xa;
  3630. *(uint16_t*)0x200000b63fe6 = htobe16(0);
  3631. *(uint32_t*)0x200000b63fe8 = htobe32(0);
  3632. memset((void*)0x200000b63fec, 0, 16);
  3633. *(uint32_t*)0x200000b63ffc = 0;
  3634. syscall(__NR_sendto, /*fd=*/r[69], /*buf=*/0x200000000240ul, /*len=*/1ul,
  3635. /*f=MSG_FASTOPEN|MSG_OOB|MSG_DONTWAIT|MSG_DONTROUTE|MSG_CONFIRM*/
  3636. 0x20000845ul, /*addr=*/0x200000b63fe4ul, /*addrlen=*/0x1cul);
  3637. *(uint32_t*)0x200000000080 = 0xd;
  3638. syscall(__NR_setsockopt, /*fd=*/r[68], /*level=*/0, /*opt=*/0xd4,
  3639. /*val=*/0x200000000080ul, /*len=*/4ul);
  3640. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/6);
  3641. if (res != -1)
  3642. r[70] = res;
  3643. syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul,
  3644. /*proto=NETLINK_FIB_LOOKUP*/ 0xa);
  3645. syscall(__NR_socket, /*domain=*/0xaul,
  3646. /*type=SOCK_CLOEXEC|SOCK_DGRAM*/ 0x80002ul, /*proto=*/0);
  3647. memcpy((void*)0x200000000440, "ext4\000", 5);
  3648. memcpy((void*)0x200000000480, "./file0\000", 8);
  3649. *(uint8_t*)0x200000000000 = 0;
  3650. memcpy(
  3651. (void*)0x200000000500,
  3652. "\x78\x9c\xec\xdc\x4d\x6f\x15\x55\x1c\x07\xe0\xdf\x4c\x5b\x08\x2f\x5a\x34"
  3653. "\xbe\x56\x94\x0a\x2a\x15\xb4\xa5\xa8\xd5\x85\x1b\xf6\x26\x2e\x64\xe7\xaa"
  3654. "\xa1\x85\x10\x0b\x18\x5a\x13\x21\x2c\x34\xc1\xb8\x91\x85\x89\x71\x69\xe2"
  3655. "\x07\x30\x91\x9d\x89\x1b\x76\x6e\x59\xf0\x01\x58\x1a\x0c\x31\x2c\xb4\xd1"
  3656. "\xc4\xd4\xcc\xed\x1d\x7a\x69\x7b\x0b\x85\xd6\x6b\x98\xe7\x49\xe6\xde\x73"
  3657. "\xe6\x9c\x9b\x73\x66\x4e\xfe\x73\xef\x3d\x73\x32\x01\x1a\x6b\xb8\x7a\x29"
  3658. "\x92\x9d\x49\xae\x25\x19\x5c\xcc\xde\x59\x61\x78\xf1\xed\xcf\x5b\x17\x8e"
  3659. "\xcd\xdf\xba\x70\xac\xc8\xc2\xc2\x07\xbf\x17\xad\x7a\xd5\xbe\xba\x6a\xfd"
  3660. "\xb9\x1d\xd5\x4b\x99\x8c\x94\x49\x79\xb1\xc8\x73\xab\xb4\x3b\x7b\xee\xfc"
  3661. "\x47\x93\x33\x33\xd3\x67\xdb\xf9\xb1\xb9\x53\x1f\x8f\xcd\x9e\x3b\xff\xfa"
  3662. "\xc9\x53\x93\x27\xa6\x4f\x4c\x9f\x1e\x9f\x98\x38\x74\x68\xe2\xed\x89\xb7"
  3663. "\xde\xd9\xb0\x63\x1d\x9a\xfc\xf1\xbb\xdf\x2e\xbd\xff\xf5\xb7\x5f\x7c\x38"
  3664. "\xb6\x67\xa8\xdc\x5b\xf5\x77\x67\xbb\xac\xf3\x38\x36\xca\x70\x86\xef\x3c"
  3665. "\x97\x1d\x5e\xd9\xe8\xc6\x7a\xec\xc9\x8e\x74\xd1\xdf\xc3\x8e\xb0\x2e\x7d"
  3666. "\x49\xaa\xe1\x1a\x68\xc5\xff\x60\xfa\xb2\x34\x78\x83\xf9\xe5\x7a\x4f\x3b"
  3667. "\x07\x6c\xaa\x85\xca\xd6\xae\xc5\x9f\x2d\x00\x0f\xb1\x22\xbd\xee\x01\xd0"
  3668. "\x1b\xf5\x17\x7d\xf5\xff\xb7\xde\xfe\xab\xdf\x1e\xf4\xde\xcd\x23\x8b\x7f"
  3669. "\x00\xeb\xb9\x9d\xf9\xdb\xe3\xdf\x9f\xb2\x5d\x67\x60\xd9\xff\xfb\x8d\x34"
  3670. "\x9c\xe4\xc2\xf5\xf9\xc1\x6a\xcb\x26\xcd\xc3\x00\x00\x00\x00\x34\xd9\x95"
  3671. "\x23\x49\x5e\x5b\x6d\xfe\xaf\xcc\x53\x1d\xf5\xaa\xf4\xd3\x49\x9e\x49\xf2"
  3672. "\x6c\x92\xa1\xa4\xb5\xae\x67\x77\x92\xe7\x93\xbc\x90\x64\x4f\xbd\x9e\x68"
  3673. "\x1d\x96\xd7\x5f\x39\xff\x53\xde\xb8\xaf\x03\xe3\x9e\xdc\x3c\x92\xbc\x9b"
  3674. "\x64\x7e\xc5\xfc\x5f\x3d\xfb\x97\x5d\x7d\xed\xdc\x23\x55\x26\x03\xc5\xf1"
  3675. "\x93\x33\xd3\x87\x92\x3c\x9a\x64\x24\x03\x5b\xab\xfc\xf8\x1a\x6d\x4c\xfe"
  3676. "\xf0\xc7\x4f\xdd\xca\xaa\xf1\xbf\xf6\x73\xdf\x60\xbd\x55\xed\x57\xef\x4b"
  3677. "\x35\xca\x1b\xfd\xcb\xee\x4f\x4f\x4d\xce\x4d\x3e\xc8\x31\xb3\xe4\xe6\xe7"
  3678. "\xc9\x50\xff\x6a\xe3\x5f\xdc\x5e\x09\x54\x24\x79\x31\xc9\xde\xfb\x6c\xe3"
  3679. "\xe2\xa5\xdd\x97\xbb\x95\xdd\x7d\xfc\xd9\x4c\x0b\xdf\x27\xfb\x57\x8d\xff"
  3680. "\xa5\x95\x8b\xc5\xda\xeb\x33\xc7\x5a\xd7\x83\xb1\xfa\xaa\xb0\xd2\xd5\x85"
  3681. "\xe1\xf9\x6e\xed\x1b\xff\xde\xaa\xe2\x7f\xfb\xda\xe3\xbf\xab\xe8\x5c\xaf"
  3682. "\x3b\xbb\xfe\x36\x2e\x0f\xfc\xf5\x4f\xb7\xb2\xfb\xbd\xfe\x6f\x29\x8e\xb6"
  3683. "\x3a\xb8\xa5\xbd\xef\xd3\xc9\xb9\xb9\xb3\xe3\xc9\x96\xe2\xbd\x95\xfb\x0f"
  3684. "\xaf\xbf\xcf\x0f\xab\xfa\x7c\xd4\xe7\xab\x1a\xff\x91\x7d\xab\x7f\xff\x3f"
  3685. "\xde\xfe\x4c\x75\x42\xf7\x25\x79\x29\xc9\xcb\xed\xb5\xcb\xfb\x5b\xdf\xfd"
  3686. "\xc9\xab\x49\x0e\x24\x39\xb8\x46\x9b\x5f\x1e\xf8\xea\x4a\xb7\x32\xf1\xdf"
  3687. "\x5b\xd5\xf8\x4f\xad\x2b\xfe\xd7\x9f\xf8\x7b\xdb\xd1\xab\xdd\xda\xef\xbc"
  3688. "\xff\x5b\x6d\x55\xfb\xf5\xbd\xe0\x45\x55\xfc\xbf\xd9\xea\xcc\x48\x7b\x8f"
  3689. "\xdf\x7f\x77\x77\xaf\x03\xd4\xeb\x7e\x02\x00\x00\x00\x00\x00\x00\xb0\x31"
  3690. "\xca\xd6\x33\xf0\x8a\x72\xf4\x76\xba\x2c\x47\x47\x17\x9f\xe1\xf7\x44\xb6"
  3691. "\x97\x33\x67\x66\xe7\x0e\x1e\x3f\xf3\xc9\xe9\xa9\xc5\x67\xe5\xed\xca\x40"
  3692. "\x59\xaf\xf4\x1a\xec\x58\x0f\x3a\xde\x4a\x2f\xe5\x0f\x2f\xcb\xbf\x91\xe4"
  3693. "\xb1\x24\xdf\xf4\x6d\x6b\xe5\x47\x8f\x9d\x99\x99\xea\xf5\xc1\x43\xc3\xed"
  3694. "\xe8\x12\xff\x95\x5f\xfb\x7a\xdd\x3b\x60\xd3\x79\x5e\x2b\x34\x97\xf8\x87"
  3695. "\xe6\x12\xff\xd0\x5c\xe2\x1f\x9a\x4b\xfc\x43\x73\x89\x7f\x68\x2e\xf1\x0f"
  3696. "\xcd\x25\xfe\xa1\xb9\xc4\x3f\x34\x97\xf8\x87\x46\x7a\x90\xe7\xfa\x49\x48"
  3697. "\x48\x3c\xac\x89\x5e\x5f\x99\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3698. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3699. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3700. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3701. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3702. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3703. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3704. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3705. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3706. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3707. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3708. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3709. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x1f\xfe\x0d\x00\x00\xff"
  3710. "\xff\xbc\xb0\xdc\x06",
  3711. 1049);
  3712. syz_mount_image(/*fs=*/0x200000000440, /*dir=*/0x200000000480, /*flags=*/0,
  3713. /*opts=*/0x200000000000, /*chdir=*/1, /*size=*/0x419,
  3714. /*img=*/0x200000000500);
  3715. memcpy((void*)0x200000000040, "./file2\000", 8);
  3716. res = syscall(
  3717. __NR_open, /*file=*/0x200000000040ul,
  3718. /*flags=O_TRUNC|O_SYNC|O_NOFOLLOW|O_NOCTTY|O_LARGEFILE|O_EXCL|0x82002*/
  3719. 0x1ab382ul, /*mode=*/0ul);
  3720. if (res != -1)
  3721. r[71] = res;
  3722. syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc);
  3723. syscall(__NR_write, /*fd=*/-1, /*data=*/0x200000000280ul, /*len=*/0xfd14ul);
  3724. syscall(__NR_write, /*fd=*/-1, /*data=*/0ul, /*size=*/0ul);
  3725. syscall(__NR_chdir, /*dir=*/0ul);
  3726. res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0ul, /*flags=*/0x275a,
  3727. /*mode=*/0);
  3728. if (res != -1)
  3729. r[72] = res;
  3730. syscall(__NR_getsockopt, /*fd=*/-1, /*level=*/1, /*optname=*/0x11,
  3731. /*optval=*/0ul, /*optlen=*/0ul);
  3732. *(uint32_t*)0x20000001d000 = 0;
  3733. *(uint32_t*)0x20000001d004 = 0x80;
  3734. *(uint8_t*)0x20000001d008 = 0;
  3735. *(uint8_t*)0x20000001d009 = 0;
  3736. *(uint8_t*)0x20000001d00a = 0;
  3737. *(uint8_t*)0x20000001d00b = 0;
  3738. *(uint32_t*)0x20000001d00c = 0;
  3739. *(uint64_t*)0x20000001d010 = 0;
  3740. *(uint64_t*)0x20000001d018 = 0;
  3741. *(uint64_t*)0x20000001d020 = 5;
  3742. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 0, 1);
  3743. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 1, 1);
  3744. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 2, 1);
  3745. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 3, 1);
  3746. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 4, 1);
  3747. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 5, 1);
  3748. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 6, 1);
  3749. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 7, 1);
  3750. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 8, 1);
  3751. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 9, 1);
  3752. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 10, 1);
  3753. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 11, 1);
  3754. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 12, 1);
  3755. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 13, 1);
  3756. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 14, 1);
  3757. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 15, 2);
  3758. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 17, 1);
  3759. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 18, 1);
  3760. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 19, 1);
  3761. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 20, 1);
  3762. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 21, 1);
  3763. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 22, 1);
  3764. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 23, 1);
  3765. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 24, 1);
  3766. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 25, 1);
  3767. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 26, 1);
  3768. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 27, 1);
  3769. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 28, 1);
  3770. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 29, 1);
  3771. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 30, 1);
  3772. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 31, 1);
  3773. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 32, 1);
  3774. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 33, 1);
  3775. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 34, 1);
  3776. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 35, 1);
  3777. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 36, 1);
  3778. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 37, 1);
  3779. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 38, 26);
  3780. *(uint32_t*)0x20000001d030 = 0;
  3781. *(uint32_t*)0x20000001d034 = 0;
  3782. *(uint64_t*)0x20000001d038 = 0;
  3783. *(uint64_t*)0x20000001d040 = 0;
  3784. *(uint64_t*)0x20000001d048 = 0;
  3785. *(uint64_t*)0x20000001d050 = 0;
  3786. *(uint32_t*)0x20000001d058 = 0;
  3787. *(uint32_t*)0x20000001d05c = 6;
  3788. *(uint64_t*)0x20000001d060 = 0;
  3789. *(uint32_t*)0x20000001d068 = 0;
  3790. *(uint16_t*)0x20000001d06c = 0;
  3791. *(uint16_t*)0x20000001d06e = 0;
  3792. *(uint32_t*)0x20000001d070 = 7;
  3793. *(uint32_t*)0x20000001d074 = 0;
  3794. *(uint64_t*)0x20000001d078 = 0;
  3795. syscall(__NR_perf_event_open, /*attr=*/0x20000001d000ul, /*pid=*/0,
  3796. /*cpu=*/-1, /*group=*/-1, /*flags=*/0ul);
  3797. memcpy((void*)0x200000000000, "#! ", 3);
  3798. *(uint8_t*)0x200000000003 = 0xa;
  3799. syscall(__NR_write, /*fd=*/r[72], /*data=*/0x200000000000ul,
  3800. /*len=*/0x208e24bul);
  3801. syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul,
  3802. /*prot=*/0ul, /*flags=MAP_FIXED*/ 0x10ul, /*fd=*/r[72],
  3803. /*offset=*/0ul);
  3804. syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0ul, /*f=*/0ul);
  3805. *(uint32_t*)0x2000000000c0 = 0xb;
  3806. *(uint8_t*)0x2000000000c4 = 0x29;
  3807. *(uint16_t*)0x2000000000c5 = 3;
  3808. *(uint32_t*)0x2000000000c7 = 0;
  3809. syscall(__NR_write, /*fd=*/r[72], /*data=*/0x2000000000c0ul, /*size=*/0xbul);
  3810. *(uint64_t*)0x200000000240 = 0;
  3811. syscall(__NR_sendfile, /*fdout=*/r[71], /*fdin=*/r[71],
  3812. /*off=*/0x200000000240ul, /*count=*/7ul);
  3813. memcpy((void*)0x200000000040, "./file2\000", 8);
  3814. res = syscall(__NR_open, /*file=*/0x200000000040ul,
  3815. /*flags=O_SYNC|O_CREAT|O_CLOEXEC|O_RDWR*/ 0x181042ul,
  3816. /*mode=*/0ul);
  3817. if (res != -1)
  3818. r[73] = res;
  3819. *(uint32_t*)0x200000000280 = 0x8b;
  3820. *(uint8_t*)0x200000000284 = 0x29;
  3821. *(uint16_t*)0x200000000285 = 1;
  3822. *(uint32_t*)0x200000000287 = 2;
  3823. *(uint8_t*)0x20000000028b = 1;
  3824. *(uint32_t*)0x20000000028c = 2;
  3825. *(uint64_t*)0x200000000290 = 7;
  3826. *(uint64_t*)0x200000000298 = 0x1ff;
  3827. *(uint8_t*)0x2000000002a0 = 2;
  3828. *(uint16_t*)0x2000000002a1 = 9;
  3829. memcpy((void*)0x2000000002a3, "./control", 9);
  3830. *(uint8_t*)0x2000000002ac = 0x40;
  3831. *(uint32_t*)0x2000000002ad = 0;
  3832. *(uint64_t*)0x2000000002b1 = 1;
  3833. *(uint64_t*)0x2000000002b9 = 0x49b;
  3834. *(uint8_t*)0x2000000002c1 = 0x61;
  3835. *(uint16_t*)0x2000000002c2 = 7;
  3836. memcpy((void*)0x2000000002c4, "./file0", 7);
  3837. *(uint8_t*)0x2000000002cb = 8;
  3838. *(uint32_t*)0x2000000002cc = 2;
  3839. *(uint64_t*)0x2000000002d0 = 8;
  3840. *(uint64_t*)0x2000000002d8 = 8;
  3841. *(uint8_t*)0x2000000002e0 = 0;
  3842. *(uint16_t*)0x2000000002e1 = 9;
  3843. memcpy((void*)0x2000000002e3, "./control", 9);
  3844. *(uint8_t*)0x2000000002ec = 8;
  3845. *(uint32_t*)0x2000000002ed = 1;
  3846. *(uint64_t*)0x2000000002f1 = 3;
  3847. *(uint64_t*)0x2000000002f9 = 4;
  3848. *(uint8_t*)0x200000000301 = 0x80;
  3849. *(uint16_t*)0x200000000302 = 7;
  3850. memcpy((void*)0x200000000304, "./file0", 7);
  3851. syscall(__NR_write, /*fd=*/r[73], /*data=*/0x200000000280ul, /*size=*/0x8bul);
  3852. *(uint64_t*)0x200000000240 = 0;
  3853. syscall(__NR_sendfile, /*fdout=*/r[73], /*fdin=*/r[73],
  3854. /*off=*/0x200000000240ul, /*count=*/0x7f06ul);
  3855. *(uint64_t*)0x200000000180 = 0;
  3856. *(uint32_t*)0x200000000188 = 0;
  3857. *(uint64_t*)0x200000000190 = 0x200000000000;
  3858. *(uint64_t*)0x200000000000 = 0x200000000d80;
  3859. memcpy(
  3860. (void*)0x200000000d80,
  3861. "\x50\x00\x13\x1f\x00\x00\x00\x00\x0a\x01\x39\xad\x83\xfa\x15\x38\xd6\x34"
  3862. "\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x01\x00\x00\x00\x00\xf7\xff\xfe\xd4"
  3863. "\xff\xff\xff\xff\x02\x00\xab\xcd\x2d\xb9\x90\xb2\xe9\x6f\x00\x00\x00\x00"
  3864. "\x67\xd9\x00\x01\x01\x00\x00\x84\xe3\xcc\xe4\x18\x81\xff\xff\xff\xff\xe3"
  3865. "\x00\x00\x00\x00\x00\x72\xdf\x04\xe7\xbb\x0c\x33\x8c\x81\x67\x42\xed\xcc"
  3866. "\xcc\x0b\xfc\xed\x63\x7d\xcc\xdb\x7e\x3a\xe5\x32\x4c\xaa\x99\x62\xfd\x9d"
  3867. "\x52\xee\x50\xf9\x52\xbd\x74\x7b\x8a\x29\xa5\x53\x59\xeb\x1e\x51\x8e\xee"
  3868. "\x8d\xa8\x6e\x65\xe4\x64\x99\x40\xa8\x40\x4f\xb0\x26\xb8\x25\xf5\x63\xca"
  3869. "\xd0\x4b\x13\xd5\x02\xf7\x53\x0a\xe6\xa7\xf3\xd0\xb0\xd5\x83\x85\x18\x83"
  3870. "\xbd\xd9\xc0\xd9\x39\xc5\x51\x60\xee\x85\xf8\x4e\xfd\x88\xeb\x5c\xce\xfd"
  3871. "\x31\x0e\x83\xb4\xa7\xb8\x7f\xf1\x9d\xff\x07\x40\xb0\xaa\x24\x92\x3a\x6b"
  3872. "\x6d\x1e\xd7\x07\x9e\xcb\xfe\x18\x16\x47\xb9\x75\x43\x3a\x94\x7d\x5d\xc7"
  3873. "\x20\x23\xd7\x51\xe1\xcd\x83\x6b\xeb\x64\x01\x2f\xa6\x49\x31\x1e\x93",
  3874. 233);
  3875. sprintf((char*)0x200000000e69, "%020llu", (long long)r[69]);
  3876. sprintf((char*)0x200000000e7d, "0x%016llx", (long long)r[70]);
  3877. memcpy(
  3878. (void*)0x200000000e8f,
  3879. "\x0a\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3880. "\x04\xd2\x32\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3881. "\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3882. "\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3883. "\x00\x00\x00\x00\x00\x00\x00\x00\xfc\xff\xff\xff\xff\xff\xff\xff\x00\x00"
  3884. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3885. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3886. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3887. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x00\x00\x00\x00"
  3888. "\x00\x00\x00\x00\x00\x00\x60\x00\x02\x00\x63\x62\x63\x28\x61\x65\x73\x29"
  3889. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3890. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3891. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  3892. "\x00\x00\xc0\x00\x00\x00\x60\x6d\xdc\x76\x8e\x38\xbe\x5f\x49\xab\x9e\x96"
  3893. "\xac\xa8\x3e\x9d\x06\xf4\x2e\xba\xa3\xc0\xa0\xb2",
  3894. 264);
  3895. *(uint64_t*)0x200000000008 = 0x150;
  3896. *(uint64_t*)0x200000000198 = 1;
  3897. *(uint64_t*)0x2000000001a0 = 0;
  3898. *(uint64_t*)0x2000000001a8 = 0;
  3899. *(uint32_t*)0x2000000001b0 = 0;
  3900. syscall(__NR_sendmsg, /*fd=*/r[70], /*msg=*/0x200000000180ul,
  3901. /*f=MSG_FASTOPEN|MSG_DONTROUTE*/ 0x20000004ul);
  3902. res = syscall(__NR_socket, /*domain=*/0x11ul, /*type=SOCK_DGRAM*/ 2ul,
  3903. /*proto=*/0x300);
  3904. if (res != -1)
  3905. r[74] = res;
  3906. syscall(__NR_recvfrom, /*fd=*/r[74], /*buf=*/0ul, /*len=*/0ul,
  3907. /*f=MSG_ERRQUEUE*/ 0x2000ul, /*addr=*/0ul, /*addrlen=*/0ul);
  3908. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x5301, 0);
  3909. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3910. /*val=*/0);
  3911. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3912. /*val=*/0x3f);
  3913. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3914. /*val=*/0x12000);
  3915. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3916. /*val=*/2);
  3917. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3918. /*val=*/1);
  3919. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3920. /*val=*/0x101);
  3921. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3922. /*val=*/8);
  3923. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3924. /*val=*/0x80);
  3925. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3926. /*val=*/0x800000);
  3927. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3928. /*val=*/0x7fffffff);
  3929. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3930. /*val=*/0x7fff);
  3931. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3932. /*val=*/8);
  3933. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3934. /*val=*/6);
  3935. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3936. /*val=*/0xffff8000);
  3937. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3938. /*val=*/2);
  3939. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3940. /*val=*/8);
  3941. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3942. /*val=*/0xfff);
  3943. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3944. /*val=*/4);
  3945. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3946. /*val=*/5);
  3947. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3948. /*val=*/6);
  3949. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3950. /*val=*/4);
  3951. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3952. /*val=*/0x1000);
  3953. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3954. /*val=*/8);
  3955. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3956. /*val=*/-1);
  3957. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3958. /*val=*/7);
  3959. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3960. /*val=*/0x1ff);
  3961. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3962. /*val=*/0x88c);
  3963. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3964. /*val=*/0x3fbb);
  3965. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3966. /*val=*/0x15);
  3967. syz_proconfig_set__sys_devices_pci0000_00_0000_00_03_0_net_eth0_mtu(
  3968. /*val=*/0);
  3969. memcpy((void*)0x200000000400, "/dev/net/tun\000", 13);
  3970. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  3971. /*file=*/0x200000000400ul, /*flags=O_RDWR*/ 2, /*mode=*/0);
  3972. if (res != -1)
  3973. r[75] = res;
  3974. memset((void*)0x200000000280, 0, 16);
  3975. *(uint16_t*)0x200000000290 = 0x4009;
  3976. syscall(__NR_ioctl, /*fd=*/r[75], /*cmd=*/0x400454ca,
  3977. /*arg=*/0x200000000280ul);
  3978. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
  3979. if (res != -1)
  3980. r[76] = res;
  3981. res = syscall(__NR_dup2, /*oldfd=*/r[75], /*newfd=*/r[76]);
  3982. if (res != -1)
  3983. r[77] = res;
  3984. memcpy((void*)0x200000000300,
  3985. "\x00\x00\x00\x00\x04\x01\x00\x00\x01\x00\x00\x00\x88\x96", 14);
  3986. syscall(__NR_write, /*fd=*/r[77], /*buf=*/0x200000000300ul,
  3987. /*count=*/0xfdeful);
  3988. memcpy((void*)0x2000000002c0, "./file0\000", 8);
  3989. syscall(__NR_mkdir, /*path=*/0x2000000002c0ul, /*mode=*/0ul);
  3990. memcpy((void*)0x200000000140, "./file0\000", 8);
  3991. memcpy((void*)0x200000000580, "cgroup2\000", 8);
  3992. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000140ul,
  3993. /*type=*/0x200000000580ul, /*flags=*/0ul, /*data=*/0ul);
  3994. memcpy((void*)0x200000000140, "./file0\000", 8);
  3995. syscall(__NR_mkdir, /*path=*/0x200000000140ul, /*mode=*/0ul);
  3996. memcpy((void*)0x200000000000, "./file0\000", 8);
  3997. memcpy((void*)0x200000000040, "ramfs\000", 6);
  3998. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000000ul,
  3999. /*type=*/0x200000000040ul, /*flags=*/0ul, /*data=*/0ul);
  4000. memcpy((void*)0x200000000280, "./file0\000", 8);
  4001. syscall(__NR_chdir, /*dir=*/0x200000000280ul);
  4002. memcpy((void*)0x200000000080, "./file0\000", 8);
  4003. memcpy((void*)0x2000000002c0, "./file0\000", 8);
  4004. syscall(__NR_symlink, /*old=*/0x200000000080ul, /*new=*/0x2000000002c0ul);
  4005. memcpy((void*)0x200000000180, "ext4\000", 5);
  4006. memcpy((void*)0x2000000000c0, "./file0\000", 8);
  4007. memcpy((void*)0x2000000001c0, "dioread_nolock", 14);
  4008. *(uint8_t*)0x2000000001ce = 0x2c;
  4009. memcpy((void*)0x2000000001cf, "grpquota", 8);
  4010. *(uint8_t*)0x2000000001d7 = 0x2c;
  4011. memcpy((void*)0x2000000001d8, "debug_want_extra_isize", 22);
  4012. *(uint8_t*)0x2000000001ee = 0x3d;
  4013. sprintf((char*)0x2000000001ef, "0x%016llx", (long long)0x5c);
  4014. *(uint8_t*)0x200000000201 = 0x2c;
  4015. memcpy((void*)0x200000000202, "journal_ioprio", 14);
  4016. *(uint8_t*)0x200000000210 = 0x3d;
  4017. sprintf((char*)0x200000000211, "0x%016llx", (long long)5);
  4018. *(uint8_t*)0x200000000223 = 0x2c;
  4019. memcpy((void*)0x200000000224, "errors=continue", 15);
  4020. *(uint8_t*)0x200000000233 = 0x2c;
  4021. memcpy((void*)0x200000000234, "errors=continue", 15);
  4022. *(uint8_t*)0x200000000243 = 0x2c;
  4023. memcpy((void*)0x200000000244, "usrjquota=", 10);
  4024. *(uint8_t*)0x20000000024e = 0x2c;
  4025. *(uint8_t*)0x20000000024f = 0;
  4026. memcpy(
  4027. (void*)0x200000000d00,
  4028. "\x78\x9c\xec\xdb\xcf\x6f\x14\x55\x1c\x00\xf0\xef\xcc\xb6\xa0\x08\xb4\x22"
  4029. "\xfe\x00\x51\xab\x68\x6c\xfc\xd1\xd2\x82\xca\xc1\x8b\x46\x13\x0f\x9a\x98"
  4030. "\xe8\x01\x8f\xb5\x2d\x04\x59\xa8\xa1\x35\x11\x42\xb4\x1a\x83\x47\x43\xe2"
  4031. "\xdd\x78\x34\xf1\x2f\xf0\xa4\x17\xa3\x9e\x4c\xbc\xea\xdd\x90\x10\xed\x05"
  4032. "\xf4\x62\xcd\xcc\xce\x94\xed\x76\xb7\xf4\xc7\x96\x6d\xbb\x9f\x4f\x32\xed"
  4033. "\x7b\x3b\x6f\xf7\xbd\xef\xbe\x79\x3b\x6f\xe6\xed\x06\xd0\xb5\x06\xb2\x3f"
  4034. "\x49\xc4\xee\x88\xf8\x3d\x22\xfa\x6a\xd9\xc5\x05\x06\x6a\xff\x6e\xcc\x5d"
  4035. "\x1a\xff\x67\xee\xd2\x78\x12\xf3\xf3\x6f\xfd\x95\xe4\xe5\xae\xcf\x5d\x1a"
  4036. "\x2f\x8b\x96\xcf\xbb\xab\xc8\x0c\xa6\x11\xe9\x67\x49\x51\xc9\x62\xd3\x17"
  4037. "\x2e\x9e\x19\xab\x56\x27\xcf\x17\xf9\xe1\x99\xb3\xef\x0f\x4f\x5f\xb8\xf8"
  4038. "\xec\xe9\xb3\x63\xa7\x26\x4f\x4d\x9e\x1b\x3d\x7e\xfc\xd8\xd1\x91\x17\x9e"
  4039. "\x1f\x7d\xae\x2d\x71\x66\x71\x5d\x3f\xf8\xd1\xd4\xa1\x03\xaf\xbd\x73\xe5"
  4040. "\x8d\xf1\x13\x57\xde\xfd\xf9\xdb\xac\xbd\xbb\x8b\xfd\xf5\x71\xb4\xcb\x40"
  4041. "\x16\xf8\xdf\xf3\xb9\xc6\x7d\x4f\xb4\xbb\xb2\x0e\xdb\x53\x97\x4e\x7a\x3a"
  4042. "\xd8\x10\x56\xa5\x12\x11\x59\x77\xf5\xe6\xe3\xbf\x2f\x2a\x71\xb3\xf3\xfa"
  4043. "\xe2\xd5\x4f\x3b\xda\x38\x60\x43\x65\xe7\xa6\x9d\xad\x77\xcf\x26\xc9\x3c"
  4044. "\xb0\x6d\x25\xd1\xe9\x16\x00\x9d\x51\x9e\xe8\xb3\xeb\xdf\x72\xbb\x4d\x53"
  4045. "\x8f\x4d\xe1\xda\x4b\xb5\x0b\xa0\x2c\xee\x1b\xc5\x56\xdb\xd3\x13\x69\x51"
  4046. "\xa6\xb7\xe1\xfa\xb6\x9d\x06\x22\xe2\xc4\xec\xbf\x5f\x65\x5b\x6c\xd0\x7d"
  4047. "\x08\x00\x80\x7a\xdf\x67\xf3\x9f\x67\x9a\xcd\xff\xd2\xb8\xaf\xae\xdc\xde"
  4048. "\x62\x0d\xa5\x3f\x22\xee\x8e\x88\x7d\x11\x71\x4f\x44\xec\x8f\x88\x7b\x23"
  4049. "\xf2\xb2\xf7\x47\xc4\x03\xab\xac\xbf\x71\x69\x68\xe9\xfc\x27\xbd\xba\xa6"
  4050. "\xc0\x56\x28\x9b\xff\xbd\x58\xac\x6d\x2d\x9e\xff\x95\xb3\xbf\xe8\xaf\x14"
  4051. "\xb9\x3d\x79\xfc\xbd\xc9\xc9\xd3\xd5\xc9\x23\xc5\x7b\x32\x18\xbd\x3b\xb3"
  4052. "\xfc\xc8\x32\x75\xfc\xf0\xca\x6f\x5f\xb4\xda\x57\x3f\xff\xcb\xb6\xac\xfe"
  4053. "\x72\x2e\x58\xb4\xe3\x6a\x4f\xc3\x0d\xba\x89\xb1\x99\xb1\x7c\x52\xda\x06"
  4054. "\xd7\x3e\x89\x38\xd8\xd3\x2c\xfe\x64\x61\x25\x20\x89\x88\x03\x11\x71\x70"
  4055. "\x75\x2f\xbd\xb7\x4c\x9c\x7e\xea\x9b\x43\xad\x0a\xdd\x3a\xfe\x65\xb4\x61"
  4056. "\x9d\x69\xfe\xeb\x88\x27\x6b\xfd\x3f\x1b\x0d\xf1\x97\x92\xe5\xd7\x27\x87"
  4057. "\xef\x88\xea\xe4\x91\xe1\xf2\xa8\x58\xea\x97\x5f\x2f\xbf\xd9\xaa\xfe\x75"
  4058. "\xc5\xdf\x06\x59\xff\xef\x5a\x7c\xfc\x37\x16\xe9\x4f\xea\xd7\x6b\xa7\x57"
  4059. "\x5f\xc7\xe5\x3f\x3e\x6f\x79\x4d\xb3\xd6\xe3\x7f\x47\xf2\x76\xde\x2f\x3b"
  4060. "\x8a\xc7\x3e\x1c\x9b\x99\x39\x3f\x12\xb1\x23\x79\x3d\xcf\x2f\x7a\x7c\xf4"
  4061. "\xe6\x73\xcb\x7c\x59\x3e\x8b\x7f\xf0\x70\xf3\xf1\xbf\xaf\x78\x4e\x56\xcf"
  4062. "\x83\x11\x91\x1d\xc4\x0f\x45\xc4\xc3\x11\xf1\x48\xd1\xf6\x47\x23\xe2\xb1"
  4063. "\x88\x38\x5c\x56\xf0\xdf\xd2\x18\x7f\x7a\xf9\xf1\xf7\xd6\x1e\xff\xc6\xca"
  4064. "\xe2\x9f\x68\xfa\xf9\xb7\x70\xfc\x37\xf4\xff\xea\x13\x95\x33\x3f\x7e\xd7"
  4065. "\xaa\xfe\x95\xf5\xff\xb1\x3c\x35\x58\x3c\x92\x7f\xfe\xdd\xc2\x4a\x1b\xb8"
  4066. "\x9e\xf7\x0e\x00\x00\x00\xb6\x8a\x34\xff\x0e\x7c\x92\x0e\x2d\xa4\xd3\x74"
  4067. "\x68\xa8\xf6\x1d\xfe\xfd\xb1\x2b\xad\x4e\x4d\xcf\x3c\x7d\x72\xea\x83\x73"
  4068. "\x13\xb5\xef\xca\xf7\x47\x6f\x5a\xde\xe9\xea\xab\xbb\x1f\x3a\x92\xcc\x16"
  4069. "\xaf\x58\xcb\x8f\xc6\x40\x5f\x7d\xfe\x68\x71\xdf\xf8\xcb\xca\x9d\x79\x7e"
  4070. "\x68\x7c\xaa\x3a\xd1\xc9\xc0\x81\x7c\x9c\x37\x1b\xff\x99\x3f\x2b\x9d\x6e"
  4071. "\x1d\xb0\xe1\xfc\x5e\x0b\xba\x57\xe3\xf8\x4f\x3b\xd4\x0e\xe0\xf6\x73\xfe"
  4072. "\x87\xee\x65\xfc\x43\xf7\x32\xfe\xa1\x7b\x35\x1b\xff\x1f\x37\xe4\xad\x05"
  4073. "\xc0\xf6\xe4\xfc\x0f\xdd\xcb\xf8\x87\xee\x65\xfc\x43\xf7\x32\xfe\xa1\x2b"
  4074. "\xad\xe7\x77\xfd\x5b\x2b\x11\xe9\xa6\x68\xc6\xb6\x49\x44\xba\x29\x9a\x21"
  4075. "\xb1\x31\x89\xc6\xfb\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4076. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4077. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4078. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4079. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4080. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4081. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4082. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4083. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4084. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4085. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4086. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4087. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4088. "\x5b\xd4\xff\x01\x00\x00\xff\xff\x6c\xca\xeb\xbf",
  4089. 1092);
  4090. syz_mount_image(
  4091. /*fs=*/0x200000000180, /*dir=*/0x2000000000c0,
  4092. /*flags=MS_I_VERSION|MS_REC|MS_SYNCHRONOUS|MS_RELATIME|MS_NOATIME|0x300*/
  4093. 0xa04710, /*opts=*/0x2000000001c0, /*chdir=*/1, /*size=*/0x444,
  4094. /*img=*/0x200000000d00);
  4095. syz_open_dev(/*dev=*/0xc, /*major=*/4, /*minor=*/0x15);
  4096. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x4b36, 0);
  4097. memcpy((void*)0x200000000100, "./file0\000", 8);
  4098. syscall(__NR_mknod, /*file=*/0x200000000100ul, /*mode=*/0ul, /*dev=*/0);
  4099. *(uint64_t*)0x200000000680 = 0;
  4100. *(uint32_t*)0x200000000688 = 0x21;
  4101. *(uint32_t*)0x20000000068c = 0;
  4102. *(uint32_t*)0x200000000690 = 0;
  4103. syscall(__NR_timer_create, /*id=*/0ul, /*ev=*/0x200000000680ul,
  4104. /*timerid=*/0x200000000100ul);
  4105. *(uint64_t*)0x20000006b000 = 0;
  4106. *(uint64_t*)0x20000006b008 = 8;
  4107. *(uint64_t*)0x20000006b010 = 0;
  4108. *(uint64_t*)0x20000006b018 = 9;
  4109. syscall(__NR_timer_settime, /*timerid=*/0, /*flags=*/0ul,
  4110. /*new=*/0x20000006b000ul, /*old=*/0ul);
  4111. memcpy((void*)0x200000000000, "127.0.0.1\000", 10);
  4112. memcpy((void*)0x200000000040, "./file0\000", 8);
  4113. memcpy((void*)0x200000000080, "9p\000", 3);
  4114. memcpy((void*)0x200000000240, "trans=tcp,", 10);
  4115. memcpy((void*)0x20000000024a, "port", 4);
  4116. *(uint8_t*)0x20000000024e = 0x3d;
  4117. sprintf((char*)0x20000000024f, "0x%016llx", (long long)0);
  4118. *(uint8_t*)0x200000000261 = 0x2c;
  4119. *(uint8_t*)0x200000000262 = 0;
  4120. syscall(__NR_mount, /*src=*/0x200000000000ul, /*dst=*/0x200000000040ul,
  4121. /*type=*/0x200000000080ul, /*flags=*/0ul, /*opts=*/0x200000000240ul);
  4122. memcpy((void*)0x200000000000, "/dev/cdrom\000", 11);
  4123. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  4124. /*file=*/0x200000000000ul, /*flags=O_DIRECTORY*/ 0x10000,
  4125. /*mode=*/0);
  4126. if (res != -1)
  4127. r[78] = res;
  4128. *(uint8_t*)0x200000000080 = 0x2b;
  4129. *(uint8_t*)0x200000000081 = 0x16;
  4130. memset((void*)0x200000000082, 0, 6);
  4131. *(uint8_t*)0x200000000088 = 0xf4;
  4132. *(uint8_t*)0x200000000089 = 0xb5;
  4133. memcpy((void*)0x20000000008a,
  4134. "\x37\xc1\x2e\x88\xb5\x1b\xe5\x76\xc5\xbe\x45\x0a\xec\x35\x2c\x3d\xc4"
  4135. "\x64\x88\xbc\x0a\x44\xf5\x00\x9f\x46\xde\xff\xaa\x54\x52\x13\x1a\x9f"
  4136. "\xd8\x91\xaa\x02\x7c\x4e\xaa\xf4\xce\x92\x27\x60\x33\x15\x51\x89\xf0"
  4137. "\x75\x34\x47\x26\x44\xac\x66\xf4\x67\xea\x55\x98\x0b\x29\x34\x1c\x7a"
  4138. "\x43\xdd\x76\x19\x3f\xda\xd3\xf5\x9b\x9d\x09\x8b\x5c\xaa\xcb\x6b\x9e"
  4139. "\x6e\x31\xc2\x65\x76\xf5\x06\x41\x0e\xa5\xce\x0e\x23\xe8\xee\x94\xd3"
  4140. "\xca\xcd\x21\x6a\x3b\xee\xa4\x3c\x1f\x94\x03\xaf\x2c\xba\xc5\xc8\xf0"
  4141. "\x70\x93\x7a\xcc\x93\xa1\x11\x63\x59\x35\x07\x2c\x3a\xa6\x78\x1d\x7b"
  4142. "\x65\x70\xc3\xb0\x9e\xdf\x84\xa5\x5e\x70\x2f\xb7\x07\x71\x73\x37\x12"
  4143. "\xcf\x15\x90\x9e\x9f\x96\x08\x18\xe2\x89\xb4\x48\xce\x5f\x02\x84\x89"
  4144. "\x60\x61\xd6\xab\x20\xa5\x92\x31\x93\x48\x81",
  4145. 181);
  4146. syscall(__NR_setsockopt, /*fd=*/-1, /*level=*/0x29, /*optname=*/0x37,
  4147. /*optval=*/0x200000000080ul, /*optlen=*/0xc0ul);
  4148. memcpy((void*)0x200000000000, "/dev/snd/timer\000", 15);
  4149. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  4150. /*file=*/0x200000000000ul, /*flags=*/0, 0);
  4151. if (res != -1)
  4152. r[79] = res;
  4153. syscall(
  4154. __NR_clock_getres,
  4155. /*id=CLOCK_PROCESS_CPUTIME_ID|0x4b54da0c41cf7c50*/ 0x4b54da0c41cf7c52ul,
  4156. /*tp=*/0ul);
  4157. *(uint32_t*)0x200000000140 = 1;
  4158. *(uint32_t*)0x200000000144 = 0;
  4159. *(uint32_t*)0x200000000148 = 0;
  4160. *(uint32_t*)0x20000000014c = 0;
  4161. *(uint32_t*)0x200000000150 = 0;
  4162. memset((void*)0x200000000154, 0, 32);
  4163. syscall(__NR_ioctl, /*fd=*/r[79], /*cmd=*/0x40345410,
  4164. /*arg=*/0x200000000140ul);
  4165. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/3ul, /*proto=*/2);
  4166. if (res != -1)
  4167. r[80] = res;
  4168. syscall(__NR_getsockopt, /*fd=*/r[80], /*level=*/1, /*optname=*/0,
  4169. /*optval=*/0ul, /*optlen=*/0ul);
  4170. memcpy(
  4171. (void*)0x200000000940,
  4172. "\0203q}2[\340\232\356\257\003\227\236t\v\"|"
  4173. "Ma\206\347\300\024\237\271h\261\226\347=I\2060S6\265\250\302\225Je%"
  4174. "\376G\'\250\345\217\370\322\034\300\373\034\246\253\bi\344^"
  4175. "\325\375\251\r\2547A\224k\315\t\000\220k\326\005\266&\320\235aA\305\234_"
  4176. "\324\030,\f\324s\262\231/"
  4177. "\300\232\362Oc\300c\003gB!\260\270n\001\233T\225\020\206\350$\177\r["
  4178. "\371\0161v\261\034\210\v\225uy\265:\342\341\334(\375\005\237B\204O\376@"
  4179. "\000\000\000\000\000\000\000\000\000\000\000\000\032\240\212\033\003\"&"
  4180. "\254\312p>\314Z\001\274\030\301\271\351\v\213\234\264Q\324\226EV<>"
  4181. "\t\000\000\000\304tL\352\365W\275#"
  4182. "\317\212\320\350\270\354\004\205\f\357\264\204\355\237/"
  4183. "\324\273\352;-Dp\370\320F\220\370\222Ip6\364\026\350\024\340\222!\222-"
  4184. "F\342\024D\221\250b\004\335\035\a\334\340\030\205{"
  4185. "\200Q\366k\226\372Q\237W\vO\360\344O\\\316S\362\336\0049d\006#"
  4186. "\210\303\337\205O\034\303\255?r\327\016\000\327\203\260\210\234\366Y-"
  4187. "F\230\335\234~\375\225\303\266lC\252\"Y\365\320\267\334\213\027|"
  4188. "\351q\242K\354z\204:*\365Y\321\2331}\233\025\324\354\002o\001&"
  4189. "\252\220w\304\307yn\265\032g\253&?"
  4190. "\276\313\350v\250\340\244\201sW\254f\0249\322}\357CGa\232$4\214\245!"
  4191. "p\203\005\226%\002%\253j\n\b\310NC\221}&"
  4192. "y\323\341\356p\'\305\253\031GsX5\214\n\237h\356;4\261%"
  4193. "V\340\251\216\3630:\330\030N~G\0239\312\257\353o\035\027\325nAp\327\314("
  4194. "A\230 "
  4195. "\000;]\375;\320\234\031v\034\302]"
  4196. "\264Dk\205\344\210\2154\200\231\301i\255\2466\223\v\321/"
  4197. ";6U\344\261\233\247\270\335t8\226\301=W\321\001\333r\311n@"
  4198. "fw\305\272\234\234}\375\214\333gE@N\307\252\210Z\001:\270\206\207#"
  4199. "\365\324L->\271\021_\374h)\274\2525\255\267?\2530{"
  4200. "8\207\346\253\200\272p<\223}"
  4201. "1K\323\202\2651c\300\366\256\352\233ht\221N\021\002\24557\210&\a!"
  4202. "\022D\037y\214\336\236`\253\345\234\320\233\214["
  4203. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\302"
  4204. "\365\200\375\004\3544\340\n\252%R\301\273\271:"
  4205. "\017\274\005\315\243\206\276\257\270S\352\234\006["
  4206. "Q\231\003\325J\361\351}*\204\232\337\f\365\356\337H@"
  4207. "\340\016\000\370\217Q;"
  4208. "n2I\373\f\262\320\224\t\335\265\252\352\225\310\037\024\343\243\026\245"
  4209. "\326\375\333\314\336\350q\351\306\265\211\341\304\317\337\\\2750\302~"
  4210. "\355\000\332\351\307\265}"
  4211. "\224\260\034\365\327\034\265\033\0168\252\242\261h\265P\002KQ",
  4212. 737);
  4213. res = syscall(__NR_memfd_create, /*name=*/0x200000000940ul, /*flags=*/0ul);
  4214. if (res != -1)
  4215. r[81] = res;
  4216. memcpy((void*)0x200000000040, "/dev/loop#\000", 11);
  4217. res = -1;
  4218. res = syz_open_dev(/*dev=*/0x200000000040, /*id=*/0, /*flags=*/0);
  4219. if (res != -1)
  4220. r[82] = res;
  4221. syscall(__NR_ioctl, /*fd=*/r[82], /*cmd=*/0x4c06, /*arg=*/r[81]);
  4222. syscall(__NR_ioctl, /*fd=*/r[79], /*cmd=*/0x54a0, 0);
  4223. memcpy((void*)0x200000000000, "/dev/snd/timer\000", 15);
  4224. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  4225. /*file=*/0x200000000000ul, /*flags=*/0x20, 0);
  4226. if (res != -1)
  4227. r[83] = res;
  4228. *(uint32_t*)0x200000000140 = 1;
  4229. *(uint32_t*)0x200000000144 = 0;
  4230. *(uint32_t*)0x200000000148 = 0;
  4231. *(uint32_t*)0x20000000014c = 0;
  4232. *(uint32_t*)0x200000000150 = 0;
  4233. memset((void*)0x200000000154, 0, 32);
  4234. syscall(__NR_ioctl, /*fd=*/r[83], /*cmd=*/0x40345410,
  4235. /*arg=*/0x200000000140ul);
  4236. syscall(__NR_ioctl, /*fd=*/r[83], /*cmd=*/0x54a2, 0);
  4237. syscall(__NR_ioctl, /*fd=*/r[79], /*cmd=*/0x54a1, 0);
  4238. *(uint8_t*)0x200000000040 = 0xa;
  4239. syscall(__NR_ioctl, /*fd=*/r[78], /*cmd=*/0x5390, /*arg=*/0x200000000040ul);
  4240. *(uint32_t*)0x20000001d000 = 1;
  4241. *(uint32_t*)0x20000001d004 = 0x80;
  4242. *(uint8_t*)0x20000001d008 = 0;
  4243. *(uint8_t*)0x20000001d009 = 0;
  4244. *(uint8_t*)0x20000001d00a = 0;
  4245. *(uint8_t*)0x20000001d00b = 0;
  4246. *(uint32_t*)0x20000001d00c = 0;
  4247. *(uint64_t*)0x20000001d010 = 0x18a;
  4248. *(uint64_t*)0x20000001d018 = 0x308;
  4249. *(uint64_t*)0x20000001d020 = 6;
  4250. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 0, 1);
  4251. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 1, 1);
  4252. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 2, 1);
  4253. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 3, 1);
  4254. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 4, 1);
  4255. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 5, 1);
  4256. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 6, 1);
  4257. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 7, 1);
  4258. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 8, 1);
  4259. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 9, 1);
  4260. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 10, 1);
  4261. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 11, 1);
  4262. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 12, 1);
  4263. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 13, 1);
  4264. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 14, 1);
  4265. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 15, 2);
  4266. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 17, 1);
  4267. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 18, 1);
  4268. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 19, 1);
  4269. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 20, 1);
  4270. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 21, 1);
  4271. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 22, 1);
  4272. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 23, 1);
  4273. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 24, 1);
  4274. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 25, 1);
  4275. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 26, 1);
  4276. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 27, 1);
  4277. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 28, 1);
  4278. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 29, 1);
  4279. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 30, 1);
  4280. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 31, 1);
  4281. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 32, 1);
  4282. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 33, 1);
  4283. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 34, 1);
  4284. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 35, 1);
  4285. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 36, 1);
  4286. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 37, 1);
  4287. STORE_BY_BITMASK(uint64_t, , 0x20000001d028, 0, 38, 26);
  4288. *(uint32_t*)0x20000001d030 = 0;
  4289. *(uint32_t*)0x20000001d034 = 0;
  4290. *(uint64_t*)0x20000001d038 = 3;
  4291. *(uint64_t*)0x20000001d040 = 0xb535;
  4292. *(uint64_t*)0x20000001d048 = 0x107100;
  4293. *(uint64_t*)0x20000001d050 = 2;
  4294. *(uint32_t*)0x20000001d058 = 0;
  4295. *(uint32_t*)0x20000001d05c = 0;
  4296. *(uint64_t*)0x20000001d060 = 0;
  4297. *(uint32_t*)0x20000001d068 = 0;
  4298. *(uint16_t*)0x20000001d06c = 0;
  4299. *(uint16_t*)0x20000001d06e = 0;
  4300. *(uint32_t*)0x20000001d070 = 0x2c6;
  4301. *(uint32_t*)0x20000001d074 = 0;
  4302. *(uint64_t*)0x20000001d078 = 0;
  4303. syscall(__NR_perf_event_open, /*attr=*/0x20000001d000ul, /*pid=*/0,
  4304. /*cpu=*/-1, /*group=*/-1, /*flags=*/0ul);
  4305. memcpy((void*)0x200000000040, "ext4\000", 5);
  4306. memcpy((void*)0x200000000240, "./file0\000", 8);
  4307. *(uint8_t*)0x2000000001c0 = 0;
  4308. memcpy(
  4309. (void*)0x2000000018c0,
  4310. "\x78\x9c\xec\xdd\xcb\x6b\x5c\x65\x1b\x00\xf0\xe7\x4c\x6e\x4d\xda\xef\x4b"
  4311. "\x3e\xf8\x40\xeb\x2a\x20\x68\xa0\x74\x62\x6a\x6c\x15\x5c\x54\x5c\x88\x60"
  4312. "\xa1\xa0\x6b\xdb\x30\x99\x86\x36\x93\x4c\xc9\x4c\x4a\x13\x02\x6d\x11\xc1"
  4313. "\x8d\xa0\xc5\x85\xa0\x9b\xee\x04\x2f\x75\xe7\xd6\xcb\x56\xff\x0b\x17\xd2"
  4314. "\x52\x6c\x1a\x8c\xb8\x90\x91\x33\x99\x69\x27\xcd\x4c\x3a\x69\x6e\x8d\xf9"
  4315. "\xfd\xe0\xb4\xef\x3b\xe7\x4c\x9e\xf7\x39\x97\xf7\xbc\x33\xe7\x30\x27\x80"
  4316. "\x7d\x6b\x30\xfd\x27\x13\x71\x38\x22\x3e\x4a\x22\xfa\x6b\xaf\x27\x11\xd1"
  4317. "\x55\x2d\x75\x46\x9c\x5c\x59\x6e\x79\x71\x21\x97\x4e\x49\x54\x2a\x6f\xff"
  4318. "\x9e\x54\x97\x59\x5a\x5c\xc8\x45\xc3\x7b\x52\x07\x6b\x95\xa7\x23\xe2\xc7"
  4319. "\xf7\x23\x8e\x64\xd6\xc6\x2d\xcd\xcd\x4f\x8e\x15\x0a\xf9\x99\x5a\x7d\xb8"
  4320. "\x3c\x75\x71\xb8\x34\x37\x7f\xf4\xfc\xd4\xd8\x44\x7e\x22\x3f\x7d\x7c\x64"
  4321. "\x74\xf4\xd8\x89\x97\x4e\x1c\xdf\xba\x5c\xff\xf8\x65\xfe\xd0\xed\x8f\xdf"
  4322. "\x78\xfe\x9b\x93\x7f\xbd\xf7\xd4\xcd\x0f\x7f\x4a\xe2\x64\x1c\xaa\xcd\x6b"
  4323. "\xcc\x63\xab\x0c\xc6\x60\x6d\x9d\x74\xa5\xab\x70\x95\xd7\xb7\x3a\xd8\x2e"
  4324. "\x4b\xd6\x99\x77\x60\x07\xdb\xc1\xc6\xa4\x87\x66\xc7\xca\x51\x1e\x87\xa3"
  4325. "\x3f\x3a\xaa\xa5\x16\x7a\x77\xb2\x65\x00\xc0\x76\xb9\x12\x11\x15\x00\x60"
  4326. "\x9f\x49\x9c\xff\x01\x60\x9f\xa9\x7f\x0f\xb0\xb4\xb8\x90\xab\x4f\xeb\x7c"
  4327. "\x5d\xb0\xce\xc5\x81\xbd\xe9\xce\x6b\x2b\x17\xa8\x96\x6a\xd7\x36\x97\xef"
  4328. "\xe7\xdf\x59\xbb\x66\x77\xa0\x7a\x1d\xb4\x6f\x29\x59\x95\x7c\x12\x11\x03"
  4329. "\x5b\x10\x7f\x30\x22\x3e\xff\xee\xdd\xaf\xd2\x29\xb6\xe9\x3a\x24\x40\x33"
  4330. "\x57\xaf\x45\xc4\xd9\x81\xc1\xb5\xfd\x7f\xb2\xe6\x9e\x85\x8d\x7a\xa1\x8d"
  4331. "\x65\x06\x1f\xaa\x37\xf4\x7f\xdd\x9b\x0c\x0f\x3c\xc2\xf7\xe9\xf8\xe7\xe5"
  4332. "\x66\xe3\xbf\xcc\xfd\xf1\x4f\x34\x19\xff\xf4\x34\x39\x76\x1f\xc7\x3a\xc7"
  4333. "\x7f\x4d\xe6\xd6\x16\x84\x69\x29\x1d\xff\xbd\xda\x70\x6f\xdb\x72\x43\xfe"
  4334. "\x35\x03\x1d\xb5\xda\x7f\xaa\x63\xbe\xae\xe4\xdc\xf9\x42\x3e\xed\xdb\xfe"
  4335. "\x1b\x11\x43\xd1\xd5\x93\xd6\x47\xd6\x89\x31\x74\xef\xef\x7b\xad\xe6\x35"
  4336. "\x8e\xff\xee\x5e\xbf\x90\xf6\x79\xb9\xbb\xd7\x2f\x7c\xf9\x60\x89\xcc\xad"
  4337. "\xce\x9e\xd5\xef\x19\x1f\x2b\x8f\x6d\x26\xe7\x46\x77\xae\x45\x3c\xd3\xd9"
  4338. "\x2c\xff\x7a\xff\xbf\x72\x0f\x5b\xb3\xf1\xef\xe9\x36\x63\xbc\xf9\xca\x07"
  4339. "\x9f\xb5\x9a\x97\xe6\x9f\xe6\x5b\x9f\xd2\xf8\xab\xf3\xdf\x5e\x95\x1b\x11"
  4340. "\xcf\x35\xdd\xfe\x0f\xee\x68\x4b\xd6\xbd\x3f\x71\xb8\xba\x3b\x0c\xd7\x77"
  4341. "\x8a\x26\xbe\xfd\xf5\xd3\xbe\x56\xf1\x1b\xb7\x7f\x3a\xa5\xf1\xeb\x9f\x05"
  4342. "\x76\x42\xba\xfd\xfb\xd6\xcf\x7f\x20\x69\xbc\x5f\xb3\xb4\xf1\x18\x3f\xdf"
  4343. "\xe8\xff\xa1\xd5\xbc\x47\xe7\xdf\x7c\xff\xef\x4e\xde\xa9\x96\xeb\x83\x84"
  4344. "\xcb\x63\xe5\xf2\xcc\x48\x44\x77\xf2\xd6\xda\xd7\x8f\x3d\x78\x6f\xbd\x5e"
  4345. "\x5f\x3e\xcd\x7f\xe8\xd9\xee\xa6\xc7\x7f\xbd\xff\x6b\xb6\xff\xa7\x9f\x09"
  4346. "\xcf\xb6\x99\x7f\xe7\xed\x6b\x5f\x3f\x7e\xfe\xdb\x2b\xcd\x7f\x7c\x43\xdb"
  4347. "\x7f\xe3\x85\x9b\xcb\x93\x1d\xad\xe2\xb7\xb7\xfd\x47\xab\xa5\xa1\xda\x2b"
  4348. "\xed\xf4\x7f\xed\x36\x70\x33\xeb\x0e\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4349. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xda\x95\x89\x88\x43\x91\x64\xb2"
  4350. "\xf7\xcb\x99\x4c\x36\xbb\xf2\x0c\xef\xff\x47\x5f\xa6\x50\x2c\x95\x8f\x9c"
  4351. "\x2b\xce\x4e\x8f\x47\xf5\x59\xd9\x03\xd1\x95\xa9\xff\xd4\x65\x7f\xc3\xef"
  4352. "\xa1\x8e\xd4\x7e\x0f\xbf\x5e\x3f\xf6\x50\xfd\xc5\x88\xf8\x5f\x44\x7c\xd2"
  4353. "\xd3\x5b\xad\x67\x73\xc5\xc2\xf8\x6e\x27\x0f\x00\x00\x00\x00\x00\x00\x00"
  4354. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4355. "\x00\x00\x00\x00\x00\x00\x35\x07\x5b\x3c\xff\x3f\xf5\x5b\xcf\x6e\xb7\x0e"
  4356. "\x00\xd8\x36\x07\x76\xbb\x01\x00\xc0\x8e\x73\xfe\x07\x80\xfd\x67\x63\xe7"
  4357. "\xff\xde\x6d\x6b\x07\x00\xb0\x73\x7c\xfe\x07\x80\xfd\xc7\xf9\x1f\x00\xf6"
  4358. "\x1f\xe7\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4359. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4360. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4361. "\xb6\xd9\xe9\x53\xa7\xd2\xa9\xf2\xe7\xe2\x42\x2e\xad\x8f\x5f\x9a\x9b\x9d"
  4362. "\x2c\x5e\x3a\x3a\x9e\x2f\x4d\x66\xa7\x66\x73\xd9\x5c\x71\xe6\x62\x76\xa2"
  4363. "\x58\x9c\x28\xe4\xb3\xb9\xe2\x54\xcb\x3f\x74\x75\xe5\xbf\x42\xb1\x78\x71"
  4364. "\x34\xa6\x67\x2f\x0f\x97\xf3\xa5\xf2\x70\x69\x6e\xfe\xcc\x54\x71\x76\xba"
  4365. "\x7c\xe6\xfc\xd4\xd8\x44\xfe\x4c\xbe\x6b\xc7\x32\x03\x00\x00\x00\x00\x00"
  4366. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4367. "\x00\x00\x00\x00\x00\x00\x00\x80\xf6\x95\xe6\xe6\x27\xc7\x0a\x85\xfc\xcc"
  4368. "\x9e\x29\x54\x2a\x95\x2b\x4f\x40\x33\xfe\x0d\x85\x8e\xda\x4e\xf0\xa4\xb4"
  4369. "\x67\xcf\x15\x32\x9b\x58\x75\x5f\xec\x76\xe3\x1f\x51\x68\xec\x25\x7a\x77"
  4370. "\xa7\x73\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4371. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4372. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4373. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4374. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4375. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4376. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4377. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4378. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4379. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4380. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4381. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4382. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4383. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4384. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4385. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4386. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4387. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4388. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4389. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4390. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4391. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4392. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4393. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4394. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4395. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4396. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4397. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4398. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4399. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4400. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4401. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4402. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4403. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4404. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4405. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4406. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4407. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4408. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4409. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4410. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4411. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4412. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4413. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4414. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4415. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4416. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4417. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\x03\xfe\x09\x00\x00"
  4418. "\xff\xff\xaa\x8a\x25\x14",
  4419. 1950);
  4420. syz_mount_image(/*fs=*/0x200000000040, /*dir=*/0x200000000240, /*flags=*/0,
  4421. /*opts=*/0x2000000001c0, /*chdir=*/1, /*size=*/0x79e,
  4422. /*img=*/0x2000000018c0);
  4423. memcpy((void*)0x200000000040, "./bus\000", 6);
  4424. res = syscall(__NR_creat, /*file=*/0x200000000040ul, /*mode=*/0ul);
  4425. if (res != -1)
  4426. r[84] = res;
  4427. *(uint64_t*)0x200000000600 = 0x200000000380;
  4428. memset((void*)0x200000000380, 96, 1);
  4429. *(uint64_t*)0x200000000608 = 1;
  4430. syscall(__NR_pwritev2, /*fd=*/r[84], /*vec=*/0x200000000600ul, /*vlen=*/1ul,
  4431. /*off_low=*/0xac04, /*off_high=*/0, /*flags=*/0ul);
  4432. memcpy((void*)0x200000008140, "./bus\000", 6);
  4433. res =
  4434. syscall(__NR_open, /*file=*/0x200000008140ul,
  4435. /*flags=O_NOFOLLOW|O_NOCTTY|O_NOATIME|O_CREAT|O_RDWR*/ 0x60142ul,
  4436. /*mode=*/0ul);
  4437. if (res != -1)
  4438. r[85] = res;
  4439. syscall(__NR_fallocate, /*fd=*/r[85], /*mode=FALLOC_FL_COLLAPSE_RANGE*/ 8ul,
  4440. /*off=*/0ul, /*len=*/0x8000ul);
  4441. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/2ul, /*proto=*/0x88);
  4442. if (res != -1)
  4443. r[86] = res;
  4444. syscall(__NR_socket, /*domain=*/0xaul, /*type=*/2ul, /*proto=*/0x88);
  4445. syscall(__NR_ioctl, /*fd=*/r[86], /*cmd=*/0x89f1, /*arg=*/0ul);
  4446. syscall(__NR_setsockopt, /*fd=*/-1, /*level=*/0, /*optname=*/0x29,
  4447. /*optval=*/0ul, /*optlen=*/0xfe3bul);
  4448. memcpy((void*)0x200000000080, "./bus\000", 6);
  4449. res = syscall(__NR_creat, /*file=*/0x200000000080ul, /*mode=*/0ul);
  4450. if (res != -1)
  4451. r[87] = res;
  4452. memcpy((void*)0x200000000040, "blkio.throttle.io_service_bytes\000", 32);
  4453. res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000040ul,
  4454. /*flags=*/0x275a, /*mode=*/0);
  4455. if (res != -1)
  4456. r[88] = res;
  4457. syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul,
  4458. /*prot=*/0ul,
  4459. /*flags=MAP_STACK|MAP_POPULATE|MAP_FIXED|MAP_SHARED*/ 0x28011ul,
  4460. /*fd=*/r[88], /*offset=*/0ul);
  4461. res = syscall(__NR_socket,
  4462. /*domain=AF_INET6|0x200000000000000*/ 0x20000000000000aul,
  4463. /*type=SOCK_DGRAM*/ 2ul, /*proto=*/0);
  4464. if (res != -1)
  4465. r[89] = res;
  4466. syscall(__NR_ioctl, /*fd=*/r[89], /*cmd=*/0x8916, /*arg=*/0ul);
  4467. syscall(__NR_close_range, /*fd=*/-1, /*max_fd=*/-1,
  4468. /*flags=CLOSE_RANGE_UNSHARE*/ 2ul);
  4469. syscall(__NR_ioperm, /*from=*/0ul, /*num=*/0x800ul, /*on=*/8ul);
  4470. res = syscall(__NR_socket, /*domain=*/1ul, /*type=SOCK_DGRAM*/ 2ul,
  4471. /*proto=*/0);
  4472. if (res != -1)
  4473. r[90] = res;
  4474. syscall(__NR_recvmmsg, /*fd=*/r[90], /*mmsg=*/0ul, /*vlen=*/0ul, /*f=*/0ul,
  4475. /*timeout=*/0ul);
  4476. syscall(__NR_open_by_handle_at, /*mountdirfd=*/r[87], /*handle=*/0ul,
  4477. /*flags=*/0ul);
  4478. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0);
  4479. if (res != -1)
  4480. r[91] = res;
  4481. *(uint32_t*)0x200000000000 = 0xdf;
  4482. syscall(__NR_setsockopt, /*fd=*/r[91], /*level=*/6,
  4483. /*optname=TCP_THIN_LINEAR_TIMEOUTS|TCP_CORK*/ 0x13,
  4484. /*optval=*/0x200000000000ul, /*optlen=*/4ul);
  4485. syscall(__NR_socketpair, /*domain=*/1ul, /*type=*/1ul, /*proto=*/0,
  4486. /*fds=*/0x200000000000ul);
  4487. memcpy((void*)0x2000000000c0, "ext4\000", 5);
  4488. memcpy((void*)0x200000000040, "./file0\000", 8);
  4489. memcpy((void*)0x200000001280, "quota", 5);
  4490. *(uint8_t*)0x200000001285 = 0x2c;
  4491. memcpy((void*)0x200000001286, "noload", 6);
  4492. *(uint8_t*)0x20000000128c = 0x2c;
  4493. memcpy((void*)0x20000000128d, "errors=remount-ro", 17);
  4494. *(uint8_t*)0x20000000129e = 0x2c;
  4495. memcpy((void*)0x20000000129f, "init_itable", 11);
  4496. *(uint8_t*)0x2000000012aa = 0x2c;
  4497. *(uint8_t*)0x2000000012ab = 0;
  4498. memcpy(
  4499. (void*)0x200000001380,
  4500. "\x78\x9c\xec\xdd\x4d\x6f\x1b\x5b\x19\x00\xe0\x77\x26\x49\xf3\x71\x73\x6f"
  4501. "\x72\xc5\x5d\x00\x02\x6e\x29\x85\x82\xaa\xda\x89\xdb\x46\xa8\xab\xb2\xe1"
  4502. "\x43\x55\x25\x44\xc5\x8a\x45\x1b\x12\x37\x8a\x62\xc7\x51\xec\x94\x26\x74"
  4503. "\x91\xfe\x07\x24\x2a\xb1\x82\x9f\xc0\x02\x89\x05\x52\x57\xec\xd9\xc1\x8e"
  4504. "\x4d\xbb\x40\x2a\x50\x81\x1a\x24\x16\x46\x33\xb6\xd3\x24\x8d\x93\x94\x36"
  4505. "\xb6\x6e\xfc\x3c\xd2\x68\xce\x99\x33\xcd\x7b\x4e\xad\x39\xaf\x7b\xdc\xf8"
  4506. "\x04\x30\xb0\xce\x47\xc4\x76\x44\x9c\x8b\x88\x7b\x11\x31\xd5\xbe\x9e\xb4"
  4507. "\x8f\xb8\xd9\x3a\xb2\xfb\x5e\xbd\x7c\xb4\xb0\xf3\xf2\xd1\x42\x12\xcd\xe6"
  4508. "\x9d\x7f\x24\x79\x7b\x76\x2d\xf6\xfc\x99\xcc\x07\xed\x9f\x39\x16\x11\x3f"
  4509. "\xfa\x5e\xc4\x4f\x93\x37\xe3\xd6\x37\xb7\x56\xe6\x2b\x95\xf2\x7a\xbb\x5e"
  4510. "\x6c\x54\xd7\x8a\xf5\xcd\xad\x2b\xcb\xd5\xf9\xa5\xf2\x52\x79\xb5\x54\x9a"
  4511. "\x9b\x9d\x9b\xf9\xf6\xd5\xeb\xa5\xf7\x36\xd6\x4f\xab\xbf\x7d\xf1\xdd\xe5"
  4512. "\x5b\x3f\xfe\xc3\xef\xbf\xfc\xec\x4f\xdb\xdf\xfa\x79\xd6\xad\xc9\x76\xdb"
  4513. "\xde\x71\xbc\x4f\xad\xa1\x8f\xec\xc6\xc9\x0c\x47\xc4\xad\xd3\x08\xd6\x07"
  4514. "\x43\xed\xf1\x9c\xeb\x77\x47\xf8\xbf\xa4\x11\x51\x88\x88\x0b\xf9\xf3\x3f"
  4515. "\x15\x43\xf9\xab\x09\x00\x9c\x65\xcd\xe6\x54\x34\xa7\xf6\xd6\x01\x80\xb3"
  4516. "\x2e\xcd\xd7\xc0\x92\xb4\xd0\x5e\x0b\x98\x8c\x34\x2d\x14\x5a\x6b\x78\x9f"
  4517. "\xc4\x44\x5a\xa9\xd5\x1b\x97\xef\xd7\x36\x56\x17\x5b\x6b\x65\xd3\x31\x92"
  4518. "\xde\x5f\xae\x94\x67\xda\x6b\x85\xd3\x31\x92\x64\xf5\xd9\xbc\xfc\xba\x5e"
  4519. "\x3a\x50\xbf\x1a\x11\x1f\x47\xc4\x2f\x46\xc7\xf3\x7a\x61\xa1\x56\x59\xec"
  4520. "\xe7\x1b\x1f\x00\x18\x60\x1f\x1c\xc8\xff\xff\x1e\x6d\xe5\x7f\x00\xe0\x8c"
  4521. "\x1b\xeb\x77\x07\x00\x80\x9e\x93\xff\x01\x60\xf0\xc8\xff\x00\x30\x78\xe4"
  4522. "\x7f\x00\x18\x3c\xf2\x3f\x00\x0c\x1e\xf9\x1f\x00\x06\x8f\xfc\x0f\x00\x03"
  4523. "\xe5\x87\xb7\x6f\x67\x47\x73\xa7\xfd\xfd\xd7\x8b\x0f\x36\x37\x56\x6a\x0f"
  4524. "\xae\x2c\x96\xeb\x2b\x85\xea\xc6\x42\x61\xa1\xb6\xbe\x56\x58\xaa\xd5\x96"
  4525. "\xf2\xef\xec\xa9\x1e\xf7\xf3\x2a\xb5\xda\xda\xec\xb5\xd8\x78\x58\x6c\x94"
  4526. "\xeb\x8d\x62\x7d\x73\xeb\x6e\xb5\xb6\xb1\xda\xb8\x9b\x7f\xaf\xf7\xdd\xf2"
  4527. "\x48\x4f\x46\x05\x00\x1c\xe5\xe3\x4f\x9f\xfe\x25\x89\x88\xed\x1b\xe3\xf9"
  4528. "\x11\x7b\xf6\x72\x90\xab\xe1\x6c\x4b\xfb\xdd\x01\xa0\x6f\x86\xfa\xdd\x01"
  4529. "\xa0\x6f\x8e\xd9\xed\xeb\x79\xaf\xfa\x01\xf4\x9e\x7f\xe3\xc3\xc0\xfb\xfe"
  4530. "\x21\x5b\xf4\xee\xb3\xe7\xbf\x08\x8d\xef\x6b\x78\x72\x3a\x1d\x02\x4e\xdf"
  4531. "\xa5\x2f\x58\xff\x87\x41\x65\xfd\x1f\x06\x97\xf5\x7f\x18\x5c\xc7\xac\xff"
  4532. "\x03\x67\x58\xb3\x99\xd8\xf3\x1f\x00\x06\x8c\x35\x7e\xe0\x2d\x3e\xff\xdf"
  4533. "\xcf\xe7\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4534. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\xb0\xc9\xfc\x48\xd2\x42\x7b\x2f"
  4535. "\xf0\xc9\x48\xd3\x42\x21\xe2\xc3\x88\x98\x8e\x91\xe4\xfe\x72\xa5\x3c\x13"
  4536. "\x11\x1f\x45\xc4\x9f\x47\x47\x46\xb3\xfa\x6c\xbf\x3b\x0d\x00\xbc\xa3\xf4"
  4537. "\x6f\x49\x7b\xff\xaf\x4b\x53\x17\x27\x0f\xb6\x9e\x4b\xfe\x33\x9a\x9f\x23"
  4538. "\xe2\x67\xbf\xba\xf3\xcb\x87\xf3\x8d\xc6\xfa\x6c\x76\xfd\x9f\xbb\xd7\x1b"
  4539. "\x4f\xda\xd7\x4b\xfd\xe8\x3f\x00\x70\x9c\x4e\x9e\xee\xe4\xf1\x8e\x57\x2f"
  4540. "\x1f\x2d\x74\x8e\x5e\xf6\xe7\xc5\x77\x5a\x9b\x8b\x66\x71\x77\xda\x47\xab"
  4541. "\x65\x38\x86\xf3\xf3\x58\x8c\x44\xc4\xc4\xbf\x92\x76\xbd\x25\x7b\xbf\x32"
  4542. "\xf4\x1e\xe2\x6f\x3f\x8e\x88\xcf\x1f\x36\xfe\x24\x5f\x1b\x99\x6e\xef\x7c"
  4543. "\x7a\x30\x7e\x16\xfb\xc3\x9e\xc6\x4f\xf7\xc5\x4f\xf3\xb6\xd6\x39\xfb\xbb"
  4544. "\xf8\xdc\xdb\x87\xee\xba\xa5\x2b\x0c\x8a\xa7\xd9\xfc\x73\xf3\xb0\xe7\x2f"
  4545. "\x8d\xf3\xf9\xf9\xf0\xe7\x7f\x2c\x9f\xa1\xde\x5d\x67\xfe\xdb\x79\x63\xfe"
  4546. "\x4b\x77\xe7\xbf\xa1\x2e\xf3\xdf\xf9\x93\xc6\xb8\xf6\xc7\x1f\x74\x6d\x7b"
  4547. "\x1c\xf1\xc5\xe1\xc3\xe2\x27\xbb\xf1\x93\x2e\xf1\x2f\x1e\x19\xb5\xd9\xec"
  4548. "\x94\xfe\xfa\xa5\xaf\x5c\xe8\x7a\xd7\xaf\x23\x2e\xc5\xe1\xf1\xf7\xc6\x2a"
  4549. "\x36\xaa\x6b\xc5\xfa\xe6\xd6\x95\xe5\xea\xfc\x52\x79\xa9\xbc\x5a\x2a\xcd"
  4550. "\xcd\xce\xcd\x8c\x5f\xbd\x5e\x2a\xe6\x6b\xd4\xc5\xce\x4a\xf5\x9b\xfe\x7e"
  4551. "\xe3\xf2\x47\x47\x8d\x7f\xa2\x4b\xfc\xb1\x63\xc6\xff\xf5\x23\xc7\xff\xda"
  4552. "\x6f\xfe\x7b\xef\x27\x5f\x3d\x22\xfe\x37\xbf\x76\xf8\xeb\xff\xc9\x11\xf1"
  4553. "\xb3\x9c\xf8\x8d\x13\xc6\x9f\x9f\xf8\x5d\xd7\xb9\x3e\x8b\xbf\xd8\x65\xfc"
  4554. "\xfb\x5f\xff\xfd\xf9\x22\xbb\x76\xf9\x84\xf1\x9f\x3d\xdf\x5a\x3c\xe1\xad"
  4555. "\x00\x40\x0f\xd4\x37\xb7\x56\xe6\x2b\x95\xf2\xfa\xd1\x85\x4e\xee\x3f\xd1"
  4556. "\xcd\x0a\x0a\x0a\x9f\xf5\x42\x9f\x27\x26\xe0\xd4\xbd\x7e\xe8\xfb\xdd\x13"
  4557. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x9b\x5e\xfc\x3a\x51\xbf"
  4558. "\xc7\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4559. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4560. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4561. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4562. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4563. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4564. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4565. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4566. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4567. "\x00\x00\x00\x00\x00\x00\x00\xc0\xd9\xf5\xbf\x00\x00\x00\xff\xff\xfb\x38"
  4568. "\xd9\x0f",
  4569. 1226);
  4570. syz_mount_image(/*fs=*/0x2000000000c0, /*dir=*/0x200000000040, /*flags=*/0,
  4571. /*opts=*/0x200000001280, /*chdir=*/1, /*size=*/0x4ca,
  4572. /*img=*/0x200000001380);
  4573. memcpy((void*)0x2000000002c0, "./file0\000", 8);
  4574. syscall(__NR_stat, /*file=*/0x2000000002c0ul, /*statbuf=*/0x2000000001c0ul);
  4575. memcpy((void*)0x200000000240, "/dev/input/event#\000", 18);
  4576. res = -1;
  4577. res = syz_open_dev(/*dev=*/0x200000000240, /*id=*/0, /*flags=*/0);
  4578. if (res != -1)
  4579. r[92] = res;
  4580. syscall(__NR_ioctl, /*fd=*/r[92], /*cmd=*/0x80084505, /*arg=*/0ul);
  4581. *(uint32_t*)0x200000000000 = 0x6e;
  4582. res = syscall(__NR_accept4, /*fd=*/-1, /*peer=*/0x200000000100ul,
  4583. /*peerlen=*/0x200000000000ul, /*flags=SOCK_NONBLOCK*/ 0x800ul);
  4584. if (res != -1)
  4585. r[93] = res;
  4586. *(uint32_t*)0x200000000180 = 0xc;
  4587. syscall(__NR_getsockopt, /*fd=*/r[93], /*level=*/1, /*optname=*/0x11,
  4588. /*optval=*/0x200000000080ul, /*optlen=*/0x200000000180ul);
  4589. memcpy((void*)0x2000000000c0, "ext4\000", 5);
  4590. memcpy((void*)0x200000000040, "./file0\000", 8);
  4591. memcpy((void*)0x200000001280, "quota", 5);
  4592. *(uint8_t*)0x200000001285 = 0x2c;
  4593. memcpy((void*)0x200000001286, "noload", 6);
  4594. *(uint8_t*)0x20000000128c = 0x2c;
  4595. memcpy((void*)0x20000000128d, "errors=remount-ro", 17);
  4596. *(uint8_t*)0x20000000129e = 0x2c;
  4597. memcpy((void*)0x20000000129f, "init_itable", 11);
  4598. *(uint8_t*)0x2000000012aa = 0x2c;
  4599. *(uint8_t*)0x2000000012ab = 0;
  4600. memcpy(
  4601. (void*)0x200000001380,
  4602. "\x78\x9c\xec\xdd\x4d\x6f\x1b\x5b\x19\x00\xe0\x77\x26\x49\xf3\x71\x73\x6f"
  4603. "\x72\xc5\x5d\x00\x02\x6e\x29\x85\x82\xaa\xda\x89\xdb\x46\xa8\xab\xb2\xe1"
  4604. "\x43\x55\x25\x44\xc5\x8a\x45\x1b\x12\x37\x8a\x62\xc7\x51\xec\x94\x26\x74"
  4605. "\x91\xfe\x07\x24\x2a\xb1\x82\x9f\xc0\x02\x89\x05\x52\x57\xec\xd9\xc1\x8e"
  4606. "\x4d\xbb\x40\x2a\x50\x81\x1a\x24\x16\x46\x33\xb6\xd3\x24\x8d\x93\x94\x36"
  4607. "\xb6\x6e\xfc\x3c\xd2\x68\xce\x99\x33\xcd\x7b\x4e\xad\x39\xaf\x7b\xdc\xf8"
  4608. "\x04\x30\xb0\xce\x47\xc4\x76\x44\x9c\x8b\x88\x7b\x11\x31\xd5\xbe\x9e\xb4"
  4609. "\x8f\xb8\xd9\x3a\xb2\xfb\x5e\xbd\x7c\xb4\xb0\xf3\xf2\xd1\x42\x12\xcd\xe6"
  4610. "\x9d\x7f\x24\x79\x7b\x76\x2d\xf6\xfc\x99\xcc\x07\xed\x9f\x39\x16\x11\x3f"
  4611. "\xfa\x5e\xc4\x4f\x93\x37\xe3\xd6\x37\xb7\x56\xe6\x2b\x95\xf2\x7a\xbb\x5e"
  4612. "\x6c\x54\xd7\x8a\xf5\xcd\xad\x2b\xcb\xd5\xf9\xa5\xf2\x52\x79\xb5\x54\x9a"
  4613. "\x9b\x9d\x9b\xf9\xf6\xd5\xeb\xa5\xf7\x36\xd6\x4f\xab\xbf\x7d\xf1\xdd\xe5"
  4614. "\x5b\x3f\xfe\xc3\xef\xbf\xfc\xec\x4f\xdb\xdf\xfa\x79\xd6\xad\xc9\x76\xdb"
  4615. "\xde\x71\xbc\x4f\xad\xa1\x8f\xec\xc6\xc9\x0c\x47\xc4\xad\xd3\x08\xd6\x07"
  4616. "\x43\xed\xf1\x9c\xeb\x77\x47\xf8\xbf\xa4\x11\x51\x88\x88\x0b\xf9\xf3\x3f"
  4617. "\x15\x43\xf9\xab\x09\x00\x9c\x65\xcd\xe6\x54\x34\xa7\xf6\xd6\x01\x80\xb3"
  4618. "\x2e\xcd\xd7\xc0\x92\xb4\xd0\x5e\x0b\x98\x8c\x34\x2d\x14\x5a\x6b\x78\x9f"
  4619. "\xc4\x44\x5a\xa9\xd5\x1b\x97\xef\xd7\x36\x56\x17\x5b\x6b\x65\xd3\x31\x92"
  4620. "\xde\x5f\xae\x94\x67\xda\x6b\x85\xd3\x31\x92\x64\xf5\xd9\xbc\xfc\xba\x5e"
  4621. "\x3a\x50\xbf\x1a\x11\x1f\x47\xc4\x2f\x46\xc7\xf3\x7a\x61\xa1\x56\x59\xec"
  4622. "\xe7\x1b\x1f\x00\x18\x60\x1f\x1c\xc8\xff\xff\x1e\x6d\xe5\x7f\x00\xe0\x8c"
  4623. "\x1b\xeb\x77\x07\x00\x80\x9e\x93\xff\x01\x60\xf0\xc8\xff\x00\x30\x78\xe4"
  4624. "\x7f\x00\x18\x3c\xf2\x3f\x00\x0c\x1e\xf9\x1f\x00\x06\x8f\xfc\x0f\x00\x03"
  4625. "\xe5\x87\xb7\x6f\x67\x47\x73\xa7\xfd\xfd\xd7\x8b\x0f\x36\x37\x56\x6a\x0f"
  4626. "\xae\x2c\x96\xeb\x2b\x85\xea\xc6\x42\x61\xa1\xb6\xbe\x56\x58\xaa\xd5\x96"
  4627. "\xf2\xef\xec\xa9\x1e\xf7\xf3\x2a\xb5\xda\xda\xec\xb5\xd8\x78\x58\x6c\x94"
  4628. "\xeb\x8d\x62\x7d\x73\xeb\x6e\xb5\xb6\xb1\xda\xb8\x9b\x7f\xaf\xf7\xdd\xf2"
  4629. "\x48\x4f\x46\x05\x00\x1c\xe5\xe3\x4f\x9f\xfe\x25\x89\x88\xed\x1b\xe3\xf9"
  4630. "\x11\x7b\xf6\x72\x90\xab\xe1\x6c\x4b\xfb\xdd\x01\xa0\x6f\x86\xfa\xdd\x01"
  4631. "\xa0\x6f\x8e\xd9\xed\xeb\x79\xaf\xfa\x01\xf4\x9e\x7f\xe3\xc3\xc0\xfb\xfe"
  4632. "\x21\x5b\xf4\xee\xb3\xe7\xbf\x08\x8d\xef\x6b\x78\x72\x3a\x1d\x02\x4e\xdf"
  4633. "\xa5\x2f\x58\xff\x87\x41\x65\xfd\x1f\x06\x97\xf5\x7f\x18\x5c\xc7\xac\xff"
  4634. "\x03\x67\x58\xb3\x99\xd8\xf3\x1f\x00\x06\x8c\x35\x7e\xe0\x2d\x3e\xff\xdf"
  4635. "\xcf\xe7\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4636. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\xb0\xc9\xfc\x48\xd2\x42\x7b\x2f"
  4637. "\xf0\xc9\x48\xd3\x42\x21\xe2\xc3\x88\x98\x8e\x91\xe4\xfe\x72\xa5\x3c\x13"
  4638. "\x11\x1f\x45\xc4\x9f\x47\x47\x46\xb3\xfa\x6c\xbf\x3b\x0d\x00\xbc\xa3\xf4"
  4639. "\x6f\x49\x7b\xff\xaf\x4b\x53\x17\x27\x0f\xb6\x9e\x4b\xfe\x33\x9a\x9f\x23"
  4640. "\xe2\x67\xbf\xba\xf3\xcb\x87\xf3\x8d\xc6\xfa\x6c\x76\xfd\x9f\xbb\xd7\x1b"
  4641. "\x4f\xda\xd7\x4b\xfd\xe8\x3f\x00\x70\x9c\x4e\x9e\xee\xe4\xf1\x8e\x57\x2f"
  4642. "\x1f\x2d\x74\x8e\x5e\xf6\xe7\xc5\x77\x5a\x9b\x8b\x66\x71\x77\xda\x47\xab"
  4643. "\x65\x38\x86\xf3\xf3\x58\x8c\x44\xc4\xc4\xbf\x92\x76\xbd\x25\x7b\xbf\x32"
  4644. "\xf4\x1e\xe2\x6f\x3f\x8e\x88\xcf\x1f\x36\xfe\x24\x5f\x1b\x99\x6e\xef\x7c"
  4645. "\x7a\x30\x7e\x16\xfb\xc3\x9e\xc6\x4f\xf7\xc5\x4f\xf3\xb6\xd6\x39\xfb\xbb"
  4646. "\xf8\xdc\xdb\x87\xee\xba\xa5\x2b\x0c\x8a\xa7\xd9\xfc\x73\xf3\xb0\xe7\x2f"
  4647. "\x8d\xf3\xf9\xf9\xf0\xe7\x7f\x2c\x9f\xa1\xde\x5d\x67\xfe\xdb\x79\x63\xfe"
  4648. "\x4b\x77\xe7\xbf\xa1\x2e\xf3\xdf\xf9\x93\xc6\xb8\xf6\xc7\x1f\x74\x6d\x7b"
  4649. "\x1c\xf1\xc5\xe1\xc3\xe2\x27\xbb\xf1\x93\x2e\xf1\x2f\x1e\x19\xb5\xd9\xec"
  4650. "\x94\xfe\xfa\xa5\xaf\x5c\xe8\x7a\xd7\xaf\x23\x2e\xc5\xe1\xf1\xf7\xc6\x2a"
  4651. "\x36\xaa\x6b\xc5\xfa\xe6\xd6\x95\xe5\xea\xfc\x52\x79\xa9\xbc\x5a\x2a\xcd"
  4652. "\xcd\xce\xcd\x8c\x5f\xbd\x5e\x2a\xe6\x6b\xd4\xc5\xce\x4a\xf5\x9b\xfe\x7e"
  4653. "\xe3\xf2\x47\x47\x8d\x7f\xa2\x4b\xfc\xb1\x63\xc6\xff\xf5\x23\xc7\xff\xda"
  4654. "\x6f\xfe\x7b\xef\x27\x5f\x3d\x22\xfe\x37\xbf\x76\xf8\xeb\xff\xc9\x11\xf1"
  4655. "\xb3\x9c\xf8\x8d\x13\xc6\x9f\x9f\xf8\x5d\xd7\xb9\x3e\x8b\xbf\xd8\x65\xfc"
  4656. "\xfb\x5f\xff\xfd\xf9\x22\xbb\x76\xf9\x84\xf1\x9f\x3d\xdf\x5a\x3c\xe1\xad"
  4657. "\x00\x40\x0f\xd4\x37\xb7\x56\xe6\x2b\x95\xf2\xfa\xd1\x85\x4e\xee\x3f\xd1"
  4658. "\xcd\x0a\x0a\x0a\x9f\xf5\x42\x9f\x27\x26\xe0\xd4\xbd\x7e\xe8\xfb\xdd\x13"
  4659. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x9b\x5e\xfc\x3a\x51\xbf"
  4660. "\xc7\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4661. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4662. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4663. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4664. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4665. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4666. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4667. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4668. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4669. "\x00\x00\x00\x00\x00\x00\x00\xc0\xd9\xf5\xbf\x00\x00\x00\xff\xff\xfb\x38"
  4670. "\xd9\x0f",
  4671. 1226);
  4672. syz_mount_image(/*fs=*/0x2000000000c0, /*dir=*/0x200000000040, /*flags=*/0,
  4673. /*opts=*/0x200000001280, /*chdir=*/1, /*size=*/0x4ca,
  4674. /*img=*/0x200000001380);
  4675. memcpy((void*)0x2000000002c0, "./file0\000", 8);
  4676. syscall(__NR_stat, /*file=*/0x2000000002c0ul, /*statbuf=*/0x2000000001c0ul);
  4677. memcpy((void*)0x200000000240, "/dev/input/event#\000", 18);
  4678. syz_open_dev(/*dev=*/0x200000000240, /*id=*/0, /*flags=*/0);
  4679. syscall(__NR_ioctl, /*fd=*/r[92], /*cmd=*/0x80084505, /*arg=*/0ul);
  4680. *(uint32_t*)0x200000000000 = 0x6e;
  4681. syscall(__NR_accept4, /*fd=*/-1, /*peer=*/0x200000000100ul,
  4682. /*peerlen=*/0x200000000000ul, /*flags=SOCK_NONBLOCK*/ 0x800ul);
  4683. *(uint32_t*)0x200000000180 = 0xc;
  4684. syscall(__NR_getsockopt, /*fd=*/r[93], /*level=*/1, /*optname=*/0x11,
  4685. /*optval=*/0x200000000080ul, /*optlen=*/0x200000000180ul);
  4686. memcpy((void*)0x2000000002c0, "/dev/autofs\000", 12);
  4687. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  4688. /*file=*/0x2000000002c0ul, /*flags=*/0, /*mode=*/0);
  4689. if (res != -1)
  4690. r[94] = res;
  4691. memcpy((void*)0x200000000780, "ext3\000", 5);
  4692. memcpy((void*)0x2000000007c0, "./file0\000", 8);
  4693. memcpy((void*)0x200000000000, "noblock_validity", 16);
  4694. *(uint8_t*)0x200000000010 = 0x2c;
  4695. memcpy((void*)0x200000000011, "noblock_validity", 16);
  4696. *(uint8_t*)0x200000000021 = 0x2c;
  4697. memcpy((void*)0x200000000022, "dioread_nolock", 14);
  4698. *(uint8_t*)0x200000000030 = 0x2c;
  4699. memcpy((void*)0x200000000031, "quota", 5);
  4700. *(uint8_t*)0x200000000036 = 0x2c;
  4701. memcpy((void*)0x200000000037, "nogrpid", 7);
  4702. *(uint8_t*)0x20000000003e = 0x2c;
  4703. memcpy((void*)0x20000000003f, "nombcache", 9);
  4704. *(uint8_t*)0x200000000048 = 0x2c;
  4705. *(uint8_t*)0x200000000049 = 0;
  4706. memcpy(
  4707. (void*)0x200000000840,
  4708. "\x78\x9c\xec\xdd\xcd\x6b\x1c\xe5\x1f\x00\xf0\xef\x6c\x92\xa6\xbf\xb4\x3f"
  4709. "\x13\x41\xd0\x7a\x0a\x08\x1a\x28\xdd\x98\x1a\x5b\x05\x0f\x15\x0f\x22\x58"
  4710. "\x28\xe8\xd9\x76\xd9\x6c\x43\xcd\x6e\xb6\x64\x37\xa5\x09\x01\x2d\x22\x78"
  4711. "\x11\x54\x3c\x08\x7a\xe9\xd9\x97\x7a\xf3\xea\xcb\x55\xff\x0b\x0f\xd2\x52"
  4712. "\x35\x2d\x56\x3c\x48\x64\x36\xb3\xe9\xb6\xd9\x4d\x37\x6d\x92\x45\xf7\xf3"
  4713. "\x81\xa7\x7d\x9e\x99\xd9\x3c\xf3\x9d\x67\x66\x9e\x67\x77\x86\x99\x00\xfa"
  4714. "\xd6\x78\xfa\x4f\x2e\xe2\x50\x44\x7c\x90\x44\x8c\x66\xd3\x93\x88\x18\x6a"
  4715. "\xe4\x06\x23\x4e\xac\x2f\x77\x6b\x75\xa5\x98\xa6\x24\xd6\xd6\x5e\xfb\x2d"
  4716. "\x69\x2c\x73\x73\x75\xa5\x18\x2d\x9f\x49\x1d\xc8\x0a\x8f\x45\xc4\xf7\xef"
  4717. "\x46\x1c\xce\x6d\xae\xb7\xb6\xb4\x3c\x57\x28\x97\x4b\x0b\x59\x79\xb2\x5e"
  4718. "\x39\x3f\x59\x5b\x5a\x3e\x72\xae\x52\x98\x2d\xcd\x96\xe6\x8f\x4d\x4d\x4f"
  4719. "\x1f\x3d\xfe\xec\xf1\x63\x3b\x17\xeb\x1f\x3f\x2d\x1f\xbc\xf6\xe1\xcb\x4f"
  4720. "\x7d\x75\xe2\xaf\x77\x1e\xbd\xf2\xfe\x0f\x49\x9c\x88\x83\xd9\xbc\xd6\x38"
  4721. "\x76\xca\x78\x8c\x67\xdb\x64\x28\xdd\x84\x77\x78\x69\xa7\x2b\xeb\xb1\xa4"
  4722. "\xd7\x2b\xc0\x7d\x49\x0f\xcd\x81\xf5\xa3\x3c\x0e\xc5\x68\x0c\x34\x72\x00"
  4723. "\xc0\x7f\xd9\x5b\x11\xb1\x06\x00\xf4\x99\x44\xff\x0f\x00\x7d\xa6\xf9\x3b"
  4724. "\xc0\xcd\xd5\x95\x62\x33\xf5\xf6\x17\x89\xbd\x75\xfd\xc5\x88\xd8\xbf\x1e"
  4725. "\x7f\xf3\xfa\xe6\xfa\x9c\xc1\xec\x9a\xdd\xfe\xc6\x75\xd0\x91\x9b\xc9\x1d"
  4726. "\x57\x46\x92\x88\x18\xdb\x81\xfa\xc7\x23\xe2\xb3\x6f\xde\xf8\x22\x4d\xb1"
  4727. "\x4b\xd7\x21\x01\xda\x79\xfb\x52\x44\x9c\x19\x1b\xdf\x7c\xfe\x4f\x36\xdd"
  4728. "\xb3\xb0\x5d\x4f\x77\xb1\xcc\xf8\x5d\x65\xe7\x3f\xd8\x3b\xdf\xa6\xe3\x9f"
  4729. "\xe7\xda\x8d\xff\x72\x1b\xe3\x9f\x68\x33\xfe\x19\x6e\x73\xec\xde\x8f\x7b"
  4730. "\x1f\xff\xb9\xab\x3b\x50\x4d\x47\xe9\xf8\xef\x85\x96\x7b\xdb\x6e\xb5\xc4"
  4731. "\x9f\x19\x1b\xc8\x4a\xff\x6f\x8c\xf9\x86\x92\xb3\xe7\xca\xa5\xf4\xdc\xf6"
  4732. "\x50\x44\x4c\xc4\xd0\x70\x5a\x9e\xda\xa2\x8e\x89\x1b\x7f\xdf\xe8\x34\xaf"
  4733. "\x75\xfc\xf7\xfb\x47\x6f\x7e\x9e\xd6\x9f\xfe\x7f\x7b\x89\xdc\xd5\xc1\xe1"
  4734. "\x3b\x3f\x33\x53\xa8\x17\x1e\x24\xe6\x56\xd7\x2f\x45\x3c\x3e\xd8\x2e\xfe"
  4735. "\x64\xa3\xfd\x93\x0e\xe3\xdf\x53\x5d\xd6\xf1\xca\xf3\xef\x7d\xda\x69\x5e"
  4736. "\x1a\x7f\x1a\x6f\x33\x6d\x8e\x7f\x77\xad\x5d\x8e\x78\xb2\x6d\xfb\xdf\xbe"
  4737. "\xa3\x2d\xd9\xf2\xfe\xc4\xc9\xc6\xee\x30\xd9\xdc\x29\xda\xf8\xfa\xe7\x4f"
  4738. "\x46\x3a\xd5\xdf\xda\xfe\x69\x4a\xeb\x6f\x7e\x17\xd8\x0b\x69\xfb\x8f\x6c"
  4739. "\x1d\xff\x58\xd2\x7a\xbf\x66\x6d\xfb\x75\xfc\x78\x79\xf4\xbb\x4e\xf3\xee"
  4740. "\x1d\x7f\xfb\xfd\x7f\x5f\xf2\x7a\x23\xbf\x2f\x9b\x76\xb1\x50\xaf\x2f\x4c"
  4741. "\x45\xec\x4b\x5e\xdd\x3c\xfd\xe8\xed\xcf\x36\xcb\xcd\xe5\xd3\xf8\x27\x9e"
  4742. "\x68\x7f\xfc\x6f\xb5\xff\xa7\xdf\x09\xcf\x74\x19\xff\xe0\xb5\x5f\xbf\xbc"
  4743. "\xff\xf8\x77\x57\x1a\xff\xcc\xb6\xda\x7f\xfb\x99\x2b\xb7\xe6\x06\x3a\xd5"
  4744. "\xdf\x5d\xfb\x4f\x37\x72\x13\xd9\x94\x6e\xce\x7f\xdd\xae\xe0\x83\x6c\x3b"
  4745. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4746. "\x00\xe8\x56\x2e\x22\x0e\x46\x92\xcb\x6f\xe4\x73\xb9\x7c\x7e\xfd\x1d\xde"
  4747. "\x8f\xc4\x48\xae\x5c\xad\xd5\x0f\x9f\xad\x2e\xce\xcf\x44\xe3\x5d\xd9\x63"
  4748. "\x31\x94\x6b\x3e\xea\x72\xb4\xe5\x79\xa8\x53\xd9\xf3\xf0\x9b\xe5\xa3\x77"
  4749. "\x95\x9f\x89\x88\x87\x23\xe2\xe3\xe1\xff\x35\xca\xf9\x62\xb5\x3c\xd3\xeb"
  4750. "\xe0\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4751. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x73\xa0\xc3"
  4752. "\xfb\xff\x53\xbf\x0c\xf7\x7a\xed\x00\x80\x5d\xb3\xbf\xd7\x2b\x00\x00\xec"
  4753. "\x39\xfd\x3f\x00\xf4\x1f\xfd\x3f\x00\xf4\x1f\xfd\x3f\x00\xf4\x1f\xfd\x3f"
  4754. "\x00\xf4\x1f\xfd\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4755. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4756. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4757. "\x00\x00\xbb\xec\xd4\xc9\x93\x69\x5a\xfb\x73\x75\xa5\x98\x96\x67\x2e\x2c"
  4758. "\x2d\xce\x55\x2f\x1c\x99\x29\xd5\xe6\xf2\x95\xc5\x62\xbe\x58\x5d\x38\x9f"
  4759. "\x9f\xad\x56\x67\xcb\xa5\x7c\xb1\x5a\xb9\xd7\xdf\x2b\x57\xab\xe7\xa7\x63"
  4760. "\x7e\xf1\xe2\x64\xbd\x54\xab\x4f\xd6\x96\x96\x4f\x57\xaa\x8b\xf3\xf5\xd3"
  4761. "\xe7\x2a\x85\xd9\xd2\xe9\xd2\xd0\x9e\x44\x05\x00\x00\x00\x00\x00\x00\x00"
  4762. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4763. "\x00\x00\x00\x00\x00\x00\xdb\x53\x5b\x5a\x9e\x2b\x94\xcb\xa5\x05\x19\x19"
  4764. "\x19\x99\x8d\x4c\xaf\xcf\x4c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4765. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4766. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4767. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4768. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4769. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4770. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4771. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4772. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4773. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4774. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4775. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4776. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4777. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4778. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4779. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4780. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4781. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4782. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4783. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4784. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4785. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4786. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4787. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4788. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4789. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4790. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4791. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4792. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4793. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4794. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4795. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4796. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4797. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4798. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4799. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4800. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4801. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4802. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4803. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4804. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4805. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4806. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4807. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4808. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4809. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4810. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  4811. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff"
  4812. "\x0e\xff\x04\x00\x00\xff\xff\x3e\x07\x2a\x2f",
  4813. 1883);
  4814. syz_mount_image(/*fs=*/0x200000000780, /*dir=*/0x2000000007c0,
  4815. /*flags=MS_SYNCHRONOUS*/ 0x10, /*opts=*/0x200000000000,
  4816. /*chdir=*/1, /*size=*/0x75b, /*img=*/0x200000000840);
  4817. res = syscall(__NR_socket, /*domain=AF_INET6*/ 0xaul,
  4818. /*type=SOCK_STREAM*/ 1ul, /*proto=*/0);
  4819. if (res != -1)
  4820. r[95] = res;
  4821. memcpy((void*)0x200000000140,
  4822. "lo\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  4823. *(uint64_t*)0x200000000150 = 0x200000000040;
  4824. *(uint32_t*)0x200000000040 = 0x51;
  4825. memcpy((void*)0x200000000044,
  4826. "\x65\xb3\x82\xcd\x76\x1d\x2c\x65\x8d\x52\x70\x7b\x70\x0a\xd1\xba\x5d"
  4827. "\xe9\xa6\xb9\xf4\x41\xa4\x1d\x4b\xc8\x0f\x1a\xac\xc4\x82\xa0",
  4828. 32);
  4829. memcpy((void*)0x200000000064,
  4830. "\x8d\xec\x25\xde\xfd\x0d\x0f\x66\xb4\x90\x2a\x8e\xce\x5a\x7a\x84\xbb"
  4831. "\xa7\xed\x0d\x33\xd8\xca\xab\x92\xce\x00\x00\x00\x00\x00\x00",
  4832. 32);
  4833. memcpy((void*)0x200000000084,
  4834. "\xbe\x9a\x04\x00\x10\x00\x80\x00\x00\x00\x00\x68\x3b\xbd\xda\xf2\x86"
  4835. "\xe1\x5d\xe4\x6c\x14\xa5\xbd\xa9\x88\x8b\x05\xf2\xcf\x52\x65",
  4836. 32);
  4837. memcpy((void*)0x2000000000a4,
  4838. "\xd7\x62\xb8\x94\x06\x00\x00\x00\x00\x00\x00\x00\xd1\x77\x5b\x60\x15"
  4839. "\x7d\x8d\x13\x0a\x76\x44\x7e\x8b\x95\x18\x3b\x00\x9a\x10\x8c",
  4840. 32);
  4841. memcpy((void*)0x2000000000c4,
  4842. "\xdc\x90\x38\xc4\xe7\xeb\x0b\xb0\xff\x1c\x64\x90\x62\x5f\xa8\xdb\x0f"
  4843. "\xe9\xcc\xd5\xf4\x0d\x6d\x3f\x3f\x28\xee\x71\x61\xe5\x12\x4f",
  4844. 32);
  4845. memcpy((void*)0x2000000000e4,
  4846. "\xa4\x1b\x16\x74\x00\x00\x00\x00\x00\x00\x00\x00", 12);
  4847. *(uint32_t*)0x2000000000f0 = 0;
  4848. *(uint32_t*)0x2000000000f4 = 0;
  4849. *(uint32_t*)0x2000000000f8 = 0;
  4850. *(uint32_t*)0x2000000000fc = 0;
  4851. *(uint32_t*)0x200000000100 = 0;
  4852. syscall(__NR_ioctl, /*fd=*/r[95], /*cmd=*/0x8946, /*arg=*/0x200000000140ul);
  4853. *(uint32_t*)0x200000000280 = 1;
  4854. *(uint32_t*)0x200000000284 = 1;
  4855. *(uint32_t*)0x200000000288 = 0x52;
  4856. *(uint32_t*)0x20000000028c = -1;
  4857. *(uint64_t*)0x200000000290 = 0;
  4858. memcpy((void*)0x200000000298, "./file0\000", 8);
  4859. syscall(__NR_ioctl, /*fd=*/r[94], /*cmd=*/0xc018937e,
  4860. /*arg=*/0x200000000280ul);
  4861. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0);
  4862. if (res != -1)
  4863. r[96] = res;
  4864. *(uint8_t*)0x200000000100 = 0x11;
  4865. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x541c, /*arg=*/0x200000000100ul);
  4866. *(uint8_t*)0x200000000100 = 0x11;
  4867. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x541c, /*arg=*/0x200000000100ul);
  4868. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
  4869. if (res != -1)
  4870. r[97] = res;
  4871. *(uint64_t*)0x200000000000 = 0;
  4872. *(uint64_t*)0x200000000008 = 1;
  4873. *(uint64_t*)0x200000000010 = 0;
  4874. *(uint64_t*)0x200000000018 = 0;
  4875. *(uint64_t*)0x200000000020 = 0;
  4876. *(uint64_t*)0x200000000028 = 0;
  4877. *(uint64_t*)0x200000000030 = 0x7fffffff;
  4878. *(uint64_t*)0x200000000038 = 0;
  4879. *(uint64_t*)0x200000000040 = 0;
  4880. *(uint64_t*)0x200000000048 = 0;
  4881. *(uint64_t*)0x200000000050 = 0;
  4882. *(uint64_t*)0x200000000058 = 0;
  4883. *(uint64_t*)0x200000000060 = 0;
  4884. *(uint64_t*)0x200000000068 = 0;
  4885. *(uint64_t*)0x200000000070 = 0;
  4886. *(uint64_t*)0x200000000078 = 0;
  4887. *(uint64_t*)0x200000000080 = 0;
  4888. *(uint64_t*)0x200000000088 = 0;
  4889. *(uint64_t*)0x200000000090 = 0;
  4890. *(uint64_t*)0x200000000098 = 0;
  4891. *(uint64_t*)0x2000000000a0 = 0;
  4892. *(uint64_t*)0x2000000000a8 = 0;
  4893. *(uint64_t*)0x2000000000b0 = 0;
  4894. *(uint64_t*)0x2000000000b8 = 0;
  4895. *(uint64_t*)0x2000000000c0 = 0;
  4896. *(uint64_t*)0x2000000000c8 = 0;
  4897. syscall(__NR_clock_adjtime, /*id=CLOCK_PROCESS_CPUTIME_ID|0x8*/ 0xaul,
  4898. /*tx=*/0x200000000000ul);
  4899. *(uint64_t*)0x200000005400 = 0;
  4900. *(uint32_t*)0x200000005408 = 0;
  4901. *(uint64_t*)0x200000005410 = 0x200000000200;
  4902. *(uint64_t*)0x200000000200 = 0x200000000380;
  4903. memcpy(
  4904. (void*)0x200000000380,
  4905. "\x14\x01\x00\x00\x20\x00\x23\x01\x00\x00\x00\x00\x00\x00\x00\x00\x02\x01"
  4906. "\x00\x00\xa9\x49\x8f\x68\x3e\x39\x54\x4a\x55\xba\x23\x26\xd2\x6f\xf5\x5a"
  4907. "\xaa\x1e\x69\xc6\xc5\x49\xe1\x56\xca\xd0\x3d\x7b\x63\xfd\xa7\xce\xd4\x2d"
  4908. "\x64\x23\x79\x55\x2b\x60\xfb\xb5\xff\xf5\x6e\x24\x00\x34\x96\xfd\x05\xf3"
  4909. "\x39\xc7\xe2\x5f\x8a\xd5\x60\x6b\x40\xd8\x49\x86\x0b\x3f\xeb\x13\x17\x11"
  4910. "\x62\xdb\x5e\x86\x34\x77\x9b\x76\x7c\xc5\x60\x73\x54\x43\x40\xa4\x0d\xfc"
  4911. "\x26\xed\x7f\x45\xed\xc2\x75\x30\x66\x36\x61\x81\x73\x06\x86\xa9\x89\x7c"
  4912. "\xcd\xcb\xb9\x87\x7f\x1d\xe7\x44\xdb\x11\x83\x43\xbf\x67\xeb\xf8\xa6\x3b"
  4913. "\xfa\x12\x95\x9f\xb7\xce\xe4\xfb\x72\x23\xce\xb9\xf8\x1c\xf4\xaf\xf2\xe8"
  4914. "\x63\xe5\xc1\xd5\xde\x03\xcc\x46\xb9\x01\x44\x6a\x7f\x71\x86\x21\xb6\xe7"
  4915. "\x27\xac\x09\x8f\x4c\x38\x7d\x9d\x43\x22\x88\xa7\xea\x4a\x5a\x46\x65\x21"
  4916. "\xc5\x8e\xaa\x5e\x6b\x84\x48\x23\x9b\x27\x3c\xe0\x1c\x42\x98\x7a\xd1\x9e"
  4917. "\x48\x7d\xbb\x57\x76\x53\x1f\xc1\x0d\xe2\xc9\x1f\x42\x2b\xec\xd7\xbc\x13"
  4918. "\x7f\x98\x0d\xdc\x5f\x1b\xcd\xd5\x8f\xca\xea\x09\xb8\x77\x3b\x0d\x31\x75"
  4919. "\x33\xe0\x3e\x05\x38\x68\x17\x95\x07\x54\xc4\x32\x4a\xb2\x4c\x04\x77\xee"
  4920. "\x1b\x85\x34\x7c\xfa\x3c\x8b\xac\x8d\x89\x02\x85\x59\x2d\xf8\x00\x00",
  4921. 287);
  4922. *(uint64_t*)0x200000000208 = 0x114;
  4923. *(uint64_t*)0x200000005418 = 1;
  4924. *(uint64_t*)0x200000005420 = 0;
  4925. *(uint64_t*)0x200000005428 = 0;
  4926. *(uint32_t*)0x200000005430 = 0;
  4927. syscall(__NR_sendmsg, /*fd=*/r[97], /*msg=*/0x200000005400ul, /*f=*/0ul);
  4928. *(uint64_t*)0x200000000000 = htobe64(0);
  4929. *(uint64_t*)0x200000000008 = htobe64(1);
  4930. *(uint32_t*)0x200000000010 = 0;
  4931. syscall(__NR_setsockopt, /*fd=*/r[96], /*level=*/0x29, /*optname=*/0x11,
  4932. /*optval=*/0x200000000000ul, /*optlen=*/0x14ul);
  4933. memcpy((void*)0x200000000000, "net/protocols\000", 14);
  4934. syz_open_procfs(/*pid=*/0, /*file=*/0x200000000000);
  4935. memcpy((void*)0x200000000000, "net/protocols\000", 14);
  4936. syz_open_procfs(/*pid=*/0, /*file=*/0x200000000000);
  4937. syscall(__NR_close_range, /*fd=*/-1, /*max_fd=*/-1,
  4938. /*flags=CLOSE_RANGE_UNSHARE*/ 2ul);
  4939. memcpy((void*)0x200000000000, "./file0\000", 8);
  4940. syscall(__NR_creat, /*file=*/0x200000000000ul, /*mode=*/0ul);
  4941. res = syscall(__NR_inotify_init1, /*flags=*/0ul);
  4942. if (res != -1)
  4943. r[98] = res;
  4944. memcpy((void*)0x200000000000, "/dev/rtc0\000", 10);
  4945. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  4946. /*file=*/0x200000000000ul, /*flags=*/0, /*mode=*/0);
  4947. if (res != -1)
  4948. r[99] = res;
  4949. syscall(__NR_ioctl, /*fd=*/r[99], /*cmd=*/0x4008700e, /*arg=*/0ul);
  4950. memcpy((void*)0x200000001240, "./file0\000", 8);
  4951. res = syscall(__NR_inotify_add_watch, /*fd=*/r[98], /*file=*/0x200000001240ul,
  4952. /*mask=IN_MODIFY|IN_DELETE_SELF|IN_DELETE*/ 0x602ul);
  4953. if (res != -1)
  4954. r[100] = res;
  4955. syscall(__NR_inotify_rm_watch, /*fd=*/r[98], /*wd=*/r[100]);
  4956. res = syscall(__NR_getgid);
  4957. if (res != -1)
  4958. r[101] = res;
  4959. memcpy((void*)0x200000001b40, "ext2\000", 5);
  4960. memcpy((void*)0x200000000500, "./file0\000", 8);
  4961. *(uint8_t*)0x200000000580 = 0;
  4962. memcpy(
  4963. (void*)0x200000003100,
  4964. "\x78\x9c\xec\xdd\x4f\x6f\x23\x67\x19\x00\xf0\x67\x9c\xb8\x64\xbb\x59\x92"
  4965. "\x02\x87\x52\xa9\xa5\xa2\x45\xd9\x0a\xd6\x4e\x1a\xda\x46\x1c\xda\x22\x21"
  4966. "\x6e\x95\x40\xcb\x7d\x89\x12\x27\x8a\xe2\xc4\x51\xec\xb4\x9b\xa8\x42\xa9"
  4967. "\xf8\x00\x48\x08\xc1\x4a\x9c\x38\x71\x41\xe2\x03\x20\xa1\xfd\x08\x68\xa5"
  4968. "\x95\xd8\x3b\x02\x04\x42\xb0\x0b\x07\x0e\xc0\xa0\x19\x4f\xb2\x89\x35\xde"
  4969. "\x64\xd5\xd8\x5e\x39\xbf\x9f\xf4\x7a\xde\x19\x7b\xe6\x79\x5e\x3b\x1e\xcf"
  4970. "\x9f\x37\x33\x01\x5c\x5a\xaf\x46\xc4\xfb\x11\x31\x11\x11\x6f\x44\xc4\x4c"
  4971. "\x31\xbd\x52\x94\x38\xec\x96\xec\x75\x8f\x1e\x7e\xbc\x92\x95\x24\xd2\xf4"
  4972. "\xe6\xdf\x93\x7c\x9e\x6c\x3c\x22\x92\x93\xcb\xbc\x5a\xcc\x36\xd5\x1d\x94"
  4973. "\x6a\xef\x1f\x6c\x2e\x37\x9b\x8d\xdd\x62\xbc\xde\xd9\xda\xa9\xb7\xf7\x0f"
  4974. "\x6e\x6c\x6c\x2d\xaf\x37\xd6\x1b\xdb\x8b\x8b\x0b\x6f\x2f\xbd\xb3\xf4\xd6"
  4975. "\xd2\xfc\x85\xb4\xf3\x5a\x44\xbc\xfb\xad\x3f\xff\xf4\x47\xbf\xfc\xf6\xbb"
  4976. "\xbf\xfd\xda\x47\x7f\xb8\xf5\xd7\xeb\x3f\xc8\x92\x9e\x2e\x9e\x2f\xda\x71"
  4977. "\xe1\x1e\xe4\x8f\xd5\xec\xbd\x38\x36\x19\x11\xbb\x83\x08\x36\x02\x13\x45"
  4978. "\x7b\xaa\xa3\x4e\x04\x00\x80\x73\xa9\x45\xc4\xe7\x22\xe2\xcb\xf9\xf6\xff"
  4979. "\x4c\x4c\xe4\x5b\x73\x39\x9b\x74\x00\x00\x00\x30\x26\xd2\xf7\xa6\xe3\x3f"
  4980. "\x49\x44\x0a\x00\x00\x00\x8c\xad\xf7\xf2\x3e\xb0\x49\xa5\x56\xf4\xf7\x9d"
  4981. "\x8e\x4a\xa5\x56\xeb\xf6\xe1\xfd\x42\x3c\x5f\x69\xb6\xda\x9d\xaf\xae\xb5"
  4982. "\xf6\xb6\x57\xbb\x7d\x65\x67\xa3\x5a\x59\xdb\x68\x36\xe6\x8b\xbe\xc2\xb3"
  4983. "\x51\x4d\xb2\xf1\x85\xbc\xfe\x78\xfc\xcd\x9e\xf1\xc5\x88\x78\x21\x22\x7e"
  4984. "\x32\x73\x25\x1f\xaf\xad\xb4\x9a\xab\xa3\x3e\xf8\x01\x00\x00\x00\x97\xc4"
  4985. "\xd5\x9e\xfd\xff\x7f\xcd\x74\xf7\xff\x01\x00\x00\x80\x31\x33\x3b\xea\x04"
  4986. "\x00\x00\x00\x80\x81\xeb\xb7\xff\x9f\x0c\x39\x0f\x00\x00\x00\x60\x70\x9c"
  4987. "\xff\x07\x00\x00\x80\xb1\xf6\x9d\x0f\x3e\xc8\x4a\x7a\x74\xff\xeb\xd5\x0f"
  4988. "\xf7\xf7\x36\x5b\x1f\xde\x58\x6d\xb4\x37\x6b\x5b\x7b\x2b\xb5\x95\xd6\xee"
  4989. "\x4e\x6d\xbd\xd5\x5a\xcf\xaf\xd9\xb7\x75\xd6\xf2\x9a\xad\xd6\xce\xd7\x63"
  4990. "\x7b\xef\x76\xbd\xd3\x68\x77\xea\xed\xfd\x83\x5b\x5b\xad\xbd\xed\xce\xad"
  4991. "\x8d\x53\xb7\xc0\x06\x00\x00\x00\x86\xe8\x85\x2f\xdd\x7d\x90\x44\xc4\xe1"
  4992. "\x37\xae\xe4\x25\xf3\x5c\xf6\x30\xd1\x67\x06\x7d\x05\x60\x6c\x54\x9e\xe6"
  4993. "\xc5\x7f\x1a\x5c\x1e\xc0\xf0\xf5\xfb\x99\x07\xc6\xdf\xe4\xa8\x13\x00\x46"
  4994. "\xe7\x70\xd4\x09\x00\xa3\x76\xea\x52\x1f\x25\x1b\x05\x27\x3b\xef\x9c\x3a"
  4995. "\x66\xf0\xbb\xc1\xe5\x04\x00\x00\x5c\xac\xb9\x2f\x96\x9f\xff\xcf\x76\x01"
  4996. "\xaa\xa3\x4e\x0e\x18\xa8\xa7\x3a\xff\x0f\x8c\x15\xe7\xff\xe1\xf2\x7a\xca"
  4997. "\xf3\xff\xf7\x06\x95\x07\x30\x7c\x55\x5b\x00\x70\xe9\x9d\x75\xab\x8f\xbe"
  4998. "\x17\xef\x38\xf7\xf9\xff\x34\x3d\x73\x59\x00\x00\xc0\x40\x4d\xe7\x25\xa9"
  4999. "\xd4\x8a\x73\x81\xd3\x51\xa9\xd4\x6a\x11\xd7\xf2\x7f\xf5\xaf\x26\x6b\x1b"
  5000. "\xcd\xc6\x7c\x44\x7c\x36\x22\x7e\x3f\x53\xfd\x4c\x36\xbe\x90\xcf\x99\xb8"
  5001. "\x3d\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5002. "\x00\x00\x00\x9c\x53\x9a\x26\x91\x02\x00\x00\x00\x63\x2d\xa2\xf2\x97\xa4"
  5003. "\xb8\xff\xd7\xdc\xcc\xeb\xd3\xbd\xc7\x07\x9e\x4b\xfe\x3d\x93\x0f\x23\xe2"
  5004. "\xa3\x9f\xdf\xac\xdc\x5e\xee\x74\x76\x17\xb2\xe9\xff\x38\x9e\xde\xb9\x73"
  5005. "\xf3\x67\xf9\xf4\x37\x47\x71\x04\x03\x00\x00\x00\xe8\x75\xb4\x9f\x7e\xb4"
  5006. "\x1f\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5007. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5008. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5009. "\x00\x00\x00\x17\xe9\xd1\xc3\x8f\x57\x8e\xca\x30\xe3\xfe\xed\x9b\x11\x31"
  5010. "\x5b\x16\x7f\x32\xa6\xf2\xe1\x54\x54\x23\xe2\xf9\x7f\x26\x31\x79\x62\xbe"
  5011. "\x24\x22\x26\x2e\x20\xfe\xe1\x27\x11\xf1\x62\x59\xfc\x24\x4b\x2b\x66\x8b"
  5012. "\x2c\x7a\xe3\x57\x22\xe2\xca\x70\xe2\xbf\x9c\xa6\x69\x69\xfc\xab\x17\x10"
  5013. "\x1f\x2e\xb3\xbb\xd9\xfa\xe7\xfd\xb2\xef\x5f\x25\x5e\xcd\x87\xe5\xdf\xff"
  5014. "\xc9\xa2\x7c\x5a\xfd\xd7\x7f\x95\xe3\xf5\xdf\x44\x9f\xf5\xdf\xb5\x73\xc6"
  5015. "\x78\xe9\xfe\xaf\xeb\x7d\xe3\x7f\x12\xf1\xd2\x64\xf9\xfa\xe7\x28\x7e\xd2"
  5016. "\x27\xfe\x6b\x65\x0b\x2c\x79\x53\xbe\xff\xbd\x83\x83\x7e\xf1\xd3\x5f\x44"
  5017. "\xcc\x95\xfe\xfe\x24\xa7\x62\xd5\x3b\x5b\x3b\xf5\xf6\xfe\xc1\x8d\x8d\xad"
  5018. "\xe5\xf5\xc6\x7a\x63\x7b\x71\x71\xe1\xed\xa5\x77\x96\xde\x5a\x9a\xaf\xaf"
  5019. "\x6d\x34\x1b\xc5\x63\x69\x8c\x1f\xbf\xfc\x9b\xff\xf5\x4c\xfa\x6f\xda\x95"
  5020. "\xb7\x3f\xfa\xc4\x9f\x3d\xa3\xfd\xaf\x67\x95\xea\xc9\xc6\xf4\x86\x29\x82"
  5021. "\xdd\xbf\xfd\xf0\xf3\xdd\x6a\xb5\x67\x11\x79\xfc\xeb\xaf\x95\x7f\xfe\x2f"
  5022. "\x3e\x21\x7e\xf6\x37\xf1\x95\xe2\x77\x20\x7b\x7e\xee\xa8\x7e\xd8\xad\x9f"
  5023. "\xf4\xca\xaf\xee\xbd\x52\x9a\x58\x11\x7f\xb5\x4f\xfb\x8f\x3f\xff\xac\x52"
  5024. "\xd2\xfe\xeb\xfd\x16\xda\xe3\x8d\xef\xfe\xf0\x8f\xe7\x7c\x29\x00\x30\x04"
  5025. "\xed\xfd\x83\xcd\xe5\x66\xb3\xb1\x3b\xf0\xca\x9d\x34\x4d\x87\x15\x4b\xe5"
  5026. "\x19\xac\x4c\x3d\x1b\x69\xa8\x9c\x5d\xb9\x88\x23\x5b\x00\x00\xc0\xb3\xe6"
  5027. "\xf1\x46\xff\xa8\x33\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5028. "\x00\x00\x80\xcb\xab\xbd\x9f\x4e\x0c\xfa\x72\x62\xbd\x31\x0f\x47\xd3\x54"
  5029. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5030. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5031. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5032. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5033. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5034. "\x00\x00\x00\x00\x80\x27\xfa\x7f\x00\x00\x00\xff\xff\xa2\xc2\xe3\xbd",
  5035. 1277);
  5036. syz_mount_image(
  5037. /*fs=*/0x200000001b40, /*dir=*/0x200000000500,
  5038. /*flags=MS_POSIXACL|MS_RELATIME|MS_RDONLY|MS_NOSUID*/ 0x210003,
  5039. /*opts=*/0x200000000580, /*chdir=*/1, /*size=*/0x4fc,
  5040. /*img=*/0x200000003100);
  5041. memcpy((void*)0x200000000040, ".\000", 2);
  5042. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  5043. /*file=*/0x200000000040ul, /*flags=*/0, /*mode=*/0);
  5044. if (res != -1)
  5045. r[102] = res;
  5046. syscall(__NR_fdatasync, /*fd=*/r[102]);
  5047. syscall(__NR_unshare, /*flags=CLONE_NEWIPC*/ 0x8000000ul);
  5048. syscall(__NR_semget, /*key=*/0ul, /*nsems=*/0x4004ul, /*flags=*/0ul);
  5049. *(uint32_t*)0x200000000080 = r[101];
  5050. *(uint32_t*)0x200000000084 = r[101];
  5051. *(uint32_t*)0x200000000088 = r[101];
  5052. syscall(__NR_setgroups, /*size=*/3ul, /*list=*/0x200000000080ul);
  5053. syscall(__NR_semctl, /*semid=*/0, /*semnum=*/0ul, /*cmd=*/0x11ul,
  5054. /*arg=*/0x200000000000ul);
  5055. res = syscall(__NR_semget, /*key=*/0ul, /*nsems=*/0x4000000009ul,
  5056. /*flags=*/0ul);
  5057. if (res != -1)
  5058. r[103] = res;
  5059. *(uint16_t*)0x200000000040 = 4;
  5060. *(uint16_t*)0x200000000042 = 0xfe01;
  5061. *(uint16_t*)0x200000000044 = 0;
  5062. syscall(__NR_semop, /*semid=*/r[103], /*ops=*/0x200000000040ul, /*nops=*/1ul);
  5063. *(uint16_t*)0x200000000000 = 4;
  5064. *(uint16_t*)0x200000000002 = 0xab3;
  5065. *(uint16_t*)0x200000000004 = 0;
  5066. syscall(__NR_semop, /*semid=*/r[103], /*ops=*/0x200000000000ul, /*nops=*/1ul);
  5067. memcpy((void*)0x200000000000, "ext4\000", 5);
  5068. memcpy((void*)0x200000000100, "./file1\000", 8);
  5069. *(uint8_t*)0x200000000140 = 0;
  5070. memcpy(
  5071. (void*)0x200000000d40,
  5072. "\x78\x9c\xec\xdb\xcb\x6f\x54\x55\x18\x00\xf0\xef\xde\x69\xa9\xbc\x6c\xc5"
  5073. "\x27\x88\x5a\x45\x63\xe3\xa3\xa5\x05\x95\x05\x1b\x8c\x26\x2e\x34\x31\xd1"
  5074. "\x05\x2e\x6b\x3b\x10\x64\xa0\x86\xd6\x44\x08\x11\x34\x06\x97\x86\xc4\xbd"
  5075. "\x71\x69\xe2\x5f\xe0\x4a\x37\x06\x5d\x99\xb8\xd5\xbd\x21\x21\xca\x46\x70"
  5076. "\x35\xe6\xce\xdc\x3b\x9d\x0e\x33\x6d\x69\xa7\x1d\x61\x7e\xbf\x64\xe0\xdc"
  5077. "\xd7\x9c\xef\xeb\x39\x67\xee\x99\x7b\x32\x01\xf4\xad\xd1\xec\x9f\x24\x62"
  5078. "\x47\xc4\x60\xb1\x2f\x69\x3d\x61\xb4\xfe\xdf\x8d\xeb\xe7\x67\x6e\x5e\x3f"
  5079. "\x3f\x93\x44\xb5\xfa\xce\x5f\x49\xed\xbc\x7f\xae\x9f\x9f\x69\x9c\xfb\x77"
  5080. "\xb5\x66\x7b\xfe\x26\x63\x69\x44\xfa\x79\xd2\xf2\x86\x75\xf3\x67\xcf\x9d"
  5081. "\x9c\xae\x54\xca\x67\xf2\xed\x89\x85\x53\x1f\x4e\xcc\x9f\x3d\xf7\xe2\x89"
  5082. "\x53\xd3\xc7\xcb\xc7\xcb\xa7\xa7\x0e\x1d\x3a\x78\x60\xf2\x95\x97\xa7\x5e"
  5083. "\xea\x4a\x9e\xc3\x59\xac\x7b\x3e\x99\xdb\xbb\xfb\x8d\xf7\x2e\xbf\x35\x73"
  5084. "\xf4\xf2\xfb\x3f\x7f\x97\x85\x75\xf8\x42\xfd\xf8\x92\x3c\xba\x64\xf4\xca"
  5085. "\x68\xbb\xd4\x6b\x9e\xe9\x76\x65\x3d\xb6\xb3\xa9\x9c\x0c\x2c\x96\xab\xb9"
  5086. "\x5e\xc4\xc4\xca\x4a\x11\x91\x35\x57\x36\xf8\x7f\x8f\xe1\x28\xc5\x62\xe3"
  5087. "\x0d\xc7\xeb\x9f\xf5\x34\x38\x60\x43\x65\x9f\xcd\x43\x9d\x6e\x52\x11\x17"
  5088. "\xab\xc0\x5d\x2c\x89\x5e\x47\x00\xf4\x46\x71\xa3\xcf\xbe\xff\x16\xaf\xcd"
  5089. "\x9a\x7b\xfc\x1f\x5c\x3b\x12\x71\xb3\x54\xcf\xff\x46\xfe\xaa\x1f\x19\x88"
  5090. "\x34\x3f\x67\xb0\xe5\xfb\x6d\x37\x8d\x46\xc4\xd1\x8b\xff\x7e\x9d\xbd\xa2"
  5091. "\x78\x0e\xe1\xdb\x32\x00\xb0\x81\x7e\x38\x12\x11\x2f\xb4\x9b\xff\xa5\xf1"
  5092. "\x50\xd3\x79\xf7\xe6\x6b\x28\x23\x11\x71\x5f\x44\xec\x8a\x88\xfb\x23\xe2"
  5093. "\x81\x88\x78\x30\xa2\x76\xee\xc3\x11\xf1\xc8\x6d\xd6\x3f\xda\xb2\x7d\xeb"
  5094. "\xfc\x33\xbd\xba\xa6\xc4\x56\x29\x9b\xff\x1d\xce\xd7\xb6\x96\xce\xff\x8a"
  5095. "\xd9\x5f\x8c\x94\xf2\xad\x9d\xb5\xfc\x07\x93\x63\x27\x2a\xe5\xfd\xf9\xdf"
  5096. "\x64\x2c\x06\x87\xb2\xed\xc9\x65\xea\xf8\xf1\xb5\xdf\xbe\xec\x74\xac\x31"
  5097. "\xff\x1b\x8a\xda\x1c\x30\xab\xbf\x98\x0b\xe6\x71\x5c\x1d\x18\x5a\x7a\xcd"
  5098. "\xec\xf4\xc2\xf4\x7a\x72\x6e\x76\xed\xd3\x88\x3d\x03\xed\xf2\x4f\x1a\x2b"
  5099. "\x01\x49\x44\xec\x8e\x88\x3d\x6b\xac\xe3\xc4\x73\xdf\xee\xed\x74\xac\x79"
  5100. "\xfe\xdb\x3e\xff\x56\x5b\x16\x8b\x03\x6b\x0c\xa8\x49\xf5\x9b\x88\x67\xeb"
  5101. "\xfd\xfa\x62\xb4\xe4\x5f\x48\x1a\xeb\x93\x69\xbb\xf5\xc9\x89\x7b\xa2\x52"
  5102. "\xde\x3f\x51\xf4\x8a\x5b\xfd\xf2\xeb\xa5\xb7\x3b\xd5\xbf\x6c\xfe\x23\xeb"
  5103. "\xcf\x6f\x25\x59\xfb\x6f\x6b\xdb\xff\x1b\x46\x92\xe6\xf5\xda\xf9\xdb\xaf"
  5104. "\xe3\xd2\x1f\x5f\x74\x4c\x65\xe5\xf6\x6f\xdf\xff\xb7\x24\xef\xd6\xca\x45"
  5105. "\x6f\xf8\x78\x7a\x61\xe1\xcc\x64\xc4\x96\xe4\xcd\x5b\xf7\x4f\x2d\x5e\x5b"
  5106. "\x6c\x17\xe7\x67\xf9\x8f\xed\x6b\x3f\xfe\x77\xe5\xd7\x64\xf9\x3f\x1a\x11"
  5107. "\x59\x27\x7e\x2c\x22\x1e\x8f\x88\x27\xf2\xd8\x9f\x8c\x88\xa7\x22\x62\xdf"
  5108. "\x32\xf9\x5f\x79\xf5\xe9\x0f\x3a\x1d\xbb\xfd\xfe\x1f\x4b\xf2\x5b\xaf\x2c"
  5109. "\xff\xd9\xb6\xed\xdf\xe8\xff\x2d\xed\xbf\x4c\xa1\xb8\xa6\xe5\x50\xe9\xe4"
  5110. "\x4f\xdf\x77\xaa\x7f\x75\xed\x7f\xb0\x56\x1a\xcb\xf7\xac\xe6\xf3\x6f\x85"
  5111. "\x48\xd7\xd1\x9b\x01\x00\x00\xe0\xce\x93\x46\xc4\x8e\x48\xd2\xf1\x46\x39"
  5112. "\x4d\xc7\xc7\x23\xb6\xd7\x9e\xed\x6e\x4b\x2b\x73\xf3\x0b\xcf\x1f\x9b\xfb"
  5113. "\xe8\xf4\x6c\xed\x37\x02\x31\x12\x83\x69\xf1\xa4\x6b\xb8\xe9\x79\xe8\x64"
  5114. "\xfe\xb8\xaa\xd8\x9e\x6a\xd9\x3e\x90\x3f\x37\xfe\xaa\xb4\x35\x39\x56\xaa"
  5115. "\x94\xc7\x67\xe6\x2a\xb3\xbd\x4e\x1e\xfa\xdc\xf6\x0e\xe3\x3f\xf3\x67\xa9"
  5116. "\xd7\xd1\x01\x1b\x6e\x8d\xeb\x68\x5b\xbb\x1d\x07\xb0\xf9\xba\xb0\x8e\x0e"
  5117. "\xdc\xa1\x96\x1d\xff\x49\xfe\x5a\xf2\x73\x01\xe0\x6e\xe1\xfe\x0f\xfd\xcb"
  5118. "\xf8\x87\xfe\xd5\x6e\xfc\x5f\xe8\x41\x1c\xc0\xe6\x73\xff\x87\xfe\x65\xfc"
  5119. "\x43\xff\x6a\x8c\xff\xa1\xde\xc6\x01\x6c\x3e\xf7\x7f\xe8\x4b\xab\xfa\x91"
  5120. "\xbc\x82\x42\xad\x50\x8a\xc5\x3d\x91\xf6\x3e\x1e\x85\x8d\x2b\xf4\xfa\x93"
  5121. "\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5122. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5123. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5124. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5125. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5126. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5127. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5128. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5129. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5130. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5131. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5132. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5133. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x3b\xfe\x0b\x00\x00"
  5134. "\xff\xff\xa1\xfe\xf3\xac",
  5135. 1122);
  5136. syz_mount_image(
  5137. /*fs=*/0x200000000000, /*dir=*/0x200000000100,
  5138. /*flags=MS_I_VERSION|MS_SLAVE|MS_PRIVATE|MS_POSIXACL|MS_SYNCHRONOUS|MS_SILENT|0xc0600307*/
  5139. 0xc0ed8317, /*opts=*/0x200000000140, /*chdir=*/0xe, /*size=*/0x462,
  5140. /*img=*/0x200000000d40);
  5141. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0);
  5142. if (res != -1)
  5143. r[104] = res;
  5144. syscall(__NR_fcntl, /*fd=*/-1, /*cmd=*/8ul, /*pid=*/-1);
  5145. syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x10);
  5146. *(uint16_t*)0x200000000000 = 0xa;
  5147. *(uint16_t*)0x200000000002 = htobe16(2);
  5148. *(uint32_t*)0x200000000004 = htobe32(0);
  5149. memset((void*)0x200000000008, 0, 16);
  5150. *(uint32_t*)0x200000000018 = 0;
  5151. syscall(__NR_bind, /*fd=*/r[104], /*addr=*/0x200000000000ul,
  5152. /*addrlen=*/0x1cul);
  5153. *(uint16_t*)0x200000b63fe4 = 0xa;
  5154. *(uint16_t*)0x200000b63fe6 = htobe16(2);
  5155. *(uint32_t*)0x200000b63fe8 = htobe32(0);
  5156. *(uint64_t*)0x200000b63fec = htobe64(0);
  5157. *(uint64_t*)0x200000b63ff4 = htobe64(1);
  5158. *(uint32_t*)0x200000b63ffc = 0;
  5159. syscall(
  5160. __NR_sendto, /*fd=*/r[104], /*buf=*/0ul, /*len=*/0x1eul,
  5161. /*f=MSG_FASTOPEN|MSG_PROBE|MSG_OOB|MSG_NOSIGNAL|MSG_MORE|MSG_DONTWAIT|0x2000800*/
  5162. 0x2200c851ul, /*addr=*/0x200000b63fe4ul, /*addrlen=*/0x1cul);
  5163. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/6);
  5164. if (res != -1)
  5165. r[105] = res;
  5166. *(uint64_t*)0x200000000200 = 0;
  5167. *(uint32_t*)0x200000000208 = 0;
  5168. *(uint64_t*)0x200000000210 = 0x2000000001c0;
  5169. *(uint64_t*)0x2000000001c0 = 0x200000000240;
  5170. *(uint32_t*)0x200000000240 = 0xb8;
  5171. *(uint16_t*)0x200000000244 = 0x19;
  5172. *(uint16_t*)0x200000000246 = 1;
  5173. *(uint32_t*)0x200000000248 = 0;
  5174. *(uint32_t*)0x20000000024c = 0;
  5175. *(uint32_t*)0x200000000250 = htobe32(0x7f000001);
  5176. memset((void*)0x200000000260, 0, 16);
  5177. *(uint16_t*)0x200000000270 = htobe16(0);
  5178. *(uint16_t*)0x200000000272 = htobe16(0);
  5179. *(uint16_t*)0x200000000274 = htobe16(0);
  5180. *(uint16_t*)0x200000000276 = htobe16(0);
  5181. *(uint16_t*)0x200000000278 = 0;
  5182. *(uint8_t*)0x20000000027a = 0;
  5183. *(uint8_t*)0x20000000027b = 0;
  5184. *(uint8_t*)0x20000000027c = 0;
  5185. *(uint32_t*)0x200000000280 = 0;
  5186. *(uint32_t*)0x200000000284 = -1;
  5187. *(uint64_t*)0x200000000288 = 0;
  5188. *(uint64_t*)0x200000000290 = 0;
  5189. *(uint64_t*)0x200000000298 = 0;
  5190. *(uint64_t*)0x2000000002a0 = 0;
  5191. *(uint64_t*)0x2000000002a8 = 0;
  5192. *(uint64_t*)0x2000000002b0 = 0;
  5193. *(uint64_t*)0x2000000002b8 = 0;
  5194. *(uint64_t*)0x2000000002c0 = 0;
  5195. *(uint64_t*)0x2000000002c8 = 0;
  5196. *(uint64_t*)0x2000000002d0 = 0;
  5197. *(uint64_t*)0x2000000002d8 = 0;
  5198. *(uint64_t*)0x2000000002e0 = 0;
  5199. *(uint32_t*)0x2000000002e8 = 0;
  5200. *(uint32_t*)0x2000000002ec = 0;
  5201. *(uint8_t*)0x2000000002f0 = 0;
  5202. *(uint8_t*)0x2000000002f1 = 0;
  5203. *(uint8_t*)0x2000000002f2 = 0;
  5204. *(uint8_t*)0x2000000002f3 = 0;
  5205. *(uint64_t*)0x2000000001c8 = 0xb8;
  5206. *(uint64_t*)0x200000000218 = 1;
  5207. *(uint64_t*)0x200000000220 = 0;
  5208. *(uint64_t*)0x200000000228 = 0;
  5209. *(uint32_t*)0x200000000230 = 0;
  5210. syscall(__NR_sendmsg, /*fd=*/r[105], /*msg=*/0x200000000200ul, /*f=*/0ul);
  5211. memcpy(
  5212. (void*)0x200000000080,
  5213. "\x44\xf9\xb1\x08\xb1\xcd\xc8\x85\xc9\xc5\x33\xd2\x1f\x47\x4b\xec\x8b\xfe"
  5214. "\xf1\xdf\x1e\x2d\xa7\x1e\x57\x8d\xc6\xb9\x1d\x09\xf7\xab\x15\x37\x85\x71"
  5215. "\xd8\xe2\x75\x46\x09\x00\x11\x00\x6e\x75\x43\x69\x14\xab\x71\x75\x28\xee"
  5216. "\x4b\x7a\x9b\xea\xf9\x08\xd1\x11\x37\xc1\x19\x03\x06\x4e\x83\xb4\x95\x1f"
  5217. "\x4d\x43\x3a\x54\x04\x97\x0c\x85\xd9\x2d\x70\x83\xfd\x38\x84\x4c\xbb\x0c"
  5218. "\x6c\x5e\xb5\x08\xdd\xc2\xdc\x7a\x59\x0a\xa7\x94\x1b\x1e\x9e\xeb\x5a\x68"
  5219. "\x81\x38\xde\xa0\x9b\x77\x6c\xbf\xa7\x84\xcb\xf5\x50\xbf\x30\x74\xfb\x0d"
  5220. "\x77\x5d\xa4\xdf\x5a\x3f\x48\xbb\xdf\x45\x2e\xeb\x6b\x92\x3d\xa9\xd0\xe2"
  5221. "\x5b\x80\xf7\x6a\x87\x36\x64\xb5\x75\x34\x44\xfe\x05\xf3\x3e\x5f\x91\x04"
  5222. "\x55\x40\x83\x6c\x3c\xd6\xaf\x10\xf0\xcd\x01\x8f\x0c\x6f\x57\xf9\x26\xac"
  5223. "\x95\x9a\x56\x28\xc4\x50\x88\xfb\xe0\xc8\x7f\xbe\x6c\xbc\xda\x46\x62\xd2"
  5224. "\xa1\x2f\x6d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
  5225. 215);
  5226. syscall(__NR_sendto, /*fd=*/r[104], /*buf=*/0x200000000080ul, /*len=*/0xd7ul,
  5227. /*f=MSG_FASTOPEN|MSG_OOB|MSG_DONTWAIT|MSG_CONFIRM*/ 0x20000841ul,
  5228. /*addr=*/0ul, /*addrlen=*/0ul);
  5229. res = -1;
  5230. res = syz_open_dev(/*dev=*/0xc, /*major=*/4, /*minor=*/1);
  5231. if (res != -1)
  5232. r[106] = res;
  5233. *(uint64_t*)0x2000000021c0 = 0x200000000080;
  5234. memcpy(
  5235. (void*)0x200000000080,
  5236. "\xee\xd6\x07\x05\x97\x03\xf2\xbc\xa1\xa2\xd2\x39\xe7\x9d\x8c\x1e\x95\xb6"
  5237. "\x44\x99\x85\x74\xf6\x93\x60\x2d\xfc\xb8\x32\xcd\x60\x99\xd0\x3a\x7c\x7e"
  5238. "\xa1\x05\x36\x1d\x2a\x0a\x7a\x90\xcb\x0e\x87\x86\xbd\x0f\xf3\xc8\x4c\x72"
  5239. "\x30\x40\x9d\x40\x12\x66\x21\x6c\xbe\x55\xe6\x9d\x7d\xa8\x9d\x96\xb7\x9a"
  5240. "\xf5\x6b\xaa\x96\x46\xf0\x98\x6e\xf7\x46\x9b\xf3\x98\x90\xcb\x92\x41\xed"
  5241. "\x47\x87\x58\xdc\xc8\xbe\xae\x60\xee\xed\x76\x0e\xd6\x2a\xf7\x8b\xa1\x91"
  5242. "\xb5\xfd\xb9\xd4\x88\x82\x8f\x56\x2d\x84\x0f\x97\x15\x9f\x22\x4f\x4a\x9b"
  5243. "\xea\xcb\x76\x15\x10\x18\x07\x26\x04\x6f\xfa\xa3\x1d\x70\xa4\xc5\x36\xe4"
  5244. "\x81\xdf\xc1\xe0\x8d\xb2\x40\xee\x89\x67\xfc\x1b\x2f\xa7\x46\xa4\xec\x13"
  5245. "\xdd\x24\xc1\xcf\xa2\x67\x79\x72\x5b\x99\x68\xb5\xc7\x55\x41\x87\xec\x1a"
  5246. "\xc5\x11\xf5\xe2\x0c\x35\xd5\x6e\x9f\x41\xfb\x6c\xf0\xb0\x39\x7a\xd5\x84"
  5247. "\xa9\x0b\x99\x68\xae\xbb\x94\x10\x31\x09\x90\x08\x2c\x02\x57\xaa\xc8\x98"
  5248. "\x2f\x12\x1f\x3a\xa9\xdf\x9c\x22\xfc\xf5\x49\xb8\x4f\x46\x77\x2a\x27\xa5"
  5249. "\x7e\x24\x86\x62\xbe\x3b\x7a\xe9\x10\x02\x04\xe8\xf7\x5d\xcd\x89\x11\xac"
  5250. "\xdd\x37\x6b\x38\xb6\x42\xd1\xa9\x15\x11\x89\x4e\xda\x2f\x5f\xa5\xe6\xf7"
  5251. "\xb2\xd1\x20\xd8\xba\x82\xb6\xa3\x93\x55\xbb\x4d\x13\xf2\x86\x88\xb4\xb0"
  5252. "\x95\x6d\x7f\x7f\x7f\xb8\xbf\x06\x7a\xf6\x40\xc9\xed\x4a\x1c\x65\x73\xb9"
  5253. "\x41\xb6\x41\x75\xe8\x7a\xa4\x16\x40\x52\xa9\xd9\x4e\xd8\x1f\x87\xec\x60"
  5254. "\x69\xb8\x4c\x5a\xae\xf4\x67\xed\xba\xda\xbb\xe8\x45\xa7\xd7\x5a\xf3\x39"
  5255. "\x99\x89\x9d\xfa\x88\x7c\x67\x00\x7e\x8c\xec\x6e\xad\x9f\x6c\xb3\xd2\xb5"
  5256. "\x6d\xff\x0f\x3a\x0d\x06\xa7\x2d\x0c\x56\x0e\x31\x8a\xc4\x9c\x2f\xb6\x83"
  5257. "\xb6\x4a\x51\x2f\x09\xcc\x3d\xc4\xe7\xdf\x6d\x58\xe3\x1b\x81\x63\x7d\x90"
  5258. "\xe2\xf0\x12\x3f\xd0\x21\x42\x72\x3c\x97\x5e\x89\xb2\x96\x86\x57\x71\xa0"
  5259. "\x93\x3e\x25\x91\x15\x82\x10\xe7\x93\x14\x32\x25\xf4\x67\x1b\x50\xc0\x2e"
  5260. "\xfa\xa0\x32\xed\xfe\xf7\x93\x9a\x17\x75\x3f\x72\x43\x88\xa2\xd6\xba\x88"
  5261. "\x21\xc3\xce\x4c\x40\x7a\xc7\x4d\x35\x1d\x35\x0c\xd2\xb9\x8a\x8a\x63\xdb"
  5262. "\xb0\x0b\x7c\x68\x59\xb1\x1a\x64\x0e\x34\xa3\x38\x73\x63\x09\xe3\xc0\x80"
  5263. "\x47\xf1\x80\x4b\x77\xdd\x13\x51\xa1\xfa\x66\xfe\x6b\x80\x59\xf9\xe6\x31"
  5264. "\xfb\x44\xfa\xf6\xc4\xa2\xbd\xd7\x16\xd9\x3d\x66\x9d\xc1\x4d\xba\xa4\x2e"
  5265. "\xf1\x28\x67\x1b\xba\x50\xc7\xcf\x25\x84\xea\x93\x0e\x1f\xfc\xb7\x11\x84"
  5266. "\xe5\xa9\x29\xdb\xf7\xc7\xdb\xc0\x6d\x80\x4e\x6c\x1f\x53\x6a\x3a\x1b\x33"
  5267. "\x6a\x7a\x55\x39\xa8\x87\x9c\xa4\xea\x3c\xbe\x4e\x25\x47\x22\xf4\x3f\x07"
  5268. "\x08\x61\xd1\xd0\xdf\x18\xcb\xfc\xe8\x53\x84\x21\x34\x54\x7e\xd3\x7a\xd6"
  5269. "\xc2\xd7\x57\xf7\x6f\x8a\x29\x94\x3d\x57\x38\xd5\xe7\xaa\xbf\x4c\xad\x6f"
  5270. "\x5d\xe6\xf5\x3a\x2b\x6f\x33\x6f\x19\xf4\x1e\x14\x42\x31\x08\x32\x14\x62"
  5271. "\x47\x33\xe3\x6a\xb7\x42\x08\x6d\x9f\x78\x68\x89\xd5\xaf\x36\xc0\xe2\xc6"
  5272. "\xa7\x31\x14\x81\x58\xd8\xb6\xc6\xdb\x31\x8d\x33\x52\x9d\x98\x81\x5b\x93"
  5273. "\xca\x9e\xfd\xa1\x46\xf8\xdc\x4e\xc9\xdf\x08\xf4\x32\x53\xf5\x5c\x2d\xcc"
  5274. "\x48\x0a\x0e\x8b\x85\xc1\x84\xad\x13\xdb\x79\xd4\x01\x79\xad\x4c\x43\xe3"
  5275. "\x0f\x6f\x8e\xe8\x8e\xa9\xfb\xd5\x22\x8b\x26\xb9\x07\xf4\x6f\xfc\x5c\x2b"
  5276. "\x59\x4a\xde\x4f\x48\xde\xe4\x56\x1a\xe9\x9c\x7f\xb8\x1f\xd7\x49\xcf\x9a"
  5277. "\xa3\x6a\x01\xb5\x7b\x77\x0b\x77\x21\xbf\x29\x44\x18\x24\x17\x35\x44\x97"
  5278. "\x95\x01\x6e\xd0\x59\x7d\x66\xa6\x84\x5a\xf6\x8d\x0d\x44\x23\x2c\x4f\xfb"
  5279. "\x61\x60\xa4\x57\xde\x63\xab\x8b\xf8\xfe\x5f\x02\xf4\x03\x77\x93\xa3\x59"
  5280. "\xf0\x79\x9c\x90\x6a\x62\x87\xaa\x00\x00\x4a\xfa\x09\x94\x9e\xa7\x87\xaa"
  5281. "\x73\xa6\x94\x16\xb3\xb9\xe3\x24\xca\x33\x6b\x35\x19\x7e\x7f\x3f\x8d\x14"
  5282. "\x19\xb8\x56\x67\x6f\x9e\xf2\xf7\xce\x14\xce\x12\xe2\x3c\x72\xac\xa9\xe1"
  5283. "\x2f\xba\xf1\x18\x63\xd5\xb9\xd7\x75\x99\x86\xfa\x00\x62\x59\x9f\x8c\x35"
  5284. "\x16\x4b\x7f\xd7\xe9\xe1\x45\x49\xba\x88\x3a\x24\x4f\xea\xa6\x07\x82\x79"
  5285. "\xcf\x64\x12\xf1\x3c\xb0\x88\x3f\x62\xba\xf7\xcd\xa4\xb4\x81\xc2\xb0\x88"
  5286. "\xeb\xd3\x69\xc1\x2a\x24\x33\xa4\x8c\x24\xd3\x13\x31\xa9\x40\x16\x25\x1f"
  5287. "\x3b\x86\xdd\xe8\x84\xbd\x5a\xa7\xb1\xd5\x4d\xc8\x92\xf6\xeb\x9f\xf8\x47"
  5288. "\x76\xc3\x81\x84\x78\xb9\x8a\x8b\x9f\xb4\xa9\xbd\x18\xa2\x7e\xcf\x4e\x7d"
  5289. "\xd9\x95\xcd\xc6\x96\xfb\xfa\x32\x60\xf1\x60\xe5\x90\xe6\xd3\x11\xb4\xba"
  5290. "\x53\xeb\x11\x1c\xc6\x9c\x1a\x18\x6e\x98\x05\xd8\x0f\xdc\x03\x58\x24\x78"
  5291. "\xc9\x9a\xef\x40\x29\x4c\xa7\x2b\xf9\x65\xba\x97\x7a\x7f\x6f\xca\x5f\xa8"
  5292. "\x6a\x11\x0d\xe0\x02\x60\x3f\x2d\x0e\x92\xce\x93\x60\xbd\x83\x3d\xb6\x2c"
  5293. "\xb8\x54\x7e\x28\x15\xa1\xf5\x4d\xe4\x81\xf7\x45\x88\xf1\x2e\x40\x31\x22"
  5294. "\x23\xe3\x95\x79\xd5\xe3\xc9\x21\xeb\x4e\x62\xb2\x86\x80\xc6\xc3\x50\xb8"
  5295. "\x0d\x6a\xa6\x25\x97\xd1\x9d\x3c\x1c\x12\x35\x64\xdb\xfa\x06\x86\xfd\xf8"
  5296. "\x58\xa1\x0f\x81\xda\x38\x4e\x26\x1c\xed\x07\x8b\xb3\xb2\x26\x9a\xc9\xf6"
  5297. "\x1c\xa0\x66\xbb\xb2\xbc\x65\xdb\x1f\x4b\xf1\xb4\x45\xca\x57\xdc\x32\x37"
  5298. "\x4e\x67\xb9\x45\x93\x2f\x7f\x01\x96\x06\x92\x19\xc7\x77\x23\x67\x7d\x13"
  5299. "\xef\x54\x05\x3b\xd0\x6a\x6b\xf7\x00\x41\x01\xcb\x0d\x1f\xce\x78\xc5\x9e"
  5300. "\xce\x5e\x3a\x3c\xe4\x61\x5d\x5b\x03\xf2\x79\x7e\xed\x62\x48\xfa\xed\x2a"
  5301. "\x49\x4c\x2c\xd5\x10\x28\x0f\x4f\x6b\x56\x99\xcc\x2c\xdb\x74\x03\x7a\x20"
  5302. "\x2f\xf1\x1c\x24\xd9\x61\x09\xb8\x12\xd9\x7a\x2b\xab\x0f\xa0\xea\xed\x5b"
  5303. "\x29\x21\xdb\xb3\x1b\xb9\x5a\x5f\x63\x4a\xd8\x4d\x23\x06\xa4\x0e\xdc\xaa"
  5304. "\x3f\x81\xed\xf2\x89\xec\xda\xd9\x2c\x03\x64\x74\x54\xa7\x19\x74\x50\x8b"
  5305. "\x53\xbc\x28\xf2\x63\x79\xa6\x9b\x4c\x51\xd9\x50\x5e\xac\x0a\x23\x5d\x5c"
  5306. "\x31\xda\x3f\xa5\xcc\x7d\x74\x7c\xea\x40\xac\x54\xf8\x84\x35\x78\x21\xb6"
  5307. "\xc3\x3c\xf6\x34\xf0\x16\xd5\x35\xb3\x34\x8a\x3b\x5e\x17\x9e\x6f\x48\x08"
  5308. "\xfe\x3a\xda\xcb\x30\xf7\xfd\x17\x1a\xa2\x9a\x28\x65\x07\xb5\x16\xda\xbd"
  5309. "\xea\x2d\xf7\x45\x6e\xbc\x32\xdd\xd8\x39\x1e\x47\x79\xbb\xfc\x65\xd0\x0e"
  5310. "\xa1\x34\x0e\x27\x54\x43\xa4\x4f\xf1\x74\x85\xeb\xac\xd8\xcf\xdd\xb0\x82"
  5311. "\xfe\x09\x6f\x7a\x61\x38\xc5\xf3\x5d\x66\x5b\x60\x85\x9d\x8c\x22\x82\x80"
  5312. "\x17\x30\x9d\xa1\xfa\x5c\x48\xbf\x00\x88\x07\x6e\x46\x52\x15\xe9\x21\x35"
  5313. "\x3f\xde\xc2\x46\x65\x18\x48\x88\x33\xf7\x94\x3a\x5f\x82\x93\x63\x07\x8d"
  5314. "\xc9\x05\xbd\xf0\x54\x4f\x36\xd9\xff\x0a\x9e\x87\xec\x74\x71\xa2\x36\x81"
  5315. "\x31\xa9\xc3\x99\x91\xa5\x72\xfd\xe0\xdc\x9b\x91\x07\x93\x36\x43\xc9\xb8"
  5316. "\x99\xe0\x21\x18\x61\xfb\xe7\xf2\x64\x81\xfb\x15\x38\xc9\x86\x1d\xf4\xd8"
  5317. "\xd8\x33\xf7\xa4\x8a\xa2\x1f\xd9\xc4\x62\x58\x9f\x0e\x90\x77\x2b\xe7\x89"
  5318. "\xcb\x32\xa4\xe3\xaa\x16\xd8\x6a\xa4\x01\x67\xe5\xc4\xa8\xb1\x36\xf7\xe0"
  5319. "\xbf\x65\xe9\xa1\x3c\xe5\xc0\x2e\xa0\x5c\x9b\xdc\x8b\x50\x48\xbd\x68\x43"
  5320. "\x98\x84\x30\xe0\xe0\xfb\x06\x95\x22\xe7\xb2\x72\x70\x15\xd6\x3c\x94\x8f"
  5321. "\xe1\xb8\x03\xe3\xb0\x8d\x6d\x5e\x73\x5f\x1b\xe2\x88\x23\x17\x7a\x08\xae"
  5322. "\x31\xab\x41\x63\xf0\x9f\xf2\x09\xb8\x54\x05\x02\xb2\x64\xd1\x2b\xdd\x35"
  5323. "\x6a\x43\x3b\x5f\x2c\x3b\xb0\xc0\xde\xd1\x28\xce\x5d\xed\x14\x76\x23\x7b"
  5324. "\xb3\xf4\xd5\x58\xc5\xfc\x1e\x7e\x98\x36\x36\xfc\xb2\xe7\xe2\x69\xfb\x26"
  5325. "\xb1\x78\x3a\x9a\x99\xc8\xbe\xcf\xc2\x14\x1a\x50\x1c\xf0\xfd\xba\xb9\xd1"
  5326. "\x3d\xef\xb0\x0c\x9b\x3e\x0d\xc1\xf5\x48\x31\x13\x93\x14\xb5\x03\xc5\xa2"
  5327. "\xc3\x77\xce\xfb\xb2\x95\xe6\x82\x4d\x77\x00\x32\xaa\x2b\x51\xdc\xcc\xea"
  5328. "\xcd\xeb\x57\x2a\x2c\x25\xf9\xec\x99\x0e\x4b\x83\xaf\xa2\xa4\x06\xa7\x2a"
  5329. "\x35\xa4\xca\xe6\x17\xf2\x54\x2f\x4a\x3d\x60\xfc\x02\xf6\x29\xfb\xf5\x4c"
  5330. "\xda\x85\xa8\x4e\x97\xca\x24\x44\x57\x98\x97\xaa\xd3\xb7\x31\x6d\x4e\xe8"
  5331. "\x00\x2f\x93\xb8\x2b\x13\xcd\xa7\xc5\x3e\xce\x97\xb9\x4a\x7c\xf1\x0f\x1a"
  5332. "\x4c\x73\xda\x6f\x3a\x89\xbe\x51\x19\x42\x41\x42\x75\x47\xf3\x13\xcc\x47"
  5333. "\x95\x53\x81\xcb\x74\xa5\xaf\xb7\x35\xa6\xe3\x69\x9f\x36\x43\xfe\xe5\x96"
  5334. "\x98\x55\x3c\xc3\x58\x63\x1f\x2a\x47\x08\x28\x8d\x86\xe5\x29\xb8\x25\x58"
  5335. "\xe5\x78\x93\x03\xdb\xc9\xad\x0d\xd7\x7a\x98\x9d\x07\xe1\x63\x8d\x39\xb0"
  5336. "\x9e\x9e\x47\xf3\x91\x7e\x0f\x5b\x9d\x0e\x48\x61\xbb\x44\x04\x63\xd7\x33"
  5337. "\x33\x63\x0e\x95\xf5\x1a\xb0\x13\xa6\x96\x17\x95\xfe\x44\x83\x9f\x57\x5a"
  5338. "\x17\xb8\x0e\x96\x46\xa0\xd3\x80\xe2\xca\x35\x2e\x5c\x7c\x8a\x85\xe0\x78"
  5339. "\xef\xca\x17\x00\x46\xaf\xa8\x23\xa9\x29\xa1\xf6\x92\x68\xd7\xf1\x8c\xae"
  5340. "\xe6\x70\xa2\x9c\xb9\xe7\xee\x92\x4d\xf3\x48\xe3\xcb\xdd\x8c\x13\x24\xed"
  5341. "\xd0\x8f\x07\xf1\x24\x3b\x48\xfa\x55\xab\x30\x3e\x51\x30\x4e\x6e\xdf\xe5"
  5342. "\xfb\xc3\xb9\xde\x1a\x69\x24\x17\x9c\x9b\x99\x27\x34\xea\x5f\xa2\x71\xc0"
  5343. "\x99\xfe\xc8\xa5\x24\x76\x72\xa6\xe0\xf5\x51\x69\x1d\xec\xb8\xbe\xc9\xf9"
  5344. "\x49\x4c\x7a\x26\x19\x50\xd1\xc4\xcb\x24\x0c\xfa\xc0\x5e\x05\x72\x71\x8a"
  5345. "\x33\xba\x40\x38\xec\x03\xaf\x1c\x68\xb0\x67\xda\x19\xaf\xda\x71\x58\x2c"
  5346. "\xca\x97\xa8\x01\xb8\x9b\x27\x72\x66\xe2\x91\xe7\x74\x0e\x76\x7b\x91\xe1"
  5347. "\x0a\x57\xa2\x80\x6a\x6f\xa9\x99\x0c\x51\xb5\x21\xd0\x0a\x47\x33\x38\x47"
  5348. "\x63\x03\x21\x94\x5d\x1f\x53\x60\x1a\x21\x59\x6c\x28\x14\x13\x63\xcf\xd4"
  5349. "\xa4\x57\x94\x78\x32\xd7\x54\x5f\xf6\x56\x6e\x10\xc1\xc1\x6d\xa8\xfe\x8a"
  5350. "\xb4\x0d\x4a\x4a\xfa\x8f\x19\x13\x92\x33\x2a\xcb\x53\x71\xd1\xff\x86\xed"
  5351. "\x2f\x58\x8a\x62\x01\xa0\x93\xa0\x0f\x86\x86\x84\x98\x14\x93\x60\x28\xae"
  5352. "\x79\xaf\x9d\xd8\x64\x75\x7b\xb9\xc2\x61\x4a\x9e\x76\xd6\xfa\xe7\xe6\xc0"
  5353. "\x84\x17\x88\xb7\x15\xaa\x73\xd2\xf0\x1c\x3d\x4b\x0d\xcd\xb3\x8c\x5c\x6b"
  5354. "\x81\xe6\x0d\x12\xb1\xca\x72\xb6\xc4\x7f\x5f\x3e\xb8\x83\xaf\x96\x4b\x87"
  5355. "\x7e\xfa\x0c\x5a\xcf\xbd\x7f\x41\x0a\x06\x0c\x56\xa1\x79\x8f\x0c\x40\x7c"
  5356. "\xb3\x16\xf7\x88\xe3\x0c\xf3\xd6\x9f\x19\x25\x33\xe1\x9a\x81\x8c\x8f\x7a"
  5357. "\xa9\x90\xa6\xd9\x94\xe2\xad\x77\x56\x38\x8e\xc0\x17\x4c\x1c\x0a\x42\x24"
  5358. "\x9e\x90\x3f\x32\x35\xfe\xa2\xd6\x5d\x54\x0f\xdc\x1c\x03\xe1\x57\x86\x52"
  5359. "\x87\x87\xc8\x0c\x61\x94\x76\x36\x41\xcf\x7f\x85\xf5\x49\xea\x70\x6a\xa1"
  5360. "\xb0\x7e\x4b\x29\x03\x71\x4b\x7f\x17\x64\x20\x2e\x53\x2b\x52\xe7\xaa\x8c"
  5361. "\x06\x3f\xae\x17\x0e\xa9\x33\x62\xc7\x79\x4f\x32\xcd\x5e\xd3\xcb\x39\xa2"
  5362. "\xa1\x8a\xcd\xa3\x66\xed\x03\x1a\x11\x4e\x9f\xb4\x7b\xea\xc6\x9b\xf0\x5f"
  5363. "\x25\x8d\x77\xad\x41\x81\x91\x60\x16\x7c\x5b\x0f\x6d\x34\xf1\xd0\x63\xab"
  5364. "\x2e\xf3\x19\xfc\xef\x2c\x23\x05\x8f\x85\xcc\x45\x3f\x6e\x40\x54\x7a\x99"
  5365. "\xbc\xcb\x31\x7a\x4c\x19\xe2\xb3\xd9\x95\x05\xa2\x4e\x77\x3f\x2e\xe1\x0b"
  5366. "\x88\x44\x3f\x48\x9b\xcb\xa4\x76\xe7\x86\xb4\xdc\xce\x1c\xd8\x19\xe0\x08"
  5367. "\x06\xd7\x66\xaf\x56\x80\x42\x04\xab\xbf\xb8\xa7\xf8\xe2\xf3\xb3\x99\x52"
  5368. "\x4a\x06\xea\xcb\x20\xb1\x45\x9c\x8f\x9c\x8a\x15\x74\x23\xc4\xa0\xd1\x8e"
  5369. "\x56\x09\x79\x59\x61\xa6\xb0\xb8\xac\xd6\x43\xfe\x30\xfd\xdd\x00\x77\x40"
  5370. "\x14\x5a\xe3\x1b\x08\x55\xbb\x8b\x02\x83\xa4\xe1\x39\x40\xb9\xaf\x0f\x84"
  5371. "\x27\xf0\x90\x59\xac\x0f\x1e\xe1\x50\x77\x75\xf6\x74\x3d\xeb\xef\x31\xc8"
  5372. "\x2c\x63\xfa\x8c\x5a\xdb\x08\xf0\x5e\x38\xfc\x37\xb0\x7d\x8a\x2f\x4d\x62"
  5373. "\xb9\xeb\x47\x48\xb9\xe0\x28\xc7\x66\x7a\xc8\xea\x03\xf6\x4c\xbe\x9f\x9a"
  5374. "\x3e\x75\xe4\xd5\x7b\x11\xf0\x2c\x72\x02\x4a\x65\xbc\x4f\x14\xfd\x3a\x0e"
  5375. "\xab\xb3\x9b\x06\x2a\x7c\x68\x54\xa2\x99\xee\xf7\x49\x1b\xf1\x0c\x09\x6c"
  5376. "\x50\xcf\xa4\xa3\xda\x48\x3f\x42\x93\x92\x05\x38\x3a\xe8\x31\x96\x04\xf7"
  5377. "\x42\xab\x49\x82\x80\x1f\x0c\x83\xda\xbb\xd9\xda\x48\xe8\x00\xf5\x10\xdf"
  5378. "\xec\xc2\x24\xf0\xb1\x83\xa8\x01\xdf\x96\xd2\x87\x06\x8f\xca\xad\x6c\xdd"
  5379. "\xd4\x12\xc7\x96\xa4\x81\xd6\x09\xdb\xfd\x77\xe8\xb2\x96\xdc\xe8\x6f\xf8"
  5380. "\xef\xa1\x0b\x23\xae\xc2\x61\xc0\x27\x58\x2f\x6a\x77\x0f\xf9\xf0\xf7\xa9"
  5381. "\x9d\x8b\xa4\x94\x95\xf4\x69\x6c\xd6\xec\xa9\x20\xce\x17\xe0\xf0\xb1\x35"
  5382. "\x38\x33\x68\x20\xf8\xc0\x1c\x7e\x95\x55\x67\x7a\x94\x5c\xfe\x8c\x5b\x25"
  5383. "\x8b\xee\xb2\x41\x5c\x58\xdc\xe1\x73\xb3\x45\x8e\x27\x3e\x23\xbf\x6e\xbe"
  5384. "\x2f\xea\xa2\xe9\x3d\xa4\x24\xb5\x18\x81\xb7\x32\xc4\x73\x56\xbb\x60\xde"
  5385. "\xa0\x0a\xe1\x24\xe1\x6a\xa0\xa0\x6a\x4f\xeb\x2a\x32\x1e\x91\xd7\x18\x1d"
  5386. "\x25\x8a\x3e\xe9\x52\xda\xf8\x23\xe5\x18\xc9\x36\x37\xfa\x0e\xfc\xf5\x01"
  5387. "\x9a\xa4\x9a\x1c\x7f\x38\xd7\x68\xa9\xbb\x7d\xbb\xa3\x7e\x1e\xbe\x90\x3b"
  5388. "\xf9\xbf\x19\x7e\x6b\xa7\x87\x72\x64\xd8\x5e\xb2\x01\x46\xe5\x10\x50\x1c"
  5389. "\x7c\x1e\xdb\x48\x7c\xf1\x2b\x1d\x8a\x7f\x39\xb2\x7f\xfd\x7c\xb4\xd8\xf8"
  5390. "\x09\x2e\xe5\x4a\xcd\xc1\x39\x0b\x17\xea\xe1\x31\x14\x97\x87\xf0\xf5\x85"
  5391. "\xef\xb6\xe3\xa7\x07\x32\x63\xf2\x95\x5c\x4d\xd6\xb6\xa4\xc9\x79\x1a\x66"
  5392. "\x94\xa6\xce\x9f\x00\x59\x5e\x9c\x22\xed\xda\x61\x0d\x60\x62\x11\xf5\x62"
  5393. "\x8a\x87\x16\x2d\x92\xa3\x75\xa7\xcd\x92\x71\x4a\x37\x83\x06\x52\xb9\xcd"
  5394. "\x1f\xb8\x5d\xeb\x77\xe8\xc4\xf7\xac\x28\xf0\x86\x8a\x7e\x27\x61\xae\xeb"
  5395. "\x91\xa3\x5a\xb7\x1b\x5a\x55\x7c\x21\x35\x8c\x60\xfb\xd0\xf5\x44\xb2\x60"
  5396. "\xde\xfb\xc3\xae\xda\x44\x48\x11\xdf\x2f\x08\xc7\x4c\xcf\xad\x45\xc4\x21"
  5397. "\x71\x42\x95\x4f\xaf\xc4\x2f\x66\xf4\x0d\x4e\xf9\x00\x95\x6e\xad\x58\xee"
  5398. "\xb8\x7e\x2b\x1a\x74\x7f\x86\x9b\xc7\x1c\x36\xed\x4c\x01\x5a\x59\xb9\x6f"
  5399. "\xd8\x50\x72\x09\x80\xa7\x8b\x8b\x1b\x63",
  5400. 2944);
  5401. *(uint64_t*)0x2000000021c8 = 0xb80;
  5402. syscall(__NR_writev, /*fd=*/r[106], /*vec=*/0x2000000021c0ul, /*vlen=*/1ul);
  5403. memcpy((void*)0x200000000000, "/sys/module/snd_hda_core", 24);
  5404. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  5405. /*dir=*/0x200000000000ul, /*flags=*/0, /*mode=*/0);
  5406. if (res != -1)
  5407. r[107] = res;
  5408. *(uint64_t*)0x2000000003c0 = 0x200000000300;
  5409. *(uint64_t*)0x2000000003c8 = 0x87;
  5410. syscall(__NR_readv, /*fd=*/r[107], /*vec=*/0x2000000003c0ul, /*vlen=*/1ul);
  5411. memcpy((void*)0x200000000200, "ext4\000", 5);
  5412. memcpy((void*)0x2000000047c0, "./file0\000", 8);
  5413. *(uint8_t*)0x200000000580 = 0;
  5414. memcpy(
  5415. (void*)0x200000000240,
  5416. "\x78\x9c\xec\xdd\x4d\x6c\x23\x57\x1d\x00\xf0\xff\xd8\xf1\x36\xdb\xcd\x92"
  5417. "\x14\x38\x94\x4a\x2d\x2b\x28\xda\xad\x60\xed\xa4\xa1\x6d\xc4\xa1\x5d\x24"
  5418. "\xc4\xad\x12\xa8\xdc\x97\x28\xf1\x46\xd1\x3a\x71\x14\x3b\xed\x26\xaa\x68"
  5419. "\x2a\xae\x48\x48\x08\x01\x12\x27\x4e\x5c\x90\x38\x70\x44\x42\x3d\x73\x42"
  5420. "\x95\x2a\xd1\x3b\x02\x04\x42\x74\x0b\x07\x0e\xc0\xa0\x19\x8f\xb3\x8e\x6b"
  5421. "\x27\xbb\xc2\x1f\x69\xf2\xfb\x49\xcf\x7e\x6f\xbe\xfe\xef\x25\xf2\x9b\x79"
  5422. "\x33\xe3\x71\x00\x17\xd6\xb5\x88\xb8\x15\x11\xe5\x88\x78\x2e\x22\xe6\x8b"
  5423. "\xe9\xa5\x22\xc5\x61\x27\x65\xcb\x7d\x78\xff\xcd\xb5\x2c\x25\x91\xa6\xaf"
  5424. "\xfd\x3d\xc9\xd7\xc9\xca\x11\x91\xf4\x6e\xf3\x4a\xb6\x4a\xf9\x78\x8c\x7e"
  5425. "\xad\xfd\x83\xbb\xab\x8d\x46\x7d\xb7\x28\xd7\xda\x5b\x3b\xb5\xd6\xfe\xc1"
  5426. "\xcd\xcd\xad\xd5\x8d\xfa\x46\x7d\x7b\x79\x79\xe9\xc5\x95\x97\x56\x5e\x58"
  5427. "\x59\x3c\xb5\x0d\xc9\x07\xa7\xb7\xf3\x6a\x44\xbc\xfc\xb5\x3f\xff\xe8\xfb"
  5428. "\x3f\xff\xfa\xcb\xbf\xf9\xd2\x1b\x7f\xb8\xfd\xd7\x1b\xdf\xc9\x2a\x3d\x57"
  5429. "\xcc\x2f\xda\xd1\x63\xe7\x7b\xa7\x6f\xf5\x74\xef\xe7\xaf\x95\x98\xed\x99"
  5430. "\x36\x13\x11\xbb\xa3\xd8\xf8\x19\x50\x2e\xda\x53\x39\x69\xa1\xcb\x93\xab"
  5431. "\x0f\x00\x00\x27\xab\x46\xc4\x27\x23\xe2\x73\xf9\xf1\xff\x7c\x94\xf3\xa3"
  5432. "\xb9\xdc\x89\x87\x74\x00\x00\x00\xc0\xc7\x47\xfa\xca\x5c\xfc\x3b\x89\x48"
  5433. "\x01\x00\x00\x80\x73\xeb\x95\xfc\x1e\xd8\xa4\x54\x2d\xee\xf7\x9d\x8b\x52"
  5434. "\xa9\x5a\xed\xdc\xc3\xfb\xe9\x78\xbc\xd4\x68\xb6\xda\x5f\xbc\xd3\xdc\xdb"
  5435. "\x5e\xef\xdc\x2b\xbb\x10\x95\xd2\x9d\xcd\x46\x7d\xb1\xb8\x57\x78\x21\x2a"
  5436. "\x49\x56\x5e\xca\xf3\x0f\xca\xcf\xf7\x95\x97\x23\xe2\x89\x88\xf8\xe1\xfc"
  5437. "\xe5\xbc\x5c\x5d\x6b\x36\xd6\xa7\x7d\xf2\x03\x00\x00\x00\x2e\x88\x2b\x7d"
  5438. "\xe3\xff\x7f\xce\x77\xc6\xff\x99\xf2\x48\xbe\x01\x0b\x00\x00\x00\x9c\x09"
  5439. "\x0b\xd3\xae\x00\x00\x00\x00\x30\x76\xc3\xc6\xff\x47\x4f\xf5\x7e\x6c\x72"
  5440. "\x75\x01\x00\x00\x00\xc6\xe3\x68\xfc\x6f\x9c\x0f\x00\x00\x00\xe7\xd1\x37"
  5441. "\x5e\x7d\x35\x4b\x69\xf7\xf7\xaf\xd7\x5f\xdf\xdf\xbb\xdb\x7c\xfd\xe6\x7a"
  5442. "\xbd\x75\xb7\xba\xb5\xb7\x56\x5d\x6b\xee\xee\x54\x37\x9a\xcd\x8d\xfc\x99"
  5443. "\x7d\x5b\xa7\x6d\xaf\xd1\x6c\xee\x7c\x39\xb6\xf7\xee\xd5\xda\xf5\x56\xbb"
  5444. "\xd6\xda\x3f\xb8\xbd\xd5\xdc\xdb\x6e\xdf\xde\x3c\xf6\x13\xd8\x00\x00\x00"
  5445. "\xc0\x04\x3d\xf1\xd9\x77\xde\x4f\x22\xe2\xf0\x2b\x97\xf3\x94\xb9\x94\xbd"
  5446. "\x94\x87\xac\xe0\x59\x01\x70\x6e\x94\x1e\x65\xe1\x3f\x8d\xaf\x1e\xc0\xe4"
  5447. "\x0d\xdb\xcd\x03\xe7\xdf\xcc\xa3\xae\x90\x1e\xe5\x74\x1d\xf0\x71\x77\x38"
  5448. "\xed\x0a\x00\xd3\x96\xf4\x16\x06\x1c\x14\xf4\xde\xbc\x73\xec\x9c\xc1\xef"
  5449. "\xc6\x57\x27\x00\x00\x60\xb4\xae\x7f\x66\xf0\xf5\xff\x6c\x08\x50\x39\x71"
  5450. "\xcd\x6b\x13\xaa\x21\x30\x2e\x8f\x74\xfd\x1f\x38\x57\x5c\xc4\x83\x8b\xeb"
  5451. "\x84\xeb\xff\x8b\x03\x8e\x0d\xde\x1d\x6b\x65\x80\x89\xaa\x38\x02\x80\x0b"
  5452. "\xaf\xe7\xfa\x7f\x3a\x68\xfe\xd0\x87\x77\x3c\xf4\xf5\xff\x34\x3d\x75\x5b"
  5453. "\x00\x00\xc0\x58\xcd\xe5\x29\x29\x55\x8b\x6b\x81\x73\x51\x2a\x55\xaf\x45"
  5454. "\x5c\xcd\xbf\xea\x5f\x49\xee\x6c\x36\xea\x8b\x11\xf1\x89\x88\xf8\xfd\x7c"
  5455. "\xe5\xb1\xac\xbc\x94\xaf\x99\x1c\xbf\x67\x18\x00\x00\x00\x00\x00\x00\x00"
  5456. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x2a\x4d\x93\x48\x01"
  5457. "\x00\x00\x80\x73\x2d\xa2\xf4\x97\xa4\xf8\xfd\xaf\xeb\xf3\xcf\xce\xf5\x9f"
  5458. "\x1f\xb8\x94\xfc\x6b\x3e\x7f\x8f\x88\x37\x7e\xfa\x5a\xe9\xde\x6a\xbb\xbd"
  5459. "\xbb\x94\x4d\xff\xa0\x3b\xfd\x56\x44\xfc\x38\x9f\xfe\xfc\x34\xce\x60\x00"
  5460. "\x00\x00\x00\xfd\xba\xe3\xf4\xee\x38\x1e\x00\x00\x00\x00\x00\x00\x00\x00"
  5461. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5462. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5463. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x46\xe9\xc3\xfb\x6f\xae\x75"
  5464. "\xd3\x24\xe3\xfe\xed\xab\x11\xb1\x70\x14\x3f\x39\x8c\x28\xe2\xcf\xc4\x6c"
  5465. "\xfe\x3e\x1b\x95\x88\x78\xfc\x1f\x49\xcc\xf4\xac\x97\x44\x44\x79\x04\xf1"
  5466. "\x0f\xdf\x8e\x88\x27\x7b\xdb\x5f\xc9\x63\x67\x11\x16\xf2\xaa\x75\x6a\xd1"
  5467. "\x1f\xbf\x14\x11\x97\xc7\x12\xbf\xfb\xf7\xef\xc4\xbf\x14\xb3\x4f\xa7\x69"
  5468. "\x3a\x30\xfe\x95\x11\xc4\x87\x8b\xec\x9d\xac\xff\xb9\x35\xe8\xf3\x57\x8a"
  5469. "\x6b\xf9\xfb\xe0\xcf\xff\x4c\x91\xfe\x5f\x7d\xfd\xdf\xb1\xf8\xdd\xfe\xaf"
  5470. "\x1c\x79\x17\xf8\x91\xfe\xef\xea\x43\xc6\x78\xea\xbd\x5f\xd6\x86\xc6\x7f"
  5471. "\x3b\xe2\xa9\x99\xc1\xfd\x4f\x37\x7e\xf2\xa0\xfd\x47\x55\x18\xda\xf7\x0d"
  5472. "\xf8\xa3\x7c\xfb\x5b\x07\x07\xc3\x16\x4f\x7f\x16\x71\x7d\xe0\xfe\x27\x39"
  5473. "\x5a\x26\xcb\xd5\xda\x5b\x3b\xb5\xd6\xfe\xc1\xcd\xcd\xad\xd5\x8d\xfa\x46"
  5474. "\x7d\x7b\x79\x79\xe9\xc5\x95\x97\x56\x5e\x58\x59\xac\xdd\xd9\x6c\xd4\x8b"
  5475. "\xd7\x81\x31\x7e\xf0\xf4\xaf\xff\xdb\x37\xe9\x3f\x69\x47\xde\xfe\x18\x12"
  5476. "\x7f\xe1\xa3\xed\x3f\x56\xa7\x67\xb3\x4c\xa5\xb7\x31\xfd\x61\x8a\x60\xef"
  5477. "\xdd\xbb\xff\xa9\x4e\xb6\xd2\xb7\x89\x3c\xfe\x8d\xcf\x0f\xfe\xff\x3f\x79"
  5478. "\x42\xfc\x6c\xdf\xf7\x85\x62\x3f\x90\xcd\xbf\xde\xcd\x1f\x76\xf2\xbd\x9e"
  5479. "\xf9\xc5\xbb\xcf\x0c\xac\x58\x11\x7f\xfd\x41\xfb\x7f\x3b\xf0\xff\x3f\x7b"
  5480. "\x29\x2f\xf7\xb7\xff\xc6\xb0\x8d\xf6\x79\xee\x9b\xdf\xfd\xe3\x43\x2e\x0a"
  5481. "\x00\x4c\x40\x6b\xff\xe0\xee\x6a\xa3\x51\xdf\x1d\x5d\x26\x7d\x6b\xe0\xac"
  5482. "\x9f\xa4\x69\x3a\xf2\x58\x32\x53\xcf\xbc\xf5\xb0\x0b\xcf\x8e\x30\xe8\xaf"
  5483. "\xce\x46\xdb\x27\x9f\x29\x06\x25\x31\xde\x58\xa3\x38\xb3\x05\x00\x00\x9c"
  5484. "\x35\x0f\x0e\xfa\xa7\x5d\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5485. "\x00\x00\x00\x00\xb8\xb8\x5a\xfb\x69\x79\xc4\x0f\x0f\x4b\x22\x89\x63\x53"
  5486. "\xfa\x63\x1e\x4e\xa7\xa9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5487. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5488. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5489. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5490. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5491. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x27\xfa\x5f\x00\x00\x00\xff"
  5492. "\xff\xbe\x67\xde\x15",
  5493. 1373);
  5494. syz_mount_image(
  5495. /*fs=*/0x200000000200, /*dir=*/0x2000000047c0,
  5496. /*flags=MS_POSIXACL|MS_RELATIME|MS_NOSUID|MS_NOEXEC*/ 0x21000a,
  5497. /*opts=*/0x200000000580, /*chdir=*/0xfe, /*size=*/0x55d,
  5498. /*img=*/0x200000000240);
  5499. *(uint64_t*)0x2000000003c0 = 0x200000000180;
  5500. memcpy((void*)0x200000000180,
  5501. "\x39\x00\x00\x00\x13\x00\x03\x47\x00\xbb\x65\xe1\xc3\xe4\xff\xff\x01"
  5502. "\x00\x00\x00\x01\x00\x00\x00\x56\x00\x00\x00\x25\x00\x00\x00\x19\x00"
  5503. "\x04\x00\x04\x00\x00\x00\x07\xfd\x17\xe5\xff\xff\x08\x00\x04\x00\x00"
  5504. "\x00\x00\x00\x00\x00\x00",
  5505. 57);
  5506. *(uint64_t*)0x2000000003c8 = 0x39;
  5507. syscall(__NR_writev, /*fd=*/-1, /*vec=*/0x2000000003c0ul,
  5508. /*vlen=*/0x10000000000002a5ul);
  5509. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_RAW*/ 3ul,
  5510. /*proto=*/1);
  5511. if (res != -1)
  5512. r[108] = res;
  5513. res = syscall(__NR_socketpair, /*domain=*/1ul, /*type=SOCK_DGRAM*/ 2ul,
  5514. /*proto=*/0, /*fds=*/0x2000000000c0ul);
  5515. if (res != -1) {
  5516. r[109] = *(uint32_t*)0x2000000000c0;
  5517. r[110] = *(uint32_t*)0x2000000000c4;
  5518. }
  5519. *(uint16_t*)0x200000000180 = 0;
  5520. *(uint8_t*)0x200000000182 = 0;
  5521. *(uint32_t*)0x200000000184 = 0;
  5522. syscall(__NR_connect, /*fd=*/r[109], /*addr=*/0x200000000180ul,
  5523. /*addrlen=*/0x6eul);
  5524. syscall(__NR_sendmmsg, /*fd=*/r[110], /*mmsg=*/0x2000000bd000ul,
  5525. /*vlen=*/0x318ul, /*f=*/0ul);
  5526. *(uint16_t*)0x2000000017c0 = 0;
  5527. *(uint8_t*)0x2000000017c2 = 0;
  5528. *(uint32_t*)0x2000000017c4 = 0;
  5529. syscall(__NR_connect, /*fd=*/r[110], /*addr=*/0x2000000017c0ul,
  5530. /*addrlen=*/0x6eul);
  5531. syscall(__NR_close_range, /*fd=*/r[108], /*max_fd=*/-1, /*flags=*/0ul);
  5532. memcpy((void*)0x200000000080, "memory.events\000", 14);
  5533. res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000080ul,
  5534. /*flags=*/0x275a, /*mode=*/0);
  5535. if (res != -1)
  5536. r[111] = res;
  5537. memcpy((void*)0x200000000140, "memory.events\000", 14);
  5538. res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000140ul,
  5539. /*flags=*/0x7a05, /*mode=*/0x1700);
  5540. if (res != -1)
  5541. r[112] = res;
  5542. sprintf((char*)0x200000000200, "0x%016llx", (long long)0);
  5543. syscall(__NR_write, /*fd=*/r[112], /*buf=*/0x200000000200ul,
  5544. /*len=*/0xf000ul);
  5545. syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul,
  5546. /*prot=PROT_GROWSUP|PROT_SEM|PROT_READ*/ 0x2000009ul,
  5547. /*flags=MAP_SHARED_VALIDATE|MAP_FIXED*/ 0x13ul, /*fd=*/r[111],
  5548. /*offset=*/0ul);
  5549. *(uint64_t*)0x2000000000c0 = 0;
  5550. *(uint64_t*)0x2000000000c8 = 0;
  5551. syscall(__NR_cachestat, /*fd=*/r[111], /*cstat_range=*/0x2000000000c0ul,
  5552. /*cstat=*/0ul, /*flags=*/0ul);
  5553. memcpy((void*)0x200000007cc0, "ns/pid\000", 7);
  5554. syz_open_procfs(/*pid=*/-1, /*file=*/0x200000007cc0);
  5555. syz_init_net_socket(/*domain=*/0x10, /*type=*/3, /*proto=*/0x10);
  5556. syscall(
  5557. __NR_io_uring_enter, /*fd=*/-1, /*to_submit=*/0, /*min_complete=*/0,
  5558. /*flags=IORING_ENTER_REGISTERED_RING|IORING_ENTER_EXT_ARG|IORING_ENTER_SQ_WAIT|IORING_ENTER_SQ_WAKEUP*/
  5559. 0x1eul, /*sigmask=*/0ul, /*size=*/0ul);
  5560. syscall(
  5561. __NR_io_uring_enter, /*fd=*/-1, /*to_submit=*/0, /*min_complete=*/0,
  5562. /*flags=IORING_ENTER_REGISTERED_RING|IORING_ENTER_EXT_ARG|IORING_ENTER_SQ_WAIT|IORING_ENTER_SQ_WAKEUP*/
  5563. 0x1eul, /*sigmask=*/0ul, /*size=*/0ul);
  5564. memcpy((void*)0x200000000100, "./file0\000", 8);
  5565. res = -1;
  5566. res = syz_mount_image(
  5567. /*fs=*/0, /*dir=*/0x200000000100,
  5568. /*flags=MS_SYNCHRONOUS|MS_RELATIME|MS_NOATIME*/ 0x200410, /*opts=*/0,
  5569. /*chdir=*/1, /*size=*/0, /*img=*/0x200000000000);
  5570. if (res != -1)
  5571. r[113] = res;
  5572. *(uint16_t*)0x200000000140 = 2;
  5573. *(uint64_t*)0x200000000148 = 0x2000000000c0;
  5574. *(uint16_t*)0x2000000000c0 = 0x61;
  5575. *(uint8_t*)0x2000000000c2 = 0;
  5576. *(uint8_t*)0x2000000000c3 = 0;
  5577. *(uint32_t*)0x2000000000c4 = 0;
  5578. *(uint16_t*)0x2000000000c8 = 6;
  5579. *(uint8_t*)0x2000000000ca = 0;
  5580. *(uint8_t*)0x2000000000cb = 0;
  5581. *(uint32_t*)0x2000000000cc = 0;
  5582. syscall(__NR_seccomp, /*op=*/1ul, /*flags=*/0ul, /*arg=*/0x200000000140ul);
  5583. *(uint16_t*)0x200000000140 = 2;
  5584. *(uint64_t*)0x200000000148 = 0x2000000000c0;
  5585. *(uint16_t*)0x2000000000c0 = 0x61;
  5586. *(uint8_t*)0x2000000000c2 = 0;
  5587. *(uint8_t*)0x2000000000c3 = 0;
  5588. *(uint32_t*)0x2000000000c4 = 0;
  5589. *(uint16_t*)0x2000000000c8 = 6;
  5590. *(uint8_t*)0x2000000000ca = 0;
  5591. *(uint8_t*)0x2000000000cb = 0;
  5592. *(uint32_t*)0x2000000000cc = 0;
  5593. syscall(__NR_seccomp, /*op=*/1ul, /*flags=*/0ul, /*arg=*/0x200000000140ul);
  5594. memcpy((void*)0x200000000080, "./file0\000", 8);
  5595. memcpy((void*)0x200000000940, "tmpfs\000", 6);
  5596. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000080ul,
  5597. /*type=*/0x200000000940ul, /*flags=*/0ul, /*data=*/0ul);
  5598. syscall(__NR_pidfd_getfd, /*pidfd=*/-1, /*fd=*/r[113], /*flags=*/0ul);
  5599. res = syscall(__NR_pidfd_getfd, /*pidfd=*/-1, /*fd=*/r[113], /*flags=*/0ul);
  5600. if (res != -1)
  5601. r[114] = res;
  5602. syscall(__NR_io_uring_register, /*fd=*/-1, /*opcode=*/9ul, /*arg=*/0ul,
  5603. /*nr_args=*/0ul);
  5604. res = syscall(__NR_io_uring_register, /*fd=*/-1, /*opcode=*/9ul, /*arg=*/0ul,
  5605. /*nr_args=*/0ul);
  5606. if (res != -1)
  5607. r[115] = res;
  5608. syscall(__NR_io_uring_register, /*fd=*/r[114], /*opcode=*/0xaul, /*arg=*/0ul,
  5609. /*nr_args=*/r[115]);
  5610. memcpy((void*)0x200000000200, "./file0\000", 8);
  5611. syscall(__NR_chdir, /*dir=*/0x200000000200ul);
  5612. memcpy((void*)0x200000000640, ".\000", 2);
  5613. syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000640ul,
  5614. /*flags=*/0, /*mode=*/0);
  5615. memcpy((void*)0x200000000640, ".\000", 2);
  5616. res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000640ul,
  5617. /*flags=*/0, /*mode=*/0);
  5618. if (res != -1)
  5619. r[116] = res;
  5620. syscall(__NR_getdents64, /*fd=*/r[116], /*ent=*/0ul, /*count=*/0ul);
  5621. *(uint64_t*)0x200000000000 = 0;
  5622. *(uint32_t*)0x200000000008 = 0x14;
  5623. *(uint32_t*)0x20000000000c = 0;
  5624. *(uint64_t*)0x200000000010 = 0;
  5625. *(uint64_t*)0x200000000018 = 0;
  5626. res = syscall(__NR_timer_create, /*id=*/0ul, /*ev=*/0x200000000000ul,
  5627. /*timerid=*/0x200000000200ul);
  5628. if (res != -1)
  5629. r[117] = *(uint32_t*)0x200000000200;
  5630. memcpy((void*)0x2000000000c0, "./file0\000", 8);
  5631. *(uint64_t*)0x200000000180 = 0;
  5632. *(uint64_t*)0x200000000280 = 0;
  5633. syscall(__NR_execve, /*file=*/0x2000000000c0ul, /*argv=*/0x200000000180ul,
  5634. /*envp=*/0x200000000280ul);
  5635. *(uint32_t*)0x2000000002c0 = 9;
  5636. *(uint32_t*)0x2000000002c4 = 0;
  5637. *(uint32_t*)0x2000000002c8 = 7;
  5638. *(uint32_t*)0x2000000002cc = 0xffff0001;
  5639. *(uint32_t*)0x2000000002d0 = 0;
  5640. *(uint32_t*)0x2000000002d4 = 0x8000;
  5641. syscall(__NR_ioctl, /*fd=*/r[116], /*cmd=*/0x401845ff,
  5642. /*arg=*/0x2000000002c0ul);
  5643. res = syscall(__NR_clock_gettime, /*id=*/0ul, /*tp=*/0x200000000080ul);
  5644. if (res != -1) {
  5645. r[118] = *(uint64_t*)0x200000000080;
  5646. r[119] = *(uint64_t*)0x200000000088;
  5647. }
  5648. *(uint64_t*)0x200000000940 = r[118];
  5649. *(uint64_t*)0x200000000948 = r[119] + 10000000;
  5650. *(uint64_t*)0x200000000950 = 0x77359400;
  5651. *(uint64_t*)0x200000000958 = 0;
  5652. syscall(__NR_timer_settime, /*timerid=*/r[117], /*flags=TIMER_ABSTIME*/ 1ul,
  5653. /*new=*/0x200000000940ul, /*old=*/0ul);
  5654. *(uint64_t*)0x200000000000 = 0x77359400;
  5655. *(uint64_t*)0x200000000008 = 0;
  5656. *(uint64_t*)0x200000000010 = 0;
  5657. *(uint64_t*)0x200000000018 = 0;
  5658. syscall(__NR_timer_settime, /*timerid=*/r[117], /*flags=TIMER_ABSTIME*/ 1ul,
  5659. /*new=*/0x200000000000ul, /*old=*/0x200000000040ul);
  5660. res =
  5661. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0xb704, /*arg=*/0x200000000000ul);
  5662. if (res != -1)
  5663. r[120] = *(uint32_t*)0x200000000000;
  5664. memcpy((void*)0x200000000040, "ext4\000", 5);
  5665. memcpy((void*)0x200000000480, "./file2\000", 8);
  5666. memcpy((void*)0x2000000000c0, "resuid", 6);
  5667. *(uint8_t*)0x2000000000c6 = 0x3d;
  5668. sprintf((char*)0x2000000000c7, "0x%016llx", (long long)r[120]);
  5669. *(uint8_t*)0x2000000000d9 = 0x2c;
  5670. *(uint8_t*)0x2000000000da = 0;
  5671. memcpy(
  5672. (void*)0x2000000004c0,
  5673. "\x78\x9c\xec\xdd\xcb\x6f\x54\xd5\x1f\x00\xf0\xef\x9d\x69\x0b\x3f\x1e\xbf"
  5674. "\x16\xc4\x17\xa0\x54\xd1\xd8\xf8\x68\x69\x41\x65\x61\x42\x34\x92\xb8\xd0"
  5675. "\xc4\x44\x17\xb8\xac\x6d\x21\x48\xa1\x86\xd6\x44\x08\x91\x62\x0c\x2e\x0d"
  5676. "\x89\x7b\xe3\xd2\x44\xff\x01\x57\xba\xf1\xb5\x32\x71\xab\x7b\x43\x42\x0c"
  5677. "\x1b\xd1\x98\x38\xe6\xce\xdc\x0b\x33\xd3\xe9\x6b\x98\x47\xd3\xf9\x7c\x92"
  5678. "\xdb\x39\xe7\xde\x33\x73\xcf\x77\xce\x3d\x33\xe7\x9e\x7b\x07\x02\xe8\x59"
  5679. "\xc3\xe9\x9f\x24\x62\x47\x44\xfc\x1a\x11\x83\x95\x6c\x6d\x81\xe1\xca\xc3"
  5680. "\xad\x9b\x97\xa6\xfe\xba\x79\x69\x2a\x89\x52\xe9\x8d\x3f\x92\x72\xb9\x3f"
  5681. "\x6f\x5e\x9a\xca\x8b\xe6\xcf\xdb\x9e\x65\x46\x0a\x11\x85\x8f\x92\xd8\xd7"
  5682. "\x60\xbf\xf3\x17\x2e\x9e\x99\x9c\x9d\x9d\x39\x9f\xe5\xc7\x16\xce\xbe\x3b"
  5683. "\x36\x7f\xe1\xe2\x33\xa7\xcf\x4e\x9e\x9a\x39\x35\x73\x6e\xe2\xe8\xd1\x23"
  5684. "\x87\xc7\x9f\x7f\x6e\xe2\xd9\x96\xc4\xb9\x33\xad\xeb\xde\x0f\xe6\xf6\x3f"
  5685. "\xf8\xca\x5b\xd7\x5e\x9b\x3a\x71\xed\xed\x1f\xbf\x4c\xeb\xbb\x23\xdb\x5e"
  5686. "\x1d\x47\x93\x92\xfa\x15\xc3\x31\xbc\x74\x65\xe6\xf1\xbb\xdc\xd9\x46\xb3"
  5687. "\xb3\x2a\x9d\xf4\x75\xb1\x22\xac\x4b\x31\x22\xd2\xe6\xea\x2f\xf7\xff\xc1"
  5688. "\x28\xc6\x9d\xc6\x1b\x8c\xe3\x1f\x76\xb5\x72\x40\x5b\x95\x4a\xa5\xd2\x96"
  5689. "\xe5\x37\x2f\x96\x4a\xc5\xac\x14\xb0\xf9\x24\x7a\x37\xf4\xa8\xfc\x8b\x3e"
  5690. "\x3d\xff\xcd\x97\x0e\x0d\x3d\x36\x84\x1b\x2f\x56\x4e\x80\xd2\xb8\x6f\x65"
  5691. "\x4b\x65\x4b\x5f\x14\xb2\x32\xfd\x75\xe7\xb7\xad\xb4\x18\x11\x27\x16\xff"
  5692. "\xfe\x2c\x5d\xa2\x35\xf3\x10\x00\x00\x2b\xfa\x26\x1d\xff\x3c\xdd\x68\xfc"
  5693. "\x57\x88\xfb\xaa\xca\xfd\x3f\xbb\x36\x34\x14\x11\xbb\x22\x62\x77\x44\xdc"
  5694. "\x13\x11\x7b\x22\xe2\xde\x88\x72\xd9\xfb\x23\xe2\x81\x75\xee\x7f\xb8\x26"
  5695. "\x77\xac\xc1\xf8\xa7\x70\xbd\xc9\xd0\xd6\x24\x1d\xff\xbd\x90\x5d\xdb\xaa"
  5696. "\x1d\xff\xe5\xa3\xbf\x18\x2a\x66\xb9\x9d\xe5\xf8\xfb\x93\x93\xa7\x67\x67"
  5697. "\x0e\x65\xef\xc9\x48\xf4\x6f\x49\xf3\xe3\x2b\xec\xe3\xdb\x97\x7f\xf9\x64"
  5698. "\xb9\x6d\xc3\x55\xe3\xbf\x74\x49\xf7\x9f\x8f\x05\xb3\x7a\x5c\xef\xab\x9b"
  5699. "\xa0\x9b\x9e\x5c\x98\xbc\x9b\x98\xab\xdd\xb8\x52\x9e\xdd\xbb\xbc\x34\xfe"
  5700. "\x24\xbf\x12\x30\x94\x97\xdd\xdb\xc4\xeb\xa7\xef\xd9\xe9\x27\xbf\xd8\x9f"
  5701. "\xa6\xff\x69\xb0\xbd\x6f\xd5\xf8\x57\xd0\x82\xeb\x4c\xa5\xcf\x23\x9e\xa8"
  5702. "\xb4\xff\x62\xd4\xc5\x9f\x4b\x56\xbe\x3e\x39\xb6\x35\x66\x67\x0e\x8d\xe5"
  5703. "\x47\xc5\x52\x3f\xfd\x7c\xf5\xf5\xe5\xf6\xbf\x7a\xfb\xb7\x57\xda\xfe\xdb"
  5704. "\x1a\x1e\xff\xb7\xe3\x1f\x4a\xaa\xaf\xd7\xce\xd7\x6d\x5d\x83\xab\xbf\x7d"
  5705. "\xbc\xec\x39\x4d\xb3\xc7\xff\x40\xf2\x66\xc4\xf1\x88\x81\x6c\xdd\xfb\x93"
  5706. "\x0b\x0b\xe7\xc7\x23\x06\x92\x57\xcb\xf9\x9a\xf5\x13\x77\x9e\x9b\xe7\xf3"
  5707. "\xf2\x69\xfc\x23\x07\x1b\xf7\xff\xdd\x71\x27\xd6\x7d\x11\x91\x1e\xc4\x0f"
  5708. "\x45\xc4\xc3\x11\x71\x20\xab\xfb\x23\x11\xf1\x68\x44\x1c\xac\x8b\xab\x58"
  5709. "\x79\xb8\x92\xfe\xf9\xe1\xa5\xc7\xde\x69\x3e\xfe\xf6\x4a\xe3\x9f\x6e\xdc"
  5710. "\xfe\xa5\x7f\x2b\x89\xba\xf6\x5f\x3d\x91\x7e\x56\x56\xaf\x29\x9e\xf9\xee"
  5711. "\xeb\xe6\xe3\x4f\xdb\xff\x48\x39\x35\x92\xad\x59\xcb\xe7\xdf\xda\x6a\x9a"
  5712. "\x1f\xcd\x00\x00\x00\xb0\xb9\x15\xca\xf7\xc0\x27\x85\xd1\xdb\xe9\x42\x61"
  5713. "\x74\xb4\x72\x0f\xff\x9e\xd8\x56\x98\x9d\x9b\x5f\x78\xea\xe4\xdc\x7b\xe7"
  5714. "\xa6\x2b\xf7\xca\x0f\x45\x7f\x21\x9f\xe9\x1a\xac\x9a\x0f\x1d\xcf\x26\x0a"
  5715. "\xf3\xfc\x44\x5d\xfe\x70\x36\x6f\xfc\x69\xf1\x7f\xe5\xfc\xe8\xd4\xdc\xec"
  5716. "\x74\xb7\x83\x87\x1e\xb7\x7d\x99\xfe\x9f\xfa\xbd\xd8\xed\xda\x01\x6d\xe7"
  5717. "\xf7\x5a\xd0\xbb\xd6\xd6\xff\xfb\xdb\x5e\x0f\xa0\xf3\x56\xed\xff\xc7\x6a"
  5718. "\xb3\x8b\x6d\xac\x0b\xd0\x59\x4d\x8e\xff\xbf\x6a\x75\x3d\x80\xce\x73\xfe"
  5719. "\x0f\xbd\xab\x51\xff\xbf\xdc\x85\x7a\x00\x9d\xe7\xfb\x1f\x7a\x57\xc3\xfe"
  5720. "\xbf\x6b\x47\xe7\x2b\x02\x74\x9c\xef\x7f\xe8\x5d\x79\xff\x5f\xe1\x1f\x02"
  5721. "\xbd\xfd\x8b\x66\x60\xd3\x58\xcf\xef\xfa\x37\x4d\x22\xbf\x93\xa9\x95\xaf"
  5722. "\x1c\x8b\x35\x6b\x2e\xc7\x81\x8d\x10\xe9\xc5\x33\x5b\x23\xa2\x2d\xaf\x1c"
  5723. "\x85\xf5\x3c\xeb\xfb\x5b\x6d\x08\x30\xff\x8f\x06\x36\xc2\xfb\x5c\x49\x0c"
  5724. "\x44\x44\x8b\x0e\xd1\x6e\x87\xd3\xcd\x4f\x25\x00\x00\x00\x00\x00\x00\x00"
  5725. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5726. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5727. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5728. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5729. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5730. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5731. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5732. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5733. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5734. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5735. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5736. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5737. "\x00\x00\x00\x00\x80\xd6\xf9\x2f\x00\x00\xff\xff\xbf\x00\xde\xd7",
  5738. 1168);
  5739. syz_mount_image(/*fs=*/0x200000000040, /*dir=*/0x200000000480,
  5740. /*flags=MS_STRICTATIME|MS_MANDLOCK*/ 0x1000040,
  5741. /*opts=*/0x2000000000c0, /*chdir=*/0, /*size=*/0x490,
  5742. /*img=*/0x2000000004c0);
  5743. res = syscall(__NR_socket, /*domain=*/0xaul,
  5744. /*type=SOCK_CLOEXEC|SOCK_DGRAM*/ 0x80002ul, /*proto=*/0);
  5745. if (res != -1)
  5746. r[121] = res;
  5747. memcpy((void*)0x200000000440, "ext4\000", 5);
  5748. memcpy((void*)0x200000000480, "./file0\000", 8);
  5749. *(uint8_t*)0x200000000000 = 0;
  5750. memcpy(
  5751. (void*)0x200000000500,
  5752. "\x78\x9c\xec\xdc\x4d\x6f\x15\x55\x1c\x07\xe0\xdf\x4c\x5b\x08\x2f\x5a\x34"
  5753. "\xbe\x56\x94\x0a\x2a\x15\xb4\xa5\xa8\xd5\x85\x1b\xf6\x26\x2e\x64\xe7\xaa"
  5754. "\xa1\x85\x10\x0b\x18\x5a\x13\x21\x2c\x34\xc1\xb8\x91\x85\x89\x71\x69\xe2"
  5755. "\x07\x30\x91\x9d\x89\x1b\x76\x6e\x59\xf0\x01\x58\x1a\x0c\x31\x2c\xb4\xd1"
  5756. "\xc4\xd4\xcc\xed\x1d\x7a\x69\x7b\x0b\x85\xd6\x6b\x98\xe7\x49\xe6\xde\x73"
  5757. "\xe6\x9c\x9b\x73\x66\x4e\xfe\x73\xef\x3d\x73\x32\x01\x1a\x6b\xb8\x7a\x29"
  5758. "\x92\x9d\x49\xae\x25\x19\x5c\xcc\xde\x59\x61\x78\xf1\xed\xcf\x5b\x17\x8e"
  5759. "\xcd\xdf\xba\x70\xac\xc8\xc2\xc2\x07\xbf\x17\xad\x7a\xd5\xbe\xba\x6a\xfd"
  5760. "\xb9\x1d\xd5\x4b\x99\x8c\x94\x49\x79\xb1\xc8\x73\xab\xb4\x3b\x7b\xee\xfc"
  5761. "\x47\x93\x33\x33\xd3\x67\xdb\xf9\xb1\xb9\x53\x1f\x8f\xcd\x9e\x3b\xff\xfa"
  5762. "\xc9\x53\x93\x27\xa6\x4f\x4c\x9f\x1e\x9f\x98\x38\x74\x68\xe2\xed\x89\xb7"
  5763. "\xde\xd9\xb0\x63\x1d\x9a\xfc\xf1\xbb\xdf\x2e\xbd\xff\xf5\xb7\x5f\x7c\x38"
  5764. "\xb6\x67\xa8\xdc\x5b\xf5\x77\x67\xbb\xac\xf3\x38\x36\xca\x70\x86\xef\x3c"
  5765. "\x97\x1d\x5e\xd9\xe8\xc6\x7a\xec\xc9\x8e\x74\xd1\xdf\xc3\x8e\xb0\x2e\x7d"
  5766. "\x49\xaa\xe1\x1a\x68\xc5\xff\x60\xfa\xb2\x34\x78\x83\xf9\xe5\x7a\x4f\x3b"
  5767. "\x07\x6c\xaa\x85\xca\xd6\xae\xc5\x9f\x2d\x00\x0f\xb1\x22\xbd\xee\x01\xd0"
  5768. "\x1b\xf5\x17\x7d\xf5\xff\xb7\xde\xfe\xab\xdf\x1e\xf4\xde\xcd\x23\x8b\x7f"
  5769. "\x00\xeb\xb9\x9d\xf9\xdb\xe3\xdf\x9f\xb2\x5d\x67\x60\xd9\xff\xfb\x8d\x34"
  5770. "\x9c\xe4\xc2\xf5\xf9\xc1\x6a\xcb\x26\xcd\xc3\x00\x00\x00\x00\x34\xd9\x95"
  5771. "\x23\x49\x5e\x5b\x6d\xfe\xaf\xcc\x53\x1d\xf5\xaa\xf4\xd3\x49\x9e\x49\xf2"
  5772. "\x6c\x92\xa1\xa4\xb5\xae\x67\x77\x92\xe7\x93\xbc\x90\x64\x4f\xbd\x9e\x68"
  5773. "\x1d\x96\xd7\x5f\x39\xff\x53\xde\xb8\xaf\x03\xe3\x9e\xdc\x3c\x92\xbc\x9b"
  5774. "\x64\x7e\xc5\xfc\x5f\x3d\xfb\x97\x5d\x7d\xed\xdc\x23\x55\x26\x03\xc5\xf1"
  5775. "\x93\x33\xd3\x87\x92\x3c\x9a\x64\x24\x03\x5b\xab\xfc\xf8\x1a\x6d\x4c\xfe"
  5776. "\xf0\xc7\x4f\xdd\xca\xaa\xf1\xbf\xf6\x73\xdf\x60\xbd\x55\xed\x57\xef\x4b"
  5777. "\x35\xca\x1b\xfd\xcb\xee\x4f\x4f\x4d\xce\x4d\x3e\xc8\x31\xb3\xe4\xe6\xe7"
  5778. "\xc9\x50\xff\x6a\xe3\x5f\xdc\x5e\x09\x54\x24\x79\x31\xc9\xde\xfb\x6c\xe3"
  5779. "\xe2\xa5\xdd\x97\xbb\x95\xdd\x7d\xfc\xd9\x4c\x0b\xdf\x27\xfb\x57\x8d\xff"
  5780. "\xa5\x95\x8b\xc5\xda\xeb\x33\xc7\x5a\xd7\x83\xb1\xfa\xaa\xb0\xd2\xd5\x85"
  5781. "\xe1\xf9\x6e\xed\x1b\xff\xde\xaa\xe2\x7f\xfb\xda\xe3\xbf\xab\xe8\x5c\xaf"
  5782. "\x3b\xbb\xfe\x36\x2e\x0f\xfc\xf5\x4f\xb7\xb2\xfb\xbd\xfe\x6f\x29\x8e\xb6"
  5783. "\x3a\xb8\xa5\xbd\xef\xd3\xc9\xb9\xb9\xb3\xe3\xc9\x96\xe2\xbd\x95\xfb\x0f"
  5784. "\xaf\xbf\xcf\x0f\xab\xfa\x7c\xd4\xe7\xab\x1a\xff\x91\x7d\xab\x7f\xff\x3f"
  5785. "\xde\xfe\x4c\x75\x42\xf7\x25\x79\x29\xc9\xcb\xed\xb5\xcb\xfb\x5b\xdf\xfd"
  5786. "\xc9\xab\x49\x0e\x24\x39\xb8\x46\x9b\x5f\x1e\xf8\xea\x4a\xb7\x32\xf1\xdf"
  5787. "\x5b\xd5\xf8\x4f\xad\x2b\xfe\xd7\x9f\xf8\x7b\xdb\xd1\xab\xdd\xda\xef\xbc"
  5788. "\xff\x5b\x6d\x55\xfb\xf5\xbd\xe0\x45\x55\xfc\xbf\xd9\xea\xcc\x48\x7b\x8f"
  5789. "\xdf\x7f\x77\x77\xaf\x03\xd4\xeb\x7e\x02\x00\x00\x00\x00\x00\x00\xb0\x31"
  5790. "\xca\xd6\x33\xf0\x8a\x72\xf4\x76\xba\x2c\x47\x47\x17\x9f\xe1\xf7\x44\xb6"
  5791. "\x97\x33\x67\x66\xe7\x0e\x1e\x3f\xf3\xc9\xe9\xa9\xc5\x67\xe5\xed\xca\x40"
  5792. "\x59\xaf\xf4\x1a\xec\x58\x0f\x3a\xde\x4a\x2f\xe5\x0f\x2f\xcb\xbf\x91\xe4"
  5793. "\xb1\x24\xdf\xf4\x6d\x6b\xe5\x47\x8f\x9d\x99\x99\xea\xf5\xc1\x43\xc3\xed"
  5794. "\xe8\x12\xff\x95\x5f\xfb\x7a\xdd\x3b\x60\xd3\x79\x5e\x2b\x34\x97\xf8\x87"
  5795. "\xe6\x12\xff\xd0\x5c\xe2\x1f\x9a\x4b\xfc\x43\x73\x89\x7f\x68\x2e\xf1\x0f"
  5796. "\xcd\x25\xfe\xa1\xb9\xc4\x3f\x34\x97\xf8\x87\x46\x7a\x90\xe7\xfa\x49\x48"
  5797. "\x48\x3c\xac\x89\x5e\x5f\x99\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5798. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5799. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5800. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5801. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5802. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5803. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5804. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5805. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5806. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5807. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5808. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  5809. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x1f\xfe\x0d\x00\x00\xff"
  5810. "\xff\xbc\xb0\xdc\x06",
  5811. 1049);
  5812. syz_mount_image(/*fs=*/0x200000000440, /*dir=*/0x200000000480, /*flags=*/0,
  5813. /*opts=*/0x200000000000, /*chdir=*/1, /*size=*/0x419,
  5814. /*img=*/0x200000000500);
  5815. memcpy((void*)0x200000000000,
  5816. "lo\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  5817. res =
  5818. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x8933, /*arg=*/0x200000000000ul);
  5819. if (res != -1)
  5820. r[122] = *(uint32_t*)0x200000000010;
  5821. *(uint16_t*)0x200000000580 = 0x11;
  5822. *(uint16_t*)0x200000000582 = htobe16(7);
  5823. *(uint32_t*)0x200000000584 = r[122];
  5824. *(uint16_t*)0x200000000588 = 1;
  5825. *(uint8_t*)0x20000000058a = 0;
  5826. *(uint8_t*)0x20000000058b = 6;
  5827. memset((void*)0x20000000058c, 255, 6);
  5828. memset((void*)0x200000000592, 0, 2);
  5829. syscall(__NR_bind, /*fd=*/-1, /*addr=*/0x200000000580ul, /*addrlen=*/0x14ul);
  5830. memcpy((void*)0x200000000180,
  5831. "team0\000\000\000\000\000\000\000\000\000\000\000", 16);
  5832. res = syscall(__NR_ioctl, /*fd=*/r[121], /*cmd=*/0x8933,
  5833. /*arg=*/0x200000000180ul);
  5834. if (res != -1)
  5835. r[123] = *(uint32_t*)0x200000000190;
  5836. memcpy((void*)0x2000000001c0,
  5837. "team0\000\000\000\000\000\000\000\000\000\000\000", 16);
  5838. res = syscall(__NR_ioctl, /*fd=*/r[121], /*cmd=*/0x8933,
  5839. /*arg=*/0x2000000001c0ul);
  5840. if (res != -1)
  5841. r[124] = *(uint32_t*)0x2000000001d0;
  5842. *(uint32_t*)0x200000000280 = 0x14;
  5843. res = syscall(__NR_getsockname, /*fd=*/-1, /*addr=*/0x200000000200ul,
  5844. /*addrlen=*/0x200000000280ul);
  5845. if (res != -1)
  5846. r[125] = *(uint32_t*)0x200000000204;
  5847. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_RAW*/ 3ul,
  5848. /*proto=*/3);
  5849. if (res != -1)
  5850. r[126] = res;
  5851. memcpy((void*)0x200000000300,
  5852. "lo\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  5853. res = syscall(__NR_ioctl, /*fd=*/r[126], /*cmd=*/0x8933,
  5854. /*arg=*/0x200000000300ul);
  5855. if (res != -1)
  5856. r[127] = *(uint32_t*)0x200000000310;
  5857. res = syscall(__NR_socket, /*domain=*/0x11ul, /*type=SOCK_RAW*/ 3ul,
  5858. /*proto=*/0x300);
  5859. if (res != -1)
  5860. r[128] = res;
  5861. memcpy((void*)0x200000000000,
  5862. "\xb3\xa2\xea\x52\x22\x30\x0a\xed\xdd\xc6\x56\xc6\x68\xb7", 14);
  5863. *(uint16_t*)0x200000000100 = 0x11;
  5864. *(uint16_t*)0x200000000102 = htobe16(0);
  5865. *(uint32_t*)0x200000000104 = r[127];
  5866. *(uint16_t*)0x200000000108 = 1;
  5867. *(uint8_t*)0x20000000010a = 0;
  5868. *(uint8_t*)0x20000000010b = 6;
  5869. memset((void*)0x20000000010c, 170, 5);
  5870. *(uint8_t*)0x200000000111 = 0;
  5871. memset((void*)0x200000000112, 0, 2);
  5872. syscall(__NR_sendto, /*fd=*/r[128], /*buf=*/0x200000000000ul, /*len=*/0xeul,
  5873. /*f=*/0ul, /*addr=*/0x200000000100ul, /*addrlen=*/0x14ul);
  5874. memcpy((void*)0x2000000002c0, "batadv_slave_1\000\000", 16);
  5875. res = syscall(__NR_ioctl, /*fd=*/r[121], /*cmd=*/0x8933,
  5876. /*arg=*/0x2000000002c0ul);
  5877. if (res != -1)
  5878. r[129] = *(uint32_t*)0x2000000002d0;
  5879. memcpy((void*)0x200000000380, "ip_vti0\000\000\000\000\000\000\000\000\000",
  5880. 16);
  5881. *(uint64_t*)0x200000000390 = 0x200000000300;
  5882. memcpy((void*)0x200000000300,
  5883. "tunl0\000\000\000\000\000\000\000\000\000\000\000", 16);
  5884. *(uint32_t*)0x200000000310 = 0;
  5885. *(uint16_t*)0x200000000314 = htobe16(0x10);
  5886. *(uint16_t*)0x200000000316 = htobe16(0x20);
  5887. *(uint32_t*)0x200000000318 = htobe32(0x3f);
  5888. *(uint32_t*)0x20000000031c = htobe32(9);
  5889. STORE_BY_BITMASK(uint8_t, , 0x200000000320, 0xa, 0, 4);
  5890. STORE_BY_BITMASK(uint8_t, , 0x200000000320, 4, 4, 4);
  5891. STORE_BY_BITMASK(uint8_t, , 0x200000000321, 1, 0, 2);
  5892. STORE_BY_BITMASK(uint8_t, , 0x200000000321, 0x1f, 2, 6);
  5893. *(uint16_t*)0x200000000322 = htobe16(0x28);
  5894. *(uint16_t*)0x200000000324 = htobe16(0x67);
  5895. *(uint16_t*)0x200000000326 = htobe16(0);
  5896. *(uint8_t*)0x200000000328 = 0x97;
  5897. *(uint8_t*)0x200000000329 = 0x29;
  5898. *(uint16_t*)0x20000000032a = htobe16(0);
  5899. *(uint8_t*)0x20000000032c = 0xac;
  5900. *(uint8_t*)0x20000000032d = 0x14;
  5901. *(uint8_t*)0x20000000032e = 0x14;
  5902. *(uint8_t*)0x20000000032f = 0xbb;
  5903. *(uint32_t*)0x200000000330 = htobe32(-1);
  5904. *(uint8_t*)0x200000000334 = 1;
  5905. *(uint8_t*)0x200000000335 = 0x89;
  5906. *(uint8_t*)0x200000000336 = 0xf;
  5907. *(uint8_t*)0x200000000337 = 0x8d;
  5908. *(uint8_t*)0x200000000338 = 0xac;
  5909. *(uint8_t*)0x200000000339 = 0x1e;
  5910. *(uint8_t*)0x20000000033a = 0;
  5911. *(uint8_t*)0x20000000033b = 1;
  5912. *(uint32_t*)0x20000000033c = htobe32(0);
  5913. *(uint32_t*)0x200000000340 = htobe32(0xa010102);
  5914. *(uint8_t*)0x200000000344 = 0;
  5915. struct csum_inet csum_2;
  5916. csum_inet_init(&csum_2);
  5917. csum_inet_update(&csum_2, (const uint8_t*)0x200000000320, 40);
  5918. *(uint16_t*)0x20000000032a = csum_inet_digest(&csum_2);
  5919. res =
  5920. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x89f2, /*arg=*/0x200000000380ul);
  5921. if (res != -1)
  5922. r[130] = *(uint32_t*)0x200000000310;
  5923. memcpy((void*)0x2000000003c0,
  5924. "gre0\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  5925. *(uint64_t*)0x2000000003d0 = 0x200000000940;
  5926. memcpy((void*)0x200000000940, "syztnl0\000\000\000\000\000\000\000\000\000",
  5927. 16);
  5928. *(uint32_t*)0x200000000950 = 0;
  5929. *(uint16_t*)0x200000000954 = htobe16(0x40);
  5930. *(uint16_t*)0x200000000956 = htobe16(0x700);
  5931. *(uint32_t*)0x200000000958 = htobe32(0xfffffffc);
  5932. *(uint32_t*)0x20000000095c = htobe32(2);
  5933. STORE_BY_BITMASK(uint8_t, , 0x200000000960, 0x33, 0, 4);
  5934. STORE_BY_BITMASK(uint8_t, , 0x200000000960, 4, 4, 4);
  5935. STORE_BY_BITMASK(uint8_t, , 0x200000000961, 1, 0, 2);
  5936. STORE_BY_BITMASK(uint8_t, , 0x200000000961, 0x39, 2, 6);
  5937. *(uint16_t*)0x200000000962 = htobe16(0xcc);
  5938. *(uint16_t*)0x200000000964 = htobe16(0x68);
  5939. *(uint16_t*)0x200000000966 = htobe16(0);
  5940. *(uint8_t*)0x200000000968 = 2;
  5941. *(uint8_t*)0x200000000969 = 4;
  5942. *(uint16_t*)0x20000000096a = htobe16(0);
  5943. *(uint32_t*)0x20000000096c = htobe32(0x64010100);
  5944. *(uint32_t*)0x200000000970 = htobe32(0xe0000001);
  5945. *(uint8_t*)0x200000000974 = 0x44;
  5946. *(uint8_t*)0x200000000975 = 0xc;
  5947. *(uint8_t*)0x200000000976 = 0x35;
  5948. STORE_BY_BITMASK(uint8_t, , 0x200000000977, 1, 0, 4);
  5949. STORE_BY_BITMASK(uint8_t, , 0x200000000977, 0, 4, 4);
  5950. *(uint32_t*)0x200000000978 = htobe32(0);
  5951. *(uint32_t*)0x20000000097c = htobe32(5);
  5952. *(uint8_t*)0x200000000980 = 0x86;
  5953. *(uint8_t*)0x200000000981 = 0x57;
  5954. *(uint32_t*)0x200000000982 = htobe32(1);
  5955. *(uint8_t*)0x200000000986 = 2;
  5956. *(uint8_t*)0x200000000987 = 0xf;
  5957. memcpy((void*)0x200000000988,
  5958. "\xfe\x77\x00\xef\x32\x59\x1e\x53\xb0\x21\x09\xab\xee", 13);
  5959. *(uint8_t*)0x200000000995 = 0;
  5960. *(uint8_t*)0x200000000996 = 9;
  5961. memcpy((void*)0x200000000997, "\x7c\xa1\xad\xe9\x86\x92\x94", 7);
  5962. *(uint8_t*)0x20000000099e = 1;
  5963. *(uint8_t*)0x20000000099f = 0xb;
  5964. memcpy((void*)0x2000000009a0, "\x45\x8c\x95\x02\xd2\x28\x5d\x7f\xc9", 9);
  5965. *(uint8_t*)0x2000000009a9 = 6;
  5966. *(uint8_t*)0x2000000009aa = 0xc;
  5967. memcpy((void*)0x2000000009ab, "\xe2\x5c\x80\x66\x82\x2c\x6b\xd7\x3b\x6c", 10);
  5968. *(uint8_t*)0x2000000009b5 = 0;
  5969. *(uint8_t*)0x2000000009b6 = 0x12;
  5970. memcpy((void*)0x2000000009b7,
  5971. "\x45\x8b\xba\xbf\xac\xe4\x82\xde\xf7\x8d\xe6\xd1\x61\x05\xd8\xc2",
  5972. 16);
  5973. *(uint8_t*)0x2000000009c7 = 1;
  5974. *(uint8_t*)0x2000000009c8 = 4;
  5975. memcpy((void*)0x2000000009c9, "\xea\xef", 2);
  5976. *(uint8_t*)0x2000000009cb = 6;
  5977. *(uint8_t*)0x2000000009cc = 0xc;
  5978. memcpy((void*)0x2000000009cd, "\xbc\xe9\x07\x69\xc9\xcd\x77\x85\xe1\xe7", 10);
  5979. *(uint8_t*)0x2000000009d7 = 0x86;
  5980. *(uint8_t*)0x2000000009d8 = 0x55;
  5981. *(uint32_t*)0x2000000009d9 = htobe32(-1);
  5982. *(uint8_t*)0x2000000009dd = 1;
  5983. *(uint8_t*)0x2000000009de = 2;
  5984. *(uint8_t*)0x2000000009df = 7;
  5985. *(uint8_t*)0x2000000009e0 = 0xc;
  5986. memcpy((void*)0x2000000009e1, "\x2b\x2a\x01\xdf\x96\xc5\x3c\x8f\x29\x90", 10);
  5987. *(uint8_t*)0x2000000009eb = 2;
  5988. *(uint8_t*)0x2000000009ec = 0x10;
  5989. memcpy((void*)0x2000000009ed,
  5990. "\x6d\xc1\x2a\xa5\x18\xc0\x1b\xd0\x8b\x4f\xee\xed\x4e\xe9", 14);
  5991. *(uint8_t*)0x2000000009fb = 5;
  5992. *(uint8_t*)0x2000000009fc = 0x11;
  5993. memcpy((void*)0x2000000009fd,
  5994. "\xdc\x23\x28\xb2\xf2\xe3\xee\xd4\xda\xc3\x10\xae\xa5\xfd\x1a", 15);
  5995. *(uint8_t*)0x200000000a0c = 6;
  5996. *(uint8_t*)0x200000000a0d = 0x10;
  5997. memcpy((void*)0x200000000a0e,
  5998. "\x5b\xc1\xdd\x8e\x4a\x48\xbe\xd8\x4e\x98\x8f\xf3\x6f\xa8", 14);
  5999. *(uint8_t*)0x200000000a1c = 7;
  6000. *(uint8_t*)0x200000000a1d = 0x10;
  6001. memcpy((void*)0x200000000a1e,
  6002. "\xa4\x47\xe7\x28\x12\xe8\x71\x7a\x96\xf2\xea\x4a\xfe\x24", 14);
  6003. struct csum_inet csum_3;
  6004. csum_inet_init(&csum_3);
  6005. csum_inet_update(&csum_3, (const uint8_t*)0x200000000960, 204);
  6006. *(uint16_t*)0x20000000096a = csum_inet_digest(&csum_3);
  6007. res =
  6008. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x89f0, /*arg=*/0x2000000003c0ul);
  6009. if (res != -1)
  6010. r[131] = *(uint32_t*)0x200000000950;
  6011. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
  6012. if (res != -1)
  6013. r[132] = res;
  6014. memcpy((void*)0x200000001b40,
  6015. "sit0\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  6016. res = syscall(__NR_ioctl, /*fd=*/r[132], /*cmd=*/0x8933,
  6017. /*arg=*/0x200000001b40ul);
  6018. if (res != -1)
  6019. r[133] = *(uint32_t*)0x200000001b50;
  6020. *(uint64_t*)0x200000000380 = 0;
  6021. *(uint32_t*)0x200000000388 = 0;
  6022. *(uint64_t*)0x200000000390 = 0x200000000340;
  6023. *(uint64_t*)0x200000000340 = 0x200000001b80;
  6024. *(uint32_t*)0x200000001b80 = 0xec4;
  6025. *(uint16_t*)0x200000001b84 = 0x64;
  6026. *(uint16_t*)0x200000001b86 = 1;
  6027. *(uint32_t*)0x200000001b88 = 0;
  6028. *(uint32_t*)0x200000001b8c = 0;
  6029. *(uint8_t*)0x200000001b90 = 0;
  6030. *(uint8_t*)0x200000001b91 = 0;
  6031. *(uint16_t*)0x200000001b92 = 0;
  6032. *(uint32_t*)0x200000001b94 = r[133];
  6033. *(uint16_t*)0x200000001b98 = 0;
  6034. *(uint16_t*)0x200000001b9a = 0;
  6035. *(uint16_t*)0x200000001b9c = 0;
  6036. *(uint16_t*)0x200000001b9e = 4;
  6037. *(uint16_t*)0x200000001ba0 = 0;
  6038. *(uint16_t*)0x200000001ba2 = 0;
  6039. *(uint16_t*)0x200000001ba4 = 0xc;
  6040. *(uint16_t*)0x200000001ba6 = 1;
  6041. memcpy((void*)0x200000001ba8, "tcindex\000", 8);
  6042. *(uint16_t*)0x200000001bb0 = 0x24;
  6043. *(uint16_t*)0x200000001bb2 = 2;
  6044. *(uint16_t*)0x200000001bb4 = 8;
  6045. *(uint16_t*)0x200000001bb6 = 3;
  6046. *(uint32_t*)0x200000001bb8 = 0;
  6047. *(uint16_t*)0x200000001bbc = 8;
  6048. *(uint16_t*)0x200000001bbe = 1;
  6049. *(uint32_t*)0x200000001bc0 = 0;
  6050. *(uint16_t*)0x200000001bc4 = 8;
  6051. *(uint16_t*)0x200000001bc6 = 5;
  6052. *(uint16_t*)0x200000001bc8 = 0;
  6053. *(uint16_t*)0x200000001bca = 0;
  6054. *(uint16_t*)0x200000001bcc = 8;
  6055. *(uint16_t*)0x200000001bce = 1;
  6056. *(uint32_t*)0x200000001bd0 = 0;
  6057. *(uint16_t*)0x200000001bd4 = 0xa;
  6058. *(uint16_t*)0x200000001bd6 = 1;
  6059. memcpy((void*)0x200000001bd8, "rsvp6\000", 6);
  6060. *(uint16_t*)0x200000001be0 = 0xe64;
  6061. *(uint16_t*)0x200000001be2 = 2;
  6062. *(uint16_t*)0x200000001be4 = 0xe60;
  6063. *(uint16_t*)0x200000001be6 = 6;
  6064. *(uint16_t*)0x200000001be8 = 0x124;
  6065. STORE_BY_BITMASK(uint16_t, , 0x200000001bea, 0, 0, 14);
  6066. STORE_BY_BITMASK(uint16_t, , 0x200000001beb, 0, 6, 1);
  6067. STORE_BY_BITMASK(uint16_t, , 0x200000001beb, 0, 7, 1);
  6068. *(uint16_t*)0x200000001bec = 8;
  6069. *(uint16_t*)0x200000001bee = 1;
  6070. memcpy((void*)0x200000001bf0, "nat\000", 4);
  6071. *(uint16_t*)0x200000001bf4 = 0x54;
  6072. STORE_BY_BITMASK(uint16_t, , 0x200000001bf6, 2, 0, 14);
  6073. STORE_BY_BITMASK(uint16_t, , 0x200000001bf7, 0, 6, 1);
  6074. STORE_BY_BITMASK(uint16_t, , 0x200000001bf7, 1, 7, 1);
  6075. *(uint16_t*)0x200000001bf8 = 0x28;
  6076. *(uint16_t*)0x200000001bfa = 1;
  6077. *(uint32_t*)0x200000001bfc = 0;
  6078. *(uint32_t*)0x200000001c00 = 0;
  6079. *(uint32_t*)0x200000001c04 = 0;
  6080. *(uint32_t*)0x200000001c08 = 0;
  6081. *(uint32_t*)0x200000001c0c = 0;
  6082. *(uint8_t*)0x200000001c10 = 0xac;
  6083. *(uint8_t*)0x200000001c11 = 0x14;
  6084. *(uint8_t*)0x200000001c12 = 0x14;
  6085. *(uint8_t*)0x200000001c13 = 0xaa;
  6086. *(uint32_t*)0x200000001c14 = htobe32(0xe0000001);
  6087. *(uint32_t*)0x200000001c18 = htobe32(0);
  6088. *(uint32_t*)0x200000001c1c = 0;
  6089. *(uint16_t*)0x200000001c20 = 0x28;
  6090. *(uint16_t*)0x200000001c22 = 1;
  6091. *(uint32_t*)0x200000001c24 = 0;
  6092. *(uint32_t*)0x200000001c28 = 0;
  6093. *(uint32_t*)0x200000001c2c = 0;
  6094. *(uint32_t*)0x200000001c30 = 0;
  6095. *(uint32_t*)0x200000001c34 = 0;
  6096. *(uint32_t*)0x200000001c38 = htobe32(0);
  6097. *(uint32_t*)0x200000001c3c = htobe32(-1);
  6098. *(uint32_t*)0x200000001c40 = htobe32(0);
  6099. *(uint32_t*)0x200000001c44 = 0;
  6100. *(uint16_t*)0x200000001c48 = 0xa9;
  6101. *(uint16_t*)0x200000001c4a = 6;
  6102. memcpy((void*)0x200000001c4c,
  6103. "\x7f\x55\xdb\xe4\xf0\x61\x52\x21\xd8\x96\xfe\x3e\xfa\x06\x3c\x44\xe9"
  6104. "\x1e\xd3\x68\x14\x75\xce\xc0\xa7\x42\x2b\x98\xa3\xd4\xcd\x1d\xdc\x31"
  6105. "\x9a\x99\xc1\x5c\x37\xb5\x70\xed\xbc\xb5\x3f\x30\x49\xf3\x39\x53\x17"
  6106. "\xc7\x8b\xef\x16\x3d\xcb\x2b\x4c\x62\xfd\x86\x6d\x04\xf2\xd8\xd4\xf1"
  6107. "\x97\xb0\xbf\x2f\x1c\xee\xf3\xa5\xb1\xf7\x2a\x04\x7b\xe6\x82\xb7\x52"
  6108. "\x71\xb9\x32\xbd\xaa\xfb\x03\x87\xb3\xce\x7b\x9f\x55\xae\xa4\x9d\x9c"
  6109. "\xba\xf5\x6c\x29\xf1\x8a\x3d\x85\x9b\xc4\x4e\xda\x6d\x73\xc5\x51\x9c"
  6110. "\x7a\x56\x25\x46\x53\xf8\xd8\x91\x5e\x58\x18\xac\x43\x2e\x25\xe1\x88"
  6111. "\x8f\xf1\x36\x91\xd1\x95\x65\xd4\xdc\x99\x0c\x4e\x4c\xdb\x2b\x58\x0c"
  6112. "\xac\xcf\xdc\x71\x2b\x24\x2e\x62\x19\xd8\xc5\x83",
  6113. 165);
  6114. *(uint16_t*)0x200000001cf4 = 0xc;
  6115. *(uint16_t*)0x200000001cf6 = 7;
  6116. *(uint32_t*)0x200000001cf8 = 0;
  6117. *(uint32_t*)0x200000001cfc = 0;
  6118. *(uint16_t*)0x200000001d00 = 0xc;
  6119. *(uint16_t*)0x200000001d02 = 8;
  6120. *(uint32_t*)0x200000001d04 = 0;
  6121. *(uint32_t*)0x200000001d08 = 0;
  6122. *(uint16_t*)0x200000001d0c = 0x190;
  6123. STORE_BY_BITMASK(uint16_t, , 0x200000001d0e, 0, 0, 14);
  6124. STORE_BY_BITMASK(uint16_t, , 0x200000001d0f, 0, 6, 1);
  6125. STORE_BY_BITMASK(uint16_t, , 0x200000001d0f, 0, 7, 1);
  6126. *(uint16_t*)0x200000001d10 = 9;
  6127. *(uint16_t*)0x200000001d12 = 1;
  6128. memcpy((void*)0x200000001d14, "gact\000", 5);
  6129. *(uint16_t*)0x200000001d1c = 0x64;
  6130. STORE_BY_BITMASK(uint16_t, , 0x200000001d1e, 2, 0, 14);
  6131. STORE_BY_BITMASK(uint16_t, , 0x200000001d1f, 0, 6, 1);
  6132. STORE_BY_BITMASK(uint16_t, , 0x200000001d1f, 1, 7, 1);
  6133. *(uint16_t*)0x200000001d20 = 0x18;
  6134. *(uint16_t*)0x200000001d22 = 2;
  6135. *(uint32_t*)0x200000001d24 = 0;
  6136. *(uint32_t*)0x200000001d28 = 0;
  6137. *(uint32_t*)0x200000001d2c = 0;
  6138. *(uint32_t*)0x200000001d30 = 0;
  6139. *(uint32_t*)0x200000001d34 = 0;
  6140. *(uint16_t*)0x200000001d38 = 0x18;
  6141. *(uint16_t*)0x200000001d3a = 2;
  6142. *(uint32_t*)0x200000001d3c = 0;
  6143. *(uint32_t*)0x200000001d40 = 0;
  6144. *(uint32_t*)0x200000001d44 = 0;
  6145. *(uint32_t*)0x200000001d48 = 0;
  6146. *(uint32_t*)0x200000001d4c = 0;
  6147. *(uint16_t*)0x200000001d50 = 0x18;
  6148. *(uint16_t*)0x200000001d52 = 2;
  6149. *(uint32_t*)0x200000001d54 = 0;
  6150. *(uint32_t*)0x200000001d58 = 0;
  6151. *(uint32_t*)0x200000001d5c = 0;
  6152. *(uint32_t*)0x200000001d60 = 0;
  6153. *(uint32_t*)0x200000001d64 = 0;
  6154. *(uint16_t*)0x200000001d68 = 0x18;
  6155. *(uint16_t*)0x200000001d6a = 2;
  6156. *(uint32_t*)0x200000001d6c = 0;
  6157. *(uint32_t*)0x200000001d70 = 0;
  6158. *(uint32_t*)0x200000001d74 = 0;
  6159. *(uint32_t*)0x200000001d78 = 0;
  6160. *(uint32_t*)0x200000001d7c = 0;
  6161. *(uint16_t*)0x200000001d80 = 0x101;
  6162. *(uint16_t*)0x200000001d82 = 6;
  6163. memcpy((void*)0x200000001d84,
  6164. "\x9f\xcf\x28\x83\xff\xf3\x70\x4c\xca\xa4\x9c\x8f\xc8\x6e\xf5\xd7\x08"
  6165. "\x03\xbc\x93\xf6\xf9\x13\xd0\x43\xff\xd1\x2c\xb9\x87\xc6\xc7\xa8\x28"
  6166. "\x81\x27\xd1\x5b\x8c\xe7\x9b\x75\x6e\x56\x2a\xf0\x83\x81\x82\x7b\xd0"
  6167. "\x1e\xc5\x07\x89\xbd\x26\x4c\x1c\x39\x64\xf9\x62\x7a\x8f\x9f\x6c\x3b"
  6168. "\xbf\x31\x50\x2d\xc5\x78\x1d\xfe\x7b\x3d\x7f\xd7\xb6\xc9\x6b\xbb\xb4"
  6169. "\xe0\x4f\x39\xa6\xa2\xb0\x5c\xc4\x98\x8d\x5a\x5a\x6d\xed\x70\x1d\xbc"
  6170. "\xbd\x08\x96\xdd\xb2\x16\xcc\x26\x87\x5e\xc7\x4a\xfa\xab\xe4\x88\x74"
  6171. "\xdd\x09\x06\xb5\x80\xfc\x92\x38\xc2\x01\xe8\x27\x39\x74\x6d\xe3\xbd"
  6172. "\x36\x82\xc5\x79\x1c\x3c\xc5\xe8\x97\x5c\xc7\x68\xb4\x18\xd3\xb6\x3f"
  6173. "\x23\x56\x3c\x24\x3e\x9e\x55\x4e\xa4\x65\x2f\xd7\x93\x47\x78\xca\x69"
  6174. "\x9b\xcb\x17\xe7\x66\x22\x5a\xef\xde\xbf\x20\x7d\xb5\xb5\xa1\xbe\x5b"
  6175. "\x92\xbd\x99\x08\x0a\x95\xb4\x73\x35\x9f\x62\xb0\x78\xd8\x7d\xb1\xa2"
  6176. "\x5d\x33\xaf\x09\x70\xee\x94\x41\xca\x08\x99\x7d\xdc\x80\xd4\xcb\x87"
  6177. "\x58\xd4\x7d\x16\xdd\x63\x2f\x0e\x1a\x28\x7e\x2a\x8e\x2e\x33\x64\x2c"
  6178. "\x1b\xe0\x1f\x7e\xe9\xfd\xe1\xc0\x9e\xbe\x67\x8a\x95\x31\x20",
  6179. 253);
  6180. *(uint16_t*)0x200000001e84 = 0xc;
  6181. *(uint16_t*)0x200000001e86 = 7;
  6182. *(uint32_t*)0x200000001e88 = 0;
  6183. *(uint32_t*)0x200000001e8c = 0;
  6184. *(uint16_t*)0x200000001e90 = 0xc;
  6185. *(uint16_t*)0x200000001e92 = 8;
  6186. *(uint32_t*)0x200000001e94 = 0;
  6187. *(uint32_t*)0x200000001e98 = 0;
  6188. *(uint16_t*)0x200000001e9c = 0xac;
  6189. STORE_BY_BITMASK(uint16_t, , 0x200000001e9e, 0, 0, 14);
  6190. STORE_BY_BITMASK(uint16_t, , 0x200000001e9f, 0, 6, 1);
  6191. STORE_BY_BITMASK(uint16_t, , 0x200000001e9f, 0, 7, 1);
  6192. *(uint16_t*)0x200000001ea0 = 8;
  6193. *(uint16_t*)0x200000001ea2 = 1;
  6194. memcpy((void*)0x200000001ea4, "nat\000", 4);
  6195. *(uint16_t*)0x200000001ea8 = 0x54;
  6196. STORE_BY_BITMASK(uint16_t, , 0x200000001eaa, 2, 0, 14);
  6197. STORE_BY_BITMASK(uint16_t, , 0x200000001eab, 0, 6, 1);
  6198. STORE_BY_BITMASK(uint16_t, , 0x200000001eab, 1, 7, 1);
  6199. *(uint16_t*)0x200000001eac = 0x28;
  6200. *(uint16_t*)0x200000001eae = 1;
  6201. *(uint32_t*)0x200000001eb0 = 0;
  6202. *(uint32_t*)0x200000001eb4 = 0;
  6203. *(uint32_t*)0x200000001eb8 = 0;
  6204. *(uint32_t*)0x200000001ebc = 0;
  6205. *(uint32_t*)0x200000001ec0 = 0;
  6206. *(uint32_t*)0x200000001ec4 = htobe32(0xe0000001);
  6207. *(uint8_t*)0x200000001ec8 = 0xac;
  6208. *(uint8_t*)0x200000001ec9 = 0x14;
  6209. *(uint8_t*)0x200000001eca = 0x14;
  6210. *(uint8_t*)0x200000001ecb = 0xbb;
  6211. *(uint32_t*)0x200000001ecc = htobe32(0);
  6212. *(uint32_t*)0x200000001ed0 = 0;
  6213. *(uint16_t*)0x200000001ed4 = 0x28;
  6214. *(uint16_t*)0x200000001ed6 = 1;
  6215. *(uint32_t*)0x200000001ed8 = 0;
  6216. *(uint32_t*)0x200000001edc = 0;
  6217. *(uint32_t*)0x200000001ee0 = 0;
  6218. *(uint32_t*)0x200000001ee4 = 0;
  6219. *(uint32_t*)0x200000001ee8 = 0;
  6220. *(uint32_t*)0x200000001eec = htobe32(0xe0000001);
  6221. *(uint8_t*)0x200000001ef0 = 0xac;
  6222. *(uint8_t*)0x200000001ef1 = 0x14;
  6223. *(uint8_t*)0x200000001ef2 = 0x14;
  6224. *(uint8_t*)0x200000001ef3 = 0;
  6225. *(uint32_t*)0x200000001ef4 = htobe32(0);
  6226. *(uint32_t*)0x200000001ef8 = 0;
  6227. *(uint16_t*)0x200000001efc = 0x31;
  6228. *(uint16_t*)0x200000001efe = 6;
  6229. memcpy((void*)0x200000001f00,
  6230. "\x72\xad\x1f\x5d\xa6\x46\x30\x4a\xed\x9d\xf0\xef\x31\x30\x4a\x92\xc8"
  6231. "\xc6\x16\xee\x53\xeb\xf1\x3e\x60\x2e\xff\x93\x15\x5d\xe0\x7b\x07\xaa"
  6232. "\x33\x77\xf0\xf7\x8a\x47\xd6\x0b\xbc\x8d\x94",
  6233. 45);
  6234. *(uint16_t*)0x200000001f30 = 0xc;
  6235. *(uint16_t*)0x200000001f32 = 7;
  6236. *(uint32_t*)0x200000001f34 = 0;
  6237. *(uint32_t*)0x200000001f38 = 0;
  6238. *(uint16_t*)0x200000001f3c = 0xc;
  6239. *(uint16_t*)0x200000001f3e = 8;
  6240. *(uint32_t*)0x200000001f40 = 0;
  6241. *(uint32_t*)0x200000001f44 = 0;
  6242. *(uint16_t*)0x200000001f48 = 0x130;
  6243. STORE_BY_BITMASK(uint16_t, , 0x200000001f4a, 0, 0, 14);
  6244. STORE_BY_BITMASK(uint16_t, , 0x200000001f4b, 0, 6, 1);
  6245. STORE_BY_BITMASK(uint16_t, , 0x200000001f4b, 0, 7, 1);
  6246. *(uint16_t*)0x200000001f4c = 0xb;
  6247. *(uint16_t*)0x200000001f4e = 1;
  6248. memcpy((void*)0x200000001f50, "mirred\000", 7);
  6249. *(uint16_t*)0x200000001f58 = 0xc4;
  6250. STORE_BY_BITMASK(uint16_t, , 0x200000001f5a, 2, 0, 14);
  6251. STORE_BY_BITMASK(uint16_t, , 0x200000001f5b, 0, 6, 1);
  6252. STORE_BY_BITMASK(uint16_t, , 0x200000001f5b, 1, 7, 1);
  6253. *(uint16_t*)0x200000001f5c = 0x20;
  6254. *(uint16_t*)0x200000001f5e = 2;
  6255. *(uint32_t*)0x200000001f60 = 0;
  6256. *(uint32_t*)0x200000001f64 = 0;
  6257. *(uint32_t*)0x200000001f68 = 0;
  6258. *(uint32_t*)0x200000001f6c = 0;
  6259. *(uint32_t*)0x200000001f70 = 0;
  6260. *(uint32_t*)0x200000001f74 = 0;
  6261. *(uint32_t*)0x200000001f78 = 0;
  6262. *(uint16_t*)0x200000001f7c = 0x20;
  6263. *(uint16_t*)0x200000001f7e = 2;
  6264. *(uint32_t*)0x200000001f80 = 0;
  6265. *(uint32_t*)0x200000001f84 = 0;
  6266. *(uint32_t*)0x200000001f88 = 0;
  6267. *(uint32_t*)0x200000001f8c = 0;
  6268. *(uint32_t*)0x200000001f90 = 0;
  6269. *(uint32_t*)0x200000001f94 = 0;
  6270. *(uint32_t*)0x200000001f98 = 0;
  6271. *(uint16_t*)0x200000001f9c = 0x20;
  6272. *(uint16_t*)0x200000001f9e = 2;
  6273. *(uint32_t*)0x200000001fa0 = 0;
  6274. *(uint32_t*)0x200000001fa4 = 0;
  6275. *(uint32_t*)0x200000001fa8 = 0;
  6276. *(uint32_t*)0x200000001fac = 0;
  6277. *(uint32_t*)0x200000001fb0 = 0;
  6278. *(uint32_t*)0x200000001fb4 = 0;
  6279. *(uint32_t*)0x200000001fb8 = 0;
  6280. *(uint16_t*)0x200000001fbc = 0x20;
  6281. *(uint16_t*)0x200000001fbe = 2;
  6282. *(uint32_t*)0x200000001fc0 = 0;
  6283. *(uint32_t*)0x200000001fc4 = 0;
  6284. *(uint32_t*)0x200000001fc8 = 0;
  6285. *(uint32_t*)0x200000001fcc = 0;
  6286. *(uint32_t*)0x200000001fd0 = 0;
  6287. *(uint32_t*)0x200000001fd4 = 0;
  6288. *(uint32_t*)0x200000001fd8 = 0;
  6289. *(uint16_t*)0x200000001fdc = 0x20;
  6290. *(uint16_t*)0x200000001fde = 2;
  6291. *(uint32_t*)0x200000001fe0 = 0;
  6292. *(uint32_t*)0x200000001fe4 = 0;
  6293. *(uint32_t*)0x200000001fe8 = 0;
  6294. *(uint32_t*)0x200000001fec = 0;
  6295. *(uint32_t*)0x200000001ff0 = 0;
  6296. *(uint32_t*)0x200000001ff4 = 0;
  6297. *(uint32_t*)0x200000001ff8 = 0;
  6298. *(uint16_t*)0x200000001ffc = 0x20;
  6299. *(uint16_t*)0x200000001ffe = 2;
  6300. *(uint32_t*)0x200000002000 = 0;
  6301. *(uint32_t*)0x200000002004 = 0;
  6302. *(uint32_t*)0x200000002008 = 0;
  6303. *(uint32_t*)0x20000000200c = 5;
  6304. *(uint32_t*)0x200000002010 = 0;
  6305. *(uint32_t*)0x200000002014 = 0;
  6306. *(uint32_t*)0x200000002018 = 0;
  6307. *(uint16_t*)0x20000000201c = 0x41;
  6308. *(uint16_t*)0x20000000201e = 6;
  6309. memcpy((void*)0x200000002020,
  6310. "\x0d\x75\x58\xfa\x48\x39\x43\x00\x9c\xc3\xd0\x54\x1d\x5d\x1b\x78\x98"
  6311. "\xe6\x29\xd0\xe4\xb3\x04\xb3\x96\x90\x40\xef\x8d\xfd\xc5\x5e\x79\xa8"
  6312. "\x72\xfc\xa1\xc2\x8b\xf2\x38\x16\x04\xad\xa9\x2f\x70\x65\x6d\x4c\x89"
  6313. "\x4d\x2c\xce\x1a\xe9\x3d\x61\x66\x43\x13",
  6314. 61);
  6315. *(uint16_t*)0x200000002060 = 0xc;
  6316. *(uint16_t*)0x200000002062 = 7;
  6317. *(uint32_t*)0x200000002064 = 0;
  6318. *(uint32_t*)0x200000002068 = 0;
  6319. *(uint16_t*)0x20000000206c = 0xc;
  6320. *(uint16_t*)0x20000000206e = 8;
  6321. *(uint32_t*)0x200000002070 = 0;
  6322. *(uint32_t*)0x200000002074 = 0;
  6323. *(uint16_t*)0x200000002078 = 0x9cc;
  6324. STORE_BY_BITMASK(uint16_t, , 0x20000000207a, 0, 0, 14);
  6325. STORE_BY_BITMASK(uint16_t, , 0x20000000207b, 0, 6, 1);
  6326. STORE_BY_BITMASK(uint16_t, , 0x20000000207b, 0, 7, 1);
  6327. *(uint16_t*)0x20000000207c = 0xb;
  6328. *(uint16_t*)0x20000000207e = 1;
  6329. memcpy((void*)0x200000002080, "skbmod\000", 7);
  6330. *(uint16_t*)0x200000002088 = 4;
  6331. STORE_BY_BITMASK(uint16_t, , 0x20000000208a, 2, 0, 14);
  6332. STORE_BY_BITMASK(uint16_t, , 0x20000000208b, 0, 6, 1);
  6333. STORE_BY_BITMASK(uint16_t, , 0x20000000208b, 1, 7, 1);
  6334. *(uint16_t*)0x20000000208c = 0x99d;
  6335. *(uint16_t*)0x20000000208e = 6;
  6336. memcpy(
  6337. (void*)0x200000002090,
  6338. "\x91\x44\x10\xc3\x14\x2f\x4b\x77\x1a\x94\x34\xcc\x0f\x95\xe7\x04\x01\xb8"
  6339. "\x48\xb6\x22\xff\x33\x17\x89\x14\x27\x49\x2c\x39\x12\xa8\x31\x5a\xce\xdc"
  6340. "\xfb\x38\xe3\x96\x1c\x96\x20\x11\x76\xf4\x3b\x00\x35\xc0\x65\xf0\x1b\x1f"
  6341. "\x4f\x3f\x06\x1f\xe8\x29\xa0\xdf\xbb\x01\x4a\xcd\xd4\x3c\x0d\x31\x51\x01"
  6342. "\xf0\x89\x7d\xfe\x91\x57\x4a\xcf\x5b\x86\xe0\x96\x12\x4c\x50\x65\x0f\xce"
  6343. "\x68\x28\x0c\x58\xd5\x6e\xc8\x50\x7a\xf5\x95\xd9\x8c\xa6\xf4\x48\x97\xbb"
  6344. "\x7c\x58\xe9\x44\x62\x91\x23\xd9\x6f\x22\xac\x0b\xd6\x6d\x1b\x95\x2c\xdf"
  6345. "\x47\x5b\x84\xb2\xa7\xab\x6f\xa7\xbc\xec\x0e\x72\x45\x55\x90\x2a\x25\x49"
  6346. "\x2c\xd4\x08\x47\x97\x15\x0c\x5e\xf3\x05\x15\x45\x62\x1a\x78\xab\xd9\xff"
  6347. "\x86\xc8\x82\x05\xe6\xdf\x41\x33\x76\x8e\x82\x71\xc6\x34\x35\x51\x52\x93"
  6348. "\xcd\xdd\x75\xe0\x96\xe9\x28\x67\x2d\x99\xc6\x30\xb2\x85\xc3\x9e\xc1\xf0"
  6349. "\xc5\x6e\x66\xb6\x7e\xb4\x38\x26\x72\xc8\xde\x49\x56\x98\x16\x4c\x19\xde"
  6350. "\x6d\x2a\xcb\x8c\xdb\xa3\x40\x6d\xb2\x48\x68\xba\xe0\xfc\x93\xa1\xa6\x79"
  6351. "\x85\xc0\x40\x96\x8c\x05\x92\x36\x1e\x5e\xcc\x0d\xde\xda\x42\x2e\x37\x66"
  6352. "\x12\x75\x58\xcd\x30\xbc\xf6\xc5\xd7\xd2\x33\x39\xc2\x28\xdf\x7f\xb1\xe4"
  6353. "\x5b\x5d\x29\xfc\x28\x1f\x9a\x1f\xad\x68\xc7\x9d\x11\x10\xe6\x16\x84\x21"
  6354. "\x90\x56\x59\x8f\xbd\xb3\x55\xb3\x36\x97\xda\x47\xb0\x00\x02\x58\x4c\x72"
  6355. "\x5f\xf7\x53\x86\x50\x3e\xbd\x9b\x1a\xb4\x52\x17\x3f\x31\xc9\x0d\xac\x89"
  6356. "\x24\x20\x7d\xc1\xe6\xb5\x66\xdf\x35\x52\x89\x9e\x85\xb1\xa7\xa3\x31\x3b"
  6357. "\x54\x26\x81\xf0\xae\x5d\x10\x03\x66\xdb\x60\xa9\x85\xc5\x09\x3d\x18\xcc"
  6358. "\x32\x6a\x44\xd8\x70\x4f\xc8\x02\xc9\xf7\x2c\x54\x33\xe5\xc5\xd7\xd9\x68"
  6359. "\xce\x9c\xc6\x4d\x43\x17\xe0\x8d\x96\x53\xd5\xc3\x37\x8e\x94\xd0\x0e\x68"
  6360. "\x3c\xd0\x49\x9a\x28\x15\x8c\x62\x0c\x79\x0d\xfe\x93\x01\x47\x10\x0a\x60"
  6361. "\x6f\x70\x44\x38\xe3\xc2\x8f\x9d\xad\x21\x8e\x57\x93\x77\x0a\xb2\x79\xd6"
  6362. "\xe1\xee\x0c\xdc\xbd\x0e\x58\x5e\xb0\x17\x36\x20\x6e\x68\x48\xa8\x75\xb7"
  6363. "\xd3\x8f\x36\xe4\x00\xba\x7a\xee\x0e\x68\x74\xa3\xf2\xc1\x78\xec\xc8\xc3"
  6364. "\x3b\x85\xc1\x1a\x8b\xc4\xd1\xf6\x4d\x1f\x4f\x42\xad\x92\x4e\x0a\x2e\xa6"
  6365. "\x8c\x09\x6b\x6a\xf0\x29\x05\x84\x16\x3c\x0f\x74\xd4\x5b\xf2\xf7\x01\x41"
  6366. "\x4a\xd5\xe9\xeb\x2d\x8c\x1f\xd9\x32\x60\x51\x08\x9c\x2e\x74\x22\xed\x2b"
  6367. "\x14\xab\x97\x26\x0a\x7b\xb0\xb0\xa4\x14\x18\xe9\x79\x8d\xa6\x69\x0f\x0d"
  6368. "\x41\xd6\xfe\x41\xbe\x78\xef\x09\x97\x6e\xb1\x9d\xbc\xd7\xdb\x0a\xbc\x49"
  6369. "\x3e\x35\x73\xe3\x89\x14\xba\x11\x56\x84\x90\x41\xed\x39\x56\x82\x7c\x07"
  6370. "\x9e\xc8\xf7\x8b\xb1\x01\xf0\xea\xa0\x62\xe4\x2e\x14\x7c\xbb\xe0\xc4\xbc"
  6371. "\xd0\x4a\x21\x72\x56\x7b\x75\x2c\xaa\x45\x5d\x55\x47\x1a\xe2\x95\x74\xbc"
  6372. "\xd2\x7c\xb3\x6f\xba\xb6\xbc\xbe\xf2\xf7\x08\x67\x93\xa8\x60\xa7\xc5\x3d"
  6373. "\x55\xa1\xe0\x5a\xb4\x70\x12\x83\xf8\xfa\x5d\x98\xd4\x27\x8d\x17\x7b\xe2"
  6374. "\x6d\xfa\x7a\x45\x91\x01\x4d\x78\xd7\x46\x7e\xb1\x72\x25\x02\x3e\xae\x7d"
  6375. "\xfa\xaf\x48\xf8\xd1\x93\x68\xfc\x51\x9a\x94\x5e\x7b\xfe\x87\x10\x00\xd8"
  6376. "\x67\x55\x30\xca\xf7\x25\xcf\xf6\x0f\xdf\x02\xbd\xef\xf7\x7f\xa0\xcf\xe0"
  6377. "\x20\x41\x26\x5b\xe3\xa1\xb5\x49\xb4\x4d\xa6\x48\xd2\xb2\x78\x57\xac\xab"
  6378. "\x39\x98\x90\x43\xb1\xe3\xf0\xd6\x28\x96\x84\x3b\x47\xbc\xfe\x76\x73\x1f"
  6379. "\x97\x38\x6b\xf8\x71\xcf\x8d\xd1\x19\x62\x21\x73\x68\x7c\x17\xb6\xd9\xe5"
  6380. "\x1f\x3a\x05\x80\x0e\x81\xaf\x53\x43\x7d\x2f\xef\x3c\x96\x3d\x56\x60\xd9"
  6381. "\xd6\x42\x74\xc0\x63\x6b\x5c\xf4\xc0\x55\x2b\x85\xf4\x1f\xe5\x11\x0e\x0b"
  6382. "\x0c\x15\x93\x42\x44\x5e\x56\xbd\x00\x74\x4f\x65\x05\xde\x57\xdf\x44\x25"
  6383. "\x1e\x47\x33\xb4\x9e\xdd\x8b\x14\x10\x05\x56\xb0\x4c\x1e\xc8\x87\x64\xb7"
  6384. "\xad\xfc\xb6\xf0\x7e\xdc\x9e\x6a\x10\x4e\xb2\xfc\xfd\x16\x01\x2d\xd0\xe2"
  6385. "\x88\x0e\x3e\xbd\x27\xc3\x98\x90\xdb\x33\x18\xd7\xc9\xf7\xa3\x6c\x49\xeb"
  6386. "\x9c\xba\x81\xa7\x1d\x54\xab\x18\xa4\x54\xab\x5b\x29\xb9\xb3\x71\x16\x0a"
  6387. "\xb5\x0e\xdb\x80\xe5\x7a\x0c\xcb\xc6\xa3\xd5\x77\x19\x98\xbe\xed\x38\x1d"
  6388. "\x5b\x1a\xf1\x8c\x39\xba\xa2\x64\x70\x15\xdb\x44\x6c\xbd\x8f\x28\xae\xdd"
  6389. "\x56\x39\x7d\x88\xaf\xcd\x5c\xd0\x33\x17\x85\x83\xcf\xa3\xd2\xf0\xe6\xe9"
  6390. "\xf3\x15\x5c\x30\x02\xd1\x96\x56\x44\x10\x9f\x82\xd6\xe8\x84\xfd\xee\x36"
  6391. "\x6d\x10\xdc\xce\x30\x90\x74\x7d\xea\xd8\x34\x27\xac\x35\x28\x33\xd0\xf0"
  6392. "\xef\x98\xe2\xea\x39\x53\xb0\x17\x86\x7b\x21\x8e\xb6\x74\xe4\x98\xff\xbc"
  6393. "\x6f\x8d\x38\xcf\xec\x66\x07\xe9\x72\x84\xa6\x37\xfe\xc1\x0b\x91\x56\x26"
  6394. "\x8b\x00\x82\xa4\xb1\x78\xf6\x05\xd1\xd4\xe1\x24\xc3\x90\xe4\xad\xb5\xfa"
  6395. "\x79\x68\x82\xcd\x5b\x94\xd7\xa2\xf9\xba\x05\xbc\x53\x10\xdd\x48\x72\xfb"
  6396. "\x65\xb9\x37\x87\x59\xaa\xe0\xd2\xd4\xa4\x9c\x36\x0d\xfe\x15\x2a\x03\xe6"
  6397. "\xcc\x89\xf9\x1a\x7e\x07\xe5\x36\x1f\xcf\xa9\xc9\x38\x8a\xea\xc6\xf8\xe2"
  6398. "\xa3\x16\x1b\x6b\x66\x83\xf6\x4c\x6f\xd9\x1e\x3e\xac\xe2\xb9\xb8\x88\xb8"
  6399. "\xb0\x69\x3c\xc4\x39\xc5\x65\x52\x38\x91\x61\x12\x8f\xfd\xd1\xe7\x01\x2e"
  6400. "\xb9\xf0\xbc\xbb\x6e\x8f\xc5\xc4\xf1\x0d\xb3\xc8\x5e\x2d\x83\x60\x1d\xae"
  6401. "\xe7\xfa\x9c\x40\xcf\x9a\x90\x96\xe2\x52\x82\xb3\x62\xed\x31\x27\xfa\x71"
  6402. "\xe9\x06\x14\x4c\x7d\x8c\x1d\xa1\x52\xe8\xd6\x83\xec\x13\xac\x8c\x7c\x48"
  6403. "\x01\xf2\x2f\xb2\x9f\x81\xcd\x26\xf4\xf8\xe7\xec\x1d\x79\x0d\x63\x48\x40"
  6404. "\x29\x9e\xc7\xf6\x9b\x62\xb6\xc3\x49\x18\xb1\xf7\xd4\x56\xce\xf0\x15\x28"
  6405. "\x6c\x5c\x16\x9d\x5a\xb9\x85\x49\xec\x79\xec\xb9\xcc\x72\xff\x89\x58\x3f"
  6406. "\xb4\xab\xf4\x5f\x07\xe4\x36\xc4\x38\xd5\x25\xb0\x16\x89\xc9\x8d\x8f\xdc"
  6407. "\xa4\xe2\x73\xe8\x92\x3f\x82\x0d\x7a\x3d\x2e\x02\x5d\x8f\x88\x31\xba\x75"
  6408. "\x9a\x4d\x34\x46\xd3\xb7\x81\x5f\x8b\x09\x27\x20\x01\xa1\xe7\x46\xba\xdc"
  6409. "\x24\xbf\x23\xdd\x9b\x16\x02\x2d\x77\x7d\x15\xd1\xac\x48\x79\xf3\x5b\xdc"
  6410. "\xd2\x84\xf1\x88\x48\x85\x8b\x4b\x8b\x57\x42\xc8\x9a\x25\xfe\x7a\x6c\xc1"
  6411. "\xea\x28\x45\x19\x07\xdd\xcf\x2c\x5d\x59\x29\x80\x50\xd5\xcf\x9d\x42\xc7"
  6412. "\x0e\xf3\xbc\xf5\x1f\x7e\x55\xc6\xc4\xe3\xac\x93\xef\x41\x01\xa3\x83\x5c"
  6413. "\x96\x85\xb3\xbc\x78\x3c\xdf\xce\x00\x0d\x02\x48\xbf\x3e\x78\xb2\x63\xc8"
  6414. "\x3a\x38\x0b\xf3\xe7\x6b\xb3\x76\x5b\xa3\xa9\x99\x6a\x38\x55\x03\xbd\x35"
  6415. "\x53\x5e\x23\x7a\x45\xe8\x41\x62\xae\xab\xd6\x00\x19\xbf\xde\xf2\x6f\xc7"
  6416. "\xbf\x74\x6b\xe8\x6e\xec\xa6\xd5\x78\xe8\x76\x27\x77\xa0\xfa\x96\xa1\xd0"
  6417. "\x04\x86\x85\xf9\x0c\x6a\xfd\xca\xaa\xe5\x28\xb6\xa0\x83\x7f\xa3\x04\x2b"
  6418. "\x69\x1b\xb3\x12\x40\xe1\xae\x9c\x98\xce\x54\xc4\xdb\x70\xfb\x5b\x37\x34"
  6419. "\x27\xe1\xd1\x04\xd2\xe0\xce\x65\x59\x5a\x30\x92\x04\x4d\xb2\x55\xfe\xec"
  6420. "\x45\xc1\x41\x10\xb1\xc2\xf9\x83\x72\x39\xbb\x02\x83\xa2\xc8\xa7\xf2\xe4"
  6421. "\x04\x64\x0b\x7b\x4e\xc9\xd7\x20\x7d\xf4\xb2\x70\xf2\x80\xca\x07\x15\x03"
  6422. "\x48\x32\x41\x15\xf7\x4e\x2c\xfe\xfc\x11\x36\x29\x1b\x84\x3b\xdb\x17\x37"
  6423. "\xfe\x17\x46\xcd\x65\xba\xca\xa3\x5a\x53\x50\x72\xf3\x1a\x35\x5e\xd1\xe9"
  6424. "\x18\x50\x33\x68\xcf\xc3\x60\x71\xff\x87\x2a\x65\xb3\x83\xe1\x89\x17\xaa"
  6425. "\x83\xd0\x59\xbc\x5c\x25\xaf\xf5\xba\xb3\x7f\x5b\x47\x32\x61\x7c\x0f\x37"
  6426. "\xcd\x1c\xd8\x70\xa3\x67\xa7\xbe\x52\xb4\xc5\x5d\x15\x99\x0e\x88\xa5\xbb"
  6427. "\x03\x49\xb0\x80\x77\x63\x2c\x1e\x3f\x61\x57\x1b\x0a\x38\x93\x71\xe5\xb2"
  6428. "\x1c\x79\x61\x67\x59\x94\xe0\x3c\xcd\xc3\x7b\xb5\x08\x7b\xb1\x41\x0c\xd4"
  6429. "\x46\x3b\x6b\x33\xf2\x10\xb0\x3b\x7c\x91\xbe\xce\x9e\x0e\x53\xa1\xc0\xaf"
  6430. "\xae\x9e\x08\x27\x03\xbf\xb0\x52\xe7\x56\x8d\xb1\x91\xa2\x8a\x13\xd9\x5d"
  6431. "\xf9\x55\xfd\xde\x43\x14\xb1\xa7\x77\x90\x9b\x71\xca\x19\x3d\x93\x0c\x60"
  6432. "\x19\x98\x1d\x73\x60\xa4\x38\xb8\x4d\xb7\x82\x33\x9e\xd8\x1f\xdc\x47\xb9"
  6433. "\x68\x69\x7e\xa1\xac\x14\x25\xcf\xde\x80\x84\x9a\xfd\x0d\xb4\x98\x2b\x69"
  6434. "\xea\xfd\xf9\x18\xee\x84\xcd\x31\x0d\x51\xc5\x77\x08\x18\x8c\xa1\x8e\x81"
  6435. "\xf0\x8f\x82\x27\x14\xc3\xc3\x14\xaf\x2b\xab\x6d\xaa\xa4\x09\x98\xee\x45"
  6436. "\x34\x10\x85\x56\x4d\xe1\xfe\x3b\xdd\x84\xad\xfa\x3d\xb4\x63\x21\x33\x6a"
  6437. "\x89\xe2\x2a\x3d\x2b\x29\x02\x15\xc8\x3a\x62\x45\x52\x5f\xc8\xe3\x7a\xd7"
  6438. "\x3e\xce\xfb\x47\x30\xf8\xc5\x39\x11\x99\x94\x70\x7c\xbc\xce\x0a\xb8\x8f"
  6439. "\x18\x57\x33\x04\xc9\x20\x22\x9b\x35\x60\xfb\x57\xc6\xde\x11\xa8\xe2\xe9"
  6440. "\x6d\x4d\x6f\xbc\xa5\x7e\x6d\x73\xae\x78\x82\x4a\x90\x23\x3e\xba\x1a\xf4"
  6441. "\xbc\x91\x45\x48\x5a\x06\x73\x01\xf6\x30\xef\x0d\x2a\x60\xab\x4a\xdf\xe2"
  6442. "\x3f\x26\x1b\x8f\x53\xd7\xa0\x79\x04\x13\x64\xf9\x3d\x7b\xda\x2d\x16\x2e"
  6443. "\x88\xe8\xe0\x93\xf7\x77\x38\x06\xdd\x5a\x2f\x29\xa0\x4d\x39\xfa\x03\xfa"
  6444. "\xc7\x97\x1f\xd2\x93\xae\xfb\x8c\x36\xae\xb5\xe8\x52\xa8\xf6\xe4\x28\x5a"
  6445. "\x7f\x90\xdb\x0c\xf8\x31\xa8\x53\x94\x80\xf0\x29\x1d\x9b\xa5\x4d\x97\xa9"
  6446. "\x91\x2f\x24\xbe\x39\xaa\x71\x32\x56\xb2\x4a\xfa\xec\x31\xf6\x7d\xd6\xb6"
  6447. "\xcf\xeb\x2f\x19\xa6\x1f\xbc\x1f\xe2\xb1\x6b\xb1\x80\xbc\x6b\xa9\xcc\x06"
  6448. "\x48\xfb\x30\xc4\x0c\x27\x3a\x17\x4d\x7a\xd3\x9c\xb6\xd7\xf8\x20\x88\xfa"
  6449. "\x80\x6c\xcc\x99\xa8\xcf\x19\x07\x43\xac\x23\x7d\x18\x84\xec\x73\x00\xfb"
  6450. "\x8d\x34\x56\x68\x77\xf8\x4e\x8c\x63\xbe\xaa\x51\xfc\xaf\xf3\x30\x9e\x15"
  6451. "\x02\xec\x0f\xde\xf5\xae\x0c\xed\x65\x7e\xde\xe1\xaf\x16\x15\xf0\xc6\xa3"
  6452. "\x03\xe1\x07\x21\xb1\x7e\x01\x07\x99\xfd\x70\xff\x6f\x89\x26\x23\x64\x9a"
  6453. "\xc3\x48\x3d\x98\x28\x2b\xda\x34\x45\x77\x8f\x0f\x85\xda\x32\xbd\xcc\x80"
  6454. "\xcc\xb1\x13\x8a\x90\xee\x07\x4d\xc2\xea\x43\x27\x45\xff\xbc\xd1\x59\x5f"
  6455. "\x72\xba\x0a\xeb\x41\x21\x2c\x97\xff\x37\x7a\xc4\x7b\xcb\x7d\xd2\x39\x36"
  6456. "\x09\x47\xf2\xb9\xa2\x7b\x72\x75\x8a\xaf\xdd\x0e\x68\xee\x24\x71\x2d\x10"
  6457. "\x05\xaa\x86\x9a\x7a\x6b\x02\x47\xf2\xd6\xd7\xd6\xfd\x7d\x4a\x71\xe4\xa9"
  6458. "\xf0\x76\xa0\x87\x6f\x0a\xf9\xab\xfa\x1a\x8f\xf4\x04\xb2\xf9\xf9\x0a\x96"
  6459. "\x1f\xb3\xef\x81\x4b\x9f\x2e\xda\xe0\x5d\x09\x46\xe5\x83\x05\x2b\x19\x99"
  6460. "\x4b\xd0\x19\xd1\x44\xa1\x69\x0d\xca\xb6\xdc\x3a\x3c\xf4\x73\xcd\x1c\x1d"
  6461. "\xb1\xc4\xc7\xd1\x90\x7b\xd9\x43\xe3\x05\xa4\x3b\x65\x67\x74\x4e\x99\x50"
  6462. "\x11\xb6\xf2\x9d\xaf\xaa\xcf\xae\x9b\x6d\x61\xee\x85\xb1\xec\xeb\xef\x5d"
  6463. "\xba\x7c\x41\xc4\x8d\xee\x92\xab\x35\x8d\xb8\x0e\x29\x81\x3b\xbe\xfe\xfb"
  6464. "\xe0\x39\x4d\x67\xc2\x5a\x4b\x3a\x71\xa3\x1a\x1d\x09\x1d\xd3\x16\x63\x30"
  6465. "\x88\xb1\xa2\x04\xc5\xf2\xd9\x41\x12\x8c\x1f\x6f\x1f\xc4\xea\x19\x23\x53"
  6466. "\xd4\xd6\xce\x50\xa3\x92\x12\x94\x86\x2c\xca\xad\x37\x47\x4b\x2d\xb7\xc1"
  6467. "\x05\xeb\x73\xe2\x61\x8b\xbb\xaf\x8c\xb6\x9f\xc4\x67\x5b\xfc\x68\xa2\x14"
  6468. "\xa7\x31\xcc\xd1\x99\x02\x10\x30\x44\x66\xd6\xd4\xf8\x7f\x9e\x08\x01\x46"
  6469. "\x80\x90\x94\x7c\xdd\xbe\xf8\x3a\x93\x10\xe5\xb1\x2f\x77\x37\xcb\x55\x0a"
  6470. "\xb3\x57\x9b\x4f\x3e\xb7\xe5\x7f\xd5\x90\xb9\x32\xa2\x03\xa7\xa5\x08\xa8"
  6471. "\xfb\x3b\x4b\xd1\x81\x55\xfe\xf4\xdb\x3a\x58\x04\x87\x1b\xdc\x63\x35\x54"
  6472. "\x69\xf3\x4a\x16\x43\x1a\x0a\xf6\x27\xd1\x51\xaa\x66\xf0\x2d\x30\x81\x14"
  6473. "\x92\x06\x45\x25\xd6\x9b\xde\x36\xe8\x0a\x53\xdd\x03\xfd\x41\x73\x6e\x9e"
  6474. "\x77\x77\x09\xce\x2c\x72\xcc\xdc\xc3",
  6475. 2457);
  6476. *(uint16_t*)0x200000002a2c = 0xc;
  6477. *(uint16_t*)0x200000002a2e = 7;
  6478. *(uint32_t*)0x200000002a30 = 0;
  6479. *(uint32_t*)0x200000002a34 = 0;
  6480. *(uint16_t*)0x200000002a38 = 0xc;
  6481. *(uint16_t*)0x200000002a3a = 8;
  6482. *(uint32_t*)0x200000002a3c = 0;
  6483. *(uint32_t*)0x200000002a40 = 0;
  6484. *(uint64_t*)0x200000000348 = 0xec4;
  6485. *(uint64_t*)0x200000000398 = 1;
  6486. *(uint64_t*)0x2000000003a0 = 0;
  6487. *(uint64_t*)0x2000000003a8 = 0;
  6488. *(uint32_t*)0x2000000003b0 = 0;
  6489. syscall(__NR_sendmsg, /*fd=*/r[132], /*msg=*/0x200000000380ul, /*f=*/0ul);
  6490. memcpy((void*)0x200000000140, "batadv_slave_0\000\000", 16);
  6491. res =
  6492. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x8933, /*arg=*/0x200000000140ul);
  6493. if (res != -1)
  6494. r[134] = *(uint32_t*)0x200000000150;
  6495. memcpy((void*)0x2000000001c0, "syztnl0\000\000\000\000\000\000\000\000\000",
  6496. 16);
  6497. *(uint64_t*)0x2000000001d0 = 0x200000000180;
  6498. memcpy((void*)0x200000000180,
  6499. "sit0\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  6500. *(uint32_t*)0x200000000190 = r[134];
  6501. *(uint16_t*)0x200000000194 = htobe16(0x700);
  6502. *(uint16_t*)0x200000000196 = htobe16(0x40);
  6503. *(uint32_t*)0x200000000198 = htobe32(0x808b);
  6504. *(uint32_t*)0x20000000019c = htobe32(0);
  6505. STORE_BY_BITMASK(uint8_t, , 0x2000000001a0, 6, 0, 4);
  6506. STORE_BY_BITMASK(uint8_t, , 0x2000000001a0, 4, 4, 4);
  6507. STORE_BY_BITMASK(uint8_t, , 0x2000000001a1, 0, 0, 2);
  6508. STORE_BY_BITMASK(uint8_t, , 0x2000000001a1, 0xa, 2, 6);
  6509. *(uint16_t*)0x2000000001a2 = htobe16(0x18);
  6510. *(uint16_t*)0x2000000001a4 = htobe16(0x64);
  6511. *(uint16_t*)0x2000000001a6 = htobe16(0);
  6512. *(uint8_t*)0x2000000001a8 = 0x33;
  6513. *(uint8_t*)0x2000000001a9 = 0x29;
  6514. *(uint16_t*)0x2000000001aa = htobe16(0);
  6515. *(uint32_t*)0x2000000001ac = htobe32(0);
  6516. *(uint32_t*)0x2000000001b0 = htobe32(0);
  6517. *(uint8_t*)0x2000000001b4 = 0x86;
  6518. *(uint8_t*)0x2000000001b5 = 2;
  6519. struct csum_inet csum_4;
  6520. csum_inet_init(&csum_4);
  6521. csum_inet_update(&csum_4, (const uint8_t*)0x2000000001a0, 24);
  6522. *(uint16_t*)0x2000000001aa = csum_inet_digest(&csum_4);
  6523. syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x89f8, /*arg=*/0x2000000001c0ul);
  6524. memcpy((void*)0x200000000400,
  6525. "team0\000\000\000\000\000\000\000\000\000\000\000", 16);
  6526. res = syscall(__NR_ioctl, /*fd=*/r[121], /*cmd=*/0x8933,
  6527. /*arg=*/0x200000000400ul);
  6528. if (res != -1)
  6529. r[135] = *(uint32_t*)0x200000000410;
  6530. *(uint64_t*)0x200000000c40 = 0x200000000080;
  6531. *(uint16_t*)0x200000000080 = 0x10;
  6532. *(uint16_t*)0x200000000082 = 0;
  6533. *(uint32_t*)0x200000000084 = 0;
  6534. *(uint32_t*)0x200000000088 = 0x2000000;
  6535. *(uint32_t*)0x200000000c48 = 0xc;
  6536. *(uint64_t*)0x200000000c50 = 0x2000000004c0;
  6537. *(uint64_t*)0x2000000004c0 = 0x200000000a40;
  6538. *(uint32_t*)0x200000000a40 = 0x1cc;
  6539. *(uint16_t*)0x200000000a44 = 0;
  6540. *(uint16_t*)0x200000000a46 = 0x400;
  6541. *(uint32_t*)0x200000000a48 = 0x70bd2b;
  6542. *(uint32_t*)0x200000000a4c = 0x25dfdbfd;
  6543. *(uint8_t*)0x200000000a50 = 0xb;
  6544. *(uint8_t*)0x200000000a51 = 0;
  6545. *(uint16_t*)0x200000000a52 = 0;
  6546. *(uint16_t*)0x200000000a54 = 0x18;
  6547. STORE_BY_BITMASK(uint16_t, , 0x200000000a56, 1, 0, 14);
  6548. STORE_BY_BITMASK(uint16_t, , 0x200000000a57, 0, 6, 1);
  6549. STORE_BY_BITMASK(uint16_t, , 0x200000000a57, 1, 7, 1);
  6550. *(uint16_t*)0x200000000a58 = 0x14;
  6551. *(uint16_t*)0x200000000a5a = 2;
  6552. memcpy((void*)0x200000000a5c, "team_slave_0\000\000\000\000", 16);
  6553. *(uint16_t*)0x200000000a6c = 0xc;
  6554. STORE_BY_BITMASK(uint16_t, , 0x200000000a6e, 1, 0, 14);
  6555. STORE_BY_BITMASK(uint16_t, , 0x200000000a6f, 0, 6, 1);
  6556. STORE_BY_BITMASK(uint16_t, , 0x200000000a6f, 1, 7, 1);
  6557. *(uint16_t*)0x200000000a70 = 8;
  6558. *(uint16_t*)0x200000000a72 = 1;
  6559. *(uint32_t*)0x200000000a74 = 0;
  6560. *(uint16_t*)0x200000000a78 = 0x48;
  6561. STORE_BY_BITMASK(uint16_t, , 0x200000000a7a, 1, 0, 14);
  6562. STORE_BY_BITMASK(uint16_t, , 0x200000000a7b, 0, 6, 1);
  6563. STORE_BY_BITMASK(uint16_t, , 0x200000000a7b, 1, 7, 1);
  6564. *(uint16_t*)0x200000000a7c = 0x14;
  6565. *(uint16_t*)0x200000000a7e = 2;
  6566. memcpy((void*)0x200000000a80,
  6567. "lo\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  6568. *(uint16_t*)0x200000000a90 = 0x14;
  6569. *(uint16_t*)0x200000000a92 = 2;
  6570. memset((void*)0x200000000a94, 0, 16);
  6571. *(uint16_t*)0x200000000aa4 = 8;
  6572. *(uint16_t*)0x200000000aa6 = 3;
  6573. *(uint32_t*)0x200000000aa8 = 2;
  6574. *(uint16_t*)0x200000000aac = 0x14;
  6575. *(uint16_t*)0x200000000aae = 2;
  6576. memcpy((void*)0x200000000ab0,
  6577. "nicvf0\000\000\000\000\000\000\000\000\000\000", 16);
  6578. *(uint16_t*)0x200000000ac0 = 0xc;
  6579. STORE_BY_BITMASK(uint16_t, , 0x200000000ac2, 1, 0, 14);
  6580. STORE_BY_BITMASK(uint16_t, , 0x200000000ac3, 0, 6, 1);
  6581. STORE_BY_BITMASK(uint16_t, , 0x200000000ac3, 1, 7, 1);
  6582. *(uint16_t*)0x200000000ac4 = 8;
  6583. *(uint16_t*)0x200000000ac6 = 1;
  6584. *(uint32_t*)0x200000000ac8 = r[122];
  6585. *(uint16_t*)0x200000000acc = 0xc;
  6586. STORE_BY_BITMASK(uint16_t, , 0x200000000ace, 1, 0, 14);
  6587. STORE_BY_BITMASK(uint16_t, , 0x200000000acf, 0, 6, 1);
  6588. STORE_BY_BITMASK(uint16_t, , 0x200000000acf, 1, 7, 1);
  6589. *(uint16_t*)0x200000000ad0 = 8;
  6590. *(uint16_t*)0x200000000ad2 = 1;
  6591. *(uint32_t*)0x200000000ad4 = r[123];
  6592. *(uint16_t*)0x200000000ad8 = 0x30;
  6593. STORE_BY_BITMASK(uint16_t, , 0x200000000ada, 1, 0, 14);
  6594. STORE_BY_BITMASK(uint16_t, , 0x200000000adb, 0, 6, 1);
  6595. STORE_BY_BITMASK(uint16_t, , 0x200000000adb, 1, 7, 1);
  6596. *(uint16_t*)0x200000000adc = 8;
  6597. *(uint16_t*)0x200000000ade = 1;
  6598. *(uint32_t*)0x200000000ae0 = r[124];
  6599. *(uint16_t*)0x200000000ae4 = 8;
  6600. *(uint16_t*)0x200000000ae6 = 1;
  6601. *(uint32_t*)0x200000000ae8 = 0;
  6602. *(uint16_t*)0x200000000aec = 0x14;
  6603. *(uint16_t*)0x200000000aee = 2;
  6604. memcpy((void*)0x200000000af0, "veth0_to_team\000\000\000", 16);
  6605. *(uint16_t*)0x200000000b00 = 8;
  6606. *(uint16_t*)0x200000000b02 = 1;
  6607. *(uint32_t*)0x200000000b04 = r[125];
  6608. *(uint16_t*)0x200000000b08 = 0x60;
  6609. STORE_BY_BITMASK(uint16_t, , 0x200000000b0a, 1, 0, 14);
  6610. STORE_BY_BITMASK(uint16_t, , 0x200000000b0b, 0, 6, 1);
  6611. STORE_BY_BITMASK(uint16_t, , 0x200000000b0b, 1, 7, 1);
  6612. *(uint16_t*)0x200000000b0c = 8;
  6613. *(uint16_t*)0x200000000b0e = 1;
  6614. *(uint32_t*)0x200000000b10 = r[127];
  6615. *(uint16_t*)0x200000000b14 = 8;
  6616. *(uint16_t*)0x200000000b16 = 1;
  6617. *(uint32_t*)0x200000000b18 = r[129];
  6618. *(uint16_t*)0x200000000b1c = 8;
  6619. *(uint16_t*)0x200000000b1e = 3;
  6620. *(uint32_t*)0x200000000b20 = 2;
  6621. *(uint16_t*)0x200000000b24 = 8;
  6622. *(uint16_t*)0x200000000b26 = 1;
  6623. *(uint32_t*)0x200000000b28 = r[130];
  6624. *(uint16_t*)0x200000000b2c = 8;
  6625. *(uint16_t*)0x200000000b2e = 1;
  6626. *(uint32_t*)0x200000000b30 = r[131];
  6627. *(uint16_t*)0x200000000b34 = 8;
  6628. *(uint16_t*)0x200000000b36 = 3;
  6629. *(uint32_t*)0x200000000b38 = 1;
  6630. *(uint16_t*)0x200000000b3c = 0x14;
  6631. *(uint16_t*)0x200000000b3e = 2;
  6632. memcpy((void*)0x200000000b40, "veth1_vlan\000\000\000\000\000\000", 16);
  6633. *(uint16_t*)0x200000000b50 = 8;
  6634. *(uint16_t*)0x200000000b52 = 1;
  6635. *(uint32_t*)0x200000000b54 = r[133];
  6636. *(uint16_t*)0x200000000b58 = 8;
  6637. *(uint16_t*)0x200000000b5a = 3;
  6638. *(uint32_t*)0x200000000b5c = 0;
  6639. *(uint16_t*)0x200000000b60 = 8;
  6640. *(uint16_t*)0x200000000b62 = 3;
  6641. *(uint32_t*)0x200000000b64 = 1;
  6642. *(uint16_t*)0x200000000b68 = 0x64;
  6643. STORE_BY_BITMASK(uint16_t, , 0x200000000b6a, 1, 0, 14);
  6644. STORE_BY_BITMASK(uint16_t, , 0x200000000b6b, 0, 6, 1);
  6645. STORE_BY_BITMASK(uint16_t, , 0x200000000b6b, 1, 7, 1);
  6646. *(uint16_t*)0x200000000b6c = 8;
  6647. *(uint16_t*)0x200000000b6e = 3;
  6648. *(uint32_t*)0x200000000b70 = 0;
  6649. *(uint16_t*)0x200000000b74 = 8;
  6650. *(uint16_t*)0x200000000b76 = 3;
  6651. *(uint32_t*)0x200000000b78 = 1;
  6652. *(uint16_t*)0x200000000b7c = 8;
  6653. *(uint16_t*)0x200000000b7e = 3;
  6654. *(uint32_t*)0x200000000b80 = 0;
  6655. *(uint16_t*)0x200000000b84 = 8;
  6656. *(uint16_t*)0x200000000b86 = 1;
  6657. *(uint32_t*)0x200000000b88 = r[134];
  6658. *(uint16_t*)0x200000000b8c = 0x14;
  6659. *(uint16_t*)0x200000000b8e = 2;
  6660. memcpy((void*)0x200000000b90, "team_slave_0\000\000\000\000", 16);
  6661. *(uint16_t*)0x200000000ba0 = 8;
  6662. *(uint16_t*)0x200000000ba2 = 3;
  6663. *(uint32_t*)0x200000000ba4 = 5;
  6664. *(uint16_t*)0x200000000ba8 = 8;
  6665. *(uint16_t*)0x200000000baa = 3;
  6666. *(uint32_t*)0x200000000bac = 0;
  6667. *(uint16_t*)0x200000000bb0 = 8;
  6668. *(uint16_t*)0x200000000bb2 = 1;
  6669. *(uint32_t*)0x200000000bb4 = r[135];
  6670. *(uint16_t*)0x200000000bb8 = 0x14;
  6671. *(uint16_t*)0x200000000bba = 2;
  6672. memcpy((void*)0x200000000bbc, "veth1_macvtap\000\000\000", 16);
  6673. *(uint16_t*)0x200000000bcc = 0x34;
  6674. STORE_BY_BITMASK(uint16_t, , 0x200000000bce, 1, 0, 14);
  6675. STORE_BY_BITMASK(uint16_t, , 0x200000000bcf, 0, 6, 1);
  6676. STORE_BY_BITMASK(uint16_t, , 0x200000000bcf, 1, 7, 1);
  6677. *(uint16_t*)0x200000000bd0 = 0x14;
  6678. *(uint16_t*)0x200000000bd2 = 2;
  6679. memcpy((void*)0x200000000bd4,
  6680. "veth0\000\000\000\000\000\000\000\000\000\000\000", 16);
  6681. *(uint16_t*)0x200000000be4 = 0x14;
  6682. *(uint16_t*)0x200000000be6 = 2;
  6683. memcpy((void*)0x200000000be8, "batadv0\000\000\000\000\000\000\000\000\000",
  6684. 16);
  6685. *(uint16_t*)0x200000000bf8 = 8;
  6686. *(uint16_t*)0x200000000bfa = 3;
  6687. *(uint32_t*)0x200000000bfc = 1;
  6688. *(uint16_t*)0x200000000c00 = 0xc;
  6689. STORE_BY_BITMASK(uint16_t, , 0x200000000c02, 1, 0, 14);
  6690. STORE_BY_BITMASK(uint16_t, , 0x200000000c03, 0, 6, 1);
  6691. STORE_BY_BITMASK(uint16_t, , 0x200000000c03, 1, 7, 1);
  6692. *(uint16_t*)0x200000000c04 = 8;
  6693. *(uint16_t*)0x200000000c06 = 3;
  6694. *(uint32_t*)0x200000000c08 = 1;
  6695. *(uint64_t*)0x2000000004c8 = 0x1cc;
  6696. *(uint64_t*)0x200000000c58 = 1;
  6697. *(uint64_t*)0x200000000c60 = 0;
  6698. *(uint64_t*)0x200000000c68 = 0;
  6699. *(uint32_t*)0x200000000c70 = 4;
  6700. syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0x200000000c40ul,
  6701. /*f=MSG_ZEROCOPY*/ 0x4000000ul);
  6702. memcpy((void*)0x200000000040, "./file2\000", 8);
  6703. res = syscall(
  6704. __NR_open, /*file=*/0x200000000040ul,
  6705. /*flags=O_TRUNC|O_SYNC|O_NOFOLLOW|O_NOCTTY|O_LARGEFILE|O_EXCL|0x82002*/
  6706. 0x1ab382ul, /*mode=*/0ul);
  6707. if (res != -1)
  6708. r[136] = res;
  6709. syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc);
  6710. syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc);
  6711. syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0ul, /*f=*/0ul);
  6712. *(uint32_t*)0x200000000100 = 0;
  6713. *(uint8_t*)0x200000000104 = 0x29;
  6714. *(uint16_t*)0x200000000105 = 0;
  6715. *(uint32_t*)0x200000000107 = 0;
  6716. syscall(__NR_write, /*fd=*/r[136], /*data=*/0x200000000100ul,
  6717. /*size=*/0xbful);
  6718. *(uint64_t*)0x200000000240 = 0;
  6719. syscall(__NR_sendfile, /*fdout=*/r[136], /*fdin=*/r[136],
  6720. /*off=*/0x200000000240ul, /*count=*/0x7f06ul);
  6721. memcpy((void*)0x200000000040, "./file2\000", 8);
  6722. res = syscall(__NR_open, /*file=*/0x200000000040ul,
  6723. /*flags=O_SYNC|O_CREAT|O_CLOEXEC|O_RDWR*/ 0x181042ul,
  6724. /*mode=*/0ul);
  6725. if (res != -1)
  6726. r[137] = res;
  6727. *(uint32_t*)0x200000000100 = 0;
  6728. *(uint8_t*)0x200000000104 = 0x29;
  6729. *(uint16_t*)0x200000000105 = 0;
  6730. *(uint32_t*)0x200000000107 = 0;
  6731. syscall(__NR_write, /*fd=*/r[137], /*data=*/0x200000000100ul,
  6732. /*size=*/0xbful);
  6733. *(uint64_t*)0x200000000240 = 0;
  6734. syscall(__NR_sendfile, /*fdout=*/r[137], /*fdin=*/r[137],
  6735. /*off=*/0x200000000240ul, /*count=*/0x7f06ul);
  6736. res = syscall(__NR_socket, /*domain=*/2ul, /*type=SOCK_RAW*/ 3ul,
  6737. /*proto=*/0x71);
  6738. if (res != -1)
  6739. r[138] = res;
  6740. *(uint32_t*)0x200000000080 = 4;
  6741. syscall(__NR_setsockopt, /*fd=*/r[138], /*level=*/0,
  6742. /*optname=IP_CHECKSUM*/ 0x17, /*optval=*/0x200000000080ul,
  6743. /*optlen=*/4ul);
  6744. *(uint32_t*)0x200000000100 = 0x10000;
  6745. syscall(__NR_setsockopt, /*fd=*/r[138], /*level=*/0,
  6746. /*optname=IP_CHECKSUM*/ 0x17, /*optval=*/0x200000000100ul,
  6747. /*optlen=*/4ul);
  6748. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul,
  6749. /*proto=NETLINK_INET_DIAG*/ 4);
  6750. if (res != -1)
  6751. r[139] = res;
  6752. memcpy((void*)0x2000000000c0, "TIPCv2\000", 7);
  6753. res = -1;
  6754. res = syz_genetlink_get_family_id(/*name=*/0x2000000000c0, /*fd=*/r[139]);
  6755. if (res != -1)
  6756. r[140] = res;
  6757. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x10);
  6758. if (res != -1)
  6759. r[141] = res;
  6760. memcpy((void*)0x200000000280, "ethtool\000", 8);
  6761. res = -1;
  6762. res = syz_genetlink_get_family_id(/*name=*/0x200000000280, /*fd=*/r[139]);
  6763. if (res != -1)
  6764. r[142] = res;
  6765. *(uint64_t*)0x200000000340 = 0x200000000240;
  6766. *(uint16_t*)0x200000000240 = 0x10;
  6767. *(uint16_t*)0x200000000242 = 0;
  6768. *(uint32_t*)0x200000000244 = 0;
  6769. *(uint32_t*)0x200000000248 = 0x80000000;
  6770. *(uint32_t*)0x200000000348 = 0xc;
  6771. *(uint64_t*)0x200000000350 = 0x200000000300;
  6772. *(uint64_t*)0x200000000300 = 0x2000000002c0;
  6773. *(uint32_t*)0x2000000002c0 = 0x1c;
  6774. *(uint16_t*)0x2000000002c4 = r[142];
  6775. *(uint16_t*)0x2000000002c6 = 0x800;
  6776. *(uint32_t*)0x2000000002c8 = 0x70bd25;
  6777. *(uint32_t*)0x2000000002cc = 0x25dfdbfb;
  6778. *(uint8_t*)0x2000000002d0 = 3;
  6779. *(uint8_t*)0x2000000002d1 = 0;
  6780. *(uint16_t*)0x2000000002d2 = 0;
  6781. *(uint16_t*)0x2000000002d4 = 5;
  6782. *(uint16_t*)0x2000000002d6 = 5;
  6783. *(uint8_t*)0x2000000002d8 = 3;
  6784. *(uint64_t*)0x200000000308 = 0x1c;
  6785. *(uint64_t*)0x200000000358 = 1;
  6786. *(uint64_t*)0x200000000360 = 0;
  6787. *(uint64_t*)0x200000000368 = 0;
  6788. *(uint32_t*)0x200000000370 = 0;
  6789. syscall(__NR_sendmsg, /*fd=*/r[141], /*msg=*/0x200000000340ul,
  6790. /*f=MSG_DONTROUTE*/ 4ul);
  6791. memcpy((void*)0x200000000000, "./file0\000", 8);
  6792. syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000000ul,
  6793. /*mode=*/0ul);
  6794. res = syscall(__NR_pipe2, /*pipefd=*/0x200000000240ul, /*flags=*/0ul);
  6795. if (res != -1) {
  6796. r[143] = *(uint32_t*)0x200000000240;
  6797. r[144] = *(uint32_t*)0x200000000244;
  6798. }
  6799. memcpy((void*)0x2000000002c0,
  6800. "\x15\x00\x00\x00\x65\xff\xff\x01\x80\x00\x00\x08\x00\x39\x50\x32\x30"
  6801. "\x30\x30",
  6802. 19);
  6803. syscall(__NR_write, /*fd=*/r[144], /*data=*/0x2000000002c0ul,
  6804. /*size=*/0x15ul);
  6805. res = syscall(__NR_dup, /*oldfd=*/r[144]);
  6806. if (res != -1)
  6807. r[145] = res;
  6808. res = syscall(__NR_socket, /*domain=*/2ul,
  6809. /*type=SOCK_STREAM|0x4000000000000000*/ 0x4000000000000001ul,
  6810. /*proto=*/0);
  6811. if (res != -1)
  6812. r[146] = res;
  6813. *(uint16_t*)0x200000000080 = 2;
  6814. *(uint16_t*)0x200000000082 = htobe16(0x4e23);
  6815. *(uint32_t*)0x200000000084 = htobe32(0xe0000001);
  6816. syscall(__NR_bind, /*fd=*/r[146], /*addr=*/0x200000000080ul,
  6817. /*addrlen=*/0x10ul);
  6818. *(uint16_t*)0x200000e68000 = 2;
  6819. *(uint16_t*)0x200000e68002 = htobe16(0x4e23);
  6820. *(uint32_t*)0x200000e68004 = htobe32(0);
  6821. syscall(__NR_sendto, /*fd=*/r[146], /*buf=*/0ul, /*len=*/0ul,
  6822. /*f=MSG_FASTOPEN|MSG_PROBE|MSG_OOB|MSG_EOR|MSG_DONTROUTE|0x728*/
  6823. 0x200007bdul, /*addr=*/0x200000e68000ul, /*addrlen=*/0x10ul);
  6824. *(uint32_t*)0x2000000001c0 = 0xa;
  6825. syscall(__NR_setsockopt, /*fd=*/r[146], /*level=*/1,
  6826. /*optname=SO_KEEPALIVE*/ 9, /*optval=*/0x2000000001c0ul,
  6827. /*optlen=*/0x44ul);
  6828. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/6);
  6829. if (res != -1)
  6830. r[147] = res;
  6831. *(uint64_t*)0x200000000180 = 0;
  6832. *(uint32_t*)0x200000000188 = 0;
  6833. *(uint64_t*)0x200000000190 = 0x200000000340;
  6834. *(uint64_t*)0x200000000340 = 0x200000000d80;
  6835. *(uint32_t*)0x200000000d80 = 0x140;
  6836. *(uint16_t*)0x200000000d84 = 0x10;
  6837. *(uint16_t*)0x200000000d86 = 0x713;
  6838. *(uint32_t*)0x200000000d88 = 0;
  6839. *(uint32_t*)0x200000000d8c = 0;
  6840. *(uint8_t*)0x200000000d90 = 0xfe;
  6841. *(uint8_t*)0x200000000d91 = 0x88;
  6842. memset((void*)0x200000000d92, 0, 12);
  6843. *(uint8_t*)0x200000000d9e = 0;
  6844. *(uint8_t*)0x200000000d9f = 1;
  6845. *(uint8_t*)0x200000000da0 = -1;
  6846. *(uint8_t*)0x200000000da1 = 1;
  6847. memset((void*)0x200000000da2, 0, 13);
  6848. *(uint8_t*)0x200000000daf = 1;
  6849. *(uint16_t*)0x200000000db0 = htobe16(0);
  6850. *(uint16_t*)0x200000000db2 = htobe16(0);
  6851. *(uint16_t*)0x200000000db4 = htobe16(0);
  6852. *(uint16_t*)0x200000000db6 = htobe16(0);
  6853. *(uint16_t*)0x200000000db8 = 0;
  6854. *(uint8_t*)0x200000000dba = 0;
  6855. *(uint8_t*)0x200000000dbb = 0;
  6856. *(uint8_t*)0x200000000dbc = 0;
  6857. *(uint32_t*)0x200000000dc0 = 0;
  6858. *(uint32_t*)0x200000000dc4 = 0;
  6859. *(uint32_t*)0x200000000dc8 = htobe32(0);
  6860. *(uint32_t*)0x200000000dd8 = htobe32(0);
  6861. *(uint8_t*)0x200000000ddc = 0x32;
  6862. *(uint8_t*)0x200000000de0 = 0xfc;
  6863. *(uint8_t*)0x200000000de1 = 2;
  6864. memset((void*)0x200000000de2, 0, 13);
  6865. *(uint8_t*)0x200000000def = 0;
  6866. *(uint64_t*)0x200000000df0 = 0;
  6867. *(uint64_t*)0x200000000df8 = 0;
  6868. *(uint64_t*)0x200000000e00 = 0;
  6869. *(uint64_t*)0x200000000e08 = 0;
  6870. *(uint64_t*)0x200000000e10 = 0;
  6871. *(uint64_t*)0x200000000e18 = 0;
  6872. *(uint64_t*)0x200000000e20 = 0;
  6873. *(uint64_t*)0x200000000e28 = 0;
  6874. *(uint64_t*)0x200000000e30 = 0;
  6875. *(uint64_t*)0x200000000e38 = 0;
  6876. *(uint64_t*)0x200000000e40 = 0;
  6877. *(uint64_t*)0x200000000e48 = 0;
  6878. *(uint32_t*)0x200000000e50 = 0;
  6879. *(uint32_t*)0x200000000e54 = 0;
  6880. *(uint32_t*)0x200000000e58 = 0;
  6881. *(uint32_t*)0x200000000e5c = 0;
  6882. *(uint32_t*)0x200000000e60 = 0;
  6883. *(uint16_t*)0x200000000e64 = 0xa;
  6884. *(uint8_t*)0x200000000e66 = 0;
  6885. *(uint8_t*)0x200000000e67 = 0;
  6886. *(uint8_t*)0x200000000e68 = 0;
  6887. *(uint16_t*)0x200000000e70 = 0x48;
  6888. *(uint16_t*)0x200000000e72 = 2;
  6889. memcpy((void*)0x200000000e74,
  6890. "ecb(cipher_null)"
  6891. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  6892. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
  6893. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000",
  6894. 64);
  6895. *(uint32_t*)0x200000000eb4 = 0;
  6896. *(uint16_t*)0x200000000eb8 = 8;
  6897. *(uint16_t*)0x200000000eba = 0xc;
  6898. *(uint32_t*)0x200000000ebc = 0;
  6899. *(uint64_t*)0x200000000348 = 0x140;
  6900. *(uint64_t*)0x200000000198 = 1;
  6901. *(uint64_t*)0x2000000001a0 = 0;
  6902. *(uint64_t*)0x2000000001a8 = 0;
  6903. *(uint32_t*)0x2000000001b0 = 0;
  6904. syscall(__NR_sendmsg, /*fd=*/r[147], /*msg=*/0x200000000180ul, /*f=*/0ul);
  6905. memcpy((void*)0x200000000340,
  6906. "\x53\x00\x00\x00\x07\x00\x00\x46\x00\x9c\xe6\xe7\xe6\x76", 14);
  6907. syscall(__NR_write, /*fd=*/r[145], /*data=*/0x200000000340ul,
  6908. /*size=*/0x53ul);
  6909. memcpy((void*)0x200000000000, "./file0\000", 8);
  6910. memcpy((void*)0x200000000180, "9p\000", 3);
  6911. memcpy((void*)0x200000000080, "trans=fd,", 9);
  6912. memcpy((void*)0x200000000089, "rfdno", 5);
  6913. *(uint8_t*)0x20000000008e = 0x3d;
  6914. sprintf((char*)0x20000000008f, "0x%016llx", (long long)r[143]);
  6915. *(uint8_t*)0x2000000000a1 = 0x2c;
  6916. memcpy((void*)0x2000000000a2, "wfdno", 5);
  6917. *(uint8_t*)0x2000000000a7 = 0x3d;
  6918. sprintf((char*)0x2000000000a8, "0x%016llx", (long long)r[145]);
  6919. *(uint8_t*)0x2000000000ba = 0x2c;
  6920. *(uint8_t*)0x2000000000bb = 0x6b;
  6921. syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000000ul,
  6922. /*type=*/0x200000000180ul, /*flags=*/0ul, /*opts=*/0x200000000080ul);
  6923. *(uint64_t*)0x200000000200 = 0x200000000000;
  6924. *(uint16_t*)0x200000000000 = 0x10;
  6925. *(uint16_t*)0x200000000002 = 0;
  6926. *(uint32_t*)0x200000000004 = 0;
  6927. *(uint32_t*)0x200000000008 = 0x4000000;
  6928. *(uint32_t*)0x200000000208 = 0xc;
  6929. *(uint64_t*)0x200000000210 = 0x2000000001c0;
  6930. *(uint64_t*)0x2000000001c0 = 0x200000000140;
  6931. *(uint32_t*)0x200000000140 = 0x58;
  6932. *(uint16_t*)0x200000000144 = r[140];
  6933. *(uint16_t*)0x200000000146 = 0x100;
  6934. *(uint32_t*)0x200000000148 = 0x70bd2a;
  6935. *(uint32_t*)0x20000000014c = 0x25dfdbfe;
  6936. *(uint8_t*)0x200000000150 = 0x15;
  6937. *(uint8_t*)0x200000000151 = 0;
  6938. *(uint16_t*)0x200000000152 = 0;
  6939. *(uint16_t*)0x200000000154 = 0x2c;
  6940. STORE_BY_BITMASK(uint16_t, , 0x200000000156, 7, 0, 14);
  6941. STORE_BY_BITMASK(uint16_t, , 0x200000000157, 0, 6, 1);
  6942. STORE_BY_BITMASK(uint16_t, , 0x200000000157, 1, 7, 1);
  6943. *(uint16_t*)0x200000000158 = 0xc;
  6944. *(uint16_t*)0x20000000015a = 3;
  6945. *(uint64_t*)0x20000000015c = 0x14c;
  6946. *(uint16_t*)0x200000000164 = 0xc;
  6947. *(uint16_t*)0x200000000166 = 4;
  6948. *(uint64_t*)0x200000000168 = 9;
  6949. *(uint16_t*)0x200000000170 = 8;
  6950. *(uint16_t*)0x200000000172 = 1;
  6951. *(uint32_t*)0x200000000174 = -1;
  6952. *(uint16_t*)0x200000000178 = 8;
  6953. *(uint16_t*)0x20000000017a = 1;
  6954. *(uint32_t*)0x20000000017c = 5;
  6955. *(uint16_t*)0x200000000180 = 4;
  6956. STORE_BY_BITMASK(uint16_t, , 0x200000000182, 7, 0, 14);
  6957. STORE_BY_BITMASK(uint16_t, , 0x200000000183, 0, 6, 1);
  6958. STORE_BY_BITMASK(uint16_t, , 0x200000000183, 1, 7, 1);
  6959. *(uint16_t*)0x200000000184 = 0x14;
  6960. STORE_BY_BITMASK(uint16_t, , 0x200000000186, 1, 0, 14);
  6961. STORE_BY_BITMASK(uint16_t, , 0x200000000187, 0, 6, 1);
  6962. STORE_BY_BITMASK(uint16_t, , 0x200000000187, 1, 7, 1);
  6963. *(uint16_t*)0x200000000188 = 0x10;
  6964. *(uint16_t*)0x20000000018a = 1;
  6965. memcpy((void*)0x20000000018c, "eth", 3);
  6966. *(uint8_t*)0x20000000018f = 0x3a;
  6967. memcpy((void*)0x200000000190, "macsec0\000", 8);
  6968. *(uint64_t*)0x2000000001c8 = 0x58;
  6969. *(uint64_t*)0x200000000218 = 1;
  6970. *(uint64_t*)0x200000000220 = 0;
  6971. *(uint64_t*)0x200000000228 = 0;
  6972. *(uint32_t*)0x200000000230 = 0x10;
  6973. syscall(__NR_sendmsg, /*fd=*/r[139], /*msg=*/0x200000000200ul,
  6974. /*f=MSG_DONTWAIT*/ 0x40ul);
  6975. *(uint64_t*)0x200000009900 = 0;
  6976. *(uint32_t*)0x200000009908 = 0;
  6977. *(uint64_t*)0x200000009910 = 0x200000009800;
  6978. *(uint64_t*)0x200000009800 = 0x200000000040;
  6979. *(uint32_t*)0x200000000040 = 0x10;
  6980. *(uint16_t*)0x200000000044 = 0x15;
  6981. *(uint16_t*)0x200000000046 = 1;
  6982. *(uint32_t*)0x200000000048 = 0;
  6983. *(uint32_t*)0x20000000004c = 0;
  6984. *(uint64_t*)0x200000009808 = 0x10;
  6985. *(uint64_t*)0x200000009918 = 1;
  6986. *(uint64_t*)0x200000009920 = 0;
  6987. *(uint64_t*)0x200000009928 = 0;
  6988. *(uint32_t*)0x200000009930 = 0;
  6989. syscall(__NR_sendmsg, /*fd=*/r[139], /*msg=*/0x200000009900ul, /*f=*/0ul);
  6990. memcpy((void*)0x200000000400, "/dev/net/tun\000", 13);
  6991. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  6992. /*file=*/0x200000000400ul, /*flags=O_RDWR*/ 2, /*mode=*/0);
  6993. if (res != -1)
  6994. r[148] = res;
  6995. memset((void*)0x200000000280, 0, 16);
  6996. *(uint16_t*)0x200000000290 = 0x4009;
  6997. syscall(__NR_ioctl, /*fd=*/r[148], /*cmd=*/0x400454ca,
  6998. /*arg=*/0x200000000280ul);
  6999. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
  7000. if (res != -1)
  7001. r[149] = res;
  7002. res = syscall(__NR_dup2, /*oldfd=*/r[148], /*newfd=*/r[149]);
  7003. if (res != -1)
  7004. r[150] = res;
  7005. memcpy((void*)0x200000000300,
  7006. "\x00\x00\x00\x00\x10\x01\x00\x00\x01\x00\x00\x00\x88\x96", 14);
  7007. syscall(__NR_write, /*fd=*/r[150], /*buf=*/0x200000000300ul,
  7008. /*count=*/0xfdeful);
  7009. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
  7010. if (res != -1)
  7011. r[151] = res;
  7012. *(uint64_t*)0x200000000040 = 0;
  7013. *(uint32_t*)0x200000000048 = 0;
  7014. *(uint64_t*)0x200000000050 = 0x200000000000;
  7015. *(uint64_t*)0x200000000000 = 0x200000000080;
  7016. *(uint32_t*)0x200000000080 = 0x24;
  7017. *(uint16_t*)0x200000000084 = 0x19;
  7018. *(uint16_t*)0x200000000086 = 0x515;
  7019. *(uint32_t*)0x200000000088 = 0;
  7020. *(uint32_t*)0x20000000008c = 0;
  7021. *(uint8_t*)0x200000000090 = 2;
  7022. *(uint8_t*)0x200000000091 = 0;
  7023. *(uint16_t*)0x200000000092 = 0;
  7024. *(uint16_t*)0x200000000094 = 8;
  7025. STORE_BY_BITMASK(uint16_t, , 0x200000000096, 0, 0, 14);
  7026. STORE_BY_BITMASK(uint16_t, , 0x200000000097, 0, 6, 1);
  7027. STORE_BY_BITMASK(uint16_t, , 0x200000000097, 0, 7, 1);
  7028. *(uint32_t*)0x200000000098 = 0;
  7029. *(uint16_t*)0x20000000009c = 8;
  7030. STORE_BY_BITMASK(uint16_t, , 0x20000000009e, 1, 0, 14);
  7031. STORE_BY_BITMASK(uint16_t, , 0x20000000009f, 0, 6, 1);
  7032. STORE_BY_BITMASK(uint16_t, , 0x20000000009f, 0, 7, 1);
  7033. *(uint32_t*)0x2000000000a0 = 0;
  7034. *(uint64_t*)0x200000000008 = 0x24;
  7035. *(uint64_t*)0x200000000058 = 1;
  7036. *(uint64_t*)0x200000000060 = 0;
  7037. *(uint64_t*)0x200000000068 = 0;
  7038. *(uint32_t*)0x200000000070 = 0;
  7039. syscall(__NR_sendmsg, /*fd=*/r[151], /*msg=*/0x200000000040ul, /*f=*/0ul);
  7040. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/2ul, /*proto=*/0x88);
  7041. if (res != -1)
  7042. r[152] = res;
  7043. *(uint32_t*)0x200000000080 = 0x2d;
  7044. syscall(__NR_getsockopt, /*fd=*/r[152], /*level=*/0x29, /*optname=*/0x41,
  7045. /*optval=*/0ul, /*optlen=*/0x200000000080ul);
  7046. memcpy((void*)0x200000000400, "./file1\000", 8);
  7047. syscall(__NR_mkdir, /*path=*/0x200000000400ul, /*mode=*/0ul);
  7048. memcpy((void*)0x2000000001c0,
  7049. "\023\023w\305\3745\324\024T\325\324\035)\255\032`)"
  7050. "Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$"
  7051. "\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>"
  7052. "\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000",
  7053. 78);
  7054. syscall(__NR_mkdir, /*path=*/0x2000000001c0ul, /*mode=*/0ul);
  7055. memcpy((void*)0x200000000040, "./file1\000", 8);
  7056. memcpy((void*)0x200000000240, "system.posix_acl_default\000", 25);
  7057. *(uint32_t*)0x200000000640 = 2;
  7058. *(uint16_t*)0x200000000644 = 1;
  7059. *(uint16_t*)0x200000000646 = 0;
  7060. *(uint32_t*)0x200000000648 = 0;
  7061. *(uint16_t*)0x20000000064c = 4;
  7062. *(uint16_t*)0x20000000064e = 0;
  7063. *(uint32_t*)0x200000000650 = 0;
  7064. *(uint16_t*)0x200000000654 = 0x10;
  7065. *(uint16_t*)0x200000000656 = 0;
  7066. *(uint32_t*)0x200000000658 = 0;
  7067. *(uint16_t*)0x20000000065c = 0x20;
  7068. *(uint16_t*)0x20000000065e = 0;
  7069. *(uint32_t*)0x200000000660 = 0;
  7070. syscall(__NR_lsetxattr, /*path=*/0x200000000040ul, /*name=*/0x200000000240ul,
  7071. /*val=*/0x200000000640ul, /*size=*/0x24ul, /*flags=*/0ul);
  7072. memcpy((void*)0x200000000480, ".\000", 2);
  7073. res = syscall(__NR_open, /*file=*/0x200000000480ul, /*flags=*/0ul,
  7074. /*mode=*/0ul);
  7075. if (res != -1)
  7076. r[153] = res;
  7077. memcpy((void*)0x200000000140,
  7078. "\023\023w\305\3745\324\024T\325\324\035)\255\032`)"
  7079. "Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$"
  7080. "\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>"
  7081. "\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000",
  7082. 78);
  7083. memcpy((void*)0x2000000002c0, "./file1\000", 8);
  7084. syscall(__NR_renameat2, /*oldfd=*/r[153], /*old=*/0x200000000140ul,
  7085. /*newfd=*/r[153], /*new=*/0x2000000002c0ul, /*flags=*/0ul);
  7086. memcpy((void*)0x200000000180, "vfat\000", 5);
  7087. memcpy((void*)0x200000000000, "./file0\000", 8);
  7088. memcpy(
  7089. (void*)0x2000000004c0,
  7090. "\x75\x6e\x69\x5f\x78\x6c\x61\x74\x65\x3d\x31\x2c\x65\x72\x72\x6f\x72\x73"
  7091. "\x3d\x63\x6f\x6e\x74\x69\x6e\x0f\x65\x2c\x73\x68\x6f\x72\x74\x6e\x61\x6d"
  7092. "\x65\x3d\x6d\x69\x78\x65\x64\x2c\x6e\x6f\x63\x61\x73\x65\x5b\xda\x2c\x6e"
  7093. "\x6f\x6e\x75\x6d\x74\x61\x69\x6c\x3d\x30\x2c\x75\x74\x66\x38\x3d\x31\x2c"
  7094. "\x75\x69\x64\x3d\xda\x39\xb7\x99\xbd\xb5\xb1\x0c\xa5\xc4\x06\x0f\x23\xf4"
  7095. "\x0c\xbe\x89\xe8\x26\x78\x47\x46\x25\x13\xfa\x54\x68\x9f\x6c\xa9\xa0\xdd"
  7096. "\x82\x0c\x29\xbb\xdc\x8b\x59\x65\x44\x6f\x2b\x12\xab\xc5\x14\x69\x0d\x29"
  7097. "\x9c\x5d\x9f\x6a\x23\xb5\x68\x81\x9c\xe6\x6f\xfa\x6d\x98\xd6\xca\x55\xe3"
  7098. "\x96\x1e\xdd\xe4\x0f\x8b\xca\x2d\xab\x2a\x48\x22\xcb\x44\x74\xad\x5a\xb5"
  7099. "\x38\xb5\xb6\x80\x9d\x82\x60\x84\x7d\x62\xf1\x05\x00\x00\x00\x48\xae\x6e"
  7100. "\x1c\xbf\x37\x63\x9b\x44\x66\x1e\xf9\x37\x42\xf1\x7a\x1b\x99\x8b\x40\xe2"
  7101. "\x05\xf5\x77\x15\x10\xdd\x2f\x3a\x59\xf3\xbb\x29\x90\x83\x76\x2e\x28\x53"
  7102. "\xc7\x05\x6a\x9a\x5b\xb6\xe2\x37\xe9\x4a\x25\x61\xa2\x5b\xdc\x03\x57\xce"
  7103. "\x7a\x25\x57\x01\x14\xbb\x42",
  7104. 241);
  7105. sprintf((char*)0x2000000005b1, "0x%016llx", (long long)0);
  7106. memcpy((void*)0x2000000005c3,
  7107. ",rodir,nfs,shortname=lower,fmask=00000000000000000000002,shortname="
  7108. "win95,nfs,nonumtail=0,utf8=0,uni_xlate=1,nonumtail=0,\000",
  7109. 121);
  7110. memcpy(
  7111. (void*)0x200000002300,
  7112. "\x78\x9c\xec\xdd\x3f\x6b\x23\x47\x14\x00\xf0\xb7\xb2\x2c\x29\x49\x21\x15"
  7113. "\xa9\x42\x20\x0b\x49\x91\xca\xd8\x6e\xd3\xc8\x04\x1b\x4c\x54\x25\xa8\x48"
  7114. "\x52\x24\x26\xb6\x21\x58\x22\x60\x83\x21\x7f\x88\xe2\x2a\x6d\x9a\x94\xf9"
  7115. "\x04\x81\x40\xba\xfb\x12\xd7\xdc\x37\x38\xb8\xf6\xe0\xba\x73\x61\xd8\x63"
  7116. "\xa5\xdd\x93\xec\x93\x65\xeb\xb0\xec\xfb\xf3\xfb\x35\x1e\xcf\xce\x9b\x79"
  7117. "\x33\x1e\x6c\x5c\xec\xd3\xf7\x1f\xf6\x0f\x76\xd3\xd8\x3f\xf9\xed\x61\x34"
  7118. "\x1a\x49\x54\xda\xd1\x8e\xd3\x24\x5a\x51\x89\xd2\x1f\x71\x4e\xfb\xaf\x00"
  7119. "\x00\x5e\x67\xa7\x59\x16\x4f\xb2\x91\x79\xe2\x92\x88\x68\x2c\x2e\x2d\x00"
  7120. "\x60\x81\xe6\xfe\xfb\xff\xff\xc2\x53\x02\x00\x16\xec\xab\xaf\xbf\xf9\x62"
  7121. "\xa3\xd3\xd9\xfc\x32\x4d\x1b\xb1\xd5\xff\xf3\xb8\x9b\xff\x67\x9f\x7f\x1d"
  7122. "\x3d\xdf\xd8\x8f\x1f\xa3\x17\x7b\xb1\x1a\xcd\x38\x8b\xc8\x9e\x1b\xb5\xb7"
  7123. "\xb2\x2c\x1b\x54\xd3\x5c\x2b\x3e\xe9\x0f\x8e\xbb\x79\x64\xff\xbb\xfb\xc5"
  7124. "\xfc\x1b\x8f\x23\x86\xf1\x6b\xd1\x8c\xd6\xb0\xeb\x7c\xfc\x76\x67\x73\x2d"
  7125. "\x1d\x99\x88\x1f\xe4\x79\xbc\x5b\xac\xdf\xce\xe3\xd7\xa3\x19\xef\x4f\x59"
  7126. "\x7f\xbb\xb3\xb9\x3e\x25\x3e\xba\xb5\xf8\xf4\xe3\x89\xfc\x57\xa2\x19\x0f"
  7127. "\x7e\x88\x9f\xa2\x17\xbb\xc3\x24\xc6\xf1\xbf\xaf\xa5\xe9\xe7\xd9\xdf\x4f"
  7128. "\x7f\xfd\x36\x4f\x2f\x8f\x4f\x06\xc7\xdd\xfa\x70\xdc\x58\xb6\x74\xcb\x3f"
  7129. "\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7130. "\xde\x60\x2b\x45\xed\x9c\x7a\x0c\xeb\xf7\xe4\x5d\x45\xfd\x9d\xa5\xb3\xfc"
  7131. "\x9b\xe5\x48\x4b\xad\xf3\xf5\x79\x46\xf1\x49\x39\xd1\x85\xfa\x40\x83\x2c"
  7132. "\xfe\x29\xeb\xeb\xac\xa6\x69\x9a\x15\x03\xc7\xf1\xd5\xf8\xa0\x1a\xd5\xbb"
  7133. "\xd9\x35\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc"
  7134. "\x5a\x8e\x7e\xfe\xe5\x60\xa7\xd7\xdb\x3b\xbc\x91\x46\x59\x0d\xa0\x7c\xad"
  7135. "\xff\x65\xe7\x69\x4f\xf4\x7c\x14\xb3\x07\xd7\xc7\x6b\x55\x8a\xe6\x8c\x99"
  7136. "\x63\xa9\x1c\x93\x44\xcc\x4c\x23\xdf\xc4\x0d\x1d\xcb\x55\x8d\x77\x2e\xcb"
  7137. "\xf9\xdf\xff\xe6\x9d\xb0\x71\xf5\x98\xe5\x59\xe7\x73\x33\x8d\xf2\x76\x1d"
  7138. "\xec\x24\xd3\xcf\xb0\x1e\x65\x4f\xa3\xbc\x24\xf7\x26\xc7\xd4\xe2\x9a\x6b"
  7139. "\xd5\x2e\x7b\x94\xcd\x75\xfd\x6a\x53\x1f\x35\xe7\xde\x7b\xed\xbd\x61\x63"
  7140. "\x30\x63\x4c\x24\xb3\x12\xfb\xec\xd1\xe8\xe4\x8a\x9e\xe4\xe2\x2e\x6a\xc3"
  7141. "\x53\x9d\x1a\xbe\x5c\x34\x26\xc2\x2f\xdc\x8d\xb9\xee\xf3\x8b\xbf\x2b\x12"
  7142. "\xd5\x3a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x60\xa1"
  7143. "\xc6\x2f\xfd\x4e\x79\x78\x32\x33\xb4\x92\xd5\x17\x96\x16\x00\x00\x00\x00"
  7144. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7145. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\xdc\xaa\xf1\xe7\xff\xcf\xd1\x18\x14"
  7146. "\xc1\xd7\x18\x5c\x8b\xc3\xa3\x3b\xde\x22\x00\x00\x00\x00\x00\x00\x00\x00"
  7147. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7148. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6f\x81\x67\x01\x00"
  7149. "\x00\xff\xff\xc3\x51\x62\x02",
  7150. 673);
  7151. syz_mount_image(
  7152. /*fs=*/0x200000000180, /*dir=*/0x200000000000,
  7153. /*flags=MS_I_VERSION|MS_NOSUID|MS_NOEXEC|MS_DIRSYNC*/ 0x80008a,
  7154. /*opts=*/0x2000000004c0, /*chdir=*/7, /*size=*/0x2a1,
  7155. /*img=*/0x200000002300);
  7156. memcpy((void*)0x200000000000, "./file0\000", 8);
  7157. syscall(__NR_creat, /*file=*/0x200000000000ul, /*mode=*/0ul);
  7158. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0x88);
  7159. if (res != -1)
  7160. r[154] = res;
  7161. *(uint32_t*)0x200000000280 = 5;
  7162. res = syscall(__NR_getsockopt, /*fd=*/r[154], /*level=*/1, /*optname=*/0x11,
  7163. /*optval=*/0x200000000240ul, /*optlen=*/0x200000000280ul);
  7164. if (res != -1)
  7165. r[155] = *(uint32_t*)0x200000000244;
  7166. syscall(__NR_setreuid, /*ruid=*/0, /*euid=*/r[155]);
  7167. memcpy((void*)0x200000000080, "./file0\000", 8);
  7168. syscall(__NR_utimes, /*filename=*/0x200000000080ul, /*times=*/0ul);
  7169. memcpy((void*)0x200000000000, "vfat\000", 5);
  7170. memcpy((void*)0x200000000300, "./file0\000", 8);
  7171. memcpy(
  7172. (void*)0x200000000800,
  7173. "\x78\x9c\xec\xdc\xcb\x6b\x13\x5f\x14\xc0\xf1\xd3\xf4\x95\xa6\xb4\xc9\xe2"
  7174. "\xc7\x4f\x14\xa4\x07\xdd\xe8\x66\x68\xa3\x6b\x31\x48\x0b\x62\xc0\x52\x1b"
  7175. "\xf1\x01\xc2\xb4\x9d\x68\xc8\x98\x94\x4c\xa8\x44\xc4\xea\xca\xad\xf8\x47"
  7176. "\xb8\x28\x5d\x76\x57\xd0\xfe\x03\xdd\xb8\xd3\x8d\x1b\x77\xdd\x08\x2e\xec"
  7177. "\x42\x1c\xc9\x3c\xfa\x4c\x69\x69\x9b\x4c\xdb\x7c\x3f\x10\xee\x4d\xee\x3d"
  7178. "\x33\xf7\x4e\x26\xe1\xdc\x21\x93\xb5\x07\xef\x9f\x17\xf3\x8e\x91\x37\xab"
  7179. "\x12\x8b\xab\x74\x88\x88\xac\x8b\xa4\x24\x26\xa1\x8e\xa0\x8c\x79\xf5\x1e"
  7180. "\xd9\xea\x8d\x5c\xed\xff\xf5\xf5\xe2\xbd\x87\x8f\xee\x64\xb2\xd9\xd1\x09"
  7181. "\xd5\xb1\xcc\xe4\xb5\xb4\xaa\x0e\x0e\x7d\x7a\xf1\xaa\x2f\xe8\xb6\xdc\x2b"
  7182. "\xab\xa9\x27\x6b\x3f\xd3\x3f\x56\xff\x5f\x3d\xbf\xf6\x77\xf2\x59\xc1\xd1"
  7183. "\x82\xa3\xa5\x72\x55\x4d\x9d\x2a\x7f\xaf\x9a\x53\xb6\xa5\x33\x05\xa7\x68"
  7184. "\xa8\x8e\xdb\x96\xe9\x58\x5a\x28\x39\x56\xc5\x6f\x2f\xfb\xed\x79\xbb\x3c"
  7185. "\x3b\x5b\x53\xb3\x34\x33\x90\x98\xad\x58\x8e\xa3\x66\xa9\xa6\x45\xab\xa6"
  7186. "\xd5\xb2\x56\x2b\x35\x35\x9f\x9a\x85\x92\x1a\x86\xa1\x03\x09\xc1\x7e\x72"
  7187. "\x0b\x13\x13\x66\xe6\x90\xc1\xd3\xc7\x3c\x18\x34\x49\xa5\x92\x31\x3b\x45"
  7188. "\xa4\x6f\x57\x4b\x6e\x21\x92\x01\x01\x00\x80\x48\xed\xcc\xff\x63\xf5\x94"
  7189. "\xfe\xf8\xf2\xff\xc5\x4b\x2b\xd5\xfe\xfb\x4b\x83\x41\xfe\xbf\xdc\xd3\x28"
  7190. "\xff\xbf\xfe\xcd\xdf\xd6\xb6\xfc\x3f\x2e\x22\x4d\xcf\xff\x77\x67\x44\xed"
  7191. "\xe5\x48\xf9\x3f\x4e\x89\x7a\xfe\x9f\x08\x3e\xbf\x9e\xb7\x8f\x17\x87\xbd"
  7192. "\x0a\xf9\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7193. "\x00\x00\xa7\xc1\xba\xeb\x26\x5d\xd7\x4d\x86\x65\xf8\xe8\x15\x91\xb8\x88"
  7194. "\x84\xcf\xa3\x1e\x27\x9a\x83\xf7\xbf\xbd\x6d\xde\xb8\xd7\x35\x28\x62\xbf"
  7195. "\x9b\xcb\xcd\xe5\xfc\x32\xe8\xb0\x22\x22\xb6\x58\x32\x2c\x49\xf9\xe3\x9d"
  7196. "\x0f\x81\x7a\x3d\xbc\x17\x50\xeb\x52\xf2\xd9\x9e\x0f\xe2\xe7\xe7\x72\x9d"
  7197. "\x5e\x4b\x26\x2f\x05\x2f\x7e\x44\x92\x92\xda\x19\xef\xba\x63\xb7\xb3\xa3"
  7198. "\x23\xea\xdb\x1e\xdf\x2d\x89\xad\xf1\x69\x49\xca\x7f\x8d\xe3\xd3\x0d\xe3"
  7199. "\x7b\xe4\xca\xe5\x2d\xf1\x86\x24\xe5\xcb\xb4\x94\xc5\x96\x19\xef\xbc\xde"
  7200. "\x8c\x7f\x3d\xa2\x7a\xeb\x6e\x76\x47\x7c\x9f\xd7\x0f\x00\x00\x00\x00\x80"
  7201. "\xb3\xc0\xd0\x0d\x0d\xd7\xef\x86\xb1\x57\xbb\x1f\xbf\xb1\xbe\x6e\x78\x7d"
  7202. "\xc0\x5f\x5f\x0f\x37\x5c\x9f\x77\xc9\x85\xae\x68\xe7\x0e\x00\x00\x00\x00"
  7203. "\x40\xbb\x70\x6a\x2f\x8b\xa6\x6d\x5b\x95\x33\x57\x09\x67\x78\xd0\xa8\xf0"
  7204. "\xb7\x0c\x91\x8c\x39\xdc\xf9\xc9\x38\x74\x07\xa8\xc4\x0e\x35\xd4\x21\x11"
  7205. "\xb1\xf5\xa8\x7b\x0f\x2f\x1b\xed\xd5\x47\xc6\xa3\x3a\x2c\xe7\x3e\x7c\xfc"
  7206. "\x7d\x7c\x1b\xbc\xb1\x14\xdf\x67\xa6\x4d\xab\x74\xb7\xf6\x5b\x08\x00\x00"
  7207. "\x00\x40\x2b\x6c\x26\xfd\xe1\x2b\x37\xa3\x1d\x10\x00\x00\x00\x00\x00\x00"
  7208. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6d"
  7209. "\xa8\x15\x7f\x27\x16\xf5\x1c\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7210. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x93"
  7211. "\xe2\x5f\x00\x00\x00\xff\xff\x7b\x91\x12\x85",
  7212. 695);
  7213. syz_mount_image(/*fs=*/0x200000000000, /*dir=*/0x200000000300, /*flags=*/0,
  7214. /*opts=*/0x200000000ac0, /*chdir=*/0x45, /*size=*/0x2b7,
  7215. /*img=*/0x200000000800);
  7216. memcpy((void*)0x200000000000, ".\000", 2);
  7217. res = syscall(__NR_fspick, /*dfd=*/0xffffff9c, /*path=*/0x200000000000ul,
  7218. /*flags=*/0ul);
  7219. if (res != -1)
  7220. r[156] = res;
  7221. memcpy((void*)0x2000000006c0, "posixacl\000", 9);
  7222. syscall(__NR_fsconfig, /*fd=*/r[156], /*cmd=*/0ul, /*key=*/0x2000000006c0ul,
  7223. /*value=*/0ul, /*aux=*/0ul);
  7224. res = -1;
  7225. res = syz_genetlink_get_family_id(/*name=*/0, /*fd=*/-1);
  7226. for (int i = 0; i < 32; i++) {
  7227. syz_genetlink_get_family_id(/*name=*/0, /*fd=*/-1);
  7228. }
  7229. if (res != -1)
  7230. r[157] = res;
  7231. memcpy((void*)0x200000000000, "./file0\000", 8);
  7232. res = syscall(__NR_open, /*file=*/0x200000000000ul,
  7233. /*flags=O_NONBLOCK|O_DIRECT|O_RDWR*/ 0x4802ul, /*mode=*/0ul);
  7234. for (int i = 0; i < 32; i++) {
  7235. syscall(__NR_open, /*file=*/0x200000000000ul,
  7236. /*flags=O_NONBLOCK|O_DIRECT|O_RDWR*/ 0x4802ul, /*mode=*/0ul);
  7237. }
  7238. if (res != -1)
  7239. r[158] = res;
  7240. memcpy(
  7241. (void*)0x200000000600,
  7242. "\x34\xfd\x98\xaa\x1d\x0e\x7a\xde\xc9\x37\xa5\xf3\x31\xa7\x5f\x48\x79\x34"
  7243. "\xf5\x02\x42\xa0\x75\x19\x44\x93\x69\x72\x89\x6c\x29\xa5\x06\x8c\x8e\xcb"
  7244. "\xa1\xaa\x0a\x4e\x2a\x63\x1b\x51\x80\xe1\xfb\xde\x79\xf4\x50\x2d\xc4\xc4"
  7245. "\xa1\xfb\xa9\xdc\xd9\xed\x83\xe6\x39\xae\xfa\x1b\x87\x63\x1c\x33\xd1\xa8"
  7246. "\x2c\xb0\xc0\x03\x56\x76\xdd\xfe\xb0\xfe\x79\x84\xd7\x51\x9b\x0f\x83\x9d"
  7247. "\x49\x7f\xc9\xd6\x4e\xf1\x4d\x1d\xe2\x22\x20\xff\x26\x23\xdf\x49\x50\x13"
  7248. "\x4b\x9f\xb7\x34\xa5\x2a\xda\xd9\x5f\x13\x1c\xce\x36\x72\xa9\xd7\xd7\xb4"
  7249. "\x00\xd2\xc6\x28\x10\xb5\xf2\x03\x51\x63\x93\x30\x94\x81\x07\xbf\x8d\x45"
  7250. "\x34\xa0\x3a\xc3\x89\x45\x5c\x54\xd8\xeb\x4d\x60\x9b\x3e\x85\x8b\x72\x13"
  7251. "\xb3\x8e\xb0\x1f\x0e\xea\xba\x37\x39\xae\x92\x79\x16\xe2\x8d\xa6\xa7\x9a"
  7252. "\x3f\xd5\xe3\x2d\x30\xab\x30\xbf\x95\x9d\x45\x96\xe5\xff\xbf\xf6\x78\x9a"
  7253. "\x65\x0b\x9e\x7d\x24\x8d\x1b\xa8\x68\x01\x23\x36\xa4\xf3\xef\x8f\xab\x07"
  7254. "\xa8\xf5\xb8\x1b\xb0\xbc\x45\xb2\x17\x45\x38\x31\x5c\xa1\x2b\x7c\x72\x3b"
  7255. "\x21\x57\x56\x25\x64\xa8\xa1\xf1\x9d\x28\x17\x9f\x8c\x56\x54\x48\xe0\xe9"
  7256. "\x21\xb8\xc3\xe6\xfc\x4a\xda\xaf\xa8\xb9\x29\xad\x07\x7f\x63\x33\x25\xb6"
  7257. "\xa6\xf7\x1a\x58\x6c\xab\xc4\x88\x3e\x03\xe1\x93\x15\xf9\x46\xb2\x77\x85"
  7258. "\x85\x93\xa7\x36\x7e\x23\x22\x02\xfe\x9a\xd6\x56\xc6\x76\x8a\x15\x17\xda"
  7259. "\x7f\x04\x98\xb4\x8c\xb0\x78\xe9\x29\xfb\x11\xdb\x0c\xc5\x51\xf7\x54\xbf"
  7260. "\xfc\x48\x59\xdd\x89\xa3\x96\x91\x5c\xc8\x09\xb0\x7d\x44\x85\x73\x09\x84"
  7261. "\x09\xea\x21\x37\x10\x56\xf6\x7e\xf4\x11\x4e\xc1\x05\x47\xf4\x98\xd2\x45"
  7262. "\x13\xfe\x59\x43\x08\xbf\x02\x28\x68\xad\x21\xe8\x5b\xba\x81\x19\x42\xfd"
  7263. "\xc4\x51\x61\xa1\xa8\xa7\xfe\x00\xd5\xc6\xb0\x5e\xd7\x95\x4f\x63\x1b\xbd"
  7264. "\x12\xa5\xc9\xa5\xcf\xa5\x96\x5e\x05\x95\xde\x60\x8b\x04\xeb\xe0\x2b\x3f"
  7265. "\xcb\xf3\xb9\xf5\x78\x07\xa1\xa7\xad\x85\x28\x99\x2e\x2e\xc6\x59\x49\xda"
  7266. "\x2f\x4a\x04\x78\xdf\xd3\xae\x52\x63\x9c\x15\xd8\xae\xaa\x35\x1d\xa6\xd3"
  7267. "\x93\xb5\x8c\x77\x21\x68\xfa\xe6\x04\xd0\x97\xfe\xf4\xd6\xb9\x36\x0e\xb1"
  7268. "\x69\xa0\xb0\xee\x70\xcd\xc2\x24\x35\xa0\x03\xe6\x86\x98\xf6\x1b\x3b\x63"
  7269. "\xb1\xf5\x10\x11\xbc\x8f\x4e\xf9\x44\xc1\xde\x82\x17\x85\xf6\x70\x12\x4a"
  7270. "\x1c\x6e\xd1\x83\x35\xd6\x34\x12",
  7271. 512);
  7272. syscall(__NR_write, /*fd=*/r[158], /*buf=*/0x200000000600ul,
  7273. /*count=*/0x200ul);
  7274. for (int i = 0; i < 32; i++) {
  7275. syscall(__NR_write, /*fd=*/r[158], /*buf=*/0x200000000600ul,
  7276. /*count=*/0x200ul);
  7277. }
  7278. memcpy((void*)0x200000001240, "iso9660\000", 8);
  7279. memcpy((void*)0x200000001280, "./file0\000", 8);
  7280. *(uint8_t*)0x200000000740 = 0;
  7281. memcpy(
  7282. (void*)0x2000000047c0,
  7283. "\x78\x9c\xec\xdd\x6b\x70\xdc\x57\x7d\xf0\xf1\xdf\x7f\x7d\x53\x1c\x08\x0e"
  7284. "\x21\x17\x12\xf3\xb0\x71\x12\x48\x42\xe2\x48\x72\x62\xc7\x24\x5c\x14\x69"
  7285. "\x65\x6f\x22\x69\x85\x56\x0a\x31\xb7\xe0\xc4\xb2\x11\x91\xed\x60\x87\x40"
  7286. "\xcc\x25\x09\x97\x00\xcf\xc3\xe5\x01\x9e\xa7\xf7\x0b\xb4\x85\xba\xb4\x25"
  7287. "\xa5\x14\x5a\x66\x3a\x9d\xe9\xbb\xb6\x2f\xfa\x02\x3a\xc3\x8b\xbe\x6e\x3a"
  7288. "\xd3\x19\x06\xd3\x0b\xbd\x70\x49\xe7\xec\x1e\xc9\x8a\x13\x5b\x4e\x6c\x59"
  7289. "\xae\xcf\xe7\xe3\x81\x5d\x4b\x67\xf7\x7f\xfe\xc2\xe8\xbb\x67\xb5\xda\x13"
  7290. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7291. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x54\x83\x43\xbd"
  7292. "\xbd\x7d\x55\x8c\x34\xc7\xa6\xee\xa9\x1f\xdf\xe0\xd0\x44\x6b\xf4\x04\x9f"
  7293. "\x9f\xbb\xbf\xef\x54\x9d\x7b\xfd\xce\xa2\xc7\x8d\xa8\xd2\x7f\xa2\xa7\x27"
  7294. "\x2e\xeb\x7e\xe8\xb2\x17\x57\xf3\x9f\x7d\x49\xfa\xef\x0d\x71\x71\xf7\xde"
  7295. "\x2e\x8e\x9e\x74\xd9\x13\x87\xce\xbf\x64\xdd\x6d\x17\xad\xac\xcd\xdd\xfe"
  7296. "\x04\x13\x3a\x23\x0e\x3e\x72\xe8\x81\x9d\xb3\xb3\xd3\x07\x96\x7b\x22\xcb"
  7297. "\x64\x5b\x63\xac\xd9\x6e\x35\x47\x07\xb6\x35\xea\xcd\x76\xab\xbe\x75\xf3"
  7298. "\xe6\xde\x9b\xb6\x0f\xb7\xeb\xc3\xcd\x91\x46\x7b\x47\x7b\xb2\x31\x5a\x1f"
  7299. "\x9c\x68\x0c\x4c\xb6\x26\xea\xd7\x0e\x5e\x57\xef\xdb\xba\x75\x53\xbd\xb1"
  7300. "\x71\x47\x6b\x6a\x6c\xdb\xd0\xc0\x48\x63\xee\x83\x5b\x6e\xec\xef\xed\xdd"
  7301. "\x5c\xbf\x73\xe3\x78\x63\x60\xa2\xdd\x1a\xbb\xe9\xce\x8d\xed\xc1\xed\xcd"
  7302. "\x91\x91\xe6\xd8\xb6\xce\x98\xf4\xe9\x34\x66\x4b\xfa\x87\x78\x57\x73\xb2"
  7303. "\x3e\xd9\x18\x18\xad\xd7\x77\xcf\xcc\x4e\x6f\x5a\x6c\x92\x69\x50\xdf\xc9"
  7304. "\x0c\xea\x5f\x6c\x50\x7f\x6f\x7f\x7f\x5f\x5f\x7f\x7f\xdf\xe6\x5b\xb6\xde"
  7305. "\xb2\xa5\xb7\x77\xe5\xb3\x3e\xd0\x7b\x8c\x78\xd6\x88\xe5\xff\x47\xcb\xf2"
  7306. "\x5a\x92\xef\xe3\xf0\x42\xd4\x72\xff\x63\x24\x9a\x31\x16\x53\x71\x4f\xd4"
  7307. "\x9f\xf3\xcf\x60\x0c\xc5\x44\xb4\x62\xf4\x38\x9f\xcf\xe6\xfa\x7f\x4d\x75"
  7308. "\xe2\xe3\x2e\xec\xff\xfa\xee\x87\xd6\x5f\x78\xb4\xff\x17\x45\xa7\xff\x97"
  7309. "\x76\xef\xed\xd2\xe3\xf5\xff\x38\x73\x39\x73\x7f\x0e\xc6\x23\x71\x28\x1e"
  7310. "\x88\x9d\x31\x1b\xb3\x31\x1d\x07\x96\x7d\x46\x67\xf6\xcf\xb6\x68\xc4\x58"
  7311. "\x34\xa3\x1d\xad\x68\xc6\x68\x0c\x74\x3e\x52\xcf\x1f\xa9\xc7\xd6\xd8\x1c"
  7312. "\x9b\xa3\x37\xee\x8d\xed\x31\x1c\xed\xa8\xc7\x70\x34\x63\x24\x1a\xd1\x8e"
  7313. "\x1d\xd1\x8e\xc9\x68\x74\xfe\x45\x0d\xc6\x44\x34\x62\x20\x26\xa3\x15\x13"
  7314. "\x51\x8f\x6b\x63\x30\xae\x8b\x7a\xf4\xc5\xd6\xd8\x1a\x9b\xa2\x1e\x8d\xd8"
  7315. "\x18\x3b\xa2\x15\x53\x31\x16\xdb\x62\x28\x06\x3a\xf7\xb2\x3b\x66\x3a\x5f"
  7316. "\xf7\x4d\x27\x98\xe3\xfc\xa0\xbe\x93\x19\xd4\x7f\x82\x41\xdd\x98\xaf\xc8"
  7317. "\xff\x48\xf5\x9f\x17\x62\x09\xbe\x8b\xc3\x0b\xf3\xf4\x5c\xff\x01\x80\x72"
  7318. "\xdc\xd1\x18\xd0\x7f\x00\x28\xcc\x58\x7b\xa2\xb7\x5f\xff\x01\xa0\x28\x93"
  7319. "\xd6\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7320. "\x00\x00\x00\x00\x00\x70\xba\x55\x51\x8b\xde\x88\xf8\xd6\x9e\x23\xd5\xc2"
  7321. "\x9d\x29\x7b\x3a\x1b\xfe\x1f\xf7\x66\xab\xab\xce\x2d\x6b\x51\x75\xf7\xf2"
  7322. "\x8d\x9e\xcd\x9b\xb6\x0c\x0e\xf7\x0d\x0f\xf5\xf6\xf6\xf6\xf6\x6d\x19\xec"
  7323. "\x3b\x23\xb3\x9f\x77\x61\xb4\xda\x93\x03\xf5\xc1\xfd\x7b\x1f\x3c\x30\x7d"
  7324. "\xf0\xe0\xf4\xae\xfa\xd4\xbe\x99\xfb\xf7\xef\x9a\x3e\xe9\x7b\x38\xd5\xdb"
  7325. "\x3f\x4f\xb7\xaf\x7b\x6a\xcd\xf9\x97\xac\xbb\x6d\x6b\xfa\xcb\xf5\x7b\xa6"
  7326. "\xf7\xcd\x1c\xdc\x3f\xb3\x77\xe7\x9e\x25\x3b\x20\x00\x2c\xb0\x32\x6a\xf1"
  7327. "\x54\x44\xbc\xf2\xc9\x23\xd5\x95\xb9\xe5\x71\xfd\xd4\xd0\x70\x7d\xe4\xee"
  7328. "\x7a\x73\xdf\xee\xfd\x0b\xc6\xd6\xe6\xb6\x09\x38\xc5\x56\x2e\xf2\xd8\x62"
  7329. "\xa9\xad\x3e\xa3\x47\xd3\x76\x00\xce\x42\xab\xa2\x16\xf7\x45\xc4\xe1\x2f"
  7330. "\x1d\xa9\x36\xa4\xc6\xe7\xc7\x00\xb5\xd7\x74\x36\x06\x5c\xee\xe9\x1d\x57"
  7331. "\xe7\x79\x87\x2a\x22\xcd\x59\x63\x01\xe0\xf9\x59\x1d\xb5\x68\x45\xc4\xae"
  7332. "\x0b\xbf\x5e\x5d\x15\x11\x2b\xe2\x1c\x58\xdf\xf7\xa4\xc7\x04\x9d\x93\x98"
  7333. "\x1a\x1a\xee\x9c\xc8\xec\xcc\xce\x7d\x0f\x45\xe7\x39\x8c\x15\xdd\x51\xeb"
  7334. "\x8e\xbd\xd1\xdc\x73\x1f\x67\xf9\x63\x89\x75\x11\x6f\x4c\x73\x5d\x6d\xcf"
  7335. "\x46\x00\x5e\xb8\x35\x51\x8b\x6f\x44\xc4\xde\x97\xf4\xc4\xd5\x9d\x9f\x07"
  7336. "\x00\x00\xe7\xba\x9e\xa8\x45\xf7\x75\x7f\x47\xaa\x6b\x96\x7b\x32\x00\x00"
  7337. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7338. "\x00\x70\x8e\xa8\xa2\x16\x9f\x8b\x88\x43\x3f\x3a\x52\xf5\x2e\xf8\xf8\xa9"
  7339. "\xed\xff\x7f\x6b\xdf\xcd\x67\x64\xf6\xf3\xec\xff\x0f\x00\xcf\xc3\xca\xa8"
  7340. "\xc5\x8f\xf3\xfe\xff\x7d\xf6\xff\x3f\xfd\xb4\x1d\x80\xb3\xd0\xaa\xa8\xc5"
  7341. "\x81\xbc\xff\x7f\xbf\xfd\xff\x01\xa0\x08\xab\xa3\x16\xf7\xe6\xfd\xff\x37"
  7342. "\xd9\xff\xff\xec\x7f\x2c\x61\xff\x7f\x00\x4e\x83\x35\x51\x8b\xbf\xcc\xfb"
  7343. "\xff\xdf\x6c\xff\x7f\x00\x28\x42\x4f\xd4\xa2\xfb\xba\xbf\x23\xd5\x2d\xcb"
  7344. "\x3d\x19\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7345. "\x00\x00\x00\x00\x00\x38\x47\x9c\x17\xb5\xf8\xc7\x88\xf8\xf3\x77\x3f\xdc"
  7346. "\xd9\x57\x66\xe1\xbe\xf4\x0b\x77\x98\x79\xf1\x22\xdb\xcd\xa4\x4f\x6f\xcc"
  7347. "\xd7\x4f\x66\x4f\xbe\xd5\x79\xaf\xc1\x5a\x95\xfe\x9c\xc6\x13\x02\x00\x16"
  7348. "\xd5\x13\xb5\xb8\xbd\x73\xed\x48\x35\xb0\xdc\x93\x01\x00\x00\x00\x00\x00"
  7349. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7350. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7351. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7352. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7353. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7354. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7355. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7356. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7357. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7358. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7359. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7360. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7361. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7362. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7363. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7364. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7365. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7366. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7367. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7368. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7369. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xce\x6a\xb5\xa8\xc5"
  7370. "\xdf\x46\x44\xf5\xfd\x23\x55\x54\x11\xf1\x58\x44\x3d\xba\x97\xbd\xcb\x3d"
  7371. "\x39\x00\x60\x69\x54\xb5\xf8\x87\x88\x78\xc5\xdf\x1d\x49\xf5\x8f\xdb\xd7"
  7372. "\x3d\xb5\xe6\xfc\x4b\xd6\xdd\xb6\x35\x22\x56\xc4\x8a\xce\x43\x82\x6a\xe1"
  7373. "\xf8\x56\x7b\x72\xa0\x3e\xb8\x7f\xef\x83\x07\xa6\x0f\x1e\x9c\xde\x55\x9f"
  7374. "\xda\x37\x73\xff\xfe\x5d\xd3\x27\x7b\xb8\x9e\xc1\xa1\x89\xd6\xe8\x52\x9c"
  7375. "\xc8\x49\x59\xbd\xc4\xf3\x5f\x7d\xca\x33\xec\x49\x8f\xc9\x16\xb8\xbe\x33"
  7376. "\xe1\xa9\xa1\xe1\xce\xa4\x67\x67\x76\xee\x7b\x28\x7d\xb8\x56\xad\x38\xe5"
  7377. "\x43\x01\x50\xae\x9e\xa8\xc5\x4f\x3b\xd7\x8e\x54\xd5\x72\x4f\x06\x00\x38"
  7378. "\x23\x56\x55\xb5\xf8\xfb\x88\xf8\xa7\x37\x1c\x9e\x5f\x77\xae\xec\xae\xf9"
  7379. "\x57\x76\xff\xd6\x3b\xbf\x1c\xfd\xca\xcb\x8e\xae\x4d\x7b\xf2\x83\x85\xb9"
  7380. "\xc7\x0c\x73\xcf\x1b\x5c\x74\x82\xeb\xcf\xf9\xf8\xe2\xfa\x3d\xd3\xfb\x66"
  7381. "\x0e\xee\x9f\xd9\xbb\x73\xcf\x62\x8b\xf0\x9e\x7c\x5c\x2b\x5f\x00\x38\x35"
  7382. "\x55\x55\x8b\xbf\x8a\x88\x6d\xf7\x5d\xd6\xe9\x6a\x15\x6b\x9f\xfd\x1c\x74"
  7383. "\x1e\xf7\xc3\x88\xd8\xf2\xf9\x7a\x1e\x17\x6b\xd3\xb8\xb9\x27\xbc\xd7\x74"
  7384. "\xe2\xde\xb3\x7b\x66\x76\x7a\xe3\xfd\xfb\x67\x77\xa5\xf1\x5f\x88\x88\xbf"
  7385. "\xfe\xea\xfa\x3c\xbe\xb6\x3a\x8d\xcf\x0f\x2a\x62\xd5\xd1\xf1\xbd\x69\xec"
  7386. "\x93\x11\xf1\xfd\x6f\xcd\x8d\x8d\xce\xd8\x35\x79\x6c\xcf\xd1\xb1\x7d\x69"
  7387. "\xec\x96\x88\xd8\xf9\xcd\x67\x8e\xed\xc9\x63\xcf\x3b\x3a\xb6\x3f\x8d\xdd"
  7388. "\x10\x11\xb3\x5f\x7c\xe6\xd8\xf3\xf2\xd8\xb5\x47\xc7\x6e\x5a\xda\xaf\x32"
  7389. "\x00\x9c\x5d\xd2\xfa\xff\xb5\x11\xb1\xa9\x7d\x78\xbe\xcd\x27\x5a\xff\xcf"
  7390. "\xad\xe1\x1f\xcb\x97\x4b\xbd\xfe\x5f\xb5\xe0\x46\x3d\xf9\xb8\xab\x4e\xc3"
  7391. "\x79\x03\x40\xc9\xd2\x1a\xf9\x6f\xf2\xfa\x7f\xd5\x22\xeb\xff\xef\x46\xc4"
  7392. "\x93\x3f\x5f\x9f\xc7\x75\xd7\xd2\x6b\xf3\xe7\xcf\x3f\x66\x3d\xbf\x2f\x22"
  7393. "\x1e\xfe\xde\x33\xc7\x9e\x9f\xc7\xbe\x68\xc1\x7a\xfe\x8c\x9e\x2c\x00\xd0"
  7394. "\x91\xd6\xff\x4f\x44\xc4\xf7\x7e\x76\x78\xfe\xb9\xfc\xbc\xfe\xcf\xcb\xec"
  7395. "\xa3\xeb\xff\x8f\xad\x3b\xba\x86\xdf\x95\x2f\x97\x7a\xfd\xbf\xe6\x98\xf5"
  7396. "\x7f\x3a\xee\xcb\x4f\xc3\x79\x03\x40\xc9\x52\xff\x7f\x12\x11\xdf\x3d\x70"
  7397. "\x78\xfe\xe7\xed\x27\xd3\xff\xb9\x75\xff\x52\xf7\xbf\xe7\x98\xfe\xa7\xe3"
  7398. "\x5e\x7e\x1a\xce\x1b\x00\x4a\x96\xfa\xff\x54\x44\x7c\xf3\x03\x87\xe7\x5f"
  7399. "\x43\x77\x4c\xff\x1f\x9f\x1b\xbb\xb0\xff\xd7\x5e\x95\x6f\x9f\xff\xbe\x54"
  7400. "\xfd\x3f\xef\x98\xfe\xa7\xe3\x5e\x71\x3a\x4e\x1c\x00\x0a\x96\xfa\xff\xf9"
  7401. "\x88\xf8\xf6\x86\xc3\xf3\xaf\x8b\x3f\x99\xf5\xff\x99\xea\xff\x5a\xfd\x07"
  7402. "\x80\xd3\x2e\xf5\xff\xd6\x88\xf8\xec\x91\xc3\xf3\xcf\xe9\x9f\x4c\xff\x2f"
  7403. "\xcf\xbf\x1d\xb0\xd4\xcf\xff\x9f\x7f\x4c\xff\xd3\x71\xeb\xa7\xe3\xc4\x01"
  7404. "\xa0\x60\xab\xf2\xeb\xff\xfb\x9e\xfa\xd2\xfc\xeb\xf3\x4f\xa6\xff\xc7\x5a"
  7405. "\xaa\xfe\xbf\xc8\x9b\x12\x02\xc0\x69\x57\xc5\xc5\x55\xb7\xcc\xab\xe2\x92"
  7406. "\xce\xb5\xe1\xe6\x48\xc3\xce\x3f\x00\x00\x00\x70\x2e\xe9\xec\xef\x77\xf1"
  7407. "\xdc\xd3\xfd\xd5\x25\x51\x59\xff\x03\x00\x00\xc0\xb9\xa6\x8a\x4b\xf3\xcf"
  7408. "\xff\xd7\xc6\x65\xdd\x6b\xbb\x63\x26\x66\x63\x3a\x3c\x09\x00\x00\x00\x00"
  7409. "\xe7\x88\xce\xcf\xff\x2f\xed\x6e\xe7\x1b\x51\x5d\x16\x95\xf5\x3f\x00\x00"
  7410. "\x00\x9c\x6b\x3e\xd9\xf9\xfd\xff\xce\xef\x00\x74\xde\xfe\xbf\x27\x0e\x75"
  7411. "\xde\xae\x67\x65\xad\xf3\xdc\x40\x55\x45\x7b\x7c\x4d\xf5\x17\x3f\x8c\x89"
  7412. "\x89\x55\xd5\xe3\xe3\xf7\x5c\x5d\xed\x1d\x48\xe3\x06\xf6\xae\xe8\xde\xc1"
  7413. "\x8a\x63\xef\x71\x72\xf8\xf2\xea\x82\x7c\x27\x9d\x8b\xcd\x2b\xf3\xdf\x06"
  7414. "\x1b\xeb\xab\x97\x77\x8f\x36\xbf\x85\xdf\x0f\xf2\xc5\xee\xc5\xe6\x51\x9d"
  7415. "\x86\x09\xc4\xa7\xe3\xf2\xee\x51\x2e\xcf\xfb\x17\xee\x9a\xfb\x4c\xf7\x28"
  7416. "\x6b\x87\x9b\x23\x8d\x8d\x83\xad\x91\xdb\xfa\x62\x60\xe0\x82\xda\x64\xe3"
  7417. "\x9e\xc9\xf7\xee\x9b\x79\x7f\x74\x4e\xff\x53\x63\xa3\x17\x54\xb1\x7b\x66"
  7418. "\x76\x7a\xe3\xfd\xfb\x67\x77\x75\xe6\xd2\xd9\x1c\xe1\xf1\xbd\xf9\x5d\x8a"
  7419. "\xba\x17\x4f\x3f\x7d\x32\x73\x79\xa8\xf3\x7e\x0b\x9d\xdf\xb9\x78\xce\x33"
  7420. "\x5e\xd5\xf9\x45\x8c\x7c\xdc\xb5\xdd\xe3\xf6\x2e\x3c\xff\xfc\xbe\x4c\xc7"
  7421. "\xee\xd4\x7c\xa2\x63\x3e\x11\x57\x74\x8f\x79\x45\x7e\xaf\xc7\xb5\xcf\x3c"
  7422. "\xff\x9e\x74\xcc\xbe\x8d\xc7\x3b\xfb\x3c\x8b\xbe\xe3\x9e\xf9\xc9\xce\x62"
  7423. "\x7d\x77\x16\xeb\xbb\xef\x22\x7d\xd5\xb5\xcf\x31\x8b\xfe\xc5\x66\xd1\xbf"
  7424. "\x70\x16\x2f\xe8\x6b\x71\x12\xb3\xd8\xb4\xd8\x2c\x36\x9d\xe2\x2c\x00\x96"
  7425. "\xcb\xee\x45\x2a\x54\x3d\x3b\xfc\x2f\xe0\xbb\xdc\x99\xa9\xfb\x13\x71\x65"
  7426. "\xf7\x28\x57\x76\xdf\x9d\x78\xe5\xe5\xcf\xf1\x1d\xbd\x77\xb1\xef\xe8\xbd"
  7427. "\xa7\x58\xb7\xaf\xc5\x86\xee\x2c\x36\xcc\x0d\x3e\x5e\x63\xd3\x71\x3f\x73"
  7428. "\x4c\x55\xbf\x9c\x6e\xf0\xe5\xe3\x1e\xb7\x3d\xd2\x5f\xa5\x2f\xe1\x8a\x87"
  7429. "\xf6\x3e\x18\x97\x1c\x7c\xe4\xd0\x8d\x9d\x37\x4e\xdc\x33\xbd\xaf\xbf\x7f"
  7430. "\xd3\xe6\xde\x9b\x7b\x7b\x6f\xe9\x8f\x55\x9d\xd3\xc8\x17\xda\x03\xc0\x73"
  7431. "\xd8\xd0\x79\xfd\x7f\xe7\x35\x00\xc7\xe9\xff\xa2\x23\xaa\x9b\x17\x59\x55"
  7432. "\xbf\x74\xfe\x25\x05\x1b\xe3\xfe\xd8\x1f\xb3\xb1\x2b\x6e\xe8\xfc\xb6\x41"
  7433. "\xe7\x15\x07\xcf\x79\xaf\x6b\x17\xbc\x0c\xe1\x86\x45\x56\xad\x47\xc7\xf6"
  7434. "\xc5\x0d\x8b\xac\xea\x8e\x8e\xed\x7f\x1e\x63\x37\x9d\xf1\xff\x5d\x00\x60"
  7435. "\x29\x6d\x58\xa4\xc3\x27\xd3\xff\x1b\x16\x59\x77\x3f\xb3\xe5\x27\x5e\x1d"
  7436. "\x2f\x6c\x39\x00\xb0\x34\x1a\x13\x3f\xa8\xd6\x4e\x7e\xa2\x9a\x98\x68\x8e"
  7437. "\xdf\xdb\xb7\x75\x6b\xdf\xc0\xe4\xf6\x46\x7d\xa2\x35\x78\x57\x7d\xa2\x39"
  7438. "\xb4\xad\x51\x6f\x8e\x4d\x36\x26\x06\xb7\x0f\x8c\x6d\x6b\xd4\xc7\x27\x5a"
  7439. "\x93\xad\xc1\xd6\x48\xba\x72\x77\x73\xa8\xd1\xae\xb7\xa7\xc6\xc7\x5b\x13"
  7440. "\x93\xf5\xe1\xd6\x44\x7d\xbc\xd5\x6e\xde\x53\x1f\x6e\x8e\x34\xea\xed\x1d"
  7441. "\xed\xc9\xc6\x68\xbd\xdd\x18\x1d\x18\x9b\x6c\x3e\xda\x1e\x1f\x69\x0c\xb4"
  7442. "\x1b\xf5\xc1\xd6\xd8\xe4\xc0\xe0\x64\x7d\xa8\xd9\x1e\xac\x8f\x4f\xdd\x31"
  7443. "\xd2\x6c\x6f\x6f\x4c\x74\x6e\xdc\x1e\x6f\x0c\x36\x87\x9b\x83\x03\x93\xcd"
  7444. "\xd6\x58\xbd\xdd\x9a\x9a\x18\x6c\x6c\xac\xd7\xdb\x8d\xc6\x82\x81\xcd\xa1"
  7445. "\xc6\xd8\x64\x73\xb8\x99\xae\x8e\xd5\xc7\x27\x9a\xa3\x03\x13\x3b\xea\x77"
  7446. "\xb7\x46\xa6\x46\x1b\xf5\xa1\x46\x7b\x70\xa2\x39\x3e\xd9\xea\xde\xe1\xdc"
  7447. "\xb1\x9a\x63\xc3\xad\x89\xd1\xce\xdd\x6e\x5c\xee\x2f\x36\x00\x9c\x25\x0e"
  7448. "\x3e\x72\xe8\x81\x9d\xb3\xb3\xd3\x07\x96\xf0\xca\x72\x9f\x23\x00\xf0\x4c"
  7449. "\x8b\x54\x7a\xf5\x19\x9f\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7450. "\xf0\x2c\x67\xe2\xf7\xff\x5c\x71\xe5\x7f\xde\x95\xa7\x9f\x7e\xfa\xd1\xf4"
  7451. "\xff\x90\xb3\x65\x3e\x67\xfa\xca\x72\x7f\x67\x02\x96\x5a\x2d\x6a\x71\x24"
  7452. "\x22\xaa\xef\x1f\xa9\x3a\xef\xcc\xf7\x58\x44\x3d\xba\x97\x36\x00\x06\x80"
  7453. "\x73\x53\xea\xff\x8f\x72\xff\xaf\xd2\x7f\x00\x28\x42\xea\xff\x3f\xe7\xfe"
  7454. "\x5f\xad\xff\x00\x50\x84\xd4\xff\x7f\xc9\xfd\xbf\x46\xff\x01\xa0\x08\xa9"
  7455. "\xff\xff\x9a\xfb\xff\x2a\xfd\x07\x80\x22\xa4\xfe\xff\x5b\xee\xff\xab\xf5"
  7456. "\x1f\x00\x8a\x90\xfa\xff\xe3\xdc\xff\x6b\xf5\x1f\x00\x8a\x90\xfa\xff\xef"
  7457. "\xb9\xff\xd7\xe9\x3f\x00\x14\x21\xf5\xff\x3f\x72\xff\xaf\xd7\x7f\x00\x28"
  7458. "\x42\xea\xff\x7f\xe6\xfe\xbf\x46\xff\x01\xa0\x08\xa9\xff\xff\x95\xfb\x7f"
  7459. "\x83\xfe\x03\x40\x11\x52\xff\x7f\x92\xfb\x7f\xa3\xfe\x03\x40\x11\x52\xff"
  7460. "\x7f\x9a\xfb\xbf\x51\xff\x01\xa0\x08\xa9\xff\x3f\xcb\xfd\xbf\x49\xff\x01"
  7461. "\xa0\x08\xa9\xff\x3f\xcf\xfd\xef\xd5\x7f\x00\x28\x42\xea\xff\xd3\xb9\xff"
  7462. "\x7d\xfa\x0f\x00\x45\x48\xfd\x8f\xdc\xff\x7e\xfd\x07\x80\x22\xa4\xfe\x57"
  7463. "\xb9\xff\x9b\xf4\x1f\x00\x8a\x50\xcb\xcf\x00\xa4\xfe\xdf\xac\xff\x00\x50"
  7464. "\x84\x54\xff\x15\xb9\xff\xb7\xe8\x3f\x00\x14\x21\xf5\x7f\x65\xee\xff\x66"
  7465. "\xfd\x07\x80\x22\xa4\xfe\xaf\xca\xfd\xdf\xa2\xff\x00\x50\x84\xd4\xff\xd5"
  7466. "\xb9\xff\xb7\xea\x3f\x00\x14\x21\xf5\x7f\x4d\xee\xff\x56\xfd\x07\x80\x22"
  7467. "\xa4\xfe\xf7\xe4\xfe\xbf\x56\xff\x01\xa0\x08\xa9\xff\xe7\xe5\xfe\xdf\xa6"
  7468. "\xff\x00\x50\x84\xd4\xff\xb5\xb9\xff\xb7\xeb\x3f\x00\x14\x21\xf5\xff\xfc"
  7469. "\xdc\xff\xd7\xe9\x3f\x00\x14\x21\xf5\xff\x45\xb9\xff\xaf\xd7\x7f\x00\x28"
  7470. "\x42\xea\xff\x8b\x73\xff\xdf\xa0\xff\x00\x50\x84\xd4\xff\x0b\x72\xff\xdf"
  7471. "\xa8\xff\x00\x50\x84\xd4\xff\x97\xe4\xfe\x0f\xe8\x3f\x00\x14\x21\xf5\x7f"
  7472. "\x5d\xee\xff\x1d\xfa\x0f\x00\x45\x48\xfd\xbf\x30\xf7\x7f\x50\xff\x01\xa0"
  7473. "\x08\xa9\xff\x2f\xcd\xfd\x1f\xd2\x7f\x00\x28\x42\xea\xff\x45\xb9\xff\x0d"
  7474. "\xfd\x07\x80\x22\xa4\xfe\xbf\x2c\xf7\x7f\x58\xff\x01\xa0\x08\xa9\xff\x17"
  7475. "\xe7\xfe\x6f\xd3\x7f\x00\x28\x42\xea\xff\x25\xb9\xff\xdb\xf5\x1f\x00\x8a"
  7476. "\x90\xfa\x7f\x69\xee\x7f\x53\xff\x01\xa0\x08\xa9\xff\x97\xe5\xfe\xdf\xa9"
  7477. "\xff\x00\x50\x84\xd4\xff\x97\xe7\xfe\xdf\xa5\xff\x00\x50\x84\xd4\xff\xcb"
  7478. "\x73\xff\x47\xf4\x1f\x00\x8a\x90\xfa\x7f\x45\xee\xff\xa8\xfe\x03\x40\x11"
  7479. "\x52\xff\xd7\xe7\xfe\x8f\xe9\x3f\x00\x14\x21\xf5\xff\x15\xb9\xff\x2d\xfd"
  7480. "\x07\x80\x22\xa4\xfe\xff\xaf\xdc\xff\x71\xfd\x07\x80\x22\xa4\xfe\xbf\x32"
  7481. "\xf7\xff\x4d\xfa\x0f\x00\x45\x48\xfd\xaf\xe7\xfe\x4f\xe8\x3f\x00\x14\x21"
  7482. "\xf5\xff\xca\xdc\xff\xb6\xfe\x03\x40\x11\x52\xff\x37\xe4\xfe\x4f\xea\x3f"
  7483. "\x00\x14\x21\xf5\xff\xaa\xdc\xff\x29\xfd\x07\x80\x22\xa4\xfe\x5f\x9d\xfb"
  7484. "\x7f\xb7\xfe\x03\x40\x11\x52\xff\xaf\xc9\xfd\x7f\xb3\xfe\x03\x40\x11\x52"
  7485. "\xff\x5f\x95\xfb\x7f\x8f\xfe\x03\x40\x11\x52\xff\x5f\x9d\xfb\xbf\x43\xff"
  7486. "\x01\xa0\x08\xa9\xff\xd7\xe6\xfe\xbf\x45\xff\x01\xa0\x08\xa9\xff\xd7\xe5"
  7487. "\xfe\xbf\x55\xff\x01\xa0\x08\xa9\xff\xd7\xe7\xfe\xbf\x4d\xff\x01\xa0\x08"
  7488. "\xa9\xff\xaf\xc9\xfd\x7f\xbb\xfe\x03\x40\x11\x52\xff\x6f\xc8\xfd\x7f\x87"
  7489. "\xfe\x03\x40\x11\x52\xff\x6f\xcc\xfd\xbf\x57\xff\x01\xa0\x08\xa9\xff\x1b"
  7490. "\x73\xff\xdf\xa9\xff\x00\x50\x84\xd4\xff\x9b\x72\xff\x77\xea\x3f\x00\x14"
  7491. "\x21\xf5\xbf\x37\xf7\xff\x3e\xfd\x07\x80\x22\xa4\xfe\xf7\xe5\xfe\xdf\xaf"
  7492. "\xff\x00\x50\x84\xd4\xff\xfe\xdc\xff\x5d\xfa\x0f\x00\x45\x48\xfd\xdf\x94"
  7493. "\xfb\x3f\xad\xff\x00\x50\x84\xd4\xff\x9b\x73\xff\x77\xeb\x3f\x00\x14\x21"
  7494. "\xf5\xff\x96\xdc\xff\x3d\xfa\x0f\x00\x45\x48\xfd\xdf\x1c\x11\xab\x22\xe2"
  7495. "\x5d\xfa\x0f\x00\x45\x48\xfd\xdf\x92\xd7\xff\x33\xfa\x0f\x00\x45\x48\xfd"
  7496. "\xbf\x35\xf7\xff\xdd\xfa\x0f\x00\x45\x48\xfd\xdf\x9a\xfb\xff\x80\xfe\x03"
  7497. "\x40\x11\x52\xff\x5f\x9b\xfb\x3f\xab\xff\x00\x50\x84\xd4\xff\xdb\x72\xff"
  7498. "\xf7\xea\x3f\x00\x14\x21\xf5\xff\xf6\xdc\xff\x7d\xfa\x0f\x00\x45\x48\xfd"
  7499. "\x7f\x5d\xee\xff\x7e\xfd\x07\x80\x22\xa4\xfe\xbf\x3e\xf7\xff\x41\xfd\x07"
  7500. "\x80\x22\xa4\xfe\xbf\x21\xf7\xff\x3d\xfa\x0f\x00\x45\x48\xfd\x7f\x63\xee"
  7501. "\xff\x01\xfd\x07\x80\x22\xa4\xfe\x0f\xe4\xfe\x1f\xd4\x7f\x00\x28\x42\xea"
  7502. "\xff\x1d\xb9\xff\x0f\xe9\x3f\x00\x14\x21\xf5\x7f\x30\xf7\xff\xbd\xfa\x0f"
  7503. "\x00\x45\x48\xfd\x1f\xca\xfd\x7f\x58\xff\x01\xa0\x08\xa9\xff\x8d\xdc\xff"
  7504. "\xf7\xe9\x3f\x00\x14\x21\xf5\x7f\x38\xf7\xff\xfd\xfa\x0f\x00\x45\x48\xfd"
  7505. "\xdf\x96\xfb\xff\x88\xfe\x03\x40\x11\x52\xff\xb7\xe7\xfe\x1f\xd2\x7f\x00"
  7506. "\x28\x42\xea\x7f\x33\xf7\xff\x03\xfa\x0f\x00\x45\x48\xfd\xbf\x33\xf7\xff"
  7507. "\x83\xfa\x0f\x00\x45\x48\xfd\xbf\x2b\xf7\xff\x43\xfa\x0f\x00\x45\x48\xfd"
  7508. "\x1f\xc9\xfd\xff\xb0\xfe\x03\x40\x11\x52\xff\x47\x73\xff\x1f\xd5\x7f\x00"
  7509. "\x28\x42\xea\xff\x58\xee\xff\x63\xfa\x0f\x00\x45\x48\xfd\x6f\xe5\xfe\x3f"
  7510. "\xae\xff\x00\x50\x84\xd4\xff\xf1\xdc\xff\x8f\xe8\x3f\x00\x14\x21\xf5\xff"
  7511. "\x4d\xb9\xff\x1f\xd5\x7f\x00\x28\x42\xea\xff\x44\xee\xff\xc7\xf4\x1f\x00"
  7512. "\x8a\x90\xfa\xdf\xce\xfd\xff\xb8\xfe\x03\x40\x11\x52\xff\x27\x73\xff\x9f"
  7513. "\xd0\x7f\x00\x28\x42\xea\xff\x54\xee\xff\x27\xf4\x1f\x00\x8a\x90\xfa\x7f"
  7514. "\x77\xee\xff\x27\xf5\x1f\x00\x8a\x90\xfa\xff\xe6\xdc\xff\x4f\xe9\x3f\x00"
  7515. "\x14\x21\xf5\xff\x9e\xdc\xff\xff\xad\xff\x00\x50\x84\xd4\xff\x1d\xb9\xff"
  7516. "\xff\x47\xff\x01\xa0\x08\xa9\xff\x6f\xc9\xfd\xff\xb4\xfe\x03\x40\x11\x52"
  7517. "\xff\xdf\x9a\xfb\xff\x19\xfd\x07\x80\x22\xa4\xfe\xbf\x2d\xf7\xff\xb3\xfa"
  7518. "\x0f\x00\x45\x48\xfd\x7f\x7b\xee\xff\xe7\xf4\x1f\x00\x8a\x90\xfa\xff\x8e"
  7519. "\xdc\xff\xff\xab\xff\x00\x50\x84\xd4\xff\x7b\x73\xff\x3f\xaf\xff\x00\x50"
  7520. "\x84\xd4\xff\x77\xe6\xfe\x7f\x41\xff\x01\xa0\x08\xa9\xff\x3b\x73\xff\xbf"
  7521. "\xa8\xff\x00\x50\x84\xd4\xff\xfb\x72\xff\xff\x9f\xfe\x03\x40\x11\x52\xff"
  7522. "\xef\xcf\xfd\xff\xff\xfa\x0f\x00\x45\x48\xfd\xdf\x95\xfb\xff\x0b\xfa\x0f"
  7523. "\x00\x45\x48\xfd\x9f\xce\xfd\xff\x45\xfd\x07\x80\x22\xa4\xfe\xef\xce\xfd"
  7524. "\xff\x25\xfd\x07\x80\x22\xa4\xfe\xef\xc9\xfd\xff\x65\xfd\x07\x80\x22\xa4"
  7525. "\xfe\xbf\x2b\xf7\xff\x57\xf4\x1f\x00\x8a\x90\xfa\x3f\x93\xfb\xff\xab\xfa"
  7526. "\x0f\x00\x45\x48\xfd\x7f\x77\xee\xff\xaf\xe9\x3f\x00\x14\x21\xf5\xff\x81"
  7527. "\xdc\xff\x5f\xd7\x7f\x00\x28\x42\xea\xff\x6c\xee\xff\x6f\xe8\x3f\x00\x14"
  7528. "\x21\xf5\x7f\x6f\xee\xff\x6f\xea\x3f\x00\x14\x21\xf5\x7f\x5f\xee\xff\x97"
  7529. "\xf4\x1f\x00\x8a\x90\xfa\xbf\x3f\xf7\xff\xcb\xfa\x0f\x00\x45\x48\xfd\x7f"
  7530. "\x30\xf7\xff\xb7\xf4\x1f\x00\x8a\x90\xfa\xff\x9e\xdc\xff\xdf\xd6\x7f\x00"
  7531. "\x28\x42\xea\xff\x81\xdc\xff\xdf\xd1\x7f\x00\x28\x42\xea\xff\xc1\xdc\xff"
  7532. "\xaf\xe8\x3f\x00\x14\x21\xf5\xff\xa1\xdc\xff\xaf\xea\x3f\x00\x14\x21\xf5"
  7533. "\xff\xbd\xb9\xff\xbf\xab\xff\x00\x50\x84\xd4\xff\x87\x73\xff\x0f\xeb\x3f"
  7534. "\x00\x14\x21\xf5\xff\x7d\xb9\xff\xbf\xa7\xff\x00\x50\x84\xd4\xff\xf7\xe7"
  7535. "\xfe\x7f\x4d\xff\x01\xa0\x08\xa9\xff\x8f\xe4\xfe\xff\xbe\xfe\x03\x40\x11"
  7536. "\x52\xff\x0f\xe5\xfe\xff\x81\xfe\x03\x40\x11\x52\xff\x3f\x90\xfb\xff\x87"
  7537. "\xfa\x0f\x00\x45\x48\xfd\xff\x60\xee\xff\xd7\xf5\x1f\x00\x8a\x90\xfa\xff"
  7538. "\xa1\xdc\xff\x27\xf5\x1f\x00\x8a\x90\xfa\xff\xe1\xdc\xff\x3f\xd2\x7f\x00"
  7539. "\x28\x42\xea\xff\xa3\xb9\xff\xdf\xd0\x7f\x00\x28\x42\xea\xff\x63\xb9\xff"
  7540. "\x7f\xac\xff\x00\x50\x84\xd4\xff\xc7\x73\xff\xbf\xa9\xff\x00\x50\x84\xd4"
  7541. "\xff\x8f\xe4\xfe\xff\x89\xfe\x03\x40\x11\x52\xff\x3f\x9a\xfb\xff\x2d\xfd"
  7542. "\x07\x80\x22\xa4\xfe\x7f\x2c\xf7\xff\xdb\xfa\x0f\x00\x45\x48\xfd\xff\x78"
  7543. "\xee\xff\x9f\xea\x3f\x00\x14\x21\xf5\xff\x89\xdc\xff\x3f\xd3\x7f\x00\x28"
  7544. "\xc2\x7f\x07\x00\x00\xff\xff\x81\x63\x0f\x16",
  7545. 4709);
  7546. syz_mount_image(/*fs=*/0x200000001240, /*dir=*/0x200000001280, /*flags=*/0,
  7547. /*opts=*/0x200000000740, /*chdir=*/1, /*size=*/0x1265,
  7548. /*img=*/0x2000000047c0);
  7549. for (int i = 0; i < 32; i++) {
  7550. syz_mount_image(/*fs=*/0x200000001240, /*dir=*/0x200000001280, /*flags=*/0,
  7551. /*opts=*/0x200000000740, /*chdir=*/1, /*size=*/0x1265,
  7552. /*img=*/0x2000000047c0);
  7553. }
  7554. memcpy((void*)0x200000000000, "/dev/rfkill\000", 12);
  7555. res = syscall(
  7556. __NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000000ul,
  7557. /*flags=O_TRUNC|O_CLOEXEC|O_APPEND|O_RDWR*/ 0x80602, /*mode=*/0);
  7558. if (res != -1)
  7559. r[159] = res;
  7560. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x10);
  7561. if (res != -1)
  7562. r[160] = res;
  7563. res = syscall(__NR_epoll_create1, /*flags=*/0ul);
  7564. if (res != -1)
  7565. r[161] = res;
  7566. syscall(__NR_epoll_pwait2, /*epfd=*/r[161], /*events=*/0x200000000000ul,
  7567. /*maxevents=*/1ul, /*timeout=*/0ul, /*sigmask=*/0ul, /*size=*/0ul);
  7568. *(uint32_t*)0x200000001100 = 0x20000016;
  7569. *(uint64_t*)0x200000001104 = 0;
  7570. syscall(__NR_epoll_ctl, /*epfd=*/r[161], /*op=*/1ul, /*fd=*/r[160],
  7571. /*ev=*/0x200000001100ul);
  7572. *(uint32_t*)0x200000000040 = 0;
  7573. *(uint8_t*)0x200000000044 = 6;
  7574. *(uint8_t*)0x200000000045 = 3;
  7575. *(uint8_t*)0x200000000046 = 0;
  7576. *(uint8_t*)0x200000000047 = 0;
  7577. syscall(__NR_write, /*fd=*/r[159], /*data=*/0x200000000040ul, /*len=*/8ul);
  7578. memcpy((void*)0x200000000080, "ext3\000", 5);
  7579. memcpy((void*)0x200000000480, "./file0\000", 8);
  7580. memcpy((void*)0x200000000900, "init_itable", 11);
  7581. *(uint8_t*)0x20000000090b = 0x2c;
  7582. memcpy((void*)0x20000000090c, "resgid", 6);
  7583. *(uint8_t*)0x200000000912 = 0x2c;
  7584. sprintf((char*)0x200000000913, "0x%016llx", (long long)0xee00);
  7585. *(uint8_t*)0x200000000925 = 0x2c;
  7586. memcpy((void*)0x200000000926, "bh", 2);
  7587. *(uint8_t*)0x200000000928 = 0x2c;
  7588. memcpy((void*)0x200000000929, "noload", 6);
  7589. *(uint8_t*)0x20000000092f = 0x2c;
  7590. memcpy((void*)0x200000000930, "errors=remount-ro", 17);
  7591. *(uint8_t*)0x200000000941 = 0x2c;
  7592. memcpy((void*)0x200000000942, "usrjquota=", 10);
  7593. *(uint8_t*)0x20000000094c = 0x2c;
  7594. *(uint8_t*)0x20000000094d = 0;
  7595. memcpy(
  7596. (void*)0x200000000980,
  7597. "\x78\x9c\xec\xdb\xcd\x6f\x14\x65\x18\x00\xf0\x67\x66\xbb\xe5\xdb\x56\xc4"
  7598. "\x0f\x10\xb4\x8a\x46\xe2\x47\x4b\xcb\x87\x1c\xbc\x68\x34\xf1\xa0\x89\x89"
  7599. "\x1e\x30\x9e\xea\xb6\x10\xa4\x50\x43\x6b\x22\xa4\x51\xf4\x80\x47\x43\xa2"
  7600. "\x67\xe3\xd1\x44\xff\x01\x4f\x7a\x31\xea\xc9\xc4\xab\xde\x0d\x09\x31\xbd"
  7601. "\x80\x9e\xd6\xcc\xce\x4c\x59\xda\xdd\x42\xe9\xb6\x5b\xd9\xdf\x2f\x99\xf6"
  7602. "\x7d\x77\xde\xcd\xfb\x3c\x33\xf3\xee\xbe\x33\xb3\x13\x40\xcf\x1a\xca\xfe"
  7603. "\x24\x11\xdb\x23\xe2\x8f\x88\x18\xc8\xab\x37\x37\x18\xca\xff\x5d\x9f\x9f"
  7604. "\xab\xfd\x33\x3f\x57\x4b\xa2\x5e\x7f\xf3\xef\xa4\xd1\xee\xda\xfc\x5c\xad"
  7605. "\x6c\x5a\xbe\x6f\x5b\x5e\xa9\xd7\x8b\xfa\xa6\x16\xfd\x5e\x7a\x27\x62\x7c"
  7606. "\x6a\x6a\xf2\x5c\x51\x1f\x99\x3d\xf3\xfe\xc8\xcc\xf9\x0b\xcf\x9d\x3a\x33"
  7607. "\x7e\x72\xf2\xe4\xe4\xd9\xb1\x63\xc7\x0e\x1f\xda\xd7\x7f\x74\xec\x48\x47"
  7608. "\xf2\xcc\xf2\xba\xb6\xe7\xa3\xe9\xbd\xbb\x5f\x7d\xfb\xf2\xeb\xb5\xe3\x97"
  7609. "\xdf\xfd\xe5\xdb\x2c\xde\xed\xc5\xfa\xe6\x3c\x3a\x65\x28\xdf\xba\x2d\x3d"
  7610. "\xd9\xe9\xce\xba\x6c\x47\x53\x39\xe9\xeb\x62\x20\xac\x48\x25\x22\xb2\xdd"
  7611. "\x55\x6d\x8c\xff\x81\xa8\xc4\x96\x85\x75\x03\xf1\xca\xa7\x5d\x0d\x0e\x58"
  7612. "\x53\xf5\x7a\xbd\xde\xea\xfb\xb9\x70\xb1\x0e\xdc\xb5\xb2\xb9\x5a\xb7\x63"
  7613. "\x00\xba\x23\xff\x9a\x2f\xcf\xdc\xe7\x6a\x6b\x71\x1e\xbc\x91\x5d\x7d\x31"
  7614. "\x3f\x01\xca\xf2\xbe\x5e\x2c\xf9\x9a\xbe\x48\x8b\x36\xd5\x45\xe7\xb7\x9d"
  7615. "\x34\x14\x11\xc7\x2f\xfe\xfb\x55\xb6\xc4\x1a\x5d\x87\x00\x00\x68\xf6\x43"
  7616. "\x36\xff\x79\x36\x9f\x77\x94\x4b\xbe\x26\x8d\x07\x9a\xda\xdd\x53\xdc\x43"
  7617. "\x19\x8c\x88\x7b\x23\x62\x67\x44\xdc\x17\x11\xbb\x22\xe2\xfe\x88\x46\xdb"
  7618. "\x07\x23\xe2\xa1\x15\xf6\xbf\xf8\x0e\xc9\xd2\xf9\x4f\x7a\xe5\x8e\x12\xbb"
  7619. "\x4d\xd9\xfc\xef\x85\xe2\xde\xd6\xcd\xf3\xbf\x72\xf6\x17\x83\x95\xa2\xb6"
  7620. "\xa3\x91\x7f\x35\x39\x71\x6a\x6a\xf2\x60\xb1\x4d\x0e\x44\x75\x53\x56\x1f"
  7621. "\x5d\xa6\x8f\x1f\x5f\xfe\xfd\xf3\x76\xeb\x9a\xe7\x7f\xd9\x72\xbd\x2f\x22"
  7622. "\xf2\xb9\xe0\x77\x45\x93\xc3\x5f\x2e\xba\x40\x37\x31\x3e\x3b\xbe\xca\xb4"
  7623. "\x17\x5c\xfd\x24\x62\x4f\x5f\xab\xfc\x93\x28\x6f\xe3\x64\x67\x07\xbb\x23"
  7624. "\x62\xcf\x1d\xf6\x71\xea\xe9\x6f\xf6\xb6\x5b\xb7\x24\xff\xf9\xb9\x5a\x39"
  7625. "\x17\xbe\xa5\x0e\xdc\x67\xaa\x7f\x1d\xf1\x54\xbe\xff\x2f\xc6\xa2\xfc\x4b"
  7626. "\x49\xdb\xfb\x93\xa3\xcf\x1f\x1d\x3b\x32\xb2\x39\xa6\x26\x0f\x8e\x94\x47"
  7627. "\xc5\x52\xbf\xfe\x76\xe9\x8d\x76\xfd\xaf\x2a\xff\x0e\xc8\xf6\xff\xd6\x96"
  7628. "\xc7\xff\x42\xfe\x83\xc9\xe6\x88\x99\xf3\x17\x4e\x37\xee\xd7\xce\xac\xbc"
  7629. "\x8f\x4b\x7f\x7e\xd6\xf6\x9c\xe6\xd6\xf9\xa7\x57\xfa\x5a\x1c\xff\xfd\xc9"
  7630. "\x5b\x8d\x72\x7f\xf1\xda\x87\xe3\xb3\xb3\xe7\x46\x23\xfa\x93\xd7\x96\xbe"
  7631. "\x3e\x76\xe3\xbd\x65\xbd\x6c\x9f\xe5\x7f\x60\x7f\xeb\xf1\xbf\x33\x6e\x6c"
  7632. "\x89\x87\x23\x22\x3b\x88\xf7\x45\xc4\x23\x11\xf1\x68\x11\xfb\x63\x11\xf1"
  7633. "\x78\x44\xec\x5f\x26\xff\x9f\x5f\x7a\xe2\xbd\x95\xe7\xbf\xcc\x55\xf9\x0e"
  7634. "\xca\xf2\x9f\xb8\xd5\xfe\x8f\xe6\xfd\xbf\xf2\x42\xe5\xf4\x4f\xdf\xaf\x3c"
  7635. "\xff\x52\xb6\xff\x0f\x37\x4a\x07\x8a\x57\x6e\xe7\xf3\xef\x46\x14\x95\x65"
  7636. "\x63\x5f\xcd\xb6\x03\x00\x00\x80\xff\x8b\xb4\xf1\x1b\xf8\x24\x1d\x5e\x28"
  7637. "\xa7\xe9\xf0\x70\xfe\x1b\xfe\x5d\xb1\x35\x9d\x9a\x9e\x99\x7d\xe6\xc4\xf4"
  7638. "\x07\x67\x27\xf2\xdf\xca\x0f\x46\x35\x2d\xaf\x74\x0d\x34\x5d\x0f\x1d\x2d"
  7639. "\xae\x0d\x97\xf5\xb1\x45\xf5\x43\xc5\x75\xe3\x2f\x2a\x5b\x1a\xf5\xe1\xda"
  7640. "\xf4\xd4\x44\xb7\x93\x87\x1e\xb7\xad\xcd\xf8\xcf\xfc\x55\xe9\x76\x74\xc0"
  7641. "\x9a\xf3\xbc\x16\xf4\x2e\xe3\x1f\x7a\x97\xf1\x0f\xbd\xeb\xb6\xc6\x7f\x92"
  7642. "\xac\x7d\x20\xc0\xba\x6b\x31\xfe\xab\x65\xa1\x3e\xb0\xce\xc1\x00\xeb\xaa"
  7643. "\xd5\xf7\xff\xc7\x5d\x88\x03\x58\x7f\xce\xff\xa1\x77\x19\xff\xd0\xbb\x8c"
  7644. "\x7f\xe8\x5d\xc6\x3f\xf4\xa4\xb6\xcf\xc6\xa7\xab\x7a\xe4\xbf\x0b\x85\xec"
  7645. "\x43\xac\xf5\x13\xfe\x1b\x25\xc2\x0e\x14\xaa\x1b\x23\x8c\xac\x10\xe9\x86"
  7646. "\x08\xe3\xee\x2f\xf4\xc5\x1a\x77\xb1\xa9\xe5\xaa\x6e\x7f\x32\x01\x00\x00"
  7647. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7648. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7649. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7650. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7651. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7652. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7653. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7654. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7655. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7656. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7657. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7658. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7659. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x74\xc6\x7f\x01\x00\x00\xff\xff\xf2"
  7660. "\x8f\xd9\x8a",
  7661. 1137);
  7662. syz_mount_image(
  7663. /*fs=*/0x200000000080, /*dir=*/0x200000000480,
  7664. /*flags=MS_I_VERSION|MS_SLAVE|MS_PRIVATE|MS_POSIXACL|MS_RELATIME|MS_NOSUID|0xc0400004*/
  7665. 0xc0ed0006, /*opts=*/0x200000000900, /*chdir=*/-1, /*size=*/0x471,
  7666. /*img=*/0x200000000980);
  7667. memcpy((void*)0x200000000000, "/dev/loop#\000", 11);
  7668. res = -1;
  7669. res = syz_open_dev(/*dev=*/0x200000000000, /*id=*/0, /*flags=*/0);
  7670. if (res != -1)
  7671. r[162] = res;
  7672. memcpy((void*)0x2000000000c0, "vfat\000", 5);
  7673. memcpy((void*)0x2000000001c0, "./file0\000", 8);
  7674. *(uint16_t*)0x200000000080 = 0;
  7675. sprintf((char*)0x200000000082, "%023llo", (long long)-1);
  7676. memcpy(
  7677. (void*)0x200000000480,
  7678. "\x78\x9c\xec\xdc\xcf\x4f\x13\x41\x14\xc0\xf1\x47\x29\xa5\x2d\xa1\xed\xc1"
  7679. "\x68\x34\x31\x4c\xf4\xa2\x97\x0d\x54\xcf\xc6\xc6\x40\x62\x6c\x22\x01\x6a"
  7680. "\x04\x13\x93\x05\xb6\xda\x74\x6d\x49\xb7\xc1\xd4\x18\xd1\x93\x57\xe3\x1f"
  7681. "\xe1\x81\x70\xe4\x46\xa2\xfc\x03\x5c\xbc\xe9\xc5\x8b\x37\x2e\x26\x1e\xe4"
  7682. "\x60\x5c\xb3\xbf\x68\x0b\x05\x4c\xa1\x14\xe1\xfb\x49\xc8\xbe\xee\xcc\x5b"
  7683. "\x66\x32\x85\xbc\x69\x76\xbb\xf9\xf0\xdd\xb3\x62\xde\xd2\xf2\x7a\x55\x42"
  7684. "\x51\x25\x3d\x22\x22\x5b\x22\x29\x09\x49\xa0\xc7\x3f\x86\xdc\x38\x22\x8d"
  7685. "\x5e\xcb\xf5\x81\x9f\x5f\x2e\x4f\x4e\xcf\xdc\xcb\x64\xb3\xa3\x13\x4a\x8d"
  7686. "\x65\xa6\x6e\xa4\x95\x52\x89\xa1\x8f\xcf\x5f\xc6\xfc\x6e\x6b\xfd\xb2\x91"
  7687. "\x7a\xbc\xf9\x23\xfd\x7d\xe3\xfc\xc6\xc5\xcd\x3f\x53\x4f\x0b\x96\x2a\x58"
  7688. "\xaa\x54\xae\x2a\x5d\xcd\x96\xbf\x55\xf5\x59\xd3\x50\xf3\x05\xab\xa8\x29"
  7689. "\x35\x6e\x1a\xba\x65\xa8\x42\xc9\x32\x2a\x5e\x7b\xd9\x6b\xcf\x9b\xe5\x85"
  7690. "\x85\x9a\xd2\x4b\xf3\x83\xf1\x85\x8a\x61\x59\x4a\x2f\xd5\x54\xd1\xa8\xa9"
  7691. "\x6a\x59\x55\x2b\x35\xa5\x3f\xd1\x0b\x25\xa5\x69\x9a\x1a\x8c\x0b\x0e\x92"
  7692. "\x5b\x9e\x98\xd0\x33\x6d\x26\xcf\x1d\xf1\x60\xd0\x21\x95\x4a\x46\xef\x15"
  7693. "\x91\xd8\xae\x96\xdc\x72\x57\x06\x04\x00\x00\xba\x6a\x67\xfd\x1f\x72\x4a"
  7694. "\xfa\xb6\xea\x7f\x49\xb8\xf5\xbf\xd3\xb9\x5e\xff\xaf\x5c\x59\xaf\x0e\x3c"
  7695. "\x58\x4d\xf8\xf5\xff\x5a\xa4\x55\xfd\x7f\xf3\xab\x77\xad\xa6\xfa\x3f\x2a"
  7696. "\x22\x1d\xaf\xff\x77\x57\x44\x67\xcb\xa1\xea\x7f\x9c\x0c\x43\x91\x5d\xa7"
  7697. "\x7a\x9a\x5e\x39\xf5\x7f\xdc\xff\xfb\x75\xbd\x79\xb4\x32\xec\x06\xd4\xff"
  7698. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfc"
  7699. "\x0f\xb6\x6c\x3b\x69\xdb\x76\x32\x38\x06\x3f\xf5\x47\x08\xfc\xd7\x38\x95"
  7700. "\xf6\x5a\xff\x7e\x11\x89\x3a\xab\x6f\xb3\xfe\xa7\xd9\xe4\xf4\x8c\x44\xdd"
  7701. "\x07\xf7\xc2\x09\x11\xf3\xed\x62\x6e\x31\xe7\x1d\xfd\x0e\xeb\x22\x62\x8a"
  7702. "\x21\xc3\x92\x94\xdf\xee\xfb\xc1\xe7\xc4\xc1\x93\x47\xca\x91\x92\x4f\xe6"
  7703. "\x92\x9f\xbf\xb4\x98\xeb\x75\x5b\x32\x79\x29\xb8\xf9\x23\x92\x94\xd4\xce"
  7704. "\x7c\xdb\x1e\xbb\x9b\x1d\x1d\x51\x9e\xe6\xfc\x3e\x89\x37\xe6\xa7\x25\x29"
  7705. "\xe7\x5a\xe7\xa7\x5b\xe6\x47\xe4\xda\xd5\x86\x7c\x4d\x92\xf2\x79\x4e\xca"
  7706. "\x62\xca\xbc\xfb\xbe\xae\xe7\xbf\x1a\x51\xea\xce\xfd\xec\x8e\xfc\x98\xdb"
  7707. "\x0f\x00\x00\x00\x00\x80\xd3\x40\x53\xdb\x5a\xee\xdf\x35\x6d\xaf\x76\x2f"
  7708. "\x7f\x7b\x7f\xdd\xf2\xf3\x01\x6f\x7f\x3d\xdc\x72\x7f\x1e\x4e\x5e\x0a\x77"
  7709. "\x77\xee\x00\x00\x00\x00\x00\x9c\x15\x56\xed\x45\x51\x37\x4d\xa3\xb2\x4f"
  7710. "\x10\x93\x83\xfb\xb4\x1f\x84\xdb\x4b\xef\xdb\xaf\x4f\x6f\xc3\x0c\xff\xf5"
  7711. "\x82\x11\xf7\x7e\x17\x91\xce\xcd\x74\x9f\x20\xb8\x91\xa2\xa9\x29\xea\x9f"
  7712. "\x6c\xef\xca\xc1\xfc\x3b\x33\xe6\x90\xb4\x93\x35\xe4\x8c\x47\x1d\xf6\xb7"
  7713. "\x07\x1f\x1b\xed\xd5\x47\xc6\xbb\xb0\x82\x6e\x70\xe1\xfd\x87\x5f\x47\x77"
  7714. "\xc1\x5b\xab\xd1\x03\x66\xda\xb1\xa0\xef\x38\xfe\xf7\x00\x00\x00\x00\x38"
  7715. "\x5e\xf5\xa2\x3f\x38\x73\xbb\xbb\x03\x02\x00\x00\x00\x00\x00\x00\x00\x00"
  7716. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x0c\x3a\x8e"
  7717. "\xaf\x13\xeb\xf6\x1c\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  7718. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x93\xe2\x6f"
  7719. "\x00\x00\x00\xff\xff\x7f\xe1\x04\x71",
  7720. 747);
  7721. syz_mount_image(
  7722. /*fs=*/0x2000000000c0, /*dir=*/0x2000000001c0,
  7723. /*flags=MS_I_VERSION|MS_STRICTATIME|MS_NODEV|0x200*/ 0x1800204,
  7724. /*opts=*/0x200000000080, /*chdir=*/8, /*size=*/0x2eb,
  7725. /*img=*/0x200000000480);
  7726. for (int i = 0; i < 32; i++) {
  7727. syz_mount_image(
  7728. /*fs=*/0x2000000000c0, /*dir=*/0x2000000001c0,
  7729. /*flags=MS_I_VERSION|MS_STRICTATIME|MS_NODEV|0x200*/ 0x1800204,
  7730. /*opts=*/0x200000000080, /*chdir=*/8, /*size=*/0x2eb,
  7731. /*img=*/0x200000000480);
  7732. }
  7733. memcpy((void*)0x200000000300, "./bus\000", 6);
  7734. res = syscall(__NR_creat, /*file=*/0x200000000300ul, /*mode=*/0ul);
  7735. for (int i = 0; i < 32; i++) {
  7736. syscall(__NR_creat, /*file=*/0x200000000300ul, /*mode=*/0ul);
  7737. }
  7738. if (res != -1)
  7739. r[163] = res;
  7740. memcpy((void*)0x200000000440, "./bus\000", 6);
  7741. res = syscall(__NR_open, /*file=*/0x200000000440ul, /*flags=*/0ul,
  7742. /*mode=*/0ul);
  7743. if (res != -1)
  7744. r[164] = res;
  7745. res = syscall(__NR_dup3, /*oldfd=*/r[164], /*newfd=*/r[163], /*flags=*/0ul);
  7746. if (res != -1)
  7747. r[165] = res;
  7748. res = syscall(__NR_io_setup, /*n=*/6, /*ctx=*/0x200000000240ul);
  7749. if (res != -1)
  7750. r[166] = *(uint64_t*)0x200000000240;
  7751. *(uint64_t*)0x200000000000 = 0x2000000000c0;
  7752. *(uint64_t*)0x2000000000c0 = 0xf04aef;
  7753. *(uint32_t*)0x2000000000c8 = 0x3d8;
  7754. *(uint32_t*)0x2000000000cc = 8;
  7755. *(uint16_t*)0x2000000000d0 = 0;
  7756. *(uint16_t*)0x2000000000d2 = 0;
  7757. *(uint32_t*)0x2000000000d4 = r[165];
  7758. *(uint64_t*)0x2000000000d8 = 0;
  7759. *(uint64_t*)0x2000000000e0 = 0;
  7760. *(uint64_t*)0x2000000000e8 = 0;
  7761. *(uint64_t*)0x2000000000f0 = 0;
  7762. *(uint32_t*)0x2000000000f8 = 0;
  7763. *(uint32_t*)0x2000000000fc = -1;
  7764. syscall(__NR_io_submit, /*ctx=*/r[166], /*nr=*/1ul,
  7765. /*iocbpp=*/0x200000000000ul);
  7766. *(uint32_t*)0x200000000040 = 0x18;
  7767. *(uint32_t*)0x200000000044 = 2;
  7768. *(uint32_t*)0x200000000048 = 0;
  7769. *(uint32_t*)0x20000000004c = 0;
  7770. *(uint32_t*)0x200000000050 = 0;
  7771. *(uint32_t*)0x200000000054 = 0;
  7772. *(uint32_t*)0x200000000058 = 0;
  7773. *(uint32_t*)0x20000000005c = 0;
  7774. syscall(__NR_open_by_handle_at, /*mountdirfd=*/r[162],
  7775. /*handle=*/0x200000000040ul, /*flags=*/0ul);
  7776. *(uint64_t*)0x200000000140 = 0x200000000000;
  7777. *(uint16_t*)0x200000000000 = 0x10;
  7778. *(uint16_t*)0x200000000002 = 0;
  7779. *(uint32_t*)0x200000000004 = 0;
  7780. *(uint32_t*)0x200000000008 = 0x1000000;
  7781. *(uint32_t*)0x200000000148 = 0xc;
  7782. *(uint64_t*)0x200000000150 = 0x200000000100;
  7783. *(uint64_t*)0x200000000100 = 0x2000000009c0;
  7784. *(uint32_t*)0x2000000009c0 = 0x1ac;
  7785. *(uint16_t*)0x2000000009c4 = r[157];
  7786. *(uint16_t*)0x2000000009c6 = 0;
  7787. *(uint32_t*)0x2000000009c8 = 0x70bd2a;
  7788. *(uint32_t*)0x2000000009cc = 0x25dfdbfe;
  7789. *(uint8_t*)0x2000000009d0 = 0x28;
  7790. *(uint8_t*)0x2000000009d1 = 0;
  7791. *(uint16_t*)0x2000000009d2 = 0;
  7792. *(uint16_t*)0x2000000009d4 = 4;
  7793. *(uint16_t*)0x2000000009d6 = 0x5f;
  7794. *(uint16_t*)0x2000000009d8 = 0xa;
  7795. *(uint16_t*)0x2000000009da = 6;
  7796. memset((void*)0x2000000009dc, 0, 6);
  7797. *(uint16_t*)0x2000000009e4 = 0xa;
  7798. *(uint16_t*)0x2000000009e6 = 6;
  7799. memset((void*)0x2000000009e8, 80, 6);
  7800. *(uint16_t*)0x2000000009f0 = 0x29;
  7801. *(uint16_t*)0x2000000009f2 = 0x2a;
  7802. *(uint8_t*)0x2000000009f4 = 0x3e;
  7803. *(uint8_t*)0x2000000009f5 = 1;
  7804. *(uint8_t*)0x2000000009f6 = 3;
  7805. *(uint8_t*)0x2000000009f7 = 0x76;
  7806. *(uint8_t*)0x2000000009f8 = 6;
  7807. *(uint8_t*)0x2000000009f9 = 0;
  7808. *(uint8_t*)0x2000000009fa = 4;
  7809. *(uint16_t*)0x2000000009fb = 0xe;
  7810. *(uint16_t*)0x2000000009fd = 6;
  7811. *(uint8_t*)0x2000000009ff = 0x75;
  7812. *(uint8_t*)0x200000000a00 = 0x18;
  7813. *(uint16_t*)0x200000000a01 = 1;
  7814. *(uint16_t*)0x200000000a03 = 0x20;
  7815. *(uint16_t*)0x200000000a05 = 5;
  7816. *(uint16_t*)0x200000000a07 = 0x19;
  7817. memcpy((void*)0x200000000a09,
  7818. "\x57\xbc\x27\xf7\xb2\x41\x3a\x32\xdc\x18\x82\x61\x20\xa1\xf8\x58",
  7819. 16);
  7820. *(uint16_t*)0x200000000a1c = 4;
  7821. *(uint16_t*)0x200000000a1e = 0x5f;
  7822. *(uint16_t*)0x200000000a20 = 6;
  7823. *(uint16_t*)0x200000000a22 = 0x36;
  7824. *(uint16_t*)0x200000000a24 = 1;
  7825. *(uint16_t*)0x200000000a28 = 0xa;
  7826. *(uint16_t*)0x200000000a2a = 6;
  7827. memcpy((void*)0x200000000a2c, "\x26\x10\x0f\x80\x79\x22", 6);
  7828. *(uint16_t*)0x200000000a34 = 0x12e;
  7829. *(uint16_t*)0x200000000a36 = 0x2a;
  7830. *(uint8_t*)0x200000000a38 = 0x7e;
  7831. *(uint8_t*)0x200000000a39 = 0x15;
  7832. STORE_BY_BITMASK(uint8_t, , 0x200000000a3a, 0, 0, 1);
  7833. STORE_BY_BITMASK(uint8_t, , 0x200000000a3a, 5, 1, 7);
  7834. *(uint8_t*)0x200000000a3b = -1;
  7835. *(uint8_t*)0x200000000a3c = 0;
  7836. *(uint8_t*)0x200000000a3d = 8;
  7837. *(uint8_t*)0x200000000a3e = 2;
  7838. *(uint8_t*)0x200000000a3f = 0x11;
  7839. *(uint8_t*)0x200000000a40 = 0;
  7840. *(uint8_t*)0x200000000a41 = 0;
  7841. *(uint8_t*)0x200000000a42 = 0;
  7842. *(uint32_t*)0x200000000a43 = 1;
  7843. *(uint32_t*)0x200000000a47 = 2;
  7844. *(uint32_t*)0x200000000a4b = 8;
  7845. *(uint8_t*)0x200000000a4f = 6;
  7846. *(uint8_t*)0x200000000a50 = 2;
  7847. *(uint16_t*)0x200000000a51 = 9;
  7848. *(uint8_t*)0x200000000a53 = 3;
  7849. *(uint8_t*)0x200000000a54 = 1;
  7850. *(uint8_t*)0x200000000a55 = 0x30;
  7851. *(uint8_t*)0x200000000a56 = 0x37;
  7852. *(uint8_t*)0x200000000a57 = 0xb7;
  7853. *(uint8_t*)0x200000000a58 = 0x67;
  7854. *(uint8_t*)0x200000000a59 = 3;
  7855. memcpy((void*)0x200000000a5a,
  7856. "\x60\x0c\x80\xa8\x1d\x63\x77\xce\xf6\x7b\x2a\xd6\xac\x45\x9e\x68",
  7857. 16);
  7858. memcpy((void*)0x200000000a6a,
  7859. "\x6e\xe3\x83\x44\x6e\x80\xbe\xbb\x60\x97\xaa\x4c\xff\xd9\x12\x80\xac"
  7860. "\x73\x32\x29\x49\xe3\x67\xf6\xdd\x22\x97\xb0\x9e\x70\xd3\x84",
  7861. 32);
  7862. memcpy((void*)0x200000000a8a,
  7863. "\x57\xe8\x43\x7d\x37\xce\x2d\x70\xeb\x05\xdc\x35\x09\xe8\xaa\x26\x9b"
  7864. "\x29\xc3\x7a\x93\x2b\x21\x3e\xa6\x47\x6b\x12\x29\x4e\x52\xf0",
  7865. 32);
  7866. *(uint8_t*)0x200000000aaa = 3;
  7867. *(uint8_t*)0x200000000aab = 0x23;
  7868. memcpy(
  7869. (void*)0x200000000aac,
  7870. "\x82\xba\xdc\xbf\x55\x17\xa3\x76\x3f\x45\x09\x7a\xbd\x3e\x05\xcb\x6c\x8d"
  7871. "\x4a\xf4\xe1\xd1\xbe\x32\xb2\xe5\x73\x48\x29\xdd\x28\xf1\x7e\x58\x4a",
  7872. 35);
  7873. *(uint8_t*)0x200000000acf = 2;
  7874. *(uint8_t*)0x200000000ad0 = 0x1e;
  7875. memcpy((void*)0x200000000ad1,
  7876. "\xbd\x3d\x9a\x33\x7b\x87\xa1\x13\x61\x87\x12\xaa\xa3\xbe\xe2\x9d\x2a"
  7877. "\xcc\x5c\xba\xd0\xe6\x0b\xef\x80\x58\x0a\xb2\x92\x12",
  7878. 30);
  7879. *(uint8_t*)0x200000000aef = 1;
  7880. *(uint8_t*)0x200000000af0 = 0x1e;
  7881. memcpy((void*)0x200000000af1,
  7882. "\x35\xc1\xfc\x8a\xbf\xce\x88\xd3\x64\xc2\xc0\xbe\x2c\x5e\xb1\xdc\xa7"
  7883. "\x4c\x2d\x11\xae\x67\xa4\xca\x48\x0e\xac\x33\x0e\xb9",
  7884. 30);
  7885. *(uint8_t*)0x200000000b0f = 0x76;
  7886. *(uint8_t*)0x200000000b10 = 6;
  7887. *(uint8_t*)0x200000000b11 = 0x81;
  7888. *(uint8_t*)0x200000000b12 = 0x80;
  7889. *(uint16_t*)0x200000000b13 = 0x36;
  7890. *(uint16_t*)0x200000000b15 = 4;
  7891. *(uint8_t*)0x200000000b17 = 0x3e;
  7892. *(uint8_t*)0x200000000b18 = 1;
  7893. *(uint8_t*)0x200000000b19 = 3;
  7894. *(uint8_t*)0x200000000b1a = 0x83;
  7895. *(uint8_t*)0x200000000b1b = 0x1f;
  7896. STORE_BY_BITMASK(uint8_t, , 0x200000000b1c, 0, 0, 6);
  7897. STORE_BY_BITMASK(uint8_t, , 0x200000000b1c, 0, 6, 1);
  7898. STORE_BY_BITMASK(uint8_t, , 0x200000000b1c, 0, 7, 1);
  7899. *(uint8_t*)0x200000000b1d = 0x80;
  7900. *(uint8_t*)0x200000000b1e = 0xb;
  7901. *(uint8_t*)0x200000000b1f = 8;
  7902. *(uint8_t*)0x200000000b20 = 2;
  7903. *(uint8_t*)0x200000000b21 = 0x11;
  7904. *(uint8_t*)0x200000000b22 = 0;
  7905. *(uint8_t*)0x200000000b23 = 0;
  7906. *(uint8_t*)0x200000000b24 = 0;
  7907. *(uint32_t*)0x200000000b25 = 2;
  7908. *(uint32_t*)0x200000000b29 = 0x800;
  7909. *(uint32_t*)0x200000000b2d = 7;
  7910. memset((void*)0x200000000b31, 255, 6);
  7911. *(uint32_t*)0x200000000b37 = 0x80000000;
  7912. *(uint8_t*)0x200000000b3b = 0x83;
  7913. *(uint8_t*)0x200000000b3c = 0x25;
  7914. STORE_BY_BITMASK(uint8_t, , 0x200000000b3d, 0, 0, 6);
  7915. STORE_BY_BITMASK(uint8_t, , 0x200000000b3d, 1, 6, 1);
  7916. STORE_BY_BITMASK(uint8_t, , 0x200000000b3d, 0, 7, 1);
  7917. *(uint8_t*)0x200000000b3e = 4;
  7918. *(uint8_t*)0x200000000b3f = 5;
  7919. *(uint8_t*)0x200000000b40 = 8;
  7920. *(uint8_t*)0x200000000b41 = 2;
  7921. *(uint8_t*)0x200000000b42 = 0x11;
  7922. *(uint8_t*)0x200000000b43 = 0;
  7923. *(uint8_t*)0x200000000b44 = 0;
  7924. *(uint8_t*)0x200000000b45 = 1;
  7925. *(uint32_t*)0x200000000b46 = 0x8410;
  7926. *(uint8_t*)0x200000000b4a = 8;
  7927. *(uint8_t*)0x200000000b4b = 2;
  7928. *(uint8_t*)0x200000000b4c = 0x11;
  7929. *(uint8_t*)0x200000000b4d = 0;
  7930. *(uint8_t*)0x200000000b4e = 0;
  7931. *(uint8_t*)0x200000000b4f = 0;
  7932. *(uint32_t*)0x200000000b50 = 0x40;
  7933. *(uint32_t*)0x200000000b54 = 0x400;
  7934. memset((void*)0x200000000b58, 255, 6);
  7935. *(uint32_t*)0x200000000b5e = 0x7d;
  7936. *(uint16_t*)0x200000000b64 = 6;
  7937. *(uint16_t*)0x200000000b66 = 0x36;
  7938. *(uint16_t*)0x200000000b68 = 9;
  7939. *(uint64_t*)0x200000000108 = 0x1ac;
  7940. *(uint64_t*)0x200000000158 = 1;
  7941. *(uint64_t*)0x200000000160 = 0;
  7942. *(uint64_t*)0x200000000168 = 0;
  7943. *(uint32_t*)0x200000000170 = 0x4000000;
  7944. syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0x200000000140ul,
  7945. /*f=MSG_ZEROCOPY*/ 0x4000000ul);
  7946. memcpy(
  7947. (void*)0x200000000000,
  7948. "prodM\260\352\a\006\276\256n/"
  7949. "\3164\267\301\357\272!"
  7950. "\235\rSt\2424\t\000\000\000\000\000\000\000\377\377\020\004\000\000\035z"
  7951. "\3205\342e,\261\204\352\221^%A\345\236\023TdT\306^p\260#"
  7952. "R\004\006\256\353A;"
  7953. "Y\353\217\354\264\371\027\267\004\302\300\306\264\v\377\374\210\220\253C"
  7954. "\002\000\3604\003\210\2569\'>R^P{Vr!"
  7955. "\342W\3072\352\267Wp\3036\226\377Z\\A@\000\000\000\311\363Y\270\211#"
  7956. "\241\261)Dk\353\241\t\000{u[\275\235\364\277\\\316\002P\362MY\005^"
  7957. "\377j\234\024\267\266v\035*1>\000 "
  7958. "\000\000\000\000\024C?]\214\264Y\317\200\205\326\0036\310~"
  7959. "\250\f\000\000\265U\354\3406\355\344\333\337\a\320lg\023\371\213:s>"
  7960. "\327s\357\263\237#\025)\371\3410\307\26262<"
  7961. "k\250\210\001\000fhD\347\266\027\200\225\250\036\t\2601KB\313\000\036"
  7962. "\177E\177\002\000\000\000y<"
  7963. "nGR\224\231\270\211\233\217\325\346\002\265C\255\"u\364>-"
  7964. "\000\000\000\000\310X\332Nz\016u\217\001\000\000\000\000\000\000\335\377"
  7965. "\377\377\000\000\000\000\000\000\000\000\000\303\247/"
  7966. "\017\233`\245\230\201a\356v\000\000\000\000\a\000\000m2\362\330,"
  7967. "\027\370\216\256\310\255\355<\"\216\n\235\2613\215\357\226\322M\"8="
  7968. "tg\337U\320q\225/"
  7969. "f\354\334\243\341[\300\252\357z\311\364[R\3036b\242]"
  7970. "\355\350\260\372\"\242\3227)\325yQ\377}5\224\210\241\334\241g\340q\305:"
  7971. "\344\337\200\263,\271\262\334\201\2376\017\204WY\277SY`"
  7972. "\270\a\031\261\0058\244\303\273\370aB:\204\002?"
  7973. "\000\000\000\000\000\000\000\000\000\000\000\000\000\363o-"
  7974. "GU\260\000F\263o(aI[\326\237G\256I\203\223\214C\300#\340q\320Ex|"
  7975. "\333\250\026\376>:\t0\375\212\307\204\265\307M-"
  7976. "0A\360\224\363\314\215\2733\\\"\2102\263\2504\254\000\335}\016\301 "
  7977. "\353Ft\306\314\f}1X#"
  7978. "\344\341\224i\316\241\377\225\200\264T\234\001\363\034LB\224m("
  7979. "m\f\274\353Y\240\367\360\235\020\275\206\033y\346\337\300\305\271\271"
  7980. "\277\337~9\nC\351\305\016\332\234(\233\"\307\227\374\b\331\302T\247*}]"
  7981. "\310\263 .\233\211\017\370$\335>lU\023EG\2731] "
  7982. "\332\031\305\233\025\225\304\374w\273\222\221\304\246\2207XK\374\027]"
  7983. "\372\377\'\357\222\034\270\037K\262o "
  7984. "\321\275\262\021+\243R\357gi\016(\343?Q\302\275W\005\354\263=@\003\306^"
  7985. "\242\025%\260\'D#\266Q\217\202?S>\000P\234E\222{"
  7986. "d\346\234j1\207\263\001\336\350\211\304s\267\024~}"
  7987. "\252\214\303\225BAE\362.\217#;"
  7988. "a\224\"\321U\377\350v\323\204d\364\0234\246XI\345h\252\025\232\367Z\343%"
  7989. "\210p\220\273\235t\243\341\r\215\224\"\031\213\027)"
  7990. "\352\325\027\353\344\033\017BZ1\276\356\372\034\371\246\021\224\006\\P:"
  7991. "\257\316x\302\202\232\026\374\241\371q\022\343\032\334\267\022\273a\b"
  7992. "\273\355\262\321W\342\213\2158}\020W\275\2460A\303\003\372\2110~#"
  7993. "\bQ\313)\366]\236\024\322\352\202\250\267ZG\025r\361n 1\215 "
  7994. "\301\257\031\\\221\023\0338\341\303\244\v\224\277J\265\336\225\202\000]"
  7995. "B|\342[%\343\360\004\272\355\333\365\177\235\376>\366m$M&\177q]"
  7996. "\344\366\202\303\000\261zg}\231E\244\031\351\0324a\3275D-k\204\246\022+"
  7997. "\353k\241\376k\211\357\030\301)"
  7998. "6\2465\342D\276\341\337q\33568\3637g\2539m\347\335O\v?\340\276}"
  7999. "\251U\307{\323\026W\273\345\322\223\376\244\235\r$\3511c8`\206\274)"
  8000. "\3429\303}\271P\325F\306\022\214_"
  8001. "x\250\372\265K\003\205\223k\341\216\037)\"."
  8002. "\314\'\v\246\033j\\\n\3518yA\330T\205\200A\313o\231\231\353)"
  8003. "r\032\316\030(\0305LL\274OeO\'\342\206&\344\342\347~"
  8004. "\222\242\262\033\303\000\205\316\2557\207\240\374c\365\370\257\v,"
  8005. "q\324\030\275M\032\336\210*"
  8006. "L\005m6\354H\320T\270m\333\b\246\002\373\023\254\221\212\215\224\223\215"
  8007. "=\261\204\234\233\345\307\246\311Q\301eUc\314\0300^"
  8008. "\000\000\000\000\000\000\000\000\000\000\000\000K",
  8009. 1147);
  8010. res = syscall(__NR_memfd_create, /*name=*/0x200000000000ul,
  8011. /*flags=MFD_HUGETLB|MFD_ALLOW_SEALING*/ 6ul);
  8012. if (res != -1)
  8013. r[167] = res;
  8014. syscall(__NR_lseek, /*fd=*/r[167], /*offset=*/0ul, /*whence=SEEK_CUR*/ 1ul);
  8015. memcpy((void*)0x200000000140, "/dev/sg#\000", 9);
  8016. res = -1;
  8017. res = syz_open_dev(/*dev=*/0x200000000140, /*id=*/0, /*flags=*/0);
  8018. if (res != -1)
  8019. r[168] = res;
  8020. *(uint64_t*)0x200000000000 = 0xb5;
  8021. syscall(__NR_ioctl, /*fd=*/r[168], /*cmd=FIOASYNC*/ 0x5452,
  8022. /*v=*/0x200000000000ul);
  8023. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_RAW*/ 3ul,
  8024. /*proto=*/5);
  8025. if (res != -1)
  8026. r[169] = res;
  8027. *(uint32_t*)0x200000000440 = 0xc;
  8028. res = syscall(__NR_getsockopt, /*fd=*/r[169], /*level=*/1, /*optname=*/0x11,
  8029. /*optval=*/0x2000000001c0ul, /*optlen=*/0x200000000440ul);
  8030. if (res != -1)
  8031. r[170] = *(uint32_t*)0x2000000001c8;
  8032. syscall(__NR_setregid, /*rgid=*/0xee00, /*egid=*/0);
  8033. syscall(__NR_setregid, /*rgid=*/r[170], /*egid=*/0);
  8034. for (int i = 0; i < 64; i++) {
  8035. syscall(__NR_setregid, /*rgid=*/r[170], /*egid=*/0);
  8036. }
  8037. res = syscall(__NR_semget, /*key=*/0ul, /*nsems=*/0x4000000009ul,
  8038. /*flags=*/0ul);
  8039. for (int i = 0; i < 64; i++) {
  8040. syscall(__NR_semget, /*key=*/0ul, /*nsems=*/0x4000000009ul, /*flags=*/0ul);
  8041. }
  8042. if (res != -1)
  8043. r[171] = res;
  8044. *(uint16_t*)0x2000000000c0 = 0;
  8045. *(uint16_t*)0x2000000000c2 = 0x949c;
  8046. *(uint16_t*)0x2000000000c4 = 0;
  8047. *(uint16_t*)0x2000000000c6 = 0;
  8048. *(uint16_t*)0x2000000000c8 = 0;
  8049. *(uint16_t*)0x2000000000ca = 0;
  8050. syscall(__NR_semop, /*semid=*/r[171], /*ops=*/0x2000000000c0ul, /*nops=*/2ul);
  8051. syscall(__NR_timer_create, /*id=*/0ul, /*ev=*/0ul, /*timerid=*/0ul);
  8052. for (int i = 0; i < 64; i++) {
  8053. syscall(__NR_timer_create, /*id=*/0ul, /*ev=*/0ul, /*timerid=*/0ul);
  8054. }
  8055. memcpy((void*)0x2000000000c0, "ext4\000", 5);
  8056. memcpy((void*)0x200000000040, "./file0\000", 8);
  8057. memcpy((void*)0x200000000100, "quota", 5);
  8058. *(uint8_t*)0x200000000105 = 0x2c;
  8059. memcpy((void*)0x200000000106, "nodelalloc", 10);
  8060. *(uint8_t*)0x200000000110 = 0x2c;
  8061. memcpy((void*)0x200000000111, "errors=remount-ro", 17);
  8062. *(uint8_t*)0x200000000122 = 0x2c;
  8063. memcpy((void*)0x200000000123, "grpid", 5);
  8064. *(uint8_t*)0x200000000128 = 0x2c;
  8065. *(uint8_t*)0x200000000129 = 0;
  8066. memcpy(
  8067. (void*)0x200000000a00,
  8068. "\x78\x9c\xec\xdd\x4f\x6f\x54\x5f\x19\x00\xe0\xf7\xde\xb6\xf4\xcf\xaf\xd0"
  8069. "\x12\x59\xa8\x51\x41\x44\xd1\x10\x66\xda\x01\x1a\xc3\x0a\x37\x1a\x43\x48"
  8070. "\x8c\xc4\x95\x0b\xa8\xed\xd0\x34\x9d\xe9\x34\x9d\x29\xd2\xca\xa2\x7c\x07"
  8071. "\x13\x49\x5c\xe9\x47\x70\x61\xe2\xc2\x84\x95\x7b\x77\xba\x73\x03\x0b\x13"
  8072. "\x54\xa2\xa1\x26\x2e\xc6\xdc\x3b\xd3\xd2\x96\x4e\x5b\x84\xce\xc4\xce\xf3"
  8073. "\x24\x27\xf7\x9e\x7b\x86\x79\xcf\x61\x72\xcf\x3b\x3d\xd3\xce\x09\xa0\x6f"
  8074. "\x5d\x8a\x88\xcd\x88\x38\x13\x11\x0f\x23\x62\xa2\x7d\x3d\x69\x97\xb8\xd3"
  8075. "\x2a\xd9\xe3\xde\xbe\x79\x3a\xb7\xf5\xe6\xe9\x5c\x12\xcd\xe6\xfd\xbf\x27"
  8076. "\x79\x7b\x76\x2d\x76\xfd\x9b\xcc\x67\xed\xe7\x1c\x89\x88\x1f\x7e\x2f\xe2"
  8077. "\x27\xc9\xfb\x71\xeb\xeb\x1b\x4b\xb3\x95\x4a\x79\xb5\x5d\x2f\x36\xaa\x2b"
  8078. "\xc5\xfa\xfa\xc6\xf5\xc5\xea\xec\x42\x79\xa1\xbc\x5c\x2a\xcd\x4c\xcf\x4c"
  8079. "\x7d\xfb\xc6\xad\xd2\x27\x1b\xeb\xc5\xea\x6f\x5e\x7f\x77\xf1\xee\x8f\x7e"
  8080. "\xff\xbb\x2f\xbf\xfc\xe3\xe6\xb7\x7e\x96\x75\x6b\xbc\xdd\xb6\x7b\x1c\x9f"
  8081. "\x52\x6b\xe8\x43\x3b\x71\x32\x83\x11\x71\xf7\x24\x82\xf5\xc0\x40\x7b\x3c"
  8082. "\x67\x7a\xdd\x11\xfe\x27\x69\x44\x14\x22\xe2\x72\x7e\xff\x4f\xc4\x40\xfe"
  8083. "\x6a\x02\x00\xa7\x59\xb3\x39\x11\xcd\x89\xdd\x75\x00\xe0\xb4\x4b\xf3\x35"
  8084. "\xb0\x24\x2d\xb4\xd7\x02\xc6\x23\x4d\x0b\x85\xd6\x1a\xde\x85\x18\x4b\x2b"
  8085. "\xb5\x7a\xe3\xda\xa3\xda\xda\xf2\x7c\x6b\xad\x6c\x32\x86\xd2\x47\x8b\x95"
  8086. "\xf2\x54\x7b\xad\x70\x32\x86\x92\xac\x3e\x9d\x9f\xbf\xab\x97\xf6\xd5\x6f"
  8087. "\x44\xc4\xf9\x88\xf8\xf9\xf0\x68\x5e\x2f\xcc\xd5\x2a\xf3\xbd\x7c\xe3\x03"
  8088. "\x00\x7d\xec\xb3\x7d\xf9\xff\x5f\xc3\xad\xfc\x0f\x00\x9c\x72\x23\xbd\xee"
  8089. "\x00\x00\xd0\x75\xf2\x3f\x00\xf4\x1f\xf9\x1f\x00\xfa\x8f\xfc\x0f\x00\xfd"
  8090. "\x47\xfe\x07\x80\xfe\x23\xff\x03\x40\xff\x91\xff\x01\xa0\xaf\xfc\xe0\xde"
  8091. "\xbd\xac\x34\xb7\xda\xdf\x7f\x3d\xff\x78\x7d\x6d\xa9\xf6\xf8\xfa\x7c\xb9"
  8092. "\xbe\x54\xa8\xae\xcd\x15\xe6\x6a\xab\x2b\x85\x85\x5a\x6d\x21\xff\xce\x9e"
  8093. "\xea\x51\xcf\x57\xa9\xd5\x56\xa6\x6f\xc6\xda\x93\x62\xa3\x5c\x6f\x14\xeb"
  8094. "\xeb\x1b\x0f\xaa\xb5\xb5\xe5\xc6\x83\xfc\x7b\xbd\x1f\x94\x87\xba\x32\x2a"
  8095. "\x00\xe0\x30\xe7\x2f\xbe\xf8\x73\x12\x11\x9b\xb7\x47\xf3\x12\xbb\xf6\x72"
  8096. "\x90\xab\xe1\x74\x4b\x7b\xdd\x01\xa0\x67\x06\x7a\xdd\x01\xa0\x67\x8e\xd8"
  8097. "\xed\xeb\x55\xb7\xfa\x01\x74\x9f\x9f\xf1\x81\x03\xb6\xe8\xdd\x63\xd7\xaf"
  8098. "\x08\x8d\xee\x69\x78\x7e\x32\xfd\x01\x4e\xde\xd5\x2f\x58\xff\x87\x7e\x65"
  8099. "\xfd\x1f\xfa\x97\xf5\x7f\xe8\x5f\x47\xac\xff\x03\xa7\x58\xb3\x99\xd8\xf3"
  8100. "\x1f\x00\xfa\x8c\x35\x7e\xe0\x03\x3e\xff\xdf\xcb\xe7\xff\x00\x00\x00\x00"
  8101. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8102. "\x00\x00\xf4\xb1\xf1\xbc\x24\x69\xa1\xbd\x17\xf8\x78\xa4\x69\xa1\x10\x71"
  8103. "\x36\x22\x26\x63\x28\x79\xb4\x58\x29\x4f\x45\xc4\xb9\x88\xf8\xd3\xf0\xd0"
  8104. "\x70\x56\x9f\xee\x75\xa7\x01\x80\x8f\x94\xfe\x35\x69\xef\xff\x75\x75\xe2"
  8105. "\xca\xf8\xfe\xd6\x33\xc9\xbf\x87\xf3\x63\x44\xfc\xf4\x97\xf7\x7f\xf1\x64"
  8106. "\xb6\xd1\x58\x9d\xce\xae\xff\x63\xe7\x7a\xe3\x79\xfb\x7a\xa9\x17\xfd\x07"
  8107. "\x00\x8e\xb2\x9d\xa7\xb7\xf3\xf8\xb6\xb7\x6f\x9e\xce\x6d\x97\x6e\xf6\xe7"
  8108. "\xf5\x77\x5a\x9b\x8b\x66\x71\xb7\xda\xa5\xd5\x32\x18\x83\xf9\x71\x24\x86"
  8109. "\x22\x62\xec\x9f\x49\xbb\xde\x92\xbd\x5f\x19\xf8\x04\xf1\x37\x9f\x45\xc4"
  8110. "\xe7\x0f\x1a\x7f\x92\xaf\x8d\x4c\xb6\x77\x3e\xdd\x1f\x3f\x8b\x7d\xb6\xab"
  8111. "\xf1\xd3\x3d\xf1\xd3\xbc\xad\x75\xcc\xfe\x2f\x3e\xf7\xe1\xa1\x3b\x6e\xe9"
  8112. "\x0a\xfd\xe2\x45\x36\xff\xdc\x39\xe8\xfe\x4b\xe3\x52\x7e\x3c\xf8\xfe\x1f"
  8113. "\xc9\x67\xa8\x8f\xb7\x3d\xff\x6d\xbd\x37\xff\xa5\x3b\xf3\xdf\x40\x87\xf9"
  8114. "\xef\xd2\x71\x63\xdc\xfc\xc3\xf7\x3b\xb6\x3d\x8b\xf8\xe2\xe0\x41\xf1\x93"
  8115. "\x9d\xf8\x49\x87\xf8\x57\x8e\x19\xff\x2f\x5f\xfa\xca\xe5\x4e\x6d\xcd\x5f"
  8116. "\x45\x5c\x8d\x83\xe3\xef\x8e\x55\x6c\x54\x57\x8a\xf5\xf5\x8d\xeb\x8b\xd5"
  8117. "\xd9\x85\xf2\x42\x79\xb9\x54\x9a\x99\x9e\x99\x1a\xbd\x71\xab\x54\xcc\xd7"
  8118. "\xa8\x8b\xdb\x2b\xd5\xef\xfb\xdb\xed\x6b\xe7\x0e\x1b\xff\x58\x87\xf8\x23"
  8119. "\x47\x8c\xff\xeb\xc7\x1c\xff\xaf\xff\xf3\xf0\xc7\x5f\x3d\x24\xfe\x37\xbf"
  8120. "\x76\xf0\xeb\x7f\xe1\x90\xf8\x59\x4e\xfc\xc6\x31\xe3\xcf\x8e\xfd\xb6\xe3"
  8121. "\x5c\x9f\xc5\x9f\xef\x30\xfe\xbd\xaf\xff\xde\x7c\x91\x5d\xbb\x76\xcc\xf8"
  8122. "\x2f\x5f\x6d\xcc\x1f\xf3\xa1\x00\x40\x17\xd4\xd7\x37\x96\x66\x2b\x95\xf2"
  8123. "\xea\xe1\x27\xdb\xb9\xff\x58\x0f\x76\xe2\xc4\xc9\xff\xfb\x49\x8f\x27\x26"
  8124. "\xe0\xc4\xbd\xbb\xe9\x7b\xdd\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8125. "\x00\xa0\x93\x6e\xfc\x39\x51\xaf\xc7\x08\x00\x00\x00\x00\x00\x00\x00\x00"
  8126. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8127. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8128. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8129. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8130. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8131. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8132. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8133. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8134. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xe9\xf5"
  8135. "\xdf\x00\x00\x00\xff\xff\xff\x96\xd6\xc9",
  8136. 1216);
  8137. syz_mount_image(/*fs=*/0x2000000000c0, /*dir=*/0x200000000040, /*flags=*/0,
  8138. /*opts=*/0x200000000100, /*chdir=*/1, /*size=*/0x4c0,
  8139. /*img=*/0x200000000a00);
  8140. for (int i = 0; i < 64; i++) {
  8141. syz_mount_image(/*fs=*/0x2000000000c0, /*dir=*/0x200000000040, /*flags=*/0,
  8142. /*opts=*/0x200000000100, /*chdir=*/1, /*size=*/0x4c0,
  8143. /*img=*/0x200000000a00);
  8144. }
  8145. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc);
  8146. if (res != -1)
  8147. r[172] = res;
  8148. *(uint64_t*)0x200000000300 = 0;
  8149. *(uint32_t*)0x200000000308 = 0;
  8150. *(uint64_t*)0x200000000310 = 0x2000000000c0;
  8151. *(uint64_t*)0x2000000000c0 = 0x200000000200;
  8152. *(uint32_t*)0x200000000200 = 0x68;
  8153. *(uint8_t*)0x200000000204 = 0;
  8154. *(uint8_t*)0x200000000205 = 1;
  8155. *(uint16_t*)0x200000000206 = 0x401;
  8156. *(uint32_t*)0x200000000208 = 0;
  8157. *(uint32_t*)0x20000000020c = 0;
  8158. *(uint8_t*)0x200000000210 = 2;
  8159. *(uint8_t*)0x200000000211 = 0;
  8160. *(uint16_t*)0x200000000212 = htobe16(0);
  8161. *(uint16_t*)0x200000000214 = 0x24;
  8162. STORE_BY_BITMASK(uint16_t, , 0x200000000216, 1, 0, 14);
  8163. STORE_BY_BITMASK(uint16_t, , 0x200000000217, 0, 6, 1);
  8164. STORE_BY_BITMASK(uint16_t, , 0x200000000217, 1, 7, 1);
  8165. *(uint16_t*)0x200000000218 = 0x14;
  8166. STORE_BY_BITMASK(uint16_t, , 0x20000000021a, 1, 0, 14);
  8167. STORE_BY_BITMASK(uint16_t, , 0x20000000021b, 0, 6, 1);
  8168. STORE_BY_BITMASK(uint16_t, , 0x20000000021b, 1, 7, 1);
  8169. *(uint16_t*)0x20000000021c = 8;
  8170. *(uint16_t*)0x20000000021e = 1;
  8171. *(uint8_t*)0x200000000220 = 0xac;
  8172. *(uint8_t*)0x200000000221 = 0x14;
  8173. *(uint8_t*)0x200000000222 = 0x14;
  8174. *(uint8_t*)0x200000000223 = 0;
  8175. *(uint16_t*)0x200000000224 = 8;
  8176. *(uint16_t*)0x200000000226 = 2;
  8177. *(uint8_t*)0x200000000228 = 0xac;
  8178. *(uint8_t*)0x200000000229 = 0x14;
  8179. *(uint8_t*)0x20000000022a = 0x14;
  8180. *(uint8_t*)0x20000000022b = 0xbb;
  8181. *(uint16_t*)0x20000000022c = 0xc;
  8182. STORE_BY_BITMASK(uint16_t, , 0x20000000022e, 2, 0, 14);
  8183. STORE_BY_BITMASK(uint16_t, , 0x20000000022f, 0, 6, 1);
  8184. STORE_BY_BITMASK(uint16_t, , 0x20000000022f, 1, 7, 1);
  8185. *(uint16_t*)0x200000000230 = 5;
  8186. *(uint16_t*)0x200000000232 = 1;
  8187. *(uint8_t*)0x200000000234 = 0;
  8188. *(uint16_t*)0x200000000238 = 0x24;
  8189. STORE_BY_BITMASK(uint16_t, , 0x20000000023a, 2, 0, 14);
  8190. STORE_BY_BITMASK(uint16_t, , 0x20000000023b, 0, 6, 1);
  8191. STORE_BY_BITMASK(uint16_t, , 0x20000000023b, 1, 7, 1);
  8192. *(uint16_t*)0x20000000023c = 0x14;
  8193. STORE_BY_BITMASK(uint16_t, , 0x20000000023e, 1, 0, 14);
  8194. STORE_BY_BITMASK(uint16_t, , 0x20000000023f, 0, 6, 1);
  8195. STORE_BY_BITMASK(uint16_t, , 0x20000000023f, 1, 7, 1);
  8196. *(uint16_t*)0x200000000240 = 8;
  8197. *(uint16_t*)0x200000000242 = 1;
  8198. *(uint8_t*)0x200000000244 = 0xac;
  8199. *(uint8_t*)0x200000000245 = 0x14;
  8200. *(uint8_t*)0x200000000246 = 0x14;
  8201. *(uint8_t*)0x200000000247 = 0xaa;
  8202. *(uint16_t*)0x200000000248 = 8;
  8203. *(uint16_t*)0x20000000024a = 2;
  8204. *(uint8_t*)0x20000000024c = 0xac;
  8205. *(uint8_t*)0x20000000024d = 0x14;
  8206. *(uint8_t*)0x20000000024e = 0x14;
  8207. *(uint8_t*)0x20000000024f = 0;
  8208. *(uint16_t*)0x200000000250 = 0xc;
  8209. STORE_BY_BITMASK(uint16_t, , 0x200000000252, 2, 0, 14);
  8210. STORE_BY_BITMASK(uint16_t, , 0x200000000253, 0, 6, 1);
  8211. STORE_BY_BITMASK(uint16_t, , 0x200000000253, 1, 7, 1);
  8212. *(uint16_t*)0x200000000254 = 5;
  8213. *(uint16_t*)0x200000000256 = 1;
  8214. *(uint8_t*)0x200000000258 = 0;
  8215. *(uint16_t*)0x20000000025c = 8;
  8216. STORE_BY_BITMASK(uint16_t, , 0x20000000025e, 7, 0, 14);
  8217. STORE_BY_BITMASK(uint16_t, , 0x20000000025f, 1, 6, 1);
  8218. STORE_BY_BITMASK(uint16_t, , 0x20000000025f, 0, 7, 1);
  8219. *(uint32_t*)0x200000000260 = htobe32(0);
  8220. *(uint16_t*)0x200000000264 = 4;
  8221. STORE_BY_BITMASK(uint16_t, , 0x200000000266, 0xf, 0, 14);
  8222. STORE_BY_BITMASK(uint16_t, , 0x200000000267, 0, 6, 1);
  8223. STORE_BY_BITMASK(uint16_t, , 0x200000000267, 1, 7, 1);
  8224. *(uint64_t*)0x2000000000c8 = 0x68;
  8225. *(uint64_t*)0x200000000318 = 1;
  8226. *(uint64_t*)0x200000000320 = 0;
  8227. *(uint64_t*)0x200000000328 = 0;
  8228. *(uint32_t*)0x200000000330 = 0;
  8229. syscall(__NR_sendmsg, /*fd=*/r[172], /*msg=*/0x200000000300ul, /*f=*/0ul);
  8230. memcpy((void*)0x200000000040, "./bus\000", 6);
  8231. syscall(
  8232. __NR_open, /*file=*/0x200000000040ul,
  8233. /*flags=O_NOFOLLOW|O_NOCTTY|O_NOATIME|O_CREAT|O_CLOEXEC|0x2*/ 0xe0142ul,
  8234. /*mode=*/0ul);
  8235. for (int i = 0; i < 32; i++) {
  8236. syscall(
  8237. __NR_open, /*file=*/0x200000000040ul,
  8238. /*flags=O_NOFOLLOW|O_NOCTTY|O_NOATIME|O_CREAT|O_CLOEXEC|0x2*/ 0xe0142ul,
  8239. /*mode=*/0ul);
  8240. }
  8241. memcpy((void*)0x200000000000, ".\000", 2);
  8242. res = syscall(__NR_fspick, /*dfd=*/0xffffff9c, /*path=*/0x200000000000ul,
  8243. /*flags=*/0ul);
  8244. for (int i = 0; i < 32; i++) {
  8245. syscall(__NR_fspick, /*dfd=*/0xffffff9c, /*path=*/0x200000000000ul,
  8246. /*flags=*/0ul);
  8247. }
  8248. if (res != -1)
  8249. r[173] = res;
  8250. memcpy((void*)0x200000000080, "ro\000", 3);
  8251. syscall(__NR_fsconfig, /*fd=*/r[173], /*cmd=*/0ul, /*key=*/0x200000000080ul,
  8252. /*value=*/0ul, /*aux=*/0ul);
  8253. for (int i = 0; i < 32; i++) {
  8254. syscall(__NR_fsconfig, /*fd=*/r[173], /*cmd=*/0ul, /*key=*/0x200000000080ul,
  8255. /*value=*/0ul, /*aux=*/0ul);
  8256. }
  8257. syscall(__NR_fsconfig, /*fd=*/r[173], /*cmd=*/7ul, /*key=*/0ul, /*value=*/0ul,
  8258. /*aux=*/0ul);
  8259. for (int i = 0; i < 32; i++) {
  8260. syscall(__NR_fsconfig, /*fd=*/r[173], /*cmd=*/7ul, /*key=*/0ul,
  8261. /*value=*/0ul, /*aux=*/0ul);
  8262. }
  8263. syscall(__NR_semctl, /*semid=*/r[171], /*semnum=*/0ul, /*cmd=*/0ul, 0);
  8264. for (int i = 0; i < 64; i++) {
  8265. syscall(__NR_semctl, /*semid=*/r[171], /*semnum=*/0ul, /*cmd=*/0ul, 0);
  8266. }
  8267. syz_sysconfig_reset__proc_sys_net_ipv6_conf_eth0_accept_untracked_na();
  8268. for (int i = 0; i < 64; i++) {
  8269. syz_sysconfig_reset__proc_sys_net_ipv6_conf_eth0_accept_untracked_na();
  8270. }
  8271. memcpy((void*)0x200000007f80, "./bus\000", 6);
  8272. res =
  8273. syscall(__NR_open, /*file=*/0x200000007f80ul,
  8274. /*flags=O_SYNC|O_NOCTTY|O_NOATIME|O_EXCL|O_CREAT|0x2*/ 0x1411c2ul,
  8275. /*mode=S_IWOTH|S_IROTH|S_IXGRP|S_IWUSR*/ 0x8eul);
  8276. if (res != -1)
  8277. r[174] = res;
  8278. syscall(__NR_ftruncate, /*fd=*/r[174], /*len=*/0x2007ffbul);
  8279. syscall(__NR_sendfile, /*fdout=*/-1, /*fdin=*/-1, /*off=*/0ul, /*count=*/4ul);
  8280. res = syscall(__NR_eventfd2, /*initval=*/0x800,
  8281. /*flags=EFD_NONBLOCK|EFD_CLOEXEC*/ 0x80800ul);
  8282. if (res != -1)
  8283. r[175] = res;
  8284. syscall(__NR_sendfile, /*fdout=*/-1, /*fdin=*/r[175], /*off=*/0ul,
  8285. /*count=*/6ul);
  8286. syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul,
  8287. /*prot=PROT_WRITE*/ 2ul,
  8288. /*flags=MAP_STACK|MAP_POPULATE|MAP_FIXED|MAP_SHARED*/ 0x28011ul,
  8289. /*fd=*/r[174], /*offset=*/0ul);
  8290. syscall(__NR_mbind, /*addr=*/0x200000001000ul, /*len=*/0x800000ul,
  8291. /*mode=*/0ul, /*nodemask=*/0ul, /*maxnode=*/0ul,
  8292. /*flags=MPOL_MF_MOVE*/ 2ul);
  8293. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x10);
  8294. if (res != -1)
  8295. r[176] = res;
  8296. memcpy((void*)0x200000000040, "nl80211\000", 8);
  8297. syz_genetlink_get_family_id(/*name=*/0x200000000040, /*fd=*/-1);
  8298. syscall(__NR_fsmount, /*fs_fd=*/-1, /*flags=*/0ul, /*attr_flags=*/0x10ul);
  8299. syscall(__NR_ioctl, /*fd=*/r[176], /*cmd=*/0x8933, /*arg=*/0ul);
  8300. syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0ul, /*f=*/0ul);
  8301. memcpy((void*)0x200000000000, "task\000", 5);
  8302. res = -1;
  8303. res = syz_open_procfs(/*pid=*/0, /*file=*/0x200000000000);
  8304. if (res != -1)
  8305. r[177] = res;
  8306. syscall(__NR_getdents64, /*fd=*/r[177], /*ent=*/0ul, /*count=*/0ul);
  8307. res = syscall(__NR_socketpair, /*domain=*/1ul, /*type=SOCK_STREAM*/ 1ul,
  8308. /*proto=*/0, /*fds=*/0x200000000180ul);
  8309. if (res != -1)
  8310. r[178] = *(uint32_t*)0x200000000184;
  8311. memcpy((void*)0x200000000100,
  8312. "sit0\000\000\000\000\000\000\000\000\000\000\000\000", 16);
  8313. *(uint64_t*)0x200000000110 = 0x200000000040;
  8314. *(uint32_t*)0x200000000040 = 0x1e;
  8315. *(uint32_t*)0x200000000044 = 0;
  8316. *(uint32_t*)0x200000000048 = 0;
  8317. *(uint16_t*)0x20000000004c = 0;
  8318. *(uint8_t*)0x20000000004e = 0;
  8319. *(uint8_t*)0x20000000004f = 0;
  8320. *(uint8_t*)0x200000000050 = 0;
  8321. *(uint8_t*)0x200000000051 = 0;
  8322. *(uint8_t*)0x200000000052 = 0;
  8323. *(uint8_t*)0x200000000053 = 0;
  8324. *(uint32_t*)0x200000000054 = 0;
  8325. *(uint32_t*)0x200000000058 = 0;
  8326. *(uint16_t*)0x20000000005c = 0;
  8327. *(uint8_t*)0x20000000005e = 0;
  8328. *(uint8_t*)0x20000000005f = 0;
  8329. *(uint32_t*)0x200000000060 = 0;
  8330. *(uint32_t*)0x200000000064 = 0;
  8331. *(uint32_t*)0x200000000068 = 0;
  8332. syscall(__NR_ioctl, /*fd=*/r[178], /*cmd=*/0x8946, /*arg=*/0x200000000100ul);
  8333. memcpy((void*)0x200000000000, "/dev/vcsa#\000", 11);
  8334. res = -1;
  8335. res = syz_open_dev(/*dev=*/0x200000000000, /*id=*/6, /*flags=*/0);
  8336. if (res != -1)
  8337. r[179] = res;
  8338. *(uint64_t*)0x200000000380 = 0x200000000280;
  8339. *(uint64_t*)0x200000000388 = 0xe6;
  8340. syscall(__NR_preadv, /*fd=*/r[179], /*vec=*/0x200000000380ul, /*vlen=*/1ul,
  8341. /*off_low=*/8, /*off_high=*/0);
  8342. memcpy((void*)0x200000000040, "./file0\000", 8);
  8343. syscall(__NR_open, /*file=*/0x200000000040ul,
  8344. /*flags=O_NOFOLLOW|O_NOCTTY|O_NOATIME|O_RDWR*/ 0x60102ul,
  8345. /*mode=S_IRUSR*/ 0x100ul);
  8346. memcpy((void*)0x200000000040, "ext4\000", 5);
  8347. memcpy((void*)0x200000000500, "./file0\000", 8);
  8348. memcpy((void*)0x2000000001c0, "noblock_validity", 16);
  8349. *(uint8_t*)0x2000000001d0 = 0x2c;
  8350. memcpy((void*)0x2000000001d1, "max_dir_size_kb", 15);
  8351. *(uint8_t*)0x2000000001e0 = 0x3d;
  8352. sprintf((char*)0x2000000001e1, "0x%016llx", (long long)0xb);
  8353. *(uint8_t*)0x2000000001f3 = 0x2c;
  8354. memcpy((void*)0x2000000001f4, "lazytime", 8);
  8355. *(uint8_t*)0x2000000001fc = 0x2c;
  8356. memcpy((void*)0x2000000001fd, "norecovery", 10);
  8357. *(uint8_t*)0x200000000207 = 0x2c;
  8358. memcpy((void*)0x200000000208, "journal_dev", 11);
  8359. *(uint8_t*)0x200000000213 = 0x3d;
  8360. sprintf((char*)0x200000000214, "0x%016llx", (long long)0x4d40);
  8361. *(uint8_t*)0x200000000226 = 0x2c;
  8362. memcpy((void*)0x200000000227, "noauto_da_alloc", 15);
  8363. *(uint8_t*)0x200000000236 = 0x2c;
  8364. memcpy((void*)0x200000000237, "nogrpid", 7);
  8365. *(uint8_t*)0x20000000023e = 0x2c;
  8366. memcpy((void*)0x20000000023f, "noload", 6);
  8367. *(uint8_t*)0x200000000245 = 0x2c;
  8368. memcpy((void*)0x200000000246, "resgid", 6);
  8369. *(uint8_t*)0x20000000024c = 0x3d;
  8370. sprintf((char*)0x20000000024d, "0x%016llx", (long long)0);
  8371. *(uint8_t*)0x20000000025f = 0x32;
  8372. *(uint8_t*)0x200000000260 = 0;
  8373. memcpy(
  8374. (void*)0x200000000540,
  8375. "\x78\x9c\xec\xdd\x5d\x6b\x1c\x5d\x1d\x00\xf0\xff\x4c\xb2\x8f\x7d\xc9\x63"
  8376. "\xf2\xf8\x02\xb5\x60\x5b\x6d\x25\x2d\xda\xdd\xa4\xb1\x6d\xf0\xa2\x2f\x20"
  8377. "\xde\x15\x94\x7a\x5f\x63\xb2\x09\x21\x9b\x6c\xc8\x6e\xda\x26\x14\x9b\xe2"
  8378. "\x07\x10\x44\x54\xf0\xca\x2b\x6f\x04\x3f\x80\x20\xfd\x08\x22\x14\xec\xbd"
  8379. "\xa8\x28\xa2\xad\x5e\x78\xa1\x1d\xd9\x37\x93\xc6\xdd\x64\xab\x9b\x5d\x9f"
  8380. "\xec\xef\x07\xb3\x73\x66\xce\xce\xfe\xff\x87\x65\xcf\xcc\x99\x19\x76\x02"
  8381. "\x18\x5a\x17\x22\xe2\x4e\x44\xbc\xc9\xb2\xec\x4a\x44\x8c\x37\xd7\xa7\xcd"
  8382. "\x69\x67\xb1\xf6\xd2\x78\xdf\xeb\x57\x4f\xe6\x6b\x53\x12\x59\x76\xff\xcf"
  8383. "\x49\x24\xcd\x75\xad\xcf\x3a\x9f\x65\x59\x6d\x7e\xba\xb1\x49\x44\x8c\xd6"
  8384. "\x37\xfc\x66\xf2\x9f\x71\x2b\x5b\xdb\x2b\x73\xa5\x52\x71\xa3\xb9\x5c\xa8"
  8385. "\xae\xae\x17\x2a\x5b\xdb\x57\x97\x57\xe7\x96\x8a\x4b\xc5\xb5\x99\x99\xe9"
  8386. "\x1b\xb3\x37\x67\xaf\xcf\x4e\xf5\xa4\x9d\xb5\x9c\x6e\x7d\xf9\xf7\xdf\xff"
  8387. "\xce\x4f\xbe\x72\xeb\x17\x5f\x78\xf4\x9b\x07\x7f\xbc\xfc\xad\x5a\x5a\x9f"
  8388. "\x6c\xd6\xef\x6d\x47\x2f\x35\x9a\x9e\x8b\x13\x7b\xd6\x8d\x46\xc4\xc6\x51"
  8389. "\x04\x1b\x80\x91\xe6\x3c\x37\xe0\x3c\x00\x00\xe8\x4e\xed\x18\xff\x63\x11"
  8390. "\xf1\xd9\x88\xb8\x12\xe3\x31\x52\x3f\x3a\x05\x00\x00\x00\x8e\x93\xec\xf6"
  8391. "\x58\xfc\x23\x89\xc8\x00\x00\x00\x80\x63\x2b\x8d\x88\xb1\x48\xd2\x7c\xf3"
  8392. "\x5e\x80\xb1\x48\xd3\x7c\xbe\x71\xbf\xec\x27\xe2\x54\x5a\x2a\x57\xaa\x9f"
  8393. "\x5f\x2c\x6f\xae\x2d\xd4\xea\x22\x26\x22\x97\x2e\x2e\x97\x8a\x53\xcd\x7b"
  8394. "\x85\x27\x22\x97\xd4\x96\xa7\xeb\xe5\xdd\xe5\x6b\xfb\x96\x67\x22\xe2\x83"
  8395. "\x88\xf8\xde\xf8\xc9\xfa\x72\x7e\xbe\x5c\x5a\x18\xf4\xc9\x0f\x00\x00\x00"
  8396. "\x18\x12\xa7\xf7\x8d\xff\xff\x36\xde\x18\xff\x03\x00\x00\x00\xc7\xcc\xc4"
  8397. "\xa0\x13\x00\x00\x00\x00\x8e\x9c\xf1\x3f\x00\x00\x00\x1c\x7f\xc6\xff\x00"
  8398. "\x00\x00\x70\xac\x7d\xf5\xde\xbd\xda\x94\xb5\x9e\x7f\xbd\xf0\x70\x6b\x73"
  8399. "\xa5\xfc\xf0\xea\x42\xb1\xb2\x92\x5f\xdd\x9c\xcf\xcf\x97\x37\xd6\xf3\x4b"
  8400. "\xe5\xf2\x52\xfd\x3f\xfb\x56\x0f\xfb\xbc\x52\xb9\xbc\xfe\xc5\x58\xdb\x7c"
  8401. "\x5c\xa8\x16\x2b\xd5\x42\x65\x6b\xfb\xc1\x6a\x79\x73\xad\xfa\x60\xf9\xad"
  8402. "\x47\x60\x03\x00\x00\x00\x7d\xf4\xc1\xf9\xe7\x2f\x93\x88\xd8\xf9\xd2\xc9"
  8403. "\xfa\x04\x0c\x8f\xd1\x77\x79\xf3\xef\x8e\x2e\x0f\xa0\xff\x46\x06\x9d\x00"
  8404. "\x30\x30\xef\xb4\xff\x07\x8e\x95\xdc\xa0\x13\x00\x06\x2e\x39\xa4\xbe\xe3"
  8405. "\xcd\x3b\xbf\xec\x7d\x2e\x00\x00\xc0\xd1\x98\xfc\xd4\xf3\x97\xb7\xf7\x5d"
  8406. "\xff\x7f\xaf\x59\x77\xf0\xb9\x81\x9d\xb4\x0f\xe9\x01\x47\xc8\xf9\x3f\x18"
  8407. "\x5e\x07\x5e\xff\xcf\xb2\xec\x69\xff\x52\x01\xfa\xcc\xf5\x7f\x18\x5e\xb9"
  8408. "\x18\x09\x03\x79\x18\x6e\x87\x5d\xff\xbf\xdb\xa9\xa2\xeb\xeb\xff\x59\xf6"
  8409. "\x4e\x09\x01\x00\x00\x3d\x37\x56\x9f\x92\x34\x1f\x51\x3f\x0f\x30\x16\x69"
  8410. "\x9a\xcf\x47\xbc\x5f\x7f\x2c\x40\x2e\x59\x5c\x2e\x15\xa7\x22\xe2\xa3\x11"
  8411. "\xf1\xeb\xf1\xdc\x47\x6a\xcb\xd3\xf5\x2d\x93\x43\xc7\x0c\x00\x00\x00\x00"
  8412. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x43\x96"
  8413. "\x25\x91\x01\x00\x00\x00\xc7\x5a\x44\xfa\x87\xa4\xf9\xfc\xaf\xc9\xf1\x4b"
  8414. "\x63\xfb\xcf\x0f\xbc\x97\xfc\x7d\xbc\x3e\x8f\x88\x47\x3f\xba\xff\x83\xc7"
  8415. "\x73\xd5\xea\xc6\x74\x6d\xfd\x5f\xfe\xbd\xbe\xfa\xc3\xe6\xfa\x6b\x83\x38"
  8416. "\x83\x01\x00\x00\x00\xec\xd7\x1a\xa7\xb7\xc6\xf1\x00\x00\x00\x00\x00\x00"
  8417. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8418. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8419. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd0\x4b\xaf\x5f\x3d"
  8420. "\x99\x6f\x4d\xfd\x8c\xfb\xa7\xbb\x11\x31\xb1\x1b\x7f\xb7\x66\x34\x4e\xd4"
  8421. "\xe7\x27\x22\x17\x11\xa7\xfe\x9a\xc4\xe8\x9e\xed\x92\x88\x18\xe9\x41\xfc"
  8422. "\x9d\x67\x11\x71\xa6\x5d\xfb\x93\x5a\x5a\x31\xd1\xcc\xa2\x5d\xfc\x93\x03"
  8423. "\x8c\x9f\x46\xc4\xe9\x1e\xc4\x87\x61\xf6\xbc\xd6\xff\xdc\x69\xf7\xfb\x4b"
  8424. "\xe3\x42\x7d\xde\xfe\xf7\x77\xa3\xde\x43\xfd\xef\xf6\xf7\x7f\x7b\xe3\xb7"
  8425. "\xfa\xbf\x91\x0e\xfd\xcf\xfb\x5d\xc6\x38\xfb\xe2\x67\x85\x8e\xf1\x9f\x45"
  8426. "\x9c\x1d\x6d\xdf\xff\xb4\xe2\x27\x1d\xe2\x5f\xec\x32\xfe\x37\xbe\xbe\xbd"
  8427. "\xdd\xa9\x2e\xfb\x71\xc4\x64\xdb\xfd\x4f\xf2\x56\xac\x42\x75\x75\xbd\x50"
  8428. "\xd9\xda\xbe\xba\xbc\x3a\xb7\x54\x5c\x2a\xae\xcd\xcc\x4c\xdf\x98\xbd\x39"
  8429. "\x7b\x7d\x76\xaa\xb0\xb8\x5c\x2a\x36\x5f\xdb\xc6\xf8\xee\xa7\x7f\xfe\xe6"
  8430. "\xa0\xf6\x9f\xea\x10\x7f\xe2\x90\xf6\x5f\xea\xb2\xfd\xff\x7c\xf1\xf8\xd5"
  8431. "\xc7\x1b\xc5\x5c\xbb\xf8\x97\x2f\xb6\xff\xfe\xcf\x74\x88\x9f\x36\xf7\x7d"
  8432. "\x9f\x6b\x96\x6b\xf5\x93\xad\xf2\x4e\xa3\xbc\xd7\xb9\x9f\xfe\xea\xdc\x41"
  8433. "\xed\x5f\xe8\xd0\xfe\xc3\xbe\xff\xcb\x5d\xb6\xff\xca\xd7\xbe\xfd\xdb\x2e"
  8434. "\xdf\x0a\x00\xf4\x41\x65\x6b\x7b\x65\xae\x54\x2a\x6e\x28\xfc\xb7\x85\xda"
  8435. "\x61\x51\x9f\x83\xa6\xf1\x7f\xd2\xf6\x0f\x79\xe1\x69\xdf\x62\x7d\x66\xa7"
  8436. "\xf1\x7b\x1b\x78\x93\xbb\x2e\x0c\xba\x67\x02\x00\x00\x7a\x6d\xf7\xa0\x7f"
  8437. "\xd0\x99\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0"
  8438. "\xf0\xea\xc7\xdf\x89\xed\x8f\xb9\xb3\x5b\xcc\x92\x3e\xb7\x17\x00\x00\x00"
  8439. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8440. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8441. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8442. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8443. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  8444. "\x00\xa0\x93\x7f\x05\x00\x00\xff\xff\xfa\xda\xd9\x8d",
  8445. 1255);
  8446. syz_mount_image(/*fs=*/0x200000000040, /*dir=*/0x200000000500,
  8447. /*flags=MS_SYNCHRONOUS|MS_SILENT|MS_MANDLOCK*/ 0x8050,
  8448. /*opts=*/0x2000000001c0, /*chdir=*/1, /*size=*/0x4e5,
  8449. /*img=*/0x200000000540);
  8450. memcpy((void*)0x200000000140, "./file0\000", 8);
  8451. res = syscall(__NR_creat, /*file=*/0x200000000140ul, /*mode=*/0ul);
  8452. if (res != -1)
  8453. r[180] = res;
  8454. res = syscall(__NR_socketpair, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul,
  8455. /*proto=*/0, /*fds=*/0x2000000001c0ul);
  8456. if (res != -1) {
  8457. r[181] = *(uint32_t*)0x2000000001c0;
  8458. r[182] = *(uint32_t*)0x2000000001c4;
  8459. }
  8460. syscall(__NR_close, /*fd=*/r[180]);
  8461. syscall(__NR_fcntl, /*fd=*/r[181], /*cmd=*/0ul, /*arg=*/r[182]);
  8462. syscall(__NR_lseek, /*fd=*/-1, /*offset=*/0x49ul, /*whence=*/0ul);
  8463. syscall(__NR_getdents64, /*fd=*/-1, /*ent=*/0ul, /*count=*/0ul);
  8464. memcpy((void*)0x200000000000, "/dev/cdrom\000", 11);
  8465. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  8466. /*file=*/0x200000000000ul, /*flags=O_DIRECTORY*/ 0x10000,
  8467. /*mode=*/0);
  8468. if (res != -1)
  8469. r[183] = res;
  8470. *(uint8_t*)0x200000000080 = 0x2b;
  8471. *(uint8_t*)0x200000000081 = 0x16;
  8472. memset((void*)0x200000000082, 0, 6);
  8473. *(uint8_t*)0x200000000088 = 0xf4;
  8474. *(uint8_t*)0x200000000089 = 0xb5;
  8475. memcpy((void*)0x20000000008a,
  8476. "\x37\xc1\x2e\x88\xb5\x1b\xe5\x76\xc5\xbe\x45\x0a\xec\x35\x2c\x3d\xc4"
  8477. "\x64\x88\xbc\x0a\x44\xf5\x00\x9f\x46\xde\xff\xaa\x54\x52\x13\x1a\x9f"
  8478. "\xd8\x91\xaa\x02\x7c\x4e\xaa\xf4\xce\x92\x27\x60\x33\x15\x51\x89\xf0"
  8479. "\x75\x34\x47\x26\x44\xac\x66\xf4\x67\xea\x55\x98\x0b\x29\x34\x1c\x7a"
  8480. "\x43\xdd\x76\x19\x3f\xda\xd3\xf5\x9b\x9d\x09\x8b\x5c\xaa\xcb\x6b\x9e"
  8481. "\x6e\x31\xc2\x65\x76\xf5\x06\x41\x0e\xa5\xce\x0e\x23\xe8\xee\x94\xd3"
  8482. "\xca\xcd\x21\x6a\x3b\xee\xa4\x3c\x1f\x94\x03\xaf\x2c\xba\xc5\xc8\xf0"
  8483. "\x70\x93\x7a\xcc\x93\xa1\x11\x63\x59\x35\x07\x2c\x3a\xa6\x78\x1d\x7b"
  8484. "\x65\x70\xc3\xb0\x9e\xdf\x84\xa5\x5e\x70\x2f\xb7\x07\x71\x73\x37\x12"
  8485. "\xcf\x15\x90\x9e\x9f\x96\x08\x18\xe2\x89\xb4\x48\xce\x5f\x02\x84\x89"
  8486. "\x60\x61\xd6\xab\x20\xa5\x92\x31\x93\x48\x81",
  8487. 181);
  8488. syscall(__NR_setsockopt, /*fd=*/-1, /*level=*/0x29, /*optname=*/0x37,
  8489. /*optval=*/0x200000000080ul, /*optlen=*/0xc0ul);
  8490. memcpy((void*)0x200000000000, "/dev/snd/timer\000", 15);
  8491. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  8492. /*file=*/0x200000000000ul, /*flags=*/0, 0);
  8493. if (res != -1)
  8494. r[184] = res;
  8495. syscall(
  8496. __NR_clock_getres,
  8497. /*id=CLOCK_PROCESS_CPUTIME_ID|0x4b54da0c41cf7c50*/ 0x4b54da0c41cf7c52ul,
  8498. /*tp=*/0ul);
  8499. *(uint32_t*)0x200000000140 = 1;
  8500. *(uint32_t*)0x200000000144 = 0;
  8501. *(uint32_t*)0x200000000148 = 0;
  8502. *(uint32_t*)0x20000000014c = 0;
  8503. *(uint32_t*)0x200000000150 = 0;
  8504. memset((void*)0x200000000154, 0, 32);
  8505. syscall(__NR_ioctl, /*fd=*/r[184], /*cmd=*/0x40345410,
  8506. /*arg=*/0x200000000140ul);
  8507. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/3ul, /*proto=*/2);
  8508. if (res != -1)
  8509. r[185] = res;
  8510. syscall(__NR_getsockopt, /*fd=*/r[185], /*level=*/1, /*optname=*/0,
  8511. /*optval=*/0ul, /*optlen=*/0ul);
  8512. memcpy(
  8513. (void*)0x200000000940,
  8514. "\0203q}2[\340\232\356\257\003\227\236t\v\"|"
  8515. "Ma\206\347\300\024\237\271h\261\226\347=I\2060S6\265\250\302\225Je%"
  8516. "\376G\'\250\345\217\370\322\034\300\373\034\246\253\bi\344^"
  8517. "\325\375\251\r\2547A\224k\315\t\000\220k\326\005\266&\320\235aA\305\234_"
  8518. "\324\030,\f\324s\262\231/"
  8519. "\300\232\362Oc\300c\003gB!\260\270n\001\233T\225\020\206\350$\177\r["
  8520. "\371\0161v\261\034\210\v\225uy\265:\342\341\334(\375\005\237B\204O\376@"
  8521. "\000\000\000\000\000\000\000\000\000\000\000\000\032\240\212\033\003\"&"
  8522. "\254\312p>\314Z\001\274\030\301\271\351\v\213\234\264Q\324\226EV<>"
  8523. "\t\000\000\000\304tL\352\365W\275#"
  8524. "\317\212\320\350\270\354\004\205\f\357\264\204\355\237/"
  8525. "\324\273\352;-Dp\370\320F\220\370\222Ip6\364\026\350\024\340\222!\222-"
  8526. "F\342\024D\221\250b\004\335\035\a\334\340\030\205{"
  8527. "\200Q\366k\226\372Q\237W\vO\360\344O\\\316S\362\336\0049d\006#"
  8528. "\210\303\337\205O\034\303\255?r\327\016\000\327\203\260\210\234\366Y-"
  8529. "F\230\335\234~\375\225\303\266lC\252\"Y\365\320\267\334\213\027|"
  8530. "\351q\242K\354z\204:*\365Y\321\2331}\233\025\324\354\002o\001&"
  8531. "\252\220w\304\307yn\265\032g\253&?"
  8532. "\276\313\350v\250\340\244\201sW\254f\0249\322}\357CGa\232$4\214\245!"
  8533. "p\203\005\226%\002%\253j\n\b\310NC\221}&"
  8534. "y\323\341\356p\'\305\253\031GsX5\214\n\237h\356;4\261%"
  8535. "V\340\251\216\3630:\330\030N~G\0239\312\257\353o\035\027\325nAp\327\314("
  8536. "A\230 "
  8537. "\000;]\375;\320\234\031v\034\302]"
  8538. "\264Dk\205\344\210\2154\200\231\301i\255\2466\223\v\321/"
  8539. ";6U\344\261\233\247\270\335t8\226\301=W\321\001\333r\311n@"
  8540. "fw\305\272\234\234}\375\214\333gE@N\307\252\210Z\001:\270\206\207#"
  8541. "\365\324L->\271\021_\374h)\274\2525\255\267?\2530{"
  8542. "8\207\346\253\200\272p<\223}"
  8543. "1K\323\202\2651c\300\366\256\352\233ht\221N\021\002\24557\210&\a!"
  8544. "\022D\037y\214\336\236`\253\345\234\320\233\214["
  8545. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\302"
  8546. "\365\200\375\004\3544\340\n\252%R\301\273\271:"
  8547. "\017\274\005\315\243\206\276\257\270S\352\234\006["
  8548. "Q\231\003\325J\361\351}*\204\232\337\f\365\356\337H@"
  8549. "\340\016\000\370\217Q;"
  8550. "n2I\373\f\262\320\224\t\335\265\252\352\225\310\037\024\343\243\026\245"
  8551. "\326\375\333\314\336\350q\351\306\265\211\341\304\317\337\\\2750\302~"
  8552. "\355\000\332\351\307\265}"
  8553. "\224\260\034\365\327\034\265\033\0168\252\242\261h\265P\002KQ",
  8554. 737);
  8555. res = syscall(__NR_memfd_create, /*name=*/0x200000000940ul, /*flags=*/0ul);
  8556. if (res != -1)
  8557. r[186] = res;
  8558. memcpy((void*)0x200000000040, "/dev/loop#\000", 11);
  8559. res = -1;
  8560. res = syz_open_dev(/*dev=*/0x200000000040, /*id=*/0, /*flags=*/0);
  8561. if (res != -1)
  8562. r[187] = res;
  8563. syscall(__NR_ioctl, /*fd=*/r[187], /*cmd=*/0x4c06, /*arg=*/r[186]);
  8564. syscall(__NR_ioctl, /*fd=*/r[184], /*cmd=*/0x54a0, 0);
  8565. memcpy((void*)0x200000000000, "/dev/snd/timer\000", 15);
  8566. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  8567. /*file=*/0x200000000000ul, /*flags=*/0x20, 0);
  8568. if (res != -1)
  8569. r[188] = res;
  8570. *(uint32_t*)0x200000000140 = 1;
  8571. *(uint32_t*)0x200000000144 = 0;
  8572. *(uint32_t*)0x200000000148 = 0;
  8573. *(uint32_t*)0x20000000014c = 0;
  8574. *(uint32_t*)0x200000000150 = 0;
  8575. memset((void*)0x200000000154, 0, 32);
  8576. syscall(__NR_ioctl, /*fd=*/r[188], /*cmd=*/0x40345410,
  8577. /*arg=*/0x200000000140ul);
  8578. syscall(__NR_ioctl, /*fd=*/r[188], /*cmd=*/0x54a2, 0);
  8579. syscall(__NR_ioctl, /*fd=*/r[184], /*cmd=*/0x54a1, 0);
  8580. *(uint8_t*)0x200000000040 = 0xa;
  8581. syscall(__NR_ioctl, /*fd=*/r[183], /*cmd=*/0x5390, /*arg=*/0x200000000040ul);
  8582. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc);
  8583. if (res != -1)
  8584. r[189] = res;
  8585. *(uint64_t*)0x200000000280 = 0;
  8586. *(uint32_t*)0x200000000288 = 0;
  8587. *(uint64_t*)0x200000000290 = 0x200000000240;
  8588. *(uint64_t*)0x200000000240 = 0x200000000000;
  8589. *(uint32_t*)0x200000000000 = 0x50;
  8590. *(uint8_t*)0x200000000004 = 1;
  8591. *(uint8_t*)0x200000000005 = 2;
  8592. *(uint16_t*)0x200000000006 = 0x101;
  8593. *(uint32_t*)0x200000000008 = 0;
  8594. *(uint32_t*)0x20000000000c = 0;
  8595. *(uint8_t*)0x200000000010 = 2;
  8596. *(uint8_t*)0x200000000011 = 0;
  8597. *(uint16_t*)0x200000000012 = htobe16(0);
  8598. *(uint16_t*)0x200000000014 = 0x3c;
  8599. STORE_BY_BITMASK(uint16_t, , 0x200000000016, 1, 0, 14);
  8600. STORE_BY_BITMASK(uint16_t, , 0x200000000017, 0, 6, 1);
  8601. STORE_BY_BITMASK(uint16_t, , 0x200000000017, 1, 7, 1);
  8602. *(uint16_t*)0x200000000018 = 0xc;
  8603. STORE_BY_BITMASK(uint16_t, , 0x20000000001a, 2, 0, 14);
  8604. STORE_BY_BITMASK(uint16_t, , 0x20000000001b, 0, 6, 1);
  8605. STORE_BY_BITMASK(uint16_t, , 0x20000000001b, 1, 7, 1);
  8606. *(uint16_t*)0x20000000001c = 5;
  8607. *(uint16_t*)0x20000000001e = 1;
  8608. *(uint8_t*)0x200000000020 = 0;
  8609. *(uint16_t*)0x200000000024 = 0x2c;
  8610. STORE_BY_BITMASK(uint16_t, , 0x200000000026, 1, 0, 14);
  8611. STORE_BY_BITMASK(uint16_t, , 0x200000000027, 0, 6, 1);
  8612. STORE_BY_BITMASK(uint16_t, , 0x200000000027, 1, 7, 1);
  8613. *(uint16_t*)0x200000000028 = 0x14;
  8614. *(uint16_t*)0x20000000002a = 3;
  8615. *(uint8_t*)0x20000000002c = -1;
  8616. *(uint8_t*)0x20000000002d = 2;
  8617. memset((void*)0x20000000002e, 0, 13);
  8618. *(uint8_t*)0x20000000003b = 1;
  8619. *(uint16_t*)0x20000000003c = 0x14;
  8620. *(uint16_t*)0x20000000003e = 4;
  8621. memset((void*)0x200000000040, 0, 10);
  8622. memset((void*)0x20000000004a, 255, 2);
  8623. *(uint32_t*)0x20000000004c = htobe32(0xe0000001);
  8624. *(uint64_t*)0x200000000248 = 0x50;
  8625. *(uint64_t*)0x200000000298 = 1;
  8626. *(uint64_t*)0x2000000002a0 = 0;
  8627. *(uint64_t*)0x2000000002a8 = 0;
  8628. *(uint32_t*)0x2000000002b0 = 0;
  8629. syscall(__NR_sendmsg, /*fd=*/r[189], /*msg=*/0x200000000280ul, /*f=*/0ul);
  8630. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
  8631. if (res != -1)
  8632. r[190] = res;
  8633. *(uint64_t*)0x2000000009c0 = 0;
  8634. *(uint32_t*)0x2000000009c8 = 0;
  8635. *(uint64_t*)0x2000000009d0 = 0x200000000940;
  8636. *(uint64_t*)0x200000000940 = 0x200000000080;
  8637. memcpy((void*)0x200000000080,
  8638. "\x1c\x00\x00\x00\xb8\xb0\xd6\x10\xb3\x7b\x4e\xcf\xe3\x76\x00\x0b\x0f"
  8639. "\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x80\xa3\x9d\x2a\x73\x6c"
  8640. "\x00\x00\x02",
  8641. 37);
  8642. *(uint64_t*)0x200000000948 = 0x1c;
  8643. *(uint64_t*)0x2000000009d8 = 1;
  8644. *(uint64_t*)0x2000000009e0 = 0;
  8645. *(uint64_t*)0x2000000009e8 = 0;
  8646. *(uint32_t*)0x2000000009f0 = 0;
  8647. syscall(__NR_sendmsg, /*fd=*/r[190], /*msg=*/0x2000000009c0ul, /*f=*/0ul);
  8648. memcpy((void*)0x200000000000, "/dev/cdrom\000", 11);
  8649. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  8650. /*file=*/0x200000000000ul, /*flags=O_DIRECTORY*/ 0x10000,
  8651. /*mode=*/0);
  8652. if (res != -1)
  8653. r[191] = res;
  8654. *(uint8_t*)0x200000000080 = 0x2b;
  8655. *(uint8_t*)0x200000000081 = 0x16;
  8656. memset((void*)0x200000000082, 0, 6);
  8657. *(uint8_t*)0x200000000088 = 0xf4;
  8658. *(uint8_t*)0x200000000089 = 0xb5;
  8659. memcpy((void*)0x20000000008a,
  8660. "\x37\xc1\x2e\x88\xb5\x1b\xe5\x76\xc5\xbe\x45\x0a\xec\x35\x2c\x3d\xc4"
  8661. "\x64\x88\xbc\x0a\x44\xf5\x00\x9f\x46\xde\xff\xaa\x54\x52\x13\x1a\x9f"
  8662. "\xd8\x91\xaa\x02\x7c\x4e\xaa\xf4\xce\x92\x27\x60\x33\x15\x51\x89\xf0"
  8663. "\x75\x34\x47\x26\x44\xac\x66\xf4\x67\xea\x55\x98\x0b\x29\x34\x1c\x7a"
  8664. "\x43\xdd\x76\x19\x3f\xda\xd3\xf5\x9b\x9d\x09\x8b\x5c\xaa\xcb\x6b\x9e"
  8665. "\x6e\x31\xc2\x65\x76\xf5\x06\x41\x0e\xa5\xce\x0e\x23\xe8\xee\x94\xd3"
  8666. "\xca\xcd\x21\x6a\x3b\xee\xa4\x3c\x1f\x94\x03\xaf\x2c\xba\xc5\xc8\xf0"
  8667. "\x70\x93\x7a\xcc\x93\xa1\x11\x63\x59\x35\x07\x2c\x3a\xa6\x78\x1d\x7b"
  8668. "\x65\x70\xc3\xb0\x9e\xdf\x84\xa5\x5e\x70\x2f\xb7\x07\x71\x73\x37\x12"
  8669. "\xcf\x15\x90\x9e\x9f\x96\x08\x18\xe2\x89\xb4\x48\xce\x5f\x02\x84\x89"
  8670. "\x60\x61\xd6\xab\x20\xa5\x92\x31\x93\x48\x81",
  8671. 181);
  8672. syscall(__NR_setsockopt, /*fd=*/-1, /*level=*/0x29, /*optname=*/0x37,
  8673. /*optval=*/0x200000000080ul, /*optlen=*/0xc0ul);
  8674. memcpy((void*)0x200000000000, "/dev/snd/timer\000", 15);
  8675. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  8676. /*file=*/0x200000000000ul, /*flags=*/0, 0);
  8677. if (res != -1)
  8678. r[192] = res;
  8679. syscall(
  8680. __NR_clock_getres,
  8681. /*id=CLOCK_PROCESS_CPUTIME_ID|0x4b54da0c41cf7c50*/ 0x4b54da0c41cf7c52ul,
  8682. /*tp=*/0ul);
  8683. *(uint32_t*)0x200000000140 = 1;
  8684. *(uint32_t*)0x200000000144 = 0;
  8685. *(uint32_t*)0x200000000148 = 0;
  8686. *(uint32_t*)0x20000000014c = 0;
  8687. *(uint32_t*)0x200000000150 = 0;
  8688. memset((void*)0x200000000154, 0, 32);
  8689. syscall(__NR_ioctl, /*fd=*/r[192], /*cmd=*/0x40345410,
  8690. /*arg=*/0x200000000140ul);
  8691. res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/3ul, /*proto=*/2);
  8692. if (res != -1)
  8693. r[193] = res;
  8694. syscall(__NR_getsockopt, /*fd=*/r[193], /*level=*/1, /*optname=*/0,
  8695. /*optval=*/0ul, /*optlen=*/0ul);
  8696. memcpy(
  8697. (void*)0x200000000940,
  8698. "\0203q}2[\340\232\356\257\003\227\236t\v\"|"
  8699. "Ma\206\347\300\024\237\271h\261\226\347=I\2060S6\265\250\302\225Je%"
  8700. "\376G\'\250\345\217\370\322\034\300\373\034\246\253\bi\344^"
  8701. "\325\375\251\r\2547A\224k\315\t\000\220k\326\005\266&\320\235aA\305\234_"
  8702. "\324\030,\f\324s\262\231/"
  8703. "\300\232\362Oc\300c\003gB!\260\270n\001\233T\225\020\206\350$\177\r["
  8704. "\371\0161v\261\034\210\v\225uy\265:\342\341\334(\375\005\237B\204O\376@"
  8705. "\000\000\000\000\000\000\000\000\000\000\000\000\032\240\212\033\003\"&"
  8706. "\254\312p>\314Z\001\274\030\301\271\351\v\213\234\264Q\324\226EV<>"
  8707. "\t\000\000\000\304tL\352\365W\275#"
  8708. "\317\212\320\350\270\354\004\205\f\357\264\204\355\237/"
  8709. "\324\273\352;-Dp\370\320F\220\370\222Ip6\364\026\350\024\340\222!\222-"
  8710. "F\342\024D\221\250b\004\335\035\a\334\340\030\205{"
  8711. "\200Q\366k\226\372Q\237W\vO\360\344O\\\316S\362\336\0049d\006#"
  8712. "\210\303\337\205O\034\303\255?r\327\016\000\327\203\260\210\234\366Y-"
  8713. "F\230\335\234~\375\225\303\266lC\252\"Y\365\320\267\334\213\027|"
  8714. "\351q\242K\354z\204:*\365Y\321\2331}\233\025\324\354\002o\001&"
  8715. "\252\220w\304\307yn\265\032g\253&?"
  8716. "\276\313\350v\250\340\244\201sW\254f\0249\322}\357CGa\232$4\214\245!"
  8717. "p\203\005\226%\002%\253j\n\b\310NC\221}&"
  8718. "y\323\341\356p\'\305\253\031GsX5\214\n\237h\356;4\261%"
  8719. "V\340\251\216\3630:\330\030N~G\0239\312\257\353o\035\027\325nAp\327\314("
  8720. "A\230 "
  8721. "\000;]\375;\320\234\031v\034\302]"
  8722. "\264Dk\205\344\210\2154\200\231\301i\255\2466\223\v\321/"
  8723. ";6U\344\261\233\247\270\335t8\226\301=W\321\001\333r\311n@"
  8724. "fw\305\272\234\234}\375\214\333gE@N\307\252\210Z\001:\270\206\207#"
  8725. "\365\324L->\271\021_\374h)\274\2525\255\267?\2530{"
  8726. "8\207\346\253\200\272p<\223}"
  8727. "1K\323\202\2651c\300\366\256\352\233ht\221N\021\002\24557\210&\a!"
  8728. "\022D\037y\214\336\236`\253\345\234\320\233\214["
  8729. "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\302"
  8730. "\365\200\375\004\3544\340\n\252%R\301\273\271:"
  8731. "\017\274\005\315\243\206\276\257\270S\352\234\006["
  8732. "Q\231\003\325J\361\351}*\204\232\337\f\365\356\337H@"
  8733. "\340\016\000\370\217Q;"
  8734. "n2I\373\f\262\320\224\t\335\265\252\352\225\310\037\024\343\243\026\245"
  8735. "\326\375\333\314\336\350q\351\306\265\211\341\304\317\337\\\2750\302~"
  8736. "\355\000\332\351\307\265}"
  8737. "\224\260\034\365\327\034\265\033\0168\252\242\261h\265P\002KQ",
  8738. 737);
  8739. res = syscall(__NR_memfd_create, /*name=*/0x200000000940ul, /*flags=*/0ul);
  8740. if (res != -1)
  8741. r[194] = res;
  8742. memcpy((void*)0x200000000040, "/dev/loop#\000", 11);
  8743. res = -1;
  8744. res = syz_open_dev(/*dev=*/0x200000000040, /*id=*/0, /*flags=*/0);
  8745. if (res != -1)
  8746. r[195] = res;
  8747. syscall(__NR_ioctl, /*fd=*/r[195], /*cmd=*/0x4c06, /*arg=*/r[194]);
  8748. syscall(__NR_ioctl, /*fd=*/r[192], /*cmd=*/0x54a0, 0);
  8749. memcpy((void*)0x200000000000, "/dev/snd/timer\000", 15);
  8750. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
  8751. /*file=*/0x200000000000ul, /*flags=*/0x20, 0);
  8752. if (res != -1)
  8753. r[196] = res;
  8754. *(uint32_t*)0x200000000140 = 1;
  8755. *(uint32_t*)0x200000000144 = 0;
  8756. *(uint32_t*)0x200000000148 = 0;
  8757. *(uint32_t*)0x20000000014c = 0;
  8758. *(uint32_t*)0x200000000150 = 0;
  8759. memset((void*)0x200000000154, 0, 32);
  8760. syscall(__NR_ioctl, /*fd=*/r[196], /*cmd=*/0x40345410,
  8761. /*arg=*/0x200000000140ul);
  8762. syscall(__NR_ioctl, /*fd=*/r[196], /*cmd=*/0x54a2, 0);
  8763. syscall(__NR_ioctl, /*fd=*/r[192], /*cmd=*/0x54a1, 0);
  8764. *(uint8_t*)0x200000000040 = 0xa;
  8765. syscall(__NR_ioctl, /*fd=*/r[191], /*cmd=*/0x5390, /*arg=*/0x200000000040ul);
  8766. return 0;
  8767. }
  8768.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!