// https://syzkaller.appspot.com/bug?id=96bf91ef68d5122d762dde30c8a3b919b6a9fd28 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_memfd_create #define __NR_memfd_create 319 #endif static unsigned long long procid; static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } //% This code is derived from puff.{c,h}, found in the zlib development. The //% original files come with the following copyright notice: //% Copyright (C) 2002-2013 Mark Adler, all rights reserved //% version 2.3, 21 Jan 2013 //% This software is provided 'as-is', without any express or implied //% warranty. In no event will the author be held liable for any damages //% arising from the use of this software. //% Permission is granted to anyone to use this software for any purpose, //% including commercial applications, and to alter it and redistribute it //% freely, subject to the following restrictions: //% 1. The origin of this software must not be misrepresented; you must not //% claim that you wrote the original software. If you use this software //% in a product, an acknowledgment in the product documentation would be //% appreciated but is not required. //% 2. Altered source versions must be plainly marked as such, and must not be //% misrepresented as being the original software. //% 3. This notice may not be removed or altered from any source distribution. //% Mark Adler madler@alumni.caltech.edu //% BEGIN CODE DERIVED FROM puff.{c,h} #define MAXBITS 15 #define MAXLCODES 286 #define MAXDCODES 30 #define MAXCODES (MAXLCODES + MAXDCODES) #define FIXLCODES 288 struct puff_state { unsigned char* out; unsigned long outlen; unsigned long outcnt; const unsigned char* in; unsigned long inlen; unsigned long incnt; int bitbuf; int bitcnt; jmp_buf env; }; static int puff_bits(struct puff_state* s, int need) { long val = s->bitbuf; while (s->bitcnt < need) { if (s->incnt == s->inlen) longjmp(s->env, 1); val |= (long)(s->in[s->incnt++]) << s->bitcnt; s->bitcnt += 8; } s->bitbuf = (int)(val >> need); s->bitcnt -= need; return (int)(val & ((1L << need) - 1)); } static int puff_stored(struct puff_state* s) { s->bitbuf = 0; s->bitcnt = 0; if (s->incnt + 4 > s->inlen) return 2; unsigned len = s->in[s->incnt++]; len |= s->in[s->incnt++] << 8; if (s->in[s->incnt++] != (~len & 0xff) || s->in[s->incnt++] != ((~len >> 8) & 0xff)) return -2; if (s->incnt + len > s->inlen) return 2; if (s->outcnt + len > s->outlen) return 1; for (; len--; s->outcnt++, s->incnt++) { if (s->in[s->incnt]) s->out[s->outcnt] = s->in[s->incnt]; } return 0; } struct puff_huffman { short* count; short* symbol; }; static int puff_decode(struct puff_state* s, const struct puff_huffman* h) { int first = 0; int index = 0; int bitbuf = s->bitbuf; int left = s->bitcnt; int code = first = index = 0; int len = 1; short* next = h->count + 1; while (1) { while (left--) { code |= bitbuf & 1; bitbuf >>= 1; int count = *next++; if (code - count < first) { s->bitbuf = bitbuf; s->bitcnt = (s->bitcnt - len) & 7; return h->symbol[index + (code - first)]; } index += count; first += count; first <<= 1; code <<= 1; len++; } left = (MAXBITS + 1) - len; if (left == 0) break; if (s->incnt == s->inlen) longjmp(s->env, 1); bitbuf = s->in[s->incnt++]; if (left > 8) left = 8; } return -10; } static int puff_construct(struct puff_huffman* h, const short* length, int n) { int len; for (len = 0; len <= MAXBITS; len++) h->count[len] = 0; int symbol; for (symbol = 0; symbol < n; symbol++) (h->count[length[symbol]])++; if (h->count[0] == n) return 0; int left = 1; for (len = 1; len <= MAXBITS; len++) { left <<= 1; left -= h->count[len]; if (left < 0) return left; } short offs[MAXBITS + 1]; offs[1] = 0; for (len = 1; len < MAXBITS; len++) offs[len + 1] = offs[len] + h->count[len]; for (symbol = 0; symbol < n; symbol++) if (length[symbol] != 0) h->symbol[offs[length[symbol]]++] = symbol; return left; } static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode, const struct puff_huffman* distcode) { static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258}; static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0}; static const short dists[30] = { 1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, 257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577}; static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13}; int symbol; do { symbol = puff_decode(s, lencode); if (symbol < 0) return symbol; if (symbol < 256) { if (s->outcnt == s->outlen) return 1; if (symbol) s->out[s->outcnt] = symbol; s->outcnt++; } else if (symbol > 256) { symbol -= 257; if (symbol >= 29) return -10; int len = lens[symbol] + puff_bits(s, lext[symbol]); symbol = puff_decode(s, distcode); if (symbol < 0) return symbol; unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]); if (dist > s->outcnt) return -11; if (s->outcnt + len > s->outlen) return 1; while (len--) { if (dist <= s->outcnt && s->out[s->outcnt - dist]) s->out[s->outcnt] = s->out[s->outcnt - dist]; s->outcnt++; } } } while (symbol != 256); return 0; } static int puff_fixed(struct puff_state* s) { static int virgin = 1; static short lencnt[MAXBITS + 1], lensym[FIXLCODES]; static short distcnt[MAXBITS + 1], distsym[MAXDCODES]; static struct puff_huffman lencode, distcode; if (virgin) { lencode.count = lencnt; lencode.symbol = lensym; distcode.count = distcnt; distcode.symbol = distsym; short lengths[FIXLCODES]; int symbol; for (symbol = 0; symbol < 144; symbol++) lengths[symbol] = 8; for (; symbol < 256; symbol++) lengths[symbol] = 9; for (; symbol < 280; symbol++) lengths[symbol] = 7; for (; symbol < FIXLCODES; symbol++) lengths[symbol] = 8; puff_construct(&lencode, lengths, FIXLCODES); for (symbol = 0; symbol < MAXDCODES; symbol++) lengths[symbol] = 5; puff_construct(&distcode, lengths, MAXDCODES); virgin = 0; } return puff_codes(s, &lencode, &distcode); } static int puff_dynamic(struct puff_state* s) { static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; int nlen = puff_bits(s, 5) + 257; int ndist = puff_bits(s, 5) + 1; int ncode = puff_bits(s, 4) + 4; if (nlen > MAXLCODES || ndist > MAXDCODES) return -3; short lengths[MAXCODES]; int index; for (index = 0; index < ncode; index++) lengths[order[index]] = puff_bits(s, 3); for (; index < 19; index++) lengths[order[index]] = 0; short lencnt[MAXBITS + 1], lensym[MAXLCODES]; struct puff_huffman lencode = {lencnt, lensym}; int err = puff_construct(&lencode, lengths, 19); if (err != 0) return -4; index = 0; while (index < nlen + ndist) { int symbol; int len; symbol = puff_decode(s, &lencode); if (symbol < 0) return symbol; if (symbol < 16) lengths[index++] = symbol; else { len = 0; if (symbol == 16) { if (index == 0) return -5; len = lengths[index - 1]; symbol = 3 + puff_bits(s, 2); } else if (symbol == 17) symbol = 3 + puff_bits(s, 3); else symbol = 11 + puff_bits(s, 7); if (index + symbol > nlen + ndist) return -6; while (symbol--) lengths[index++] = len; } } if (lengths[256] == 0) return -9; err = puff_construct(&lencode, lengths, nlen); if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1])) return -7; short distcnt[MAXBITS + 1], distsym[MAXDCODES]; struct puff_huffman distcode = {distcnt, distsym}; err = puff_construct(&distcode, lengths + nlen, ndist); if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1])) return -8; return puff_codes(s, &lencode, &distcode); } static int puff(unsigned char* dest, unsigned long* destlen, const unsigned char* source, unsigned long sourcelen) { struct puff_state s = { .out = dest, .outlen = *destlen, .outcnt = 0, .in = source, .inlen = sourcelen, .incnt = 0, .bitbuf = 0, .bitcnt = 0, }; int err; if (setjmp(s.env) != 0) err = 2; else { int last; do { last = puff_bits(&s, 1); int type = puff_bits(&s, 2); err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1)); if (err != 0) break; } while (!last); } *destlen = s.outcnt; return err; } //% END CODE DERIVED FROM puff.{c,h} #define ZLIB_HEADER_WIDTH 2 static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd) { if (sourcelen < ZLIB_HEADER_WIDTH) return 0; source += ZLIB_HEADER_WIDTH; sourcelen -= ZLIB_HEADER_WIDTH; const unsigned long max_destlen = 132 << 20; void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0); if (ret == MAP_FAILED) return -1; unsigned char* dest = (unsigned char*)ret; unsigned long destlen = max_destlen; int err = puff(dest, &destlen, source, sourcelen); if (err) { munmap(dest, max_destlen); errno = -err; return -1; } if (write(dest_fd, dest, destlen) != (ssize_t)destlen) { munmap(dest, max_destlen); return -1; } return munmap(dest, max_destlen); } static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p) { int err = 0, loopfd = -1; int memfd = syscall(__NR_memfd_create, "syzkaller", 0); if (memfd == -1) { err = errno; goto error; } if (puff_zlib_to_file(data, size, memfd)) { err = errno; goto error_close_memfd; } loopfd = open(loopname, O_RDWR); if (loopfd == -1) { err = errno; goto error_close_memfd; } if (ioctl(loopfd, LOOP_SET_FD, memfd)) { if (errno != EBUSY) { err = errno; goto error_close_loop; } ioctl(loopfd, LOOP_CLR_FD, 0); usleep(1000); if (ioctl(loopfd, LOOP_SET_FD, memfd)) { err = errno; goto error_close_loop; } } close(memfd); *loopfd_p = loopfd; return 0; error_close_loop: close(loopfd); error_close_memfd: close(memfd); error: errno = err; return -1; } static void reset_loop_device(const char* loopname) { int loopfd = open(loopname, O_RDWR); if (loopfd == -1) { return; } if (ioctl(loopfd, LOOP_CLR_FD, 0)) { } close(loopfd); } static long syz_mount_image(volatile long fsarg, volatile long dir, volatile long flags, volatile long optsarg, volatile long change_dir, volatile unsigned long size, volatile long image) { unsigned char* data = (unsigned char*)image; int res = -1, err = 0, need_loop_device = !!size; char* mount_opts = (char*)optsarg; char* target = (char*)dir; char* fs = (char*)fsarg; char* source = NULL; char loopname[64]; if (need_loop_device) { int loopfd; memset(loopname, 0, sizeof(loopname)); snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); if (setup_loop_device(data, size, loopname, &loopfd) == -1) return -1; close(loopfd); source = loopname; } mkdir(target, 0777); char opts[256]; memset(opts, 0, sizeof(opts)); if (strlen(mount_opts) > (sizeof(opts) - 32)) { } strncpy(opts, mount_opts, sizeof(opts) - 32); if (strcmp(fs, "iso9660") == 0) { flags |= MS_RDONLY; } else if (strncmp(fs, "ext", 3) == 0) { bool has_remount_ro = false; char* remount_ro_start = strstr(opts, "errors=remount-ro"); if (remount_ro_start != NULL) { char after = *(remount_ro_start + strlen("errors=remount-ro")); char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1); has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ',')); } if (strstr(opts, "errors=panic") || !has_remount_ro) strcat(opts, ",errors=continue"); } else if (strcmp(fs, "xfs") == 0) { strcat(opts, ",nouuid"); } else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) { strcat(opts, ",errors=withdraw"); } res = mount(source, target, fs, flags, opts); if (res == -1) { err = errno; goto error_clear_loop; } res = open(target, O_RDONLY | O_DIRECTORY); if (res == -1) { err = errno; goto error_clear_loop; } if (change_dir) { res = chdir(target); if (res == -1) { err = errno; } } error_clear_loop: if (need_loop_device) reset_loop_device(loopname); errno = err; return res; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void reset_loop() { char buf[64]; snprintf(buf, sizeof(buf), "/dev/loop%llu", procid); int loopfd = open(buf, O_RDWR); if (loopfd != -1) { ioctl(loopfd, LOOP_CLR_FD, 0); close(loopfd); } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void setup_sysctl() { int cad_pid = fork(); if (cad_pid < 0) exit(1); if (cad_pid == 0) { for (;;) sleep(100); } char tmppid[32]; snprintf(tmppid, sizeof(tmppid), "%d", cad_pid); struct { const char* name; const char* data; } files[] = { {"/sys/kernel/debug/x86/nmi_longest_ns", "10000000000"}, {"/proc/sys/kernel/hung_task_check_interval_secs", "20"}, {"/proc/sys/net/core/bpf_jit_kallsyms", "1"}, {"/proc/sys/net/core/bpf_jit_harden", "0"}, {"/proc/sys/kernel/kptr_restrict", "0"}, {"/proc/sys/kernel/softlockup_all_cpu_backtrace", "1"}, {"/proc/sys/fs/mount-max", "100"}, {"/proc/sys/vm/oom_dump_tasks", "0"}, {"/proc/sys/debug/exception-trace", "0"}, {"/proc/sys/kernel/printk", "7 4 1 3"}, {"/proc/sys/kernel/keys/gc_delay", "1"}, {"/proc/sys/vm/oom_kill_allocating_task", "1"}, {"/proc/sys/kernel/ctrl-alt-del", "0"}, {"/proc/sys/kernel/cad_pid", tmppid}, }; for (size_t i = 0; i < sizeof(files) / sizeof(files[0]); i++) { if (!write_file(files[i].name, files[i].data)) { } } kill(cad_pid, SIGKILL); while (waitpid(cad_pid, NULL, 0) != cad_pid) ; } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { reset_loop(); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[1] = {0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // syz_mount_image$ext4 arguments: [ // fs: ptr[in, buffer] { // buffer: {65 78 74 34 00} (length 0x5) // } // dir: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8) // } // flags: mount_flags = 0x200000 (8 bytes) // opts: ptr[in, fs_options[ext4_options]] { // fs_options[ext4_options] { // elems: array[fs_opt_elem[ext4_options]] { // fs_opt_elem[ext4_options] { // elem: union ext4_options { // resgid: fs_opt["resgid", fmt[hex, gid]] { // name: buffer: {72 65 73 67 69 64} (length 0x6) // eq: const = 0x3d (1 bytes) // val: gid (resource) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // bsddf: buffer: {62 73 64 64 66} (length 0x5) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // grpquota: buffer: {67 72 70 71 75 6f 74 61} (length 0x8) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // nojournal_checksum: buffer: {6e 6f 6a 6f 75 72 6e 61 6c 5f 63 // 68 65 63 6b 73 75 6d} (length 0x12) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // debug_want_extra_isize: fs_opt["debug_want_extra_isize", // fmt[hex, int32]] { // name: buffer: {64 65 62 75 67 5f 77 61 6e 74 5f 65 78 74 72 // 61 5f 69 73 69 7a 65} (length 0x16) eq: const = 0x3d (1 // bytes) val: int32 = 0x80 (18 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // delalloc: buffer: {64 65 6c 61 6c 6c 6f 63} (length 0x8) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // nogrpid: buffer: {6e 6f 67 72 70 69 64} (length 0x7) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // noauto_da_alloc: buffer: {6e 6f 61 75 74 6f 5f 64 61 5f 61 6c // 6c 6f 63} (length 0xf) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // stripe: fs_opt["stripe", fmt[hex, int32]] { // name: buffer: {73 74 72 69 70 65} (length 0x6) // eq: const = 0x3d (1 bytes) // val: int32 = 0x2 (18 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // } // common: array[fs_opt_elem[fs_options_common]] { // } // null: const = 0x0 (1 bytes) // } // } // chdir: int8 = 0x3 (1 bytes) // size: len = 0x572 (8 bytes) // img: ptr[in, buffer] { // buffer: (compressed buffer with length 0x572) // } // ] // returns fd_dir NONFAILING(memcpy((void*)0x200000000040, "ext4\000", 5)); NONFAILING(memcpy((void*)0x200000000140, "./file1\000", 8)); NONFAILING(memcpy((void*)0x200000000440, "resgid", 6)); NONFAILING(*(uint8_t*)0x200000000446 = 0x3d); NONFAILING(sprintf((char*)0x200000000447, "0x%016llx", (long long)0xee00)); NONFAILING(*(uint8_t*)0x200000000459 = 0x2c); NONFAILING(memcpy((void*)0x20000000045a, "bsddf", 5)); NONFAILING(*(uint8_t*)0x20000000045f = 0x2c); NONFAILING(memcpy((void*)0x200000000460, "grpquota", 8)); NONFAILING(*(uint8_t*)0x200000000468 = 0x2c); NONFAILING(memcpy((void*)0x200000000469, "nojournal_checksum", 18)); NONFAILING(*(uint8_t*)0x20000000047b = 0x2c); NONFAILING(memcpy((void*)0x20000000047c, "debug_want_extra_isize", 22)); NONFAILING(*(uint8_t*)0x200000000492 = 0x3d); NONFAILING(sprintf((char*)0x200000000493, "0x%016llx", (long long)0x80)); NONFAILING(*(uint8_t*)0x2000000004a5 = 0x2c); NONFAILING(memcpy((void*)0x2000000004a6, "delalloc", 8)); NONFAILING(*(uint8_t*)0x2000000004ae = 0x2c); NONFAILING(memcpy((void*)0x2000000004af, "nogrpid", 7)); NONFAILING(*(uint8_t*)0x2000000004b6 = 0x2c); NONFAILING(memcpy((void*)0x2000000004b7, "noauto_da_alloc", 15)); NONFAILING(*(uint8_t*)0x2000000004c6 = 0x2c); NONFAILING(memcpy((void*)0x2000000004c7, "stripe", 6)); NONFAILING(*(uint8_t*)0x2000000004cd = 0x3d); NONFAILING(sprintf((char*)0x2000000004ce, "0x%016llx", (long long)2)); NONFAILING(*(uint8_t*)0x2000000004e0 = 0x2c); NONFAILING(*(uint8_t*)0x2000000004e1 = 0); NONFAILING(memcpy( (void*)0x2000000006c0, "\x78\x9c\xec\xdd\xcf\x6b\x1c\x55\x1c\x00\xf0\xef\x6c\x92\xfe\xd6\xa6\x50" "\x8a\x7a\x90\x40\x0f\x56\x6a\x37\x4d\xe2\x8f\x0a\x42\xeb\x51\xb4\x58\xd0" "\x7b\x5d\x92\x69\x28\xd9\x74\x4b\x76\x53\x9a\x58\x68\x7b\xb0\x20\x5e\xa4" "\x08\x22\x16\xc4\x3f\xc0\xbb\xc7\xe2\x1f\xa0\x7f\x45\x41\x0b\x45\x4a\xd0" "\x83\x97\xc8\x6c\x66\xdb\x6d\x92\xcd\x26\xe9\xd6\x6c\x9d\xcf\x07\xa6\x7d" "\x6f\x66\xb2\x6f\xde\xbe\xf9\xbe\xfd\xce\xce\x2e\x1b\x40\x61\x8d\x64\xff" "\x94\x22\x5e\x8e\x88\xaf\x93\x88\x83\x6d\xdb\x06\x23\xdf\x38\xb2\xb2\xdf" "\xd2\xc3\x6b\x93\xd9\x92\xc4\xf2\xf2\x27\x7f\x26\x91\xe4\xeb\x5a\xfb\x27" "\xf9\xff\xfb\xf3\xca\x4b\x11\xf1\xcb\x17\x11\xc7\x4b\x6b\xdb\xad\x2f\x2c" "\xce\x54\xaa\xd5\x74\x2e\xaf\x8f\x36\x66\x2f\x8f\xd6\x17\x16\x4f\x5c\x9c" "\xad\x4c\xa7\xd3\xe9\xa5\xf1\x89\x89\x53\x6f\x4d\x8c\xbf\xfb\xce\xdb\x3d" "\xeb\xeb\xeb\xe7\xfe\xfe\xee\xe3\xbb\x1f\x9c\xfa\xea\xe8\xd2\xb7\x3f\xdd" "\x3f\x74\x3b\x89\x33\x71\x20\xdf\xd6\xde\x8f\xa7\x70\xa3\xbd\x32\x12\x23" "\xf9\x73\x32\x14\x67\x56\xed\x38\xd6\x83\xc6\xfa\x49\xb2\xd3\x07\xc0\xb6" "\x0c\xe4\x71\x3e\x14\xd9\x1c\x70\x30\x06\xf2\xa8\x07\xfe\xff\xae\x47\xc4" "\x32\x50\x50\x89\xf8\x87\x82\x6a\xe5\x01\xad\x6b\xfb\x1e\x5d\x07\x3f\x37" "\x1e\xbc\xbf\x72\x01\xb4\xb6\xff\x83\x2b\xef\x8d\xc4\x9e\xe6\xb5\xd1\xbe" "\xa5\xe4\x89\x2b\xa3\xec\x7a\x77\xb8\x07\xed\x67\x6d\xfc\xfc\xc7\x9d\xdb" "\xd9\x12\x5d\xde\x87\xb8\xde\x83\xf6\x00\x5a\x6e\xdc\x8c\x88\x93\x83\x83" "\x6b\xe7\xbf\x24\x9f\xff\xb6\xef\x64\xf3\xcd\xe3\x8d\xad\x6e\xa3\x68\xaf" "\x3f\xb0\x93\xee\x66\xf9\xcf\x1b\xeb\xe5\x3f\xa5\x47\xf9\x4f\xac\x93\xff" "\xec\x5f\x27\x76\xb7\xa3\x7b\xfc\x97\xee\xf7\xa0\x99\x8e\xb2\xfc\xef\xbd" "\x75\xf3\xdf\x47\x53\xd7\xf0\x40\x5e\x7b\xa1\x99\xf3\x0d\x25\x17\x2e\x56" "\xd3\x93\x11\xf1\x62\x44\x1c\x8b\xa1\xdd\x59\x7d\xa3\xfb\x39\xa7\x96\xee" "\x2d\x77\xda\xd6\x9e\xff\x65\x4b\xd6\x7e\x2b\x17\xcc\x8f\xe3\xfe\xe0\xee" "\x27\xff\x66\xaa\xd2\xa8\x3c\x4d\x9f\xdb\x3d\xb8\x19\xf1\xca\xe3\xfc\x37" "\x89\x35\xf3\xff\x9e\x66\xae\xbb\x7a\xfc\xb3\xe7\xe3\x5c\x56\xf8\xf5\xcb" "\xae\x6d\x1c\x49\xef\xbc\xda\x69\x5b\xf7\xfe\xb7\xeb\x7d\x06\xbc\xfc\x63" "\xc4\x6b\xeb\x8e\xff\xe3\x3b\x5a\xc9\xc6\xf7\x27\x47\x9b\xe7\xc3\x68\xeb" "\xac\x58\xeb\xaf\x5b\x47\x7e\xeb\xd4\xfe\xd6\xfa\xdf\x7b\xd9\xf8\xef\xdb" "\xb8\xff\xc3\x49\xfb\xfd\xda\xfa\xd6\xdb\xf8\x61\xcf\x3f\x69\xa7\x6d\xdb" "\x3d\xff\x77\x25\x9f\x36\xcb\xbb\xf2\x75\x57\x2b\x8d\xc6\xdc\x58\xc4\xae" "\xe4\xa3\xb5\xeb\xc7\x1f\xff\x6d\xab\xde\xda\x3f\xeb\xff\xb1\xa3\x1b\xcf" "\x7f\xeb\x9d\xff\x7b\x23\xe2\xb3\x4d\xf6\xff\xd6\xe1\x5b\x1d\x77\xed\x87" "\xf1\x9f\xda\xd2\xf8\x6f\xbd\x70\xef\xc3\xcf\xbf\xef\xd4\xfe\xe6\xc6\xff" "\xcd\x66\xe9\x58\xbe\x66\x33\xf3\xdf\x66\x0f\xf0\x69\x9e\x3b\x00\x00\x00" "\x00\x00\x00\xe8\x37\xa5\x88\x38\x10\x49\xa9\xfc\xa8\x5c\x2a\x95\xcb\x2b" "\x9f\xef\x38\x1c\xfb\x4a\xd5\x5a\xbd\x71\xfc\x42\x6d\xfe\xd2\x54\x34\xbf" "\x2b\x3b\x1c\x43\xa5\xd6\x9d\xee\x83\x6d\x9f\x87\x18\xcb\x3f\x0f\xdb\xaa" "\x8f\xaf\xaa\x4f\x44\xc4\xa1\x88\xf8\x66\x60\x6f\xb3\x5e\x9e\xac\x55\xa7" "\x76\xba\xf3\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\xd0\x27\xf6\x77\xf8\xfe\x7f\xe6\xf7\x81\x9d\x3e\x3a\xe0\x99\xf3\x93\xdf" "\x50\x5c\x5d\xe3\xbf\x17\xbf\xf4\x04\xf4\x25\xaf\xff\x50\x5c\xe2\x1f\x8a" "\x4b\xfc\x43\x71\x89\x7f\x28\x2e\xf1\x0f\xc5\x25\xfe\xa1\xb8\xc4\x3f\x14" "\x97\xf8\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x80\x9e\x3a\x77\xf6\x6c\xb6\x2c\x2f\x3d\xbc\x36\x99" "\xd5\xa7\xae\x2c\xcc\xcf\xd4\xae\x9c\x98\x4a\xeb\x33\xe5\xd9\xf9\xc9\xf2" "\x64\x6d\xee\x72\x79\xba\x56\x9b\xae\xa6\xe5\xc9\xda\x6c\xb7\xc7\xab\xd6" "\x6a\x97\xc7\xc6\x63\xfe\xea\x68\x23\xad\x37\x46\xeb\x0b\x8b\xe7\x67\x6b" "\xf3\x97\x1a\xe7\x2f\xce\x56\xa6\xd3\xf3\xe9\xd0\x7f\xd2\x2b\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x78\xbe\xd4\x17\x16\x67" "\x2a\xd5\x6a\x3a\xa7\xd0\xb1\x70\x3a\xfa\xe2\x30\xb6\x5d\x48\xba\x8d\xf2" "\xe9\xfc\x64\xd8\xd2\x23\x47\x5e\x18\xdc\xf9\x0e\x2a\x3c\x83\xc2\x0e\x4f" "\x4c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd0\xe6\xdf\x00" "\x00\x00\xff\xff\xc9\xcb\x34\xb3", 1394)); NONFAILING(syz_mount_image(/*fs=*/0x200000000040, /*dir=*/0x200000000140, /*flags=MS_RELATIME*/ 0x200000, /*opts=*/0x200000000440, /*chdir=*/3, /*size=*/0x572, /*img=*/0x2000000006c0)); // setxattr$trusted_overlay_upper arguments: [ // path: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 30 00} (length 0xe) // } // name: nil // val: nil // size: len = 0x835 (8 bytes) // flags: setxattr_flags = 0x0 (8 bytes) // ] NONFAILING(memcpy((void*)0x200000000380, "./file0/file0\000", 14)); syscall(__NR_setxattr, /*path=*/0x200000000380ul, /*name=*/0ul, /*val=*/0ul, /*size=*/0x835ul, /*flags=*/0ul); // quotactl$Q_QUOTAON arguments: [ // cmd: quota_cmd_quota_on = 0xffffffff80000201 (8 bytes) // special: ptr[in, blockdev_filename] { // union blockdev_filename { // loop: loop_filename { // prefix: buffer: {2f 64 65 76 2f 6c 6f 6f 70} (length 0x9) // id: proc = 0x0 (1 bytes) // z: const = 0x0 (1 bytes) // } // } // } // id: uid (resource) // addr: nil // ] NONFAILING(memcpy((void*)0x200000000180, "/dev/loop", 9)); NONFAILING(*(uint8_t*)0x200000000189 = 0x30); NONFAILING(*(uint8_t*)0x20000000018a = 0); syscall(__NR_quotactl, /*cmd=Q_QUOTAON_GRP*/ 0xffffffff80000201ul, /*special=*/0x200000000180ul, /*id=*/0, /*addr=*/0ul); // mprotect arguments: [ // addr: VMA[0x3000] // len: len = 0x3000 (8 bytes) // prot: mmap_prot = 0x9 (8 bytes) // ] syscall(__NR_mprotect, /*addr=*/0x200000000000ul, /*len=*/0x3000ul, /*prot=PROT_SEM|PROT_READ*/ 9ul); // openat$cgroup_ro arguments: [ // fd: fd_cgroup (resource) // file: ptr[in, buffer] { // buffer: {68 75 67 65 74 6c 62 2e 31 47 42 2e 75 73 61 67 65 5f 69 6e // 5f 62 79 74 65 73 00} (length 0x1b) // } // flags: const = 0x275a (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd NONFAILING( memcpy((void*)0x200000000180, "hugetlb.1GB.usage_in_bytes\000", 27)); res = syscall(__NR_openat, /*fd=*/(intptr_t)-1, /*file=*/0x200000000180ul, /*flags=*/0x275a, /*mode=*/0); if (res != -1) r[0] = res; // mmap arguments: [ // addr: VMA[0xb36000] // len: len = 0xb36000 (8 bytes) // prot: mmap_prot = 0xa (8 bytes) // flags: mmap_flags = 0x28011 (8 bytes) // fd: fd (resource) // offset: intptr = 0x0 (8 bytes) // ] syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul, /*prot=PROT_SEM|PROT_WRITE*/ 0xaul, /*flags=MAP_STACK|MAP_POPULATE|MAP_FIXED|MAP_SHARED*/ 0x28011ul, /*fd=*/r[0], /*offset=*/0ul); // syz_mount_image$exfat arguments: [ // fs: ptr[in, buffer] { // buffer: {65 78 66 61 74 00} (length 0x6) // } // dir: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // flags: mount_flags = 0x0 (8 bytes) // opts: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // } // } // chdir: int8 = 0x2 (1 bytes) // size: len = 0x1509 (8 bytes) // img: ptr[in, buffer] { // buffer: (compressed buffer with length 0x1509) // } // ] // returns fd_dir NONFAILING(memcpy((void*)0x200000000100, "exfat\000", 6)); NONFAILING(memcpy((void*)0x200000000000, "./file0\000", 8)); NONFAILING(memcpy( (void*)0x200000001c40, "\x78\x9c\xec\xdc\x0b\xb4\x8e\xd5\xd6\x38\xf0\x39\xd7\x5a\x0f\x9b\xc4\x9b" "\xe4\xbe\xe6\x9a\x0f\x6f\x72\x59\x24\x49\x2e\x09\x89\x24\x49\x8e\x24\xb9" "\x25\x24\x49\x92\x84\xc4\x26\xb7\x24\x24\x21\xf7\x24\xf7\x90\xdc\x42\x72" "\xbf\xdf\x72\x4f\x92\x23\x49\x92\x90\x90\x64\xfd\x87\x4e\xfd\x9d\x73\x3a" "\xdf\xe9\x7c\xdf\x39\xe7\xf3\x8d\xb3\xe7\x6f\x8c\x67\xec\x35\xf7\xfb\xce" "\xf9\xce\x67\xcf\xbd\xf7\xfb\x3c\x6b\x8c\xbd\xbf\xee\x30\xa8\x4a\xbd\xaa" "\x95\xea\x30\x33\xfc\x53\xf0\x4f\x1f\x52\x01\x20\x05\x00\xfa\x02\x40\x16" "\x00\x88\x00\xa0\x64\xd6\x92\x59\x01\x87\x42\x06\x8d\xa9\xff\xdc\x8b\x88" "\x7f\xad\x07\xa6\x5e\xe9\x0e\xc4\x95\x24\xf3\x4f\xdb\x64\xfe\x69\x9b\xcc" "\x3f\x6d\x93\xf9\xa7\x6d\x32\xff\xb4\x4d\xe6\x9f\xb6\xc9\xfc\xd3\x36\x99" "\xbf\x10\x69\xd9\xd6\x69\xb9\xae\x91\x23\xed\x1e\xff\x7b\xfb\xff\x20\xfb" "\xff\xff\xe7\xc8\xfb\xff\x7f\x90\xc3\x45\x47\x7f\xbe\xbe\xe8\x75\x1d\xff" "\x1b\x29\x32\xff\xb4\x4d\xe6\x9f\xb6\xc9\xfc\xd3\x36\x99\x7f\xda\x26\xf3" "\x4f\xdb\x64\xfe\xff\xe1\x22\x80\x8a\x7f\xe7\x61\x99\x7f\xda\x26\xf3\x17" "\x22\x2d\xbb\xd2\xfb\xcf\x72\x5c\xd9\xe3\x4a\x7f\xff\x09\x21\x84\x10\x42" "\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84" "\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08" "\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10" "\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21" "\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42" "\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84" "\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x48\x1b\xce" "\x85\xcb\x0c\x00\xfc\xba\xbe\xd2\x7d\x09\x21\x84\x10\x42\x08\x21\x84\x10" "\xe2\x5f\x27\xa4\xff\xf3\x28\xdd\x95\x6b\x44\x08\x21\x84\x10\x42\x08\x21" "\x84\x10\xff\x46\x08\x0a\x34\x18\x88\x20\x1d\xa4\x87\x14\xc8\x00\x19\xe1" "\x2a\xc8\x04\x57\x43\x66\xc8\x02\x09\xb8\x06\xb2\xc2\xb5\x90\x0d\xae\x83" "\xec\x90\x03\x72\x42\x2e\xc8\x0d\x79\x20\x2f\x58\x20\x70\xc0\x10\x43\x3e" "\xc8\x0f\x49\xb8\x1e\x0a\xc0\x0d\x50\x10\x0a\x41\x61\x28\x02\x1e\x8a\x42" "\x31\xb8\x11\x8a\xc3\x4d\x50\x02\x6e\x86\x92\x70\x0b\x94\x82\x5b\xa1\x34" "\x94\x81\xb2\x50\x0e\x6e\x83\xf2\x70\x3b\x54\x80\x8a\x50\x09\xee\x80\xca" "\x70\x27\x54\x81\xaa\x70\x17\x54\x83\xbb\xa1\x3a\xdc\x03\x35\xe0\x5e\xa8" "\x09\xf7\x41\x2d\xb8\x1f\x6a\xc3\x1f\xa0\x0e\x3c\x00\x75\xe1\x41\xa8\x07" "\x0f\x41\x7d\x78\x18\x1a\x40\x43\x68\x04\x8d\xa1\xc9\xff\x28\xff\x79\xe8" "\x02\x2f\x40\x57\xe8\x06\xa9\xd0\x1d\x7a\xc0\x8b\xd0\x13\x7a\x41\x6f\xe8" "\x03\x7d\xe1\x25\xe8\x07\x2f\x43\x7f\x78\x05\x06\xc0\x40\x18\x04\xaf\xc2" "\x60\x78\x0d\x86\xc0\xeb\x30\x14\x86\xc1\x70\x78\x03\x46\xc0\x48\x18\x05" "\xa3\x61\x0c\x8c\x85\x71\xf0\x26\x8c\x87\xb7\x60\x02\xbc\x0d\x13\x61\x12" "\x4c\x86\x29\x30\x15\xa6\xc1\x74\x78\x07\x66\xc0\x4c\x98\x05\xef\xc2\x6c" "\x78\x0f\xe6\xc0\x5c\x98\x07\xf3\x61\x01\xbc\x0f\x0b\x61\x11\x2c\x86\x0f" "\x60\x09\x7c\x08\x4b\x61\x19\x2c\x87\x15\xb0\x12\x56\xc1\x6a\x58\x03\x6b" "\x61\x1d\xac\x87\x0d\xb0\x11\x36\xc1\x66\xd8\x02\x5b\xe1\x23\xd8\x06\xdb" "\x61\x07\xec\x84\x5d\xb0\x1b\xf6\xc0\xc7\xb0\x17\x3e\x81\x7d\xf0\x29\xec" "\x87\xcf\xfe\x3a\x3f\xcb\xdf\xcf\x3f\xfb\x57\xf9\x1d\x11\x10\x50\xa1\x42" "\x83\x06\xd3\x61\x3a\x4c\xc1\x14\xcc\x88\x19\x31\x13\x66\xc2\xcc\x98\x19" "\x13\x98\xc0\xac\x98\x15\xb3\x61\x36\xcc\x8e\xd9\x31\x27\xe6\xc4\xdc\x98" "\x1b\xf3\x62\x5e\x24\x24\x64\x64\xcc\x87\xf9\x30\x89\x49\x2c\x80\x05\xb0" "\x20\x16\xc4\xc2\x58\x18\x3d\x7a\x2c\x86\xc5\xb0\x38\xde\x84\x25\xb0\x04" "\x96\xc4\x92\x58\x0a\x4b\x61\x69\x2c\x83\x65\xb0\x1c\x96\xc3\xf2\x58\x1e" "\x2b\x60\x05\xac\x84\x95\xb0\x32\x56\xc6\x2a\x58\x05\xef\xc2\xbb\xf0\x6e" "\xac\x8e\xd5\xb1\x06\xd6\xc0\x9a\x58\x13\x6b\x61\x2d\xac\x8d\xb5\xb1\x0e" "\xd6\xc1\xba\x58\x17\xeb\x61\x3d\xac\x8f\xf5\xb1\x01\x36\xc0\x46\xd8\x08" "\x9b\x60\x13\x6c\x8a\x4d\xb1\x19\x36\xc3\x16\xd8\x02\x5b\x62\x4b\x6c\x85" "\xad\xb0\x35\xb6\xc6\x36\xd8\x06\xdb\x62\x5b\x6c\x87\xed\xb0\x3d\xb6\xc7" "\x0e\xd8\x01\x3b\x62\x27\xec\x84\xcf\xe3\xf3\xf8\x02\xbe\x80\xdd\xb0\xb2" "\xea\x8e\x3d\xb0\x07\xf6\xc4\x9e\xd8\x1b\xfb\x60\x1f\x7c\x09\xfb\xe1\xcb" "\xf8\x32\xbe\x82\x03\x70\x20\x0e\xc2\x57\xf1\x55\x7c\x0d\x87\xe0\x19\x1c" "\x8a\xc3\x70\x38\x0e\xc7\xf2\x6a\x24\x8e\xc2\xd1\xc8\x6a\x2c\x8e\xc3\x71" "\x38\x1e\xc7\xe3\x04\x9c\x80\x13\x71\x12\x4e\xc2\x29\x38\x15\xa7\xe1\x74" "\x9c\x8e\x33\x70\x26\xce\xc4\x77\x71\x36\xbe\x87\xef\xe1\x5c\x9c\x8b\xf3" "\x71\x01\x2e\xc0\x85\xb8\x08\x17\xe3\x62\x5c\x82\x67\x71\x29\x2e\xc3\xe5" "\xb8\x02\x57\xe2\x2a\x5c\x89\x6b\x70\x2d\xae\xc1\xf5\xb8\x01\xd7\xe3\x26" "\xdc\x84\x5b\x70\x0b\x7e\x84\x1f\xe1\x76\xdc\x8e\x3b\x71\x27\xee\xc6\xdd" "\xf8\x31\x7e\x8c\x9f\xe0\x27\x38\x00\xf7\xe3\x7e\x3c\x80\x07\xf0\x20\x1e" "\xc4\x43\x78\x08\x0f\xe3\x61\x3c\x82\x47\xf0\x28\x1e\xc5\x63\x78\x0c\x8f" "\xe3\x71\x3c\x81\x27\xf1\x14\x9e\xc4\xd3\x78\x1a\xcf\xe0\x59\x3c\x87\xe7" "\xf0\x3c\x9e\xc7\x0b\xf8\x6c\xee\x2f\xeb\xee\x2e\xb4\x6e\x00\xa8\x4b\x8c" "\x32\x2a\x9d\x4a\xa7\x52\x54\x8a\xca\xa8\x32\xaa\x4c\x2a\x93\xca\xac\x32" "\xab\x84\x4a\xa8\xac\x2a\xab\xca\xa6\xb2\xa9\xec\x2a\xbb\xca\xa9\x72\xaa" "\xdc\x2a\xb7\xca\xab\xf2\x2a\x52\xa4\x58\xc5\x2a\x9f\xca\xa7\x92\x2a\xa9" "\x0a\xa8\x02\xaa\xa0\x2a\xa8\x0a\xab\xc2\xca\x2b\xaf\x8a\xa9\x62\xaa\xb8" "\x2a\xae\x4a\xa8\x12\xaa\xa4\xba\x45\x95\x52\xb7\xaa\xd2\xaa\x8c\x6a\xee" "\xcb\xa9\x72\xaa\xbc\x6a\xe1\x2b\xa8\x8a\xaa\x92\xaa\xa4\x2a\xab\x3b\x55" "\x15\x55\x55\x55\x55\xd5\x54\x35\x55\x5d\x55\x57\x35\x54\x0d\x55\x53\xd5" "\x54\xb5\xd4\xfd\xaa\xb6\xea\x8e\xbd\xf1\x01\x75\x69\x32\xf5\xd4\x40\xac" "\xaf\x06\x61\x03\xd5\x50\x35\x52\x8d\xd5\x6b\xf8\x88\x6a\xaa\x86\x60\x33" "\xd5\x5c\xb5\x50\x8f\xa9\x61\x38\x14\x5b\xa9\xa6\xbe\xb5\x7a\x52\xb5\x51" "\xa3\xb0\xad\x7a\x5a\x8d\xc6\x67\x54\x7b\x35\x16\x3b\xa8\xe7\x54\x47\xd5" "\x49\x75\x56\xcf\xab\x2e\xaa\x99\xef\xfa\xeb\x76\xa7\x9a\x82\x3d\x55\x2f" "\xd5\x5b\xf5\x51\x33\xf0\x4e\x75\x69\x62\x55\xd4\x2b\x6a\x80\x1a\xa8\x06" "\xa9\x57\xd5\x7c\x7c\x4d\x0d\x51\xaf\xab\xa1\x6a\x98\x1a\xae\xde\x50\x23" "\xd4\x48\x35\x4a\x8d\x56\x63\xd4\x58\x35\x4e\xbd\xa9\xc6\xab\xb7\xd4\x04" "\xf5\xb6\x9a\xa8\x26\xa9\xc9\x6a\x8a\x9a\xaa\xa6\xa9\xe9\xea\x1d\x35\x43" "\xcd\x54\xb3\xd4\xbb\x6a\xb6\x7a\x4f\xcd\x51\x73\xd5\x3c\x35\x5f\x2d\x50" "\xef\xab\x85\x6a\x91\x5a\xac\x3e\x50\x4b\xd4\x87\x6a\xa9\x5a\xa6\x96\xab" "\x15\x6a\xa5\x5a\xa5\x56\xab\x35\x6a\xad\x5a\xa7\xd6\xab\x0d\x6a\xa3\xda" "\xa4\x36\xab\x2d\x6a\xab\xfa\x48\x6d\x53\xdb\xd5\x0e\xb5\x53\xed\x52\xbb" "\xd5\x1e\xf5\xb1\xda\xab\x3e\x51\xfb\xd4\xa7\x6a\xbf\xfa\x4c\x1d\x50\x7f" "\x54\x07\xd5\xe7\xea\x90\xfa\x42\x1d\x56\x5f\xaa\x23\xea\x2b\x75\x54\x7d" "\xad\x8e\xa9\x6f\xd4\x71\xf5\xad\x3a\xa1\x4e\xaa\x53\xea\x3b\x75\x5a\x7d" "\xaf\xce\xa8\xb3\xea\x9c\xfa\x41\x9d\x57\x3f\xaa\x0b\xea\x27\x75\x51\x05" "\x05\x1a\xb5\xd2\x5a\x1b\x1d\xe9\x74\x3a\xbd\x4e\xd1\x19\x74\x46\x7d\x95" "\x06\x7d\xb5\xce\xac\xb3\xe8\x84\xbe\x46\x67\xd5\xd7\xea\x6c\xfa\x3a\x9d" "\x5d\xe7\xd0\x39\x75\x2e\x9d\x5b\xe7\xd1\x79\xb5\xd5\xa4\x9d\x66\x1d\xeb" "\x7c\x3a\xbf\x4e\xea\xeb\x75\x01\x7d\x83\x2e\xa8\x0b\xe9\xc2\xba\x88\xf6" "\xba\xa8\x2e\xa6\x6f\xd4\xc5\xf5\x4d\xba\x84\xbe\x59\x97\xd4\xb7\xe8\x52" "\xfa\x56\x5d\x5a\x97\xd1\x65\x75\x39\x7d\x9b\x2e\xaf\x6f\xd7\x15\x74\x45" "\x5d\x49\xdf\xa1\x2b\xeb\x3b\x75\x15\x5d\x55\xdf\xa5\xab\xe9\xbb\x75\x75" "\x7d\x8f\xae\xa1\xef\xd5\x35\xf5\x7d\xba\x96\xbe\x5f\xd7\xd6\x7f\xd0\x75" "\xf4\x03\xba\xae\x7e\x50\xd7\xd3\x0f\xe9\xfa\xfa\x61\xdd\x40\x37\xd4\x8d" "\x74\x63\xdd\x44\x3f\xa2\x9b\xea\x47\x75\x33\xdd\x5c\xb7\xd0\x8f\xe9\x96" "\xfa\x71\xdd\x4a\x3f\xa1\x5b\xeb\x27\x75\x1b\xfd\x94\x6e\xab\x9f\xd6\xed" "\xf4\x33\xba\xbd\x7e\x56\x77\xd0\xcf\xe9\x8e\xba\x93\xee\xac\x7f\xd2\x17" "\x75\xd0\x5d\x75\x37\x9d\xaa\xbb\xeb\x1e\xfa\x45\xdd\x53\xf7\xd2\xbd\x75" "\x1f\xdd\x57\xbf\xa4\xfb\xe9\x97\x75\x7f\xfd\x8a\x1e\xa0\x07\xea\x41\xfa" "\x55\x3d\x58\xbf\xa6\x87\xe8\xd7\xf5\x50\x3d\x4c\x0f\xd7\x6f\xe8\x11\x7a" "\xa4\x1e\xa5\x47\xeb\x31\x7a\xac\x1e\xa7\xdf\xd4\xe3\xf5\x5b\x7a\x82\x7e" "\x5b\x4f\xd4\x93\xf4\x64\x3d\x45\x4f\xd5\xd3\x74\xef\x5f\x2a\xcd\xfa\x07" "\xf2\xdf\xfa\x1b\xf9\xfd\x7f\x7e\xf5\x2d\x7a\xab\xfe\x48\x6f\xd3\xdb\xf5" "\x0e\xbd\x53\xef\xd2\xbb\xf5\x1e\xbd\x47\xef\xd5\x7b\xf5\x3e\xbd\x4f\xef" "\xd7\xfb\xf5\x01\x7d\x40\x1f\xd4\x07\xf5\x21\x7d\x48\x1f\xd6\x87\xf5\x11" "\x7d\x44\x1f\xd5\x47\xf5\x31\x7d\x4c\x1f\xd7\xc7\xf5\x09\x7d\x52\xff\xa0" "\xbf\xd3\xa7\xf5\xf7\xfa\x8c\x3e\xab\xcf\xea\x1f\xf4\x79\x7d\x5e\x5f\xf8" "\xe5\x6b\x00\x06\x8d\x32\xda\x18\x13\x99\x74\x26\xbd\x49\x31\x19\x4c\x46" "\x73\x95\xc9\x64\xae\x36\x99\x4d\x16\x93\x30\xd7\x98\xac\xe6\x5a\x93\xcd" "\x5c\x67\xb2\x9b\x1c\x26\xa7\xc9\x65\x72\x9b\x3c\x26\xaf\xb1\x86\x8c\x33" "\x6c\x62\x93\xcf\xe4\x37\x49\x73\xbd\x29\x60\x6e\x30\x05\x4d\x21\x53\xd8" "\x14\x31\xde\x14\x35\xc5\xcc\x8d\xff\x74\xfe\xef\xf5\xd7\xc4\x34\x31\x4d" "\x4d\x53\xd3\xcc\x34\x33\x2d\x4c\x0b\xd3\xd2\xb4\x34\xad\x4c\x2b\xd3\xda" "\xb4\x36\x6d\x4c\x1b\xd3\xd6\xb4\x35\xed\x4c\x3b\xd3\xde\xb4\x37\x1d\x4c" "\x07\xd3\xd1\x74\x34\x9d\x4d\x67\xd3\xc5\x74\x31\x5d\x4d\x57\x93\x6a\x52" "\x4d\x0f\xf3\xa2\xe9\x69\x7a\x99\xde\xa6\x8f\xe9\x6b\x5e\x32\xfd\x4c\x3f" "\xd3\xdf\xf4\x37\x03\xcc\x00\x33\xc8\x0c\x32\x83\xcd\x60\x33\xc4\x0c\x31" "\x43\xcd\x50\x33\xdc\x0c\x37\x23\xcc\x08\x33\xca\x8c\x32\x63\xcc\x18\x33" "\xce\x8c\x33\xe3\xcd\x78\x33\xc1\x4c\x30\x13\xcd\x44\x33\xd9\x4c\x36\x53" "\xcd\x54\x33\xdd\x4c\x37\x33\xcc\x0c\x33\xcb\xcc\x32\xb3\xcd\x6c\x33\xc7" "\xcc\x31\xf3\xcc\x3c\xb3\xc0\x2c\x30\x0b\xcd\x42\xb3\xd8\x2c\x36\x4b\xcc" "\x12\xb3\xd4\x2c\x33\xcb\xcc\x0a\xb3\xc2\xac\x32\xab\xcc\x1a\xb3\xc6\xac" "\x33\xeb\xcc\x06\xb3\xc1\x6c\x32\x9b\xcc\x52\xb3\xd5\x6c\x35\xdb\xcc\x36" "\xb3\xc3\xec\x30\xbb\xcc\x2e\xb3\xc7\xec\x31\x7b\xcd\x5e\xb3\xcf\xec\x33" "\xfb\xcd\x7e\x73\xc0\x1c\x30\x07\xcd\x41\x73\xc8\x1c\x32\x87\xcd\x61\x73" "\xc4\x1c\x31\x47\xcd\x51\x73\xcc\x1c\x33\xc7\xcd\x71\x73\xc2\x9c\x30\xa7" "\xcc\x29\x73\xda\x9c\x36\x67\xcc\x19\x73\xce\x9c\x33\xe7\xcd\x79\x73\xc1" "\x5c\x30\x17\xcd\xc5\x4b\x97\x7d\x91\x8a\x54\x64\x22\x13\xa5\x8b\xd2\x45" "\x29\x51\x4a\x94\x31\xca\x18\x65\x8a\x32\x45\x99\xa3\xcc\x51\x22\x4a\x44" "\x59\xa3\xac\x51\xb6\xe8\xba\x28\x7b\x94\x23\xca\x19\xe5\x8a\x72\x47\x79" "\xa2\x54\xb0\x11\x45\x2e\xe2\x28\x8e\xf2\x45\xf9\xa3\x64\x74\x7d\x54\x20" "\xba\x21\x2a\x18\x15\x8a\x0a\x47\x45\x22\x1f\x15\x8d\x8a\x45\x37\x46\xc5" "\xa3\x9b\xa2\x12\xd1\xcd\x51\xc9\xe8\x96\xa8\x54\x74\x6b\x54\x3a\x2a\x13" "\x95\x8d\xca\x45\xb7\x45\xe5\xa3\xdb\xa3\x0a\x51\xc5\xa8\x52\x74\x47\x54" "\x39\xba\x33\xaa\x12\x55\x8d\xee\x8a\xaa\x45\x77\x47\xd5\xa3\x7b\xa2\x1a" "\xd1\xbd\x51\xcd\xe8\xbe\xa8\x56\x74\x7f\x54\x3b\xfa\x43\x54\x27\x7a\x20" "\xaa\x1b\x3d\x18\xd5\x8b\x1e\x8a\xea\x47\x0f\x47\x0d\xa2\x86\x51\xa3\xa8" "\x71\xd4\xe4\x5f\x5a\x3f\x84\x33\x39\x1e\xf5\x5d\x6d\x37\x9b\x6a\xbb\xdb" "\x1e\xf6\x45\xdb\xd3\xf6\xb2\xbd\x6d\x1f\xdb\xd7\xbe\x64\xfb\xd9\x97\x6d" "\x7f\xfb\x8a\x1d\x60\x07\xda\x41\xf6\x55\x3b\xd8\xbe\x66\x87\xd8\xd7\xed" "\x50\x3b\xcc\x0e\xb7\x6f\xd8\x11\x76\xa4\x1d\x65\x47\xdb\x31\x76\xac\x1d" "\x67\xdf\xb4\xe3\xed\x5b\x76\x82\x7d\xdb\x4e\xb4\x93\xec\x64\x3b\xc5\x4e" "\xb5\xd3\xec\x74\xfb\x8e\x9d\x61\x67\xda\x59\xf6\x5d\x3b\xdb\xbe\x67\xe7" "\xd8\xb9\x76\x9e\x9d\x6f\x17\xd8\xf7\xed\x42\xbb\xc8\x2e\xb6\x1f\xd8\x25" "\xf6\x43\xbb\xd4\x2e\xb3\xcb\xed\x0a\xbb\xd2\xae\xb2\xab\xed\x1a\xbb\xd6" "\xae\xb3\xeb\xed\x06\xbb\xd1\x6e\xb2\x9b\xed\x16\xbb\xd5\x7e\x64\xb7\xd9" "\xed\x76\x87\xdd\x69\x77\xd9\xdd\x76\x8f\xfd\xd8\xee\xb5\x9f\xd8\x7d\xf6" "\x53\xbb\xdf\x7e\x66\x0f\xd8\x3f\xda\x83\xf6\x73\x7b\xc8\x7e\x61\x0f\xdb" "\x2f\xed\x11\xfb\x95\x3d\x6a\xbf\xb6\xc7\xec\x37\xf6\xb8\xfd\xd6\x9e\xb0" "\x27\xed\x29\xfb\x9d\x3d\x6d\xbf\xb7\x67\xec\x59\x7b\xce\xfe\x60\xcf\xdb" "\x1f\xed\x05\xfb\x93\xbd\x68\xc3\xa5\x8b\xfb\x4b\x6f\xef\x64\xc8\x50\x3a" "\x4a\x47\x29\x94\x42\x19\x29\x23\x65\xa2\x4c\x94\x99\x32\x53\x82\x12\x94" "\x95\xb2\x52\x36\xca\x46\xd9\x29\x3b\xe5\xa4\x9c\x94\x9b\x72\x53\x5e\xca" "\x4b\x97\x30\x31\xe5\xa3\x7c\x94\xa4\x24\x15\xa0\x02\x54\x90\x0a\x52\x61" "\x2a\x4c\x9e\x3c\x15\xa3\x62\x54\x9c\x8a\x53\x09\x2a\x41\x25\xa9\x24\x95" "\xa2\x52\x54\x9a\x4a\x53\x59\x2a\x4b\xb7\xd1\x6d\x74\x3b\xdd\x4e\x15\xa9" "\x22\xdd\x41\x77\xd0\x9d\x74\x27\x55\xa5\xaa\x54\x8d\xaa\x51\x75\xaa\x4e" "\x35\xa8\x06\xd5\xa4\x9a\x54\x8b\x6a\x51\x6d\xaa\x4d\x75\xa8\x0e\xd5\xa5" "\xba\x54\x8f\xea\x51\x7d\xaa\x4f\x0d\xa8\x01\x35\xa2\x46\xd4\x84\x9a\x50" "\x53\x6a\x4a\xcd\xa8\x19\xb5\xa0\x16\xd4\x92\x5a\x52\x2b\x6a\x45\xad\xa9" "\x35\xb5\xa1\x36\xd4\x96\xda\x52\x3b\x6a\x47\xed\xa9\x3d\x75\xa0\x0e\xd4" "\x91\x3a\x52\x67\xea\x4c\x5d\xa8\x0b\x75\xa5\xae\x94\x4a\xa9\xd4\x83\x7a" "\x50\x4f\xea\x49\xbd\xa9\x37\xf5\xa5\xbe\xd4\x8f\xfa\x51\x7f\xea\x4f\x03" "\x68\x00\x0d\xa2\x41\x34\x98\x06\xd3\x10\x1a\x42\x43\x69\x18\x0d\xa7\x37" "\x68\x04\x8d\xa4\x51\x34\x9a\xc6\xd0\x58\x1a\x47\xe3\x68\x3c\x8d\xa7\x09" "\x34\x81\x26\xd2\x44\x9a\x4c\x93\x69\x2a\x4d\xa5\xe9\x34\x9d\x66\xd0\x0c" "\x9a\x45\xb3\x68\x36\xcd\xa6\x39\x34\x87\xe6\xd1\x3c\x5a\x40\x0b\x68\x21" "\x2d\xa4\xc5\xb4\x98\x96\xd0\x12\x5a\x4a\x4b\x69\x39\x2d\xa7\x95\xb4\x92" "\x56\xd3\x6a\x5a\x4b\x6b\x69\x3d\xad\xa7\x8d\xb4\x91\x36\xd3\x66\xda\x4a" "\x5b\x69\x1b\x6d\xa3\x1d\xb4\x83\x76\xd1\x2e\xda\x43\x7b\x68\x2f\xed\xa5" "\x7d\xb4\x8f\xf6\xd3\x7e\x3a\x40\x07\xe8\x20\x1d\xa4\x43\x74\x88\x0e\xd3" "\x61\x3a\x42\x47\xe8\x28\x1d\xa5\x63\x74\x8c\x8e\xd3\x71\x3a\x41\x27\xe8" "\x14\x9d\xa2\xd3\x74\x9a\xce\xd0\x19\x3a\x47\xe7\xe8\x3c\xfd\x48\x17\xe8" "\x27\xba\x48\x81\x52\x9c\x82\x8c\xee\x2a\x97\xc9\x5d\xed\x32\xbb\x2c\x2e" "\xc5\x65\x70\x97\xe2\x08\x00\x2e\xc5\x39\x5d\x2e\x97\xdb\xe5\x71\x79\x9d" "\x75\xd9\x5d\x8e\xbf\x88\xc9\x39\x57\xd0\x15\x72\x85\x5d\x11\xe7\x5d\x51" "\x57\xcc\xdd\xf8\x9b\xb8\xb4\x2b\xe3\xca\xba\x72\xee\x36\x57\xde\xdd\xee" "\x2a\xfc\x26\xae\xe6\xee\x76\xd5\xdd\x3d\xae\x86\xbb\xd7\x55\x75\x77\xfd" "\x45\x5c\xd3\xdd\xe7\x6a\xb9\x87\x5c\x6d\xf7\xb0\xab\xe3\x1a\xba\xba\xae" "\xb1\xab\xe7\x1e\x72\xf5\xdd\xc3\xae\x81\x6b\xe8\x1a\xb9\xc6\xae\xa5\x7b" "\xdc\xb5\x72\x4f\xb8\xd6\xee\x49\xd7\xc6\x3d\xf5\x9b\x78\xa1\x5b\xe4\xd6" "\xba\x75\x6e\xbd\xdb\xe0\xf6\xba\x4f\xdc\x39\xf7\x83\x3b\xea\xbe\x76\xe7" "\xdd\x8f\xae\xab\xeb\xe6\xfa\xba\x97\x5c\x3f\xf7\xb2\xeb\xef\x5e\x71\x03" "\xdc\xc0\xdf\xc4\xc3\xdd\x1b\x6e\x84\x1b\xe9\x46\xb9\xd1\x6e\x8c\x1b\xfb" "\x9b\x78\xb2\x9b\xe2\xa6\xba\x69\x6e\xba\x7b\xc7\xcd\x70\x33\x7f\x13\x2f" "\x70\xef\xbb\xd9\x6e\xb1\x9b\xe3\xe6\xba\x79\x6e\xfe\xcf\xf1\xa5\x9e\x16" "\xbb\x0f\xdc\x12\xf7\xa1\x5b\xea\x96\xb9\xe5\x6e\x85\x5b\xe9\x56\xb9\xd5" "\x6e\xcd\xff\xef\x75\x85\xdb\xe4\x36\xbb\x2d\x6e\x8f\xfb\xd8\x6d\x73\xdb" "\xdd\x0e\xb7\xd3\xed\x72\xbb\x7f\x8e\x2f\x9d\xc7\x3e\xf7\xa9\xdb\xef\x3e" "\x73\x47\xdc\x57\xee\xa0\xfb\xdc\x1d\x72\xc7\xdc\x61\xf7\xe5\xcf\xf1\xa5" "\xf3\x3b\xe6\xbe\x71\xc7\xdd\xb7\xee\x84\x3b\xe9\x4e\xb9\xef\xdc\x69\xf7" "\xbd\x3b\xe3\xce\xfe\x7c\xfe\x97\xce\xfd\x3b\xf7\x93\xbb\xe8\x82\x03\x46" "\x56\xac\xd9\x70\xc4\xe9\x38\x3d\xa7\x70\x06\xce\xc8\x57\x71\x26\xbe\x9a" "\x33\x73\x16\x4e\xf0\x35\x9c\x95\xaf\xe5\x6c\x7c\x1d\x67\xe7\x1c\x9c\x93" "\x73\x71\x6e\xce\xc3\x79\xd9\x32\xb1\x63\xe6\x98\xf3\x71\x7e\x4e\xf2\xf5" "\x5c\x80\x6f\xe0\x82\x5c\x88\x0b\x73\x11\xf6\x5c\x94\x8b\xf1\x8d\x5c\x9c" "\x6f\xe2\x12\x7c\x33\x97\xe4\x5b\xb8\x14\xdf\xca\xa5\xb9\x0c\x97\xe5\x72" "\x7c\x1b\x97\xe7\xdb\xb9\x02\x57\xe4\x4a\x7c\x07\x57\x0e\x81\xab\x70\x55" "\xbe\x8b\xab\xf1\xdd\x5c\x9d\xef\xe1\x1a\x7c\x2f\xd7\xe4\xfb\xb8\x16\xdf" "\xcf\xb5\xf9\x0f\x5c\x87\x1f\xe0\xba\xfc\x20\xd7\xe3\x87\xb8\x3e\x3f\xcc" "\x0d\xb8\x21\x37\xe2\xc6\xdc\x84\x1f\xe1\xa6\xfc\x28\x37\xe3\xe6\xdc\x82" "\x1f\xe3\x96\xfc\x38\xb7\xe2\x27\xb8\x35\x3f\xc9\x6d\xf8\x29\x6e\xcb\x4f" "\x73\x3b\x7e\x86\xdb\xf3\xb3\xdc\x81\x9f\xe3\x8e\xdc\x89\x3b\xf3\xf3\xdc" "\x85\x5f\xe0\xae\xdc\x8d\x53\xb9\x3b\xf7\xe0\x17\xb9\x27\xf7\xe2\xde\xdc" "\x87\xfb\xf2\x4b\xdc\x8f\x5f\xe6\xfe\xfc\x0a\x0f\xe0\x81\x3c\x88\x5f\xe5" "\xc1\xfc\x1a\x0f\xe1\xd7\x79\x28\x0f\xe3\xe1\xfc\x06\x8f\xe0\x91\x3c\x8a" "\x47\xf3\x18\x1e\xcb\xe3\xf8\x4d\x1e\xcf\x6f\xf1\x04\x7e\x9b\x27\xf2\x24" "\x9e\xcc\x53\x78\x2a\x4f\xe3\xe9\xfc\x0e\xcf\xe0\x99\x3c\x8b\xdf\xe5\xd9" "\xfc\x1e\xcf\xe1\xb9\x3c\x8f\xe7\xf3\x02\x7e\x9f\x17\xf2\x22\x5e\xcc\x1f" "\xf0\x12\xfe\x90\x97\xf2\x32\x5e\xce\x2b\x78\x25\xaf\xe2\xd5\xbc\x86\xd7" "\xf2\x3a\x5e\xcf\x1b\x78\x23\x6f\xe2\xcd\xbc\x85\xb7\xf2\x47\xbc\x8d\xb7" "\xf3\x0e\xde\xc9\xbb\x78\x37\xef\xe1\x8f\x79\x2f\x7f\xc2\xfb\xf8\x53\xde" "\xcf\x9f\xf1\x01\xfe\x23\x1f\xe4\xcf\xf9\x10\x7f\xc1\x87\xf9\x4b\x3e\xc2" "\x5f\xf1\x51\xfe\x9a\x8f\xf1\x37\x7c\x9c\xbf\xe5\x13\x7c\x92\x4f\xf1\x77" "\x7c\x9a\xbf\xe7\x33\x7c\x96\xcf\xf1\x0f\x7c\x9e\x7f\xe4\x0b\xfc\x13\x5f" "\xe4\xc0\x10\x63\xac\x62\x1d\x9b\x38\x8a\xd3\xc5\xe9\xe3\x94\x38\x43\x9c" "\x31\xbe\x2a\xce\x14\x5f\x1d\x67\x8e\xb3\xc4\x89\xf8\x9a\x38\x6b\x7c\x6d" "\x9c\x2d\xbe\x2e\xce\x1e\xe7\x88\x73\xc6\xb9\xe2\xdc\x71\x9e\x38\x6f\x6c" "\x63\x8a\x5d\xcc\x71\x1c\xe7\x8b\xf3\xc7\xc9\xf8\xfa\xb8\x40\x7c\x43\x5c" "\x30\x2e\x14\x17\x8e\x8b\xc4\x3e\x2e\x1a\x17\x8b\x6f\x8c\x8b\xc7\x37\xc5" "\x25\xe2\x9b\xe3\x92\xf1\x2d\x71\xa9\xf8\xd6\x18\x52\xcb\xc4\x0f\xdd\x5b" "\x2e\xbe\x2d\x2e\x1f\xdf\x1e\x57\x88\x2b\xc6\x95\xe2\x3b\xe2\xca\xf1\x9d" "\x71\x95\xb8\x6a\x7c\x57\x5c\x2d\xbe\x3b\xae\x1e\xdf\x13\xd7\x88\xef\x8d" "\x4b\xc4\xf7\xc5\xb5\xe2\xfb\xe3\xda\xf1\x1f\xe2\x3a\xf1\x03\x71\xdd\xf8" "\xc1\xb8\x5e\xfc\x50\x5c\x3f\x7e\x38\x6e\x10\x37\x8c\x1b\xc5\x8d\xe3\x26" "\xf1\x23\x71\xd3\xf8\xd1\xb8\x59\xdc\x3c\x6e\x11\x3f\x16\xb7\x8c\x1f\x8f" "\x5b\xc5\x4f\xc4\xad\xe3\x27\xe3\x36\xf1\x53\xbf\xfb\x78\x6a\xdc\x3d\xee" "\x11\xbf\x18\xbf\x18\x87\x70\x8f\xfa\xe5\x3e\x31\xb9\x30\xb9\x28\xb9\x38" "\xf9\x41\x72\x49\xf2\xc3\xe4\xd2\xe4\xb2\xe4\xf2\xe4\x8a\xe4\xca\xe4\xaa" "\xe4\xea\xe4\x9a\xe4\xda\xe4\xba\xe4\xfa\xe4\x86\xe4\xc6\xe4\xa6\xe4\xe6" "\xe4\x96\x64\x08\x55\xd3\x83\x47\xaf\xbc\xf6\xc6\x47\x3e\x9d\x4f\xef\x53" "\x7c\x06\x9f\xd1\x5f\xe5\x33\xf9\xab\x7d\x66\x9f\xc5\x27\xfc\x35\x3e\xab" "\xbf\xd6\x67\xf3\xd7\xf9\xec\x3e\x87\xcf\xe9\x73\xf9\xdc\x3e\x8f\xcf\xeb" "\xad\x27\xef\x3c\xfb\xd8\xe7\xf3\xf9\x7d\xd2\x5f\xef\x0b\xf8\x1b\x7c\x41" "\x5f\xc8\x17\xf6\x45\xbc\xf7\x45\x7d\x31\xdf\xd8\x37\xf1\x4d\x7c\x53\xff" "\xa8\x6f\xe6\x9b\xfb\x16\xfe\x31\xff\x98\x7f\xdc\x3f\xee\x9f\xf0\x4f\xf8" "\x27\x7d\x1b\xff\x94\x6f\xeb\x9f\xf6\xed\xfc\x33\xbe\xbd\x7f\xd6\x3f\xeb" "\x9f\xf3\x1d\x7d\x27\xdf\xd9\x3f\xef\xbb\xf8\x17\x7c\x57\xdf\xcd\xa7\xfa" "\x54\xdf\xc3\xf7\xf0\x3d\x7d\x4f\xdf\xdb\xf7\xf6\x7d\x7d\x5f\xdf\xcf\xf7" "\xf3\xfd\x7d\x7f\x3f\xc0\x0f\xf0\x83\xfc\x20\x3f\xd8\x0f\xf6\x43\xfc\x10" "\x3f\xd4\x0f\xf5\xc3\xfd\x70\x3f\xc2\x8f\xf0\xa3\xfc\x28\x3f\xc6\x8f\xf1" "\xe3\xfc\x38\x3f\xde\x8f\xf7\x13\xfc\x04\x3f\xd1\x4f\xf4\x93\xfd\x64\x3f" "\xd5\x4f\xf5\xd3\xfd\x74\x3f\xc3\xcf\xf0\xb3\xfc\x2c\x3f\xbb\xe0\x6c\x3f" "\xc7\xcf\xf1\xf3\xfc\x3c\xbf\xc0\x2f\xf0\x0b\xfd\x42\xbf\xd8\x2f\xf6\x4b" "\xfc\x12\xbf\xd4\x2f\xf5\xcb\xfd\x72\xbf\xd2\xaf\xf4\xab\xfd\x6a\xbf\xd6" "\xaf\xf5\xeb\xfd\x7a\xbf\xd1\x6f\xf4\x9b\xfd\x66\xbf\xd5\x6f\xf5\xdb\xfc" "\x36\xbf\xc3\xef\xf0\xbb\xfc\x2e\xbf\xc7\xef\xf1\x7b\xfd\x5e\xbf\xcf\xef" "\xf3\xfb\xfd\x7e\x7f\xc0\x1f\xf0\x07\xfd\x41\x7f\xc8\x7f\xe1\x0f\xfb\x2f" "\xfd\x11\xff\x95\x3f\xea\xbf\xf6\xc7\xfc\x37\xfe\xb8\xff\xd6\x9f\xf0\x27" "\xfd\x29\xff\x9d\x3f\xed\xbf\xf7\x67\xfc\x59\x7f\xce\xff\xe0\xcf\xfb\x1f" "\xfd\x05\xff\x93\xbf\xe8\x83\x1f\x97\x78\x33\x31\x3e\xf1\x56\x62\x42\xe2" "\xed\xc4\xc4\xc4\xa4\xc4\xe4\xc4\x94\xc4\xd4\xc4\xb4\xc4\xf4\xc4\x3b\x89" "\x19\x89\x99\x89\x59\x89\x77\x13\xb3\x13\xef\x25\xe6\x24\xe6\x26\xe6\x25" "\xe6\x27\x16\x24\xde\x4f\x2c\x4c\x2c\x4a\x2c\x4e\x7c\x90\x58\x92\xf8\x30" "\xb1\x34\xb1\x2c\xb1\x3c\xb1\x22\xb1\x32\xb1\x2a\x11\x42\x9e\x6d\x71\xc8" "\x17\xf2\x87\x64\xb8\x3e\x14\x08\x37\x84\x82\xa1\x50\x28\x1c\x8a\x04\x1f" "\x8a\x86\x62\xe1\xc6\x50\x3c\xdc\x14\x4a\x84\x9b\x43\xc9\x70\x4b\x28\x15" "\x6e\x0d\xa5\x43\x99\x50\x36\x3c\x1c\x1a\x84\x86\xa1\x51\x68\x1c\x9a\x84" "\x47\x42\xd3\xf0\x68\x68\x16\x9a\x87\x16\xe1\xb1\xd0\x32\x3c\x1e\x5a\x85" "\x27\x42\xeb\xf0\x64\x68\x13\x9e\x0a\x6d\xc3\xd3\xa1\x5d\x78\x26\xb4\x0f" "\xcf\x86\x0e\xe1\xb9\xd0\x31\x74\x0a\x9d\xc3\xf3\xa1\x4b\x78\x21\x74\x0d" "\xdd\x42\x6a\xe8\x1e\x7a\x84\x17\x43\xcf\xd0\x2b\xf4\x0e\x7d\x42\xdf\xf0" "\x52\xe8\x17\x5e\x0e\xfd\xc3\x2b\x61\x40\x18\x18\x06\x85\x57\xc3\xe0\xf0" "\x5a\x18\x12\x5e\x0f\x43\xc3\xb0\x30\x3c\xbc\x11\x46\x84\x91\x61\x54\x18" "\x1d\xc6\x84\xb1\x61\x5c\x78\x33\x8c\x0f\x6f\x85\x09\xe1\xed\x30\x31\x4c" "\x0a\x93\xc3\x94\x30\x35\x4c\x0b\xd3\xc3\x3b\x61\x46\x98\x19\x66\x85\x77" "\xc3\xec\xf0\x5e\x98\x13\xe6\x86\x79\x61\x7e\x58\x10\xde\x0f\x0b\xc3\xa2" "\xb0\x38\x7c\x10\x96\x84\x0f\xc3\xd2\xb0\x2c\x2c\x0f\x2b\xc2\xca\xb0\x2a" "\xac\x0e\x6b\xc2\xda\xb0\x2e\xac\x0f\x1b\xc2\xc6\xb0\x29\x6c\x0e\x5b\xc2" "\xd6\xf0\x51\xd8\x16\xb6\x87\x1d\x61\x67\xd8\x15\x76\x87\x3d\xe1\xe3\xb0" "\x37\x7c\x12\xf6\x85\x4f\xc3\xfe\xf0\x59\x38\x10\xfe\x18\x0e\x86\xcf\xc3" "\xa1\xf0\x45\x38\x1c\xbe\x0c\x47\xc2\x57\xe1\x68\xf8\x3a\x1c\x0b\xdf\x84" "\xe3\xe1\xdb\x70\x22\x9c\x0c\xa7\xc2\x77\xe1\x74\xf8\x3e\x9c\x09\x67\xc3" "\xb9\xf0\x43\x38\x1f\x7e\x0c\x17\xc2\x4f\xe1\xa2\xfc\xcd\x9a\x10\x42\x08" "\x21\xc4\x3f\x44\xff\xce\xe3\xdd\xff\xc6\xe7\xd2\x01\xc0\xaf\xb7\x44\x3d" "\x00\xe0\xea\xed\xb9\x0e\xff\x75\xcd\x8d\xd9\xff\xb4\xee\xa5\x72\xb7\x4c" "\x00\xc0\x93\xdd\x3a\x3c\xf0\xeb\x51\xb9\x72\x6a\x6a\xea\x2f\xcf\x5d\xaa" "\x21\xca\x3f\x17\x00\x12\x7f\x59\xff\xd7\x78\x19\xb4\x80\xc7\xa1\x35\x34" "\x87\xe2\x7f\xb3\xbf\x5e\xaa\xd3\x79\xfe\x9d\xfa\xc9\x5b\x00\x32\xfe\x59" "\x4e\x0a\x5c\x8e\x2f\xd7\xbf\xe9\xbf\xa8\xff\xc8\x63\xc3\x17\x96\x8a\xcf" "\x65\xfd\x3b\xf5\xe7\x02\x14\xcc\x7f\x39\x27\x03\x5c\x8e\x2f\xd7\x2f\xf1" "\x5f\xd4\xcf\xd1\xf4\x77\xfa\xcf\xf0\xf9\x38\x80\x66\x7f\x96\x93\x09\x2e" "\xc7\x97\xeb\x17\x83\x47\xe1\x29\x68\xfd\x17\xcf\x14\x42\x08\x21\x84\x10" "\x42\x08\x21\xfe\xa4\x97\x2a\xdb\xee\xf7\xee\x9f\x2f\xdd\x9f\xe7\x36\x97" "\x73\xd2\xc3\xe5\xf8\xf7\xee\xcf\x85\x10\x42\x08\x21\x84\x10\x42\x08\x71" "\xe5\x3d\xd3\xa9\xf3\x13\x8f\xb4\x6e\xdd\xbc\xdd\x3f\xb6\xc0\x5f\xf6\x05" "\xfe\x7b\x59\xb2\x90\xc5\x7f\xce\x22\xc3\x2f\x3f\x3a\xff\x57\xfa\xf9\x37" "\x2d\xae\xe4\x6f\x25\x21\x84\x10\x42\x08\x21\xc4\xbf\xc3\xe5\x8b\xfe\x2b" "\xdd\x89\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10" "\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21" "\x84\x10\x42\x08\x91\x76\xfd\x6f\xfc\x3b\xb1\x2b\x7d\x8e\x42\x08\x21\x84" "\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08" "\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10" "\x42\x08\x21\x84\x10\x42\x08\x21\xc4\x95\xf6\xff\x02\x00\x00\xff\xff\xb0" "\x04\x32\xe8", 5385)); NONFAILING(syz_mount_image(/*fs=*/0x200000000100, /*dir=*/0x200000000000, /*flags=*/0, /*opts=*/0x200000000600, /*chdir=*/2, /*size=*/0x1509, /*img=*/0x200000001c40)); // chmod arguments: [ // file: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // mode: open_mode = 0x23f (8 bytes) // ] NONFAILING(memcpy((void*)0x200000000180, "./file0\000", 8)); syscall( __NR_chmod, /*file=*/0x200000000180ul, /*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|0x200*/ 0x23ful); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); setup_sysctl(); const char* reason; (void)reason; install_segv_handler(); loop(); return 0; }