Re: [syzbot] [jffs2?] kernel BUG in jffs2_sum_write_sumnode

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Sorry for containing the HTML part, repeat.
Hello, I reproduced this bug and confirmed in the latest upstream.

If you fix this issue, please add the following tag to the commit:
Reported-by: xingwei lee <xrivendell7@xxxxxxxxx>
Reported-by: yue sun <samsun1006219@xxxxxxxxx>

I use the same kernel as syzbot instance:
https://syzkaller.appspot.com/bug?extid=5a281fe8aadf8f11230d
Kernel Commit: upstream fe46a7dd189e25604716c03576d05ac8a5209743
Kernel Config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=4d90a36f0cab495a
with KASAN enabled

root@syzkaller:~# ./0
[  406.727577][ T8177] ------------[ cut here ]------------
[  406.728272][ T8177] kernel BUG at fs/jffs2/summary.c:865!
[  406.729014][ T8177] invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
[  406.729850][ T8177] CPU: 2 PID: 8177 Comm: 0 Not tainted
6.8.0-08951-gfe46a7dd189e-dirty #6
[  406.730904][ T8177] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  406.732206][ T8177] RIP: 0010:jffs2_sum_write_sumnode+0x1f50/0x2630
[  406.733061][ T8177] Code: 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 81 01
00 00 8b b3 c0 05 00 00 48 c7 c2 c0 7e a4 8b 48 c7 c7 c0 7a a4 8b e8
51 ba 82 fe 90 <0f> 0b e8 69 29 01 ff e9 70 e19
[  406.735472][ T8177] RSP: 0018:ffffc9000396f4e0 EFLAGS: 00010286
[  406.736416][ T8177] RAX: 0000000000000045 RBX: ffff888022a20040
RCX: ffff888022a20040
[  406.737446][ T8177] RDX: 0000000000000000 RSI: 0000000000000000
RDI: 0000000000000000
[  406.738435][ T8177] RBP: ffffc9000396f660 R08: 0000000000000005
R09: 0000000000000000
[  406.739470][ T8177] R10: 0000000080000000 R11: 0000000000000001
R12: 0000000000000000
[  406.740463][ T8177] R13: 0000000000000000 R14: ffff888028bb1000
R15: 000000000000106c
[  406.741459][ T8177] FS:  0000000007a66480(0000)
GS:ffff8880b9300000(0000) knlGS:0000000000000000
[  406.742581][ T8177] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  406.743418][ T8177] CR2: 0000000020003029 CR3: 000000002be68000
CR4: 0000000000750ef0
[  406.744407][ T8177] DR0: 0000000000000000 DR1: 0000000000000000
DR2: 0000000000000000
[  406.745398][ T8177] DR3: 0000000000000000 DR6: 00000000fffe0ff0
DR7: 0000000000000400
[  406.746373][ T8177] PKRU: 55555554
[  406.746833][ T8177] Call Trace:
[  406.747271][ T8177]  <TASK>
[  406.747651][ T8177]  ? show_regs+0x97/0xa0
[  406.748215][ T8177]  ? die+0x3b/0xb0
[  406.748701][ T8177]  ? do_trap+0x245/0x440
[  406.749262][ T8177]  ? jffs2_sum_write_sumnode+0x1f50/0x2630
[  406.750005][ T8177]  ? jffs2_sum_write_sumnode+0x1f50/0x2630
[  406.750711][ T8177]  ? do_error_trap+0xff/0x250
[  406.751342][ T8177]  ? jffs2_sum_write_sumnode+0x1f50/0x2630
[  406.752094][ T8177]  ? handle_invalid_op+0x39/0x40
[  406.752740][ T8177]  ? jffs2_sum_write_sumnode+0x1f50/0x2630
[  406.753479][ T8177]  ? exc_invalid_op+0x2e/0x50
[  406.754090][ T8177]  ? asm_exc_invalid_op+0x1a/0x20
[  406.754716][ T8177]  ? jffs2_sum_write_sumnode+0x1f50/0x2630
[  406.755477][ T8177]  ? __pfx_jffs2_sum_write_sumnode+0x10/0x10
[  406.756234][ T8177]  ? rcu_is_watching+0x12/0xc0
[  406.756861][ T8177]  ? lock_acquire+0x1b1/0x540
[  406.757489][ T8177]  ? __pfx_lock_acquire+0x10/0x10
[  406.758117][ T8177]  ? __pfx___mutex_lock+0x10/0x10
[  406.758769][ T8177]  ? jffs2_do_reserve_space+0xc59/0x1190
[  406.759502][ T8177]  jffs2_do_reserve_space+0xc59/0x1190
[  406.760223][ T8177]  jffs2_reserve_space+0x67e/0xc20
[  406.760883][ T8177]  ? avc_has_perm_noaudit+0x152/0x3d0
[  406.761584][ T8177]  ? __pfx_jffs2_reserve_space+0x10/0x10
[  406.762302][ T8177]  ? avc_has_perm_noaudit+0x152/0x3d0
[  406.763030][ T8177]  ? cred_has_capability.isra.0+0x19d/0x310
[  406.763788][ T8177]  ? __pfx_jffs2_security_setxattr+0x10/0x10
[  406.764567][ T8177]  do_jffs2_setxattr+0x1ab/0x1770
[  406.765224][ T8177]  ? cap_capable+0x1e4/0x250
[  406.765783][ T8177]  ? __pfx_do_jffs2_setxattr+0x10/0x10
[  406.766514][ T8177]  ? xattr_resolve_name+0x292/0x440
[  406.767220][ T8177]  ? __pfx_jffs2_security_setxattr+0x10/0x10
[  406.768026][ T8177]  __vfs_setxattr+0x182/0x1f0
[  406.768646][ T8177]  ? __pfx_evm_protect_xattr.isra.0+0x10/0x10
[  406.769411][ T8177]  ? __pfx___vfs_setxattr+0x10/0x10
[  406.770067][ T8177]  __vfs_setxattr_noperm+0x132/0x610
[  406.770752][ T8177]  __vfs_setxattr_locked+0x195/0x270
[  406.771452][ T8177]  vfs_setxattr+0x151/0x370
[  406.772052][ T8177]  ? __pfx_vfs_setxattr+0x10/0x10
[  406.772704][ T8177]  ? __might_fault+0xee/0x1a0
[  406.773326][ T8177]  do_setxattr+0x153/0x180
[  406.773881][ T8177]  setxattr+0x166/0x180
[  406.774421][ T8177]  ? __pfx_setxattr+0x10/0x10
[  406.775043][ T8177]  ? mnt_get_write_access+0x21d/0x320
[  406.775743][ T8177]  path_setxattr+0x188/0x1f0
[  406.776338][ T8177]  ? __pfx_path_setxattr+0x10/0x10
[  406.776986][ T8177]  ? handle_mm_fault+0x541/0xab0
[  406.777648][ T8177]  __x64_sys_lsetxattr+0xc6/0x160
[  406.778281][ T8177]  ? do_syscall_64+0x91/0x260
[  406.778927][ T8177]  ? lockdep_hardirqs_on+0x7c/0x110
[  406.779598][ T8177]  do_syscall_64+0xd2/0x260
[  406.780194][ T8177]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[  406.780944][ T8177] RIP: 0033:0x437d49
[  406.781454][ T8177] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17
00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b
4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 488
[  406.783841][ T8177] RSP: 002b:00007fff7cd51d28 EFLAGS: 00000246
ORIG_RAX: 00000000000000bd
[  406.784889][ T8177] RAX: ffffffffffffffda RBX: 0000000020002047
RCX: 0000000000437d49
[  406.785900][ T8177] RDX: 0000000020002040 RSI: 00000000200002c0
RDI: 00000000200001c0
[  406.786886][ T8177] RBP: 00007fff7cd51d80 R08: 0000000000000003
R09: 000000017cd51d40
[  406.787878][ T8177] R10: 0000000000001009 R11: 0000000000000246
R12: 0000000000000001
[  406.788872][ T8177] R13: 00007fff7cd51f88 R14: 0000000000000001
R15: 0000000000000001
[  406.789879][ T8177]  </TASK>


=* repro.c =*
    #define _GNU_SOURCE

    #include <dirent.h>
    #include <endian.h>
    #include <errno.h>
    #include <fcntl.h>
    #include <setjmp.h>
    #include <signal.h>
    #include <stdarg.h>
    #include <stdbool.h>
    #include <stddef.h>
    #include <stdint.h>
    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <sys/ioctl.h>
    #include <sys/mman.h>
    #include <sys/mount.h>
    #include <sys/prctl.h>
    #include <sys/stat.h>
    #include <sys/syscall.h>
    #include <sys/types.h>
    #include <sys/wait.h>
    #include <time.h>
    #include <unistd.h>

    #include <linux/loop.h>

    #ifndef __NR_memfd_create
    #define __NR_memfd_create 319
    #endif

    static unsigned long long procid;

    static __thread int clone_ongoing;
    static __thread int skip_segv;
    static __thread jmp_buf segv_env;

    static void segv_handler(int sig, siginfo_t* info, void* ctx) {
        if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
            exit(sig);
        }
        uintptr_t addr = (uintptr_t)info->si_addr;
        const uintptr_t prog_start = 1 << 20;
        const uintptr_t prog_end = 100 << 20;
        int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
        int valid = addr < prog_start || addr > prog_end;
        if (skip && valid) {
            _longjmp(segv_env, 1);
        }
        exit(sig);
    }

    static void install_segv_handler(void) {
        struct sigaction sa;
        memset(&sa, 0, sizeof(sa));
        sa.sa_handler = SIG_IGN;
        syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
        syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
        memset(&sa, 0, sizeof(sa));
        sa.sa_sigaction = segv_handler;
        sa.sa_flags = SA_NODEFER | SA_SIGINFO;
        sigaction(SIGSEGV, &sa, NULL);
        sigaction(SIGBUS, &sa, NULL);
    }

    #define NONFAILING(...)                                  \
        ({                                                     \
            int ok = 1;                                          \
            __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
            if (_setjmp(segv_env) == 0) {                        \
                __VA_ARGS__;                                       \
            } else                                               \
                ok = 0;                                            \
            __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
            ok;                                                  \
        })

    static void sleep_ms(uint64_t ms) {
        usleep(ms * 1000);
    }

    static uint64_t current_time_ms(void) {
        struct timespec ts;
        if (clock_gettime(CLOCK_MONOTONIC, &ts))
            exit(1);
        return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
    }

    static bool write_file(const char* file, const char* what, ...) {
        char buf[1024];
        va_list args;
        va_start(args, what);
        vsnprintf(buf, sizeof(buf), what, args);
        va_end(args);
        buf[sizeof(buf) - 1] = 0;
        int len = strlen(buf);
        int fd = open(file, O_WRONLY | O_CLOEXEC);
        if (fd == -1)
            return false;
        if (write(fd, buf, len) != len) {
            int err = errno;
            close(fd);
            errno = err;
            return false;
        }
        close(fd);
        return true;
    }

    //% This code is derived from puff.{c,h}, found in the zlib development. The
    //% original files come with the following copyright notice:

    //% Copyright (C) 2002-2013 Mark Adler, all rights reserved
    //% version 2.3, 21 Jan 2013
    //% This software is provided 'as-is', without any express or implied
    //% warranty.  In no event will the author be held liable for any damages
    //% arising from the use of this software.
    //% Permission is granted to anyone to use this software for any purpose,
    //% including commercial applications, and to alter it and redistribute it
    //% freely, subject to the following restrictions:
    //% 1. The origin of this software must not be misrepresented; you must not
    //%    claim that you wrote the original software. If you use this software
    //%    in a product, an acknowledgment in the product documentation would be
    //%    appreciated but is not required.
    //% 2. Altered source versions must be plainly marked as such, and
must not be
    //%    misrepresented as being the original software.
    //% 3. This notice may not be removed or altered from any source
distribution.
    //% Mark Adler    madler@xxxxxxxxxxxxxxxxxx

    //% BEGIN CODE DERIVED FROM puff.{c,h}

    #define MAXBITS 15
    #define MAXLCODES 286
    #define MAXDCODES 30
    #define MAXCODES (MAXLCODES + MAXDCODES)
    #define FIXLCODES 288

    struct puff_state {
        unsigned char* out;
        unsigned long outlen;
        unsigned long outcnt;
        const unsigned char* in;
        unsigned long inlen;
        unsigned long incnt;
        int bitbuf;
        int bitcnt;
        jmp_buf env;
    };
    static int puff_bits(struct puff_state* s, int need) {
        long val = s->bitbuf;
        while (s->bitcnt < need) {
            if (s->incnt == s->inlen)
                longjmp(s->env, 1);
            val |= (long)(s->in[s->incnt++]) << s->bitcnt;
            s->bitcnt += 8;
        }
        s->bitbuf = (int)(val >> need);
        s->bitcnt -= need;
        return (int)(val & ((1L << need) - 1));
    }
    static int puff_stored(struct puff_state* s) {
        s->bitbuf = 0;
        s->bitcnt = 0;
        if (s->incnt + 4 > s->inlen)
            return 2;
        unsigned len = s->in[s->incnt++];
        len |= s->in[s->incnt++] << 8;
        if (s->in[s->incnt++] != (~len & 0xff) ||
                s->in[s->incnt++] != ((~len >> 8) & 0xff))
            return -2;
        if (s->incnt + len > s->inlen)
            return 2;
        if (s->outcnt + len > s->outlen)
            return 1;
        for (; len--; s->outcnt++, s->incnt++) {
            if (s->in[s->incnt])
                s->out[s->outcnt] = s->in[s->incnt];
        }
        return 0;
    }
    struct puff_huffman {
        short* count;
        short* symbol;
    };
    static int puff_decode(struct puff_state* s, const struct puff_huffman* h) {
        int first = 0;
        int index = 0;
        int bitbuf = s->bitbuf;
        int left = s->bitcnt;
        int code = first = index = 0;
        int len = 1;
        short* next = h->count + 1;
        while (1) {
            while (left--) {
                code |= bitbuf & 1;
                bitbuf >>= 1;
                int count = *next++;
                if (code - count < first) {
                    s->bitbuf = bitbuf;
                    s->bitcnt = (s->bitcnt - len) & 7;
                    return h->symbol[index + (code - first)];
                }
                index += count;
                first += count;
                first <<= 1;
                code <<= 1;
                len++;
            }
            left = (MAXBITS + 1) - len;
            if (left == 0)
                break;
            if (s->incnt == s->inlen)
                longjmp(s->env, 1);
            bitbuf = s->in[s->incnt++];
            if (left > 8)
                left = 8;
        }
        return -10;
    }
    static int puff_construct(struct puff_huffman* h, const short*
length, int n) {
        int len;
        for (len = 0; len <= MAXBITS; len++)
            h->count[len] = 0;
        int symbol;
        for (symbol = 0; symbol < n; symbol++)
            (h->count[length[symbol]])++;
        if (h->count[0] == n)
            return 0;
        int left = 1;
        for (len = 1; len <= MAXBITS; len++) {
            left <<= 1;
            left -= h->count[len];
            if (left < 0)
                return left;
        }
        short offs[MAXBITS + 1];
        offs[1] = 0;
        for (len = 1; len < MAXBITS; len++)
            offs[len + 1] = offs[len] + h->count[len];
        for (symbol = 0; symbol < n; symbol++)
            if (length[symbol] != 0)
                h->symbol[offs[length[symbol]]++] = symbol;
        return left;
    }
    static int puff_codes(struct puff_state* s,
                                                const struct
puff_huffman* lencode,
                                                const struct
puff_huffman* distcode) {
        static const short lens[29] = {3,  4,  5,  6,   7,   8,   9,
10,  11, 13,

15, 17, 19, 23,  27,  31,  35,  43,  51, 59,

67, 83, 99, 115, 131, 163, 195, 227, 258};
        static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1,
1, 1, 2, 2, 2,

2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
        static const short dists[30] = {
                1,    2,    3,    4,    5,    7,    9,    13,    17,    25,
                33,   49,   65,   97,   129,  193,  257,  385,   513,   769,
                1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577};
        static const short dext[30] = {0, 0, 0,  0,  1,  1,  2,  2,  3,  3,

4, 4, 5,  5,  6,  6,  7,  7,  8,  8,

9, 9, 10, 10, 11, 11, 12, 12, 13, 13};
        int symbol;
        do {
            symbol = puff_decode(s, lencode);
            if (symbol < 0)
                return symbol;
            if (symbol < 256) {
                if (s->outcnt == s->outlen)
                    return 1;
                if (symbol)
                    s->out[s->outcnt] = symbol;
                s->outcnt++;
            } else if (symbol > 256) {
                symbol -= 257;
                if (symbol >= 29)
                    return -10;
                int len = lens[symbol] + puff_bits(s, lext[symbol]);
                symbol = puff_decode(s, distcode);
                if (symbol < 0)
                    return symbol;
                unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
                if (dist > s->outcnt)
                    return -11;
                if (s->outcnt + len > s->outlen)
                    return 1;
                while (len--) {
                    if (dist <= s->outcnt && s->out[s->outcnt - dist])
                        s->out[s->outcnt] = s->out[s->outcnt - dist];
                    s->outcnt++;
                }
            }
        } while (symbol != 256);
        return 0;
    }
    static int puff_fixed(struct puff_state* s) {
        static int virgin = 1;
        static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
        static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
        static struct puff_huffman lencode, distcode;
        if (virgin) {
            lencode.count = lencnt;
            lencode.symbol = lensym;
            distcode.count = distcnt;
            distcode.symbol = distsym;
            short lengths[FIXLCODES];
            int symbol;
            for (symbol = 0; symbol < 144; symbol++)
                lengths[symbol] = 8;
            for (; symbol < 256; symbol++)
                lengths[symbol] = 9;
            for (; symbol < 280; symbol++)
                lengths[symbol] = 7;
            for (; symbol < FIXLCODES; symbol++)
                lengths[symbol] = 8;
            puff_construct(&lencode, lengths, FIXLCODES);
            for (symbol = 0; symbol < MAXDCODES; symbol++)
                lengths[symbol] = 5;
            puff_construct(&distcode, lengths, MAXDCODES);
            virgin = 0;
        }
        return puff_codes(s, &lencode, &distcode);
    }
    static int puff_dynamic(struct puff_state* s) {
        static const short order[19] = {16, 17, 18, 0, 8,  7, 9,  6, 10, 5,

 11, 4,  12, 3, 13, 2, 14, 1, 15};
        int nlen = puff_bits(s, 5) + 257;
        int ndist = puff_bits(s, 5) + 1;
        int ncode = puff_bits(s, 4) + 4;
        if (nlen > MAXLCODES || ndist > MAXDCODES)
            return -3;
        short lengths[MAXCODES];
        int index;
        for (index = 0; index < ncode; index++)
            lengths[order[index]] = puff_bits(s, 3);
        for (; index < 19; index++)
            lengths[order[index]] = 0;
        short lencnt[MAXBITS + 1], lensym[MAXLCODES];
        struct puff_huffman lencode = {lencnt, lensym};
        int err = puff_construct(&lencode, lengths, 19);
        if (err != 0)
            return -4;
        index = 0;
        while (index < nlen + ndist) {
            int symbol;
            int len;
            symbol = puff_decode(s, &lencode);
            if (symbol < 0)
                return symbol;
            if (symbol < 16)
                lengths[index++] = symbol;
            else {
                len = 0;
                if (symbol == 16) {
                    if (index == 0)
                        return -5;
                    len = lengths[index - 1];
                    symbol = 3 + puff_bits(s, 2);
                } else if (symbol == 17)
                    symbol = 3 + puff_bits(s, 3);
                else
                    symbol = 11 + puff_bits(s, 7);
                if (index + symbol > nlen + ndist)
                    return -6;
                while (symbol--)
                    lengths[index++] = len;
            }
        }
        if (lengths[256] == 0)
            return -9;
        err = puff_construct(&lencode, lengths, nlen);
        if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
            return -7;
        short distcnt[MAXBITS + 1], distsym[MAXDCODES];
        struct puff_huffman distcode = {distcnt, distsym};
        err = puff_construct(&distcode, lengths + nlen, ndist);
        if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
            return -8;
        return puff_codes(s, &lencode, &distcode);
    }
    static int puff(unsigned char* dest,
                                    unsigned long* destlen,
                                    const unsigned char* source,
                                    unsigned long sourcelen) {
        struct puff_state s = {
                .out = dest,
                .outlen = *destlen,
                .outcnt = 0,
                .in = source,
                .inlen = sourcelen,
                .incnt = 0,
                .bitbuf = 0,
                .bitcnt = 0,
        };
        int err;
        if (setjmp(s.env) != 0)
            err = 2;
        else {
            int last;
            do {
                last = puff_bits(&s, 1);
                int type = puff_bits(&s, 2);
                err = type == 0 ? puff_stored(&s)
                                                : (type == 1 ? puff_fixed(&s)

  : (type == 2 ? puff_dynamic(&s) : -1));
                if (err != 0)
                    break;
            } while (!last);
        }
        *destlen = s.outcnt;
        return err;
    }

    //% END CODE DERIVED FROM puff.{c,h}

    #define ZLIB_HEADER_WIDTH 2

    static int puff_zlib_to_file(const unsigned char* source,
                                                             unsigned
long sourcelen,
                                                             int dest_fd) {
        if (sourcelen < ZLIB_HEADER_WIDTH)
            return 0;
        source += ZLIB_HEADER_WIDTH;
        sourcelen -= ZLIB_HEADER_WIDTH;
        const unsigned long max_destlen = 132 << 20;
        void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ,
                                         MAP_PRIVATE | MAP_ANON, -1, 0);
        if (ret == MAP_FAILED)
            return -1;
        unsigned char* dest = (unsigned char*)ret;
        unsigned long destlen = max_destlen;
        int err = puff(dest, &destlen, source, sourcelen);
        if (err) {
            munmap(dest, max_destlen);
            errno = -err;
            return -1;
        }
        if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
            munmap(dest, max_destlen);
            return -1;
        }
        return munmap(dest, max_destlen);
    }

    static int setup_loop_device(unsigned char* data,
                                                             unsigned long size,
                                                             const
char* loopname,
                                                             int* loopfd_p) {
        int err = 0, loopfd = -1;
        int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
        if (memfd == -1) {
            err = errno;
            goto error;
        }
        if (puff_zlib_to_file(data, size, memfd)) {
            err = errno;
            goto error_close_memfd;
        }
        loopfd = open(loopname, O_RDWR);
        if (loopfd == -1) {
            err = errno;
            goto error_close_memfd;
        }
        if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
            if (errno != EBUSY) {
                err = errno;
                goto error_close_loop;
            }
            ioctl(loopfd, LOOP_CLR_FD, 0);
            usleep(1000);
            if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
                err = errno;
                goto error_close_loop;
            }
        }
        close(memfd);
        *loopfd_p = loopfd;
        return 0;

    error_close_loop:
        close(loopfd);
    error_close_memfd:
        close(memfd);
    error:
        errno = err;
        return -1;
    }

    static long syz_mount_image(volatile long fsarg,
                                                            volatile long dir,
                                                            volatile long flags,
                                                            volatile
long optsarg,
                                                            volatile
long change_dir,
                                                            volatile
unsigned long size,
                                                            volatile
long image) {
        unsigned char* data = (unsigned char*)image;
        int res = -1, err = 0, loopfd = -1, need_loop_device = !!size;
        char* mount_opts = (char*)optsarg;
        char* target = (char*)dir;
        char* fs = (char*)fsarg;
        char* source = NULL;
        char loopname[64];
        if (need_loop_device) {
            memset(loopname, 0, sizeof(loopname));
            snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
            if (setup_loop_device(data, size, loopname, &loopfd) == -1)
                return -1;
            source = loopname;
        }
        mkdir(target, 0777);
        char opts[256];
        memset(opts, 0, sizeof(opts));
        if (strlen(mount_opts) > (sizeof(opts) - 32)) {
        }
        strncpy(opts, mount_opts, sizeof(opts) - 32);
        if (strcmp(fs, "iso9660") == 0) {
            flags |= MS_RDONLY;
        } else if (strncmp(fs, "ext", 3) == 0) {
            bool has_remount_ro = false;
            char* remount_ro_start = strstr(opts, "errors=remount-ro");
            if (remount_ro_start != NULL) {
                char after = *(remount_ro_start + strlen("errors=remount-ro"));
                char before = remount_ro_start == opts ? '\0' :
*(remount_ro_start - 1);
                has_remount_ro = ((before == '\0' || before == ',') &&
                                                    (after == '\0' ||
after == ','));
            }
            if (strstr(opts, "errors=panic") || !has_remount_ro)
                strcat(opts, ",errors=continue");
        } else if (strcmp(fs, "xfs") == 0) {
            strcat(opts, ",nouuid");
        }
        res = mount(source, target, fs, flags, opts);
        if (res == -1) {
            err = errno;
            goto error_clear_loop;
        }
        res = open(target, O_RDONLY | O_DIRECTORY);
        if (res == -1) {
            err = errno;
            goto error_clear_loop;
        }
        if (change_dir) {
            res = chdir(target);
            if (res == -1) {
                err = errno;
            }
        }

    error_clear_loop:
        if (need_loop_device) {
            ioctl(loopfd, LOOP_CLR_FD, 0);
            close(loopfd);
        }
        errno = err;
        return res;
    }

    static void kill_and_wait(int pid, int* status) {
        kill(-pid, SIGKILL);
        kill(pid, SIGKILL);
        for (int i = 0; i < 100; i++) {
            if (waitpid(-1, status, WNOHANG | __WALL) == pid)
                return;
            usleep(1000);
        }
        DIR* dir = opendir("/sys/fs/fuse/connections");
        if (dir) {
            for (;;) {
                struct dirent* ent = readdir(dir);
                if (!ent)
                    break;
                if (strcmp(ent->d_name, ".") == 0 ||
strcmp(ent->d_name, "..") == 0)
                    continue;
                char abort[300];
                snprintf(abort, sizeof(abort),
"/sys/fs/fuse/connections/%s/abort",
                                 ent->d_name);
                int fd = open(abort, O_WRONLY);
                if (fd == -1) {
                    continue;
                }
                if (write(fd, abort, 1) < 0) {
                }
                close(fd);
            }
            closedir(dir);
        } else {
        }
        while (waitpid(-1, status, __WALL) != pid) {
        }
    }

    static void reset_loop() {
        char buf[64];
        snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);
        int loopfd = open(buf, O_RDWR);
        if (loopfd != -1) {
            ioctl(loopfd, LOOP_CLR_FD, 0);
            close(loopfd);
        }
    }

    static void setup_test() {
        prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
        setpgrp();
        write_file("/proc/self/oom_score_adj", "1000");
    }

    static void execute_one(void);

    #define WAIT_FLAGS __WALL

    static void loop(void) {
        int iter = 0;
        for (;; iter++) {
            reset_loop();
            int pid = fork();
            if (pid < 0)
                exit(1);
            if (pid == 0) {
                setup_test();
                execute_one();
                exit(0);
            }
            int status = 0;
            uint64_t start = current_time_ms();
            for (;;) {
                if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
                    break;
                sleep_ms(1);
                if (current_time_ms() - start < 5000)
                    continue;
                kill_and_wait(pid, &status);
                break;
            }
        }
    }

    void execute_one(void) {
        NONFAILING(memcpy((void*)0x20000040, "vfat\000", 5));
        NONFAILING(memcpy((void*)0x20000200, "./file0\000", 8));
        NONFAILING(syz_mount_image(/*fs=*/0x20000040, /*dir=*/0x20000200,

/*flags=*/0x220e002, /*opts=*/0, /*chdir=*/1,

/*size=*/0, /*img=*/0x20000100));
        NONFAILING(memcpy((void*)0x20000040, "mtd", 3));
        NONFAILING(sprintf((char*)0x20000043, "0x%016llx", (long long)0));
        NONFAILING(memcpy((void*)0x200000c0, "./file0\000", 8));
        NONFAILING(memcpy((void*)0x20001200, "jffs2\000", 6));
        syscall(__NR_mount, /*src=*/0x20000040ul, /*dst=*/0x200000c0ul,
                        /*type=*/0x20001200ul, /*flags=*/0ul, /*data=*/0ul);
        NONFAILING(memcpy((void*)0x200001c0, "./file0\000", 8));
        NONFAILING(memcpy((void*)0x200002c0, "security.evm\000", 13));
        NONFAILING(*(uint8_t*)0x20002040 = 3);
        NONFAILING(*(uint8_t*)0x20002041 = 2);
        NONFAILING(*(uint8_t*)0x20002042 = 0xb);
        NONFAILING(*(uint32_t*)0x20002043 = htobe32(4));
        NONFAILING(*(uint16_t*)0x20002047 = htobe16(0x1000));
        NONFAILING(memcpy(
                (void*)0x20002049,

"\x78\x8d\x9c\xb2\x99\xab\xd7\x2e\xce\x91\x3d\x53\x36\x5e\x16\x68\x8e\x51"

"\xac\xe1\x59\x84\xab\x53\xd1\x66\x6a\xe3\xf5\xdf\xbc\x86\x0b\xef\x87\x38"

"\x9e\x21\x28\x6b\xe2\x36\xdd\xc3\xd0\xfa\x2e\x51\xd5\xc5\xc7\xb3\x5c\x5d"

"\x50\x3c\x5b\x2c\x3b\x6b\xe0\xfc\x56\xe9\x7d\xf8\x8f\xaa\x06\x35\x36\x3b"

"\xa9\x2b\x82\xc4\x7a\x81\x7a\xc9\x7f\x1d\x63\x8a\x14\x61\x82\x12\x55\xec"

"\x23\xbd\x0c\xe5\xbf\x10\x94\xe3\xa8\x98\x0d\x7e\x6d\x19\x76\xba\x77\x87"

"\x45\x92\x0e\x17\x18\xfd\xda\xc4\xbd\x66\xb0\xa6\x06\x80\x1a\xae\xfd\xed"

"\x29\x3c\x3f\xce\xba\xd3\xb2\xc0\x64\x03\xdb\xa9\x99\x49\x71\x65\x9b\x7f"

"\x4a\x07\x7a\xdd\xae\xb8\xae\x3e\x5a\xca\x70\x27\xfd\xe1\xe4\x00\x01\xc0"

"\xbd\xd8\x00\xbc\xc2\x87\xe0\x2c\x86\x7e\x27\x82\xde\xaf\x67\x6a\x26\x16"

"\x47\xdb\x8c\x2f\x39\x45\x02\x20\x57\xde\x76\x81\x00\xa8\xbf\x73\xd9\xf9"

"\xff\x29\x22\x9b\x46\xde\xad\x58\xb2\xdd\xf9\x64\x33\x46\x8e\x9e\xee\x89"

"\x50\xdf\x65\x87\x11\xe4\x11\x36\x4e\x44\x14\x5e\x68\x2f\x3c\x05\x3c\x6f"

"\x5a\x18\x61\xee\xe6\xed\xf8\x85\xa9\x7c\x54\x58\x05\xac\x0c\x35\xa5\xe4"

"\x62\x3b\x20\x01\x86\x1c\x59\x33\x54\xb5\x70\xff\x3b\x4a\x45\xf1\xac\xde"

"\x0a\x8d\xbd\x17\xc0\x9c\xe4\x48\xed\x5d\xfd\x9e\x74\x72\xe6\x89\x67\xde"

"\xcb\x76\x9f\xa6\x00\xcd\x30\xbe\xb6\xc8\x03\x0e\x94\x74\xc7\xec\x4c\x1d"

"\xaf\x3e\x00\x7b\xbc\x57\x65\xb3\x66\xd4\xa1\x76\xe3\x8b\xdf\xab\xed\xd2"

"\xb0\x76\xa5\xed\x7d\x50\xf5\x17\x7b\x94\xa6\xa0\xf0\x00\xcd\x3a\xca\xdd"

"\xe8\xe8\x0f\x66\xea\xda\x14\x01\x86\x20\xb1\x59\xe9\xe1\x4c\x25\x2d\x20"

"\xc8\xdb\xb0\xfe\x36\x05\xb5\x69\x8b\x53\xe4\x21\x0b\x62\xfc\xbd\x00\x01"

"\x7e\xaa\x01\xeb\x1f\xa5\x21\xbd\xb8\xd3\x0e\x83\x95\x1b\x4e\xa0\x28\x6c"

"\x8f\x0d\x46\x45\x17\xa1\x1d\x79\x22\xd6\xcc\xe4\xd2\x05\x8e\xc8\xcd\x7b"

"\x02\xb7\x3d\x82\x5d\x7e\x0a\xbb\xbd\x85\xe9\x91\x22\x0f\xc7\x99\x55\x34"

"\xb7\xb1\x99\x8c\xa7\x52\x89\x0b\x07\x9a\x7c\xa3\xfd\xe5\x64\x38\xcf\x82"

"\xd5\xdd\x9e\xdb\xd1\x1f\xd2\x93\xc1\x7d\x1c\xf1\x66\x57\xd0\xb3\x52\xa8"

"\xc6\xc3\x63\x00\xad\x09\xa7\x8e\x3e\xe3\x91\x3b\x9b\x6f\x53\xde\xbf\xfc"

"\x7e\x32\xbf\xb6\x4b\x0e\x8c\xbe\x07\xfe\x9b\x0d\xad\xb0\x97\xae\xb2\xc2"

"\x42\x43\x0b\xec\x75\x63\x0a\x39\x21\x82\x8a\x73\x14\xde\x14\x04\x82\x9e"

"\x7a\xfb\x3b\x84\x20\xe8\x5f\x2c\x8f\x6e\x88\xde\x04\x23\x14\x41\x6e\x5c"

"\x00\xc5\x9b\x22\x20\x80\x04\xbe\xc1\x61\xf8\x45\x7c\x7f\x8e\x3a\x8c\xa4"

"\x17\x4a\x4b\x78\xdf\x6e\x46\x0d\x56\xd2\x4e\x01\xae\x1a\x24\x11\x27\x0f"

"\x79\xd0\x20\xa6\xba\xc8\x55\xf1\xa3\xef\x7b\x3d\x09\x91\x88\x26\x56\xb4"

"\x08\xdc\xda\xf0\x2d\xb4\x6a\xc8\xfc\xab\x0c\x87\x5d\x1f\x2e\x8d\xb3\x66"

"\xe6\xa2\x0c\xb6\x7a\x4d\xb9\x20\x38\x2a\x69\x15\x71\x5d\x3b\x42\x66\xf7"

"\x79\xfe\x86\x33\xbe\xa6\xde\xf2\x8c\xc1\x59\x13\x8b\x83\x43\x34\xce\xde"

"\xf3\xde\xc5\x4e\xa5\x30\x3d\xf5\x6b\xe8\x71\x15\x31\x5e\xc0\xf1\x47\x8a"

"\x0c\x08\x69\xe5\xf7\xc3\x3d\xa6\x4b\x23\xaf\x58\x11\x75\x10\x55\xc9\x08"

"\x49\x48\x44\x81\xd5\xa1\x0d\x72\xe0\x8c\xcd\x12\x71\x0c\x4f\x2f\xf5\x86"

"\xa9\xea\x17\x5f\x4a\xa7\x0b\x15\x6c\x00\xc5\x7e\x22\xc1\x36\x0b\xfc\x7d"

"\x36\xaa\x47\x92\x44\x4f\x81\xd8\xa0\xed\x41\xbf\x6a\x45\x2e\xa5\x26\x8b"

"\x86\x05\x68\x2a\xc6\x3e\xaa\x46\x52\x18\xf4\xd9\x62\xdb\x42\x15\x4d\x01"

"\x96\x6d\x3a\xd8\xfc\x2f\xde\x48\xef\x71\xbe\x08\xbe\x58\xe5\xad\x6d\x5a"

"\x35\x93\xef\xc9\xc1\x33\x6e\x54\x13\x72\xa3\x47\x99\xd2\x4e\xa0\x0d\x4d"

"\x49\x85\xbe\xd1\xda\xb1\x06\x20\x91\x1e\x9f\x69\x67\x88\x08\x26\xbe\x5a"

"\x1f\x1b\xb4\xb2\xa3\x94\x86\x54\xc6\x93\x5c\xaf\xeb\x49\x25\xe1\x07\xa0"

"\x1f\x9d\xda\x66\x8e\x5f\xd7\x48\x9e\x82\x13\x92\x41\xa9\x19\x0f\x09\x0a"

"\xfe\x20\x94\x23\x4c\x75\xfe\xc0\x74\x62\x27\x48\xd4\xdd\x78\x2a\x93\x0f"

"\x42\xb0\xe7\x5d\x92\x4b\xef\x68\xff\xaf\xba\xa9\x89\x16\x15\x1a\x36\xef"

"\x29\x98\xaf\xd3\x00\x09\x55\xef\xbf\xa0\xa9\xa0\x08\x35\x8c\x11\x04\x3c"

"\x0f\x96\xb5\x2f\xc7\x8a\x42\x53\x1a\xa5\xdf\xd8\xde\x09\x51\x8c\xff\x00"

"\x8b\x33\x92\x59\xb2\x66\xc4\x88\xbb\x1d\xa0\x58\xba\x21\x8c\xd6\x4b\x3e"

"\x41\x3c\xa2\x88\x9d\x10\x86\xe8\xc4\x0a\xe1\x15\x01\x98\x41\x21\xdc\xfa"

"\x2f\xde\x09\xd0\x68\xf6\xdb\xbe\x83\x59\x98\x0d\xad\x96\xed\x22\x0b\x85"

"\x34\xaa\xef\x35\x3d\xfc\x81\x56\x09\x07\xd2\x6c\x02\x44\x29\x24\xad\x55"

"\xb1\x1d\x3a\xee\x7e\x55\x16\xd9\x6a\xd0\x78\xc8\x5a\xd1\xcd\xb1\x8a\x45"

"\x47\x43\x05\xa8\xdb\x35\x0f\x98\x44\x38\x0e\x20\x94\xf6\x91\xa0\x5e\xa0"

"\x94\x58\xbc\x53\xf3\x23\x6a\x1f\x3f\xa5\xe1\x44\xa5\x75\xba\x57\xe5\x8d"

"\x00\xf7\x65\x3d\x2e\x6b\x6c\xbe\x18\xd2\x8c\xe3\xf5\x79\x25\x38\xad\x20"

"\xc0\xe0\xe1\x0b\x03\xda\xc3\x40\x09\xd6\xd3\xe4\xc7\x66\x2c\xca\x88\xb5"

"\x30\x66\xe9\x5e\xfe\x45\xee\x3e\x04\xda\x32\x86\x90\xda\xe1\xaa\x00\x70"

"\xf0\x94\x5e\x26\x9b\x75\x73\x3b\x10\x6f\xf6\x51\x45\x55\xd5\x4d\x95\x8f"

"\x73\x13\x44\x1f\xa2\x1f\x97\x61\x53\x12\xc4\xf6\x00\xa1\x43\x0f\x62\x98"

"\x12\xf2\x3c\xd2\x1e\x70\x3b\x96\x6e\x04\xaa\x6d\x0b\xba\x6f\x25\x39\x36"

"\x9a\x3b\xad\xeb\xfa\xa8\x19\x7d\x89\xe3\x29\x4b\x44\xc0\xea\x54\xae\x6b"

"\x7f\x4a\x49\x65\x68\x04\x31\x75\xa5\x66\x65\x41\xb5\x59\xa9\xfe\xaf\x0c"

"\x54\x54\xf1\x2f\x23\x0e\x97\xbc\xf8\x4d\xae\x11\xd1\xa8\x35\x94\x11\xb9"

"\x8b\xb6\x06\x3e\xe8\xae\x0f\xfa\x30\xb5\x75\x77\x71\xc7\xb7\x0e\x4f\xbb"

"\x6e\x95\x1a\x68\x08\x73\xe6\xda\x53\x16\x00\xe9\x51\x11\x0c\x34\xca\xac"

"\xc8\xe9\x78\xc0\x6b\x48\x48\xc8\x80\xc4\x8a\xd8\xe6\xc5\x4b\xc7\x92\xce"

"\x54\xea\x4b\x1c\x05\xab\x04\xaf\xb4\xd6\xca\xb2\x5b\x85\xd1\xc4\xb6\xc4"

"\x74\xc7\xec\x92\x67\xb5\x01\xed\xaa\x20\xee\x0e\x41\x58\x68\xd8\x78\x66"

"\x42\x6b\x13\x74\xe5\x8a\x66\x65\x30\xb9\x4e\x34\x2c\x8b\x2e\xbd\xd4\x05"

"\xfe\xf0\xa2\x6d\xf8\x2b\xbc\x50\x2d\xa2\xca\x15\x50\xc2\x8d\x3c\x0b\x69"

"\x87\x2f\xf8\x61\xcd\x23\xcb\x6e\x1f\xf1\xe6\x2f\x62\x5a\xe9\x2f\x90\xf3"

"\x09\x33\xfc\x82\x7e\xdd\x38\x61\x21\x31\x53\x52\xdb\xc9\xf4\xca\xb3\xdd"

"\xda\xde\xb8\xdf\x05\x1d\x2f\x59\xcd\x59\xe9\x7d\xc9\x2c\xe4\x34\x1f\x97"

"\x80\x03\xe4\x86\x85\xe7\x67\x3c\xf1\xe6\x02\x60\x60\x0e\x7c\xbf\x73\x1d"

"\xc1\x68\xb9\xa4\x11\xdc\x3c\x85\xf8\x43\xbd\x2c\x5f\xca\x89\xc0\x6d\x12"

"\xba\xc0\x8a\x61\xcf\x09\x9a\xe5\xf2\x3e\x5e\x90\x84\x48\xe8\x1f\x27\x79"

"\xb3\x85\xb3\x1d\xcd\x5c\xf8\xaa\xad\x4b\x85\xae\x70\x63\x62\x4a\x7d\xf5"

"\x73\xae\xcc\xc8\xb6\x19\x77\xf8\xec\x10\xe6\x8b\x5d\xf1\xc1\xb8\x05\xc7"

"\xe0\x01\x22\x8a\x65\xc0\xe7\x72\xc5\x25\x14\x66\xa4\x9f\x10\x21\x9b\xb7"

"\x18\xa4\xaa\x2e\x35\xc4\x08\x11\xa9\x72\xeb\x58\x53\x0f\x7f\x07\x41\xd3"

"\xbe\x0c\x00\xe3\x8f\x58\x99\x4a\x51\x99\x54\x7f\xc5\x15\x0c\x78\x1f\xfe"

"\x2e\x56\x56\x0f\x08\xeb\x75\xbf\xcd\x90\x85\xff\x14\x0c\xee\xfd\x0d\x6e"

"\xd4\x3d\xad\x39\xd2\xcd\xa8\x69\x4d\x42\x0e\x86\x1a\x1d\xec\x4a\x28\xd1"

"\xcf\x53\x24\xc5\xc5\xab\x81\x92\x21\x54\x87\x3b\x3f\x82\xdf\x1b\xc0\x6c"

"\xb9\x56\x5c\x08\xf7\x74\xd9\xfa\x6f\xe5\x75\xda\xf8\x7b\x32\x8a\xb1\x0b"

"\x91\x22\x43\xf1\x00\x71\x2a\x27\xf4\x98\x1f\xaa\x37\x2d\x73\x67\x02\xc5"

"\x65\xa0\x8c\x4d\x6b\x0a\xa3\x12\xd3\xc9\x01\x7f\xd1\xe7\xab\x98\x1d\xe7"

"\xee\x1d\xfc\x1a\x84\x99\x24\xaa\x92\xea\xb1\xb3\xe6\xe9\x74\x2f\x69\x13"

"\xa0\x8b\x56\x99\xd6\x70\x69\x7a\x60\x8d\x74\x9e\x06\xc3\x41\x42\x1a\x80"

"\x9a\x36\x5d\xca\x3f\x8d\x88\xd8\x42\x68\x50\x80\xf8\xed\x93\x48\x28\x88"

"\x06\x5b\x50\xbf\x9a\xbd\xe7\x5f\xe3\x7c\x8f\xf2\xae\x4f\x24\xe2\x6f\x83"

"\x94\x9a\xb5\xc4\xf4\xa9\x6e\x13\xb2\xcd\xf7\x42\xda\xf9\xc1\xb5\x83\x05"

"\x69\x14\x56\xc6\xc1\x90\xbf\xb7\xbb\xbb\x08\x4e\xa9\xf9\x7e\x99\xc3\xe0"

"\x28\x41\x5d\x4e\x05\xcc\xf7\x71\x7b\x57\x97\xff\x5b\xaf\xa2\x51\x8a\x0a"

"\xca\xb4\x34\xa1\x88\xd4\x79\x7a\x85\xf3\x65\x57\xdd\x6a\xa3\x9c\x75\xe8"

"\x0b\x72\x49\x63\x72\x65\x25\x44\xb1\x42\x49\x01\xa6\xa9\xd4\xb7\x45\x30"

"\x86\xb6\xba\x26\xa4\x05\x21\xda\x94\xab\x54\xde\x4a\x11\xb5\x1b\x4a\xd7"

"\xab\x1d\x68\x05\xf3\x23\xb0\x44\x95\x5f\x77\x9c\xfe\x7c\x1c\x35\x86\xf4"

"\xbe\x0e\xab\x22\x6a\x25\xae\x16\xbd\x8d\xc7\xeb\x01\x50\x24\xb7\x43\x4b"

"\x64\x08\x34\x3a\x1b\xe6\xe1\xdd\x39\x25\xc1\x02\xb4\xc9\xc5\x43\x98\x38"

"\x35\xb6\xbb\x45\xf8\x0e\xa3\x5b\xf7\xfc\xec\xab\x5d\x94\x72\x24\xbf\xdb"

"\x1c\x03\xb2\x0f\xc0\x7a\x5c\xac\x63\x0b\xeb\x4b\x30\x44\xeb\xe5\x5c\x90"

"\x23\x84\x4c\x1f\xd6\x4b\x4e\xb0\x25\x53\x68\x67\xf0\xaf\xa3\x88\x57\x6c"

"\x5b\x25\x64\xcd\x2e\x20\xae\x26\x33\xf7\xb7\x6c\xf6\xfb\xce\xff\x24\x0f"

"\x65\xe5\xee\xba\x28\x43\xfa\xa1\xe7\x71\x08\xd3\x5c\x59\xb3\xf5\x70\x11"

"\x26\x60\xe9\x27\x8d\xa3\x12\x76\x86\xdc\x2a\x96\x5a\x6a\xd1\x67\x2e\x29"

"\xff\x9e\xdd\x62\xf4\x9e\x41\xbd\xd6\x53\x48\xd2\x65\x78\x46\xbe\x80\x47"

"\x9c\xea\x41\x5b\xfb\x59\x27\x22\x9f\x3b\x77\x2e\xd9\xc9\xb7\x63\x9d\x8f"

"\x75\xff\x66\x21\x84\x1a\x7b\x64\x97\x81\x31\xe8\x69\x52\xbf\xe5\x10\x71"

"\x5b\x25\xef\xbc\xf3\x93\x32\x0c\x1d\x62\x99\xac\x6c\x19\xdd\x90\x88\x70"

"\xf9\x6d\x92\xb8\xbd\xcf\x11\xe3\xc9\x87\x8f\x2e\x37\xbd\xaf\x72\x71\x8a"

"\xd0\xbc\x28\x72\xc7\xa0\xb1\x01\xf6\xe3\x92\x99\x72\x34\xe0\x6c\x9b\x1b"

"\xdc\x32\x49\x71\x42\x7d\x6b\x97\xc3\xc1\x65\x31\x17\x8f\x40\xa8\xab\x52"

"\xf9\x8e\x06\x67\x80\x97\x7a\xbd\x35\x2e\x1e\xfe\x61\x85\xf7\x02\x33\xb3"

"\x0f\xdc\x96\xb6\xa2\x89\xb9\xe0\xfc\xee\x55\x59\x23\xef\x59\x0b\xd9\xcd"

"\x2f\x0e\xf7\x02\x46\x41\x45\x0d\x1a\x92\x58\x04\x6a\xc0\xe8\x0a\xcd\x44"

"\xf2\x67\x44\x69\x46\xc0\x96\xdb\x98\x48\xf7\x8c\xdd\xba\x9f\x54\x09\xb0"

"\x90\xdd\x23\x44\xd8\xd4\x5a\x16\xcd\x2e\xcc\xe5\xbf\x22\xbd\x4c\xb8\x9a"

"\xfd\x30\x67\xcb\x0b\xd9\xa7\x27\x9b\xe1\xb1\xe5\x03\x49\x8f\x39\xed\xce"

"\x71\x4f\x37\x59\x7d\x0e\x64\x60\x71\x6d\x09\xea\x37\x6d\x73\xe8\xa7\x1f"

"\xff\x13\x24\xfa\x2a\xeb\xa7\x5e\x8b\xbd\x0e\xa4\xc4\x18\xb4\x57\x84\x55"

"\x01\x53\xd4\x92\x89\x8e\x15\xda\x88\xb6\xed\x3f\x67\xe8\x5d\xbb\x11\x1c"

"\x2f\xea\xc2\xfd\x78\xb6\xf9\x01\x1c\x68\x64\xb9\xbb\x11\x65\x36\x94\xf7"

"\xf0\x25\x68\xb7\x68\xb6\xa2\x7d\x08\x0e\xad\xc0\x09\x37\x44\xb9\x11\x5a"

"\xa2\xf8\xd0\x3f\xa2\x7f\xae\xa2\xe3\x56\xef\x8c\xe6\x2e\x47\x22\xdd\xd1"

"\x39\xf7\x84\xac\x3b\x8a\xfb\x98\xc8\xd3\x98\x4c\x8c\xf9\x43\x8e\x83\x71"

"\x03\x30\x42\x8b\x78\x30\xc1\x70\x9a\x30\x9b\xba\xc3\xbb\xdb\xd0\x83\xe5"

"\x39\x93\x8c\x57\x89\xe1\x70\x9d\x2c\x0e\xe9\x4d\xcb\x2f\xe6\x4c\x31\xc8"

"\x7d\x25\xcc\x7f\x82\x6b\xbf\x5e\x02\x1d\x5a\xaa\x17\x29\x70\xaa\xe9\x6a"

"\x68\x58\xf8\xc1\x1f\xdf\xb7\x48\x32\x8d\x97\x41\x1e\xdc\x10\xdd\x16\xfd"

"\x10\xfa\xa7\xc3\xb9\x4c\xe1\x91\x52\xfb\x29\x65\x69\x04\x21\xd3\xc6\xdb"

"\x2e\x7e\x88\x88\xc7\xbb\x06\x44\x3d\xb3\x11\x1e\x3d\xb6\x9a\x88\xdd\x09"

"\x7a\xb8\xc6\x4d\x6b\xea\x30\xda\x24\x7f\xcd\x11\x7a\x30\xee\xf4\x5c\xd9"

"\x33\x9a\x78\x37\x56\x28\xcd\xbf\xa2\x6d\x6b\x34\x19\xe6\x9b\xbe\x8e\x88"

"\x47\x91\x29\x68\x4b\x23\x04\xda\xa2\xd6\x84\x30\x48\x26\xee\xe9\x7d\x34"

"\x63\x03\xcc\x63\x1e\x10\x46\x5a\x2f\x92\x43\xe8\x4d\x32\x28\x10\x38\x8b"

"\xa2\xd3\x06\x26\xa6\x3d\xf9\x79\x3e\xb9\x63\xdf\x23\x48\x65\xcb\xb6\x8c"

"\xdb\xc0\x43\x63\xe1\x7a\x6a\x6e\xb1\xc8\x01\x41\x77\xc9\x9f\xaa\xcb\x8d"

"\x7a\x8e\x99\xd8\x97\x71\x8b\xc5\x10\x55\x72\x78\x20\xd3\x21\xf2\x5f\xd1"

"\x5d\x24\xd0\x29\xd4\xfa\xd6\xfd\xe9\x7f\x09\x11\x80\xef\x2b\xc3\x91\x3b"

"\xc1\x1f\x8f\x10\x4b\xcc\x7e\xa0\x02\x41\x57\x48\x1b\x35\x37\xce\x54\x3f"

"\xe8\xab\x93\xa2\x6c\xb9\xba\x51\xfa\x78\xd3\x37\xbf\x10\xba\x29\xdc\x5f"

"\xeb\xfe\x4a\xd0\x14\xbd\x40\xf3\x33\x30\x82\x3d\x7f\x45\x73\xba\xeb\xd9"

"\xe0\x63\xd5\x9a\x87\x66\x2b\xef\x85\x9c\xee\x8a\x8e\x53\x18\xaa\xe2\x2e"

"\x79\xfb\x4d\x31\xe0\x88\xf0\x56\x9c\x67\xbb\xa4\x18\x68\xfe\x46\x4e\xd7"

"\x7e\xc7\xfe\x07\xdd\x3a\x5c\x2c\x81\xc1\xfd\xed\x16\x05\x98\xb3\x75\x64"

"\x51\x31\x73\xf1\x3f\xee\xb9\xdf\x4b\x47\xed\xe8\x05\x0a\xac\x43\x1e\x1b"

"\x20\x58\xc6\xaf\xe7\xe4\x4b\xcc\x6f\x28\xdc\x58\x33\xdd\xed\x10\xe6\x91"

"\x7e\x15\xb9\x30\x88\xcd\x90\x79\x18\x26\xca\x7c\x3b\x9a\x42\x11\xe9\xe2"

"\xff\xd4\x96\x62\x23\x81\x6d\xb6\xe4\xed\xe5\x70\x1b\x76\x98\x8d\x8f\x34"

"\xaa\x14\x0f\xfb\x4b\xc3\xef\xfc\xcb\xe5\xaf\x39\x42\xd4\xc5\x71\x77\x00"

"\xe5\x92\xa1\x70\x01\xd2\x0b\x66\x5f\xb7\xc6\xf6\x53\x61\x10\x8a\x13\x70"

"\xa4\x5d\xb4\x77\xa1\xf4\x49\xe5\xc3\xf9\xa8\x9f\x96\x72\x90\xaf\x23\x1d"

"\xb8\x2f\xed\xec\xfc\xa2\xc3\xce\xdf\xfe\xad\xb7\x75\x72\x8b\x45\xce\x4b"

"\xde\x06\x30\xe9\xe1\xdf\xcd\x98\x13\x8a\x55\x6d\xd4\x0b\x65\x55\x81\xb4"

"\x51\xa7\x16\x4a\xd5\x7c\x4f\xb2\xb5\xdc\x5b\x14\x5e\x87\x33\xde\x33\xaf"

"\x84\x4e\x40\x04\x14\xf8\x5c\x28\xca\x1f\x88\x8e\x70\xc4\x5d\x28\xc8\x23"

"\xe0\x7e\xdd\xf3\x0d\xf7\x91\x1d\xf5\x84\xad\x45\x8a\x25\x35\x50\x84\x16"

"\x3a\x9a\x7c\xc3\xba\xc4\x27\x6e\x95\x72\x11\x62\x6e\x28\x82\x12\x00\x53"

"\x34\xde\xc7\x42\xcf\xe5\x7e\x6c\x82\x34\xe5\x20\xd8\xbe\xd4\x5a\xf4\x76"

"\x77\x0f\x47\x18\xf7\x99\xc1\xa1\xf6\x37\xfc\x04\xa7\x37\x80\xa3\x5d\x21"

"\x94\xe6\x01\x7e\x40\x5d\x3e\x0b\x1e\x9f\x2c\x7c\x0f\x6a\x0e\xd2\x8a\x2e"

"\xaf\xdd\x79\x22\x76\x20\x59\xfe\x0e\xbc\x77\x59\x92\x45\xb1\x2c\x9f\x0c"

"\xef\x9e\xda\xb1\xa2\x51\x71\xa6\xa9\xa0\x56\x2e\x24\xdb\x76\xe2\x5d\xfb"

"\x5e\xcb\x73\x52\xd0\xbf\xc7\x8d\x85\x8e\x8a\xaa\xc9\x13\xef\xa4\xff\x60"

"\x48\x96\x79\xe8\xc7\x20\x19\x89\x7a\x8a\x85\xa9\xee\x29\xf1\x09\x22\x31"

"\x5b\xa7\xdb\x0a\x12\x6f\x82\x7c\x03\xfa\x5b\xbb\x90\xf9\x91\xcb\x98\x66"

"\xb3\xe0\x30\x47\xcb\x1f\xab\xbb\xdb\xe5\xa3\x52\x82\xf0\x30\xc0\xdb\xdb"

"\xd2\x27\xf8\x5b\x05\x72\x1c\x45\xc8\xb2\xb8\x5d\x33\x10\xbb\x41\xd6\xaa"

"\x56\x14\xa6\x0d\x98\x74\xd1\x2f\x11\xf5\xa9\x4b\x15\xf7\x41\xdb\x31\x0c"

"\x92\x7b\x2e\x90\x60\x7a\x2a\xf8\xc4\xb5\x7d\x6b\x69\x37\xd5\xa1\xeb\x14"

"\x58\x9d\x1e\x36\x16\x42\x45\x8c\xc2\xfb\xd2\x96\xac\x03\x1d\x09\x9d\xf4"

"\x9a\x53\xe8\xf0\xd4\x50\x6b\x2d\xcb\xb2\x0f\x54\x56\x0b\x69\x5a\x4e\x0a"

"\x4a\x5a\x13\x23\x19\x85\xd5\x3b\xb3\x53\x31\x26\xad\xd2\x81\xfd\x38\xcd"

"\xdf\x7e\xf4\x37\x20\x1e\x8a\xea\x1a\xb6\x3a\xd6\x73\xcd\xcc\x6c\x60\x41"

"\x14\xae\xc7\x71\x88\x1b\x4f\xb7\xaa\x7c\xcb\xd3\x97\xe7\x03\xf1\x08\x95"

"\x61\x9e\x15\xc7\x16\x84\xbb\xbf\xa2\xb2\xc6\x0a\x79\x0d\xe0\xe5\x05\x95"

"\x38\xb5\x1d\x34\x7a\x68\xad\x05\x74\x72\xa9\xf1\xea\xf0\x54\xdf\x77\x91"

"\xb5\x8f\x63\x8c\x05\x95\x55\xbb\xb9\x70\xed\xf8\x77\xd5\xf6\x23\xe2\x54"

"\x1d\xba\x27\xdf\x8d\x71\x3f\xe7\xc5\x5f\x40\xfb\xf3\xdb\xdc\x3d\x04\x2e"

"\x92\xb8\x3f\x94\xdd\x66\xd1\xcd\x2b\xc5\xcc\x98\xa6\xa5\x02\xb5\xd8\xd8"

"\xee\x6e\xfe\xca\xcf\xb7\x62\x46\x4c\x6f\x8c\xea\x8b\xda\xd1\x4a\x29\x19"

"\x99\x28\xe0\xcb\x07\xfb\xc3\x06\xb9\xee\xcc\xc4\xc7\xa3\x26\x18\x52\x54"

"\x41\x48\x92\xb6\x14\xdd\xcc\x20\xe9\xb5\xd2\x58\xe6\x62\x71\x43\x0c\x07"

"\x05\xc5\xa6\x22\xfa\x56\x46\xda\x48\x97\xa0\x88\xf6\x8f\xde\xb6\x68\x42"

"\xad\x3d\x72\xf2\x32\xf4\x87\xb3\xdb\x3b\x83\xd8\x26\x22\xc9\x1d\xaf\x77"

"\x96\x34\xfa\x1b\x97\xc7\xd5\xad\xb5\xd5\x3b\xe5\x19\x8b\xc5\x9a\xef\x1a"

"\xab\x60\xc3\x79\x52\x96\xa8\x4a\xc3\xf7\x73\x99\xfe\xed\x5b\x86\xf4\x4b"

"\x3a\x1c\xa3\x5e\xe4\x68\x91\xee\x90\x3a\x90\x34\x08\x83\xce\xc4\x1d\x57"

"\x7a\x88\x80\x94\x5b\x50\x4c\x7e\xa5\xbd\xc9\x4d\x66\xbf\x25\xb4\xd2\xe0"

"\x64\xbd\x69\xdf\xce\x4f\x00\xf8\xdf\xad\xe0\x73\x9f\xab\x52\x75\xdb\x11"

"\xe9\x99\xb2\x56\x22\xc2\x0c\xa0\xa9\xf1\x0f\x27\xc8\x00\xa4\xf5\xd1\x9a"

"\xa9\x2d\x04\xcd\x28\x2f\x96\xe9\x90\x30\x18\x74\xc5\xdd\xcf\xb1\x32\x23"

"\xc4\xf5\xfd\x37\xc4\x49\xad\xde\x53\x2a\x16\xae\xe6\x64\x07\xbf\xee\xee"

"\xbd\xa4\xf5\x13\xf2\x24\xe4\x34\xa9\xc0\x8a\x22\x81\xd5\xe1\xf4\x59\x1c"

"\x9a\x43\x3a\xb1\x57\x6c\x11\xed\xd0\xdf\x9f\xb6\xf4\x7b\x76\x1f\xc8\x78"

"\xd5\x32\xd7\xfc\x2a\x76\x24\x61\xfd\x14\x73\xeb\x7c\x7c\x88\x66\x8b\x74"

"\x9b\x9b\xbf\x43\xc9\x37\xfa\x2b\xd7\x3a\xe9\x17\xea\x2a\x90\x3b\xf5\xf7"

"\xd7\x1a\xe1\xc7\xd7\x1c\x60\xde\xf1\xbb\xc4\xe8\x15\x1b\xee\x5f\x4a\x39"

"\x63\x25\x90\x7f\x4f\x2b\xcb\xe9\x80\x38\xe4\x6b\xc9\xfb\x30\xd1\x99\xf0"

"\x25\xea\xbe\xb0\x37\xce\xae\xc3\xee\x18\x7f\x73\xa1\x36\xb8\x56\x6a\x94"

"\x3d\x5b\x32\x71\x19\x9e\x6d\x19\xb7\x06\x6d\x90\xb1\x0d\x0c\x11\xe7\xcb"

"\x0c\x0b\x5f\x73\x12\x7c\xd6\x85\xa7\x63\x8b\x99\xa1\xc9\xae\xa4\xfb\xf3"

"\xfa\xc6\x7a\x4b\x11\x4c\xa9\xfa\x60\xd2\xc9\xc2\x47\x23\xb0\x37\x14\x2e"

"\x3e\x47\x50\x3f\x3d\xfd\xff\xc4\x87\x21\x20\x90\xd2\x21\xeb\x85\xf5\x3c"

"\xf6\x17\x6c\x26\xb9\x3c\x75\x7b\x52\x1d\x01\x7c\xa1\x7a\xc7\x88\x9c\x26"

"\xc6\x47\x3f\xb4\x4c\xc2\xab\x79\xcd\x76\xfb\xf8\xfc\x5a\x81\xdc\x24\xbd"

"\x7b\xa6\xd5\x5d\x80\x36\xf4\xd6\x02\x18\xe7\xc8\xfd\xf7\xf3\xb9\x15\xef"

"\xd0\xbd\x0e\xdf\xac\x38\x0e\x37\x17\x79\x4a\xb4\x6b\x2a\x5d\xae\xd5\x8f"

"\xdb\x3e\xa6\x67\x20\xc0\xe7\x8a\x0c\xe8\x25\xb1\x55\xeb\xc0\x97\x9c\xf7"

"\x79\x15\xdb\x3d\xf6\x00\xbb\xd1\x79\xf1\xd2\xd6\x74\xd7\x6b\x12\xaf\xf0"

"\x87\x75\x7d\x4a\xa4\x80\xee\x15\x66\x78\x40\x74\xa5\x28\x7b\xe0\x08\x8e"

"\xfb\xe1\x2f\x55\x0b\xad\x3b\x41\x0c\xf0\x4f\xba\x8f\x06\xd1\x12\x0a\x1d"

"\xad\x35\xde\x9c\x7a\x22\xc3\xca\xf8\x3c\x1b\xf6\xea\x57\xa0\x55\xaf\xcb"

"\xc6\x1b\x06\x8f\xeb\x5d\x17\xf5\xd0\xcd\x9e\x59\x11\xd2\xd9\xc8\xc6\xff"

"\x89\xfc\x37\x72\x5a\x4b\x9a\xc3\xa8\x80\x0d\x17\x31\x19\x9c\x82\x01\xc0"

"\x52\x2e\x9a\xf7\x49\xfe\x36\xe1\x41\x94\x31\x0a\x5a\xaf\xd9\x44\xc3\x21"

"\xef\xb4\xec\xf5\xc1\x31\xcc\xf9\xde\x48\xc8\xb3\x6a\x90\x5f\x47\xeb\xa8"

"\xfb\x42\xce\x43\x5d\x1b\xd4\x08\xdc\x87\xb1\xc9\x15\x77\xff\xba\x16\xe3"

"\x2b\x9b\xe2\x19\x82\xd3\x17\x63\x20\xc8\xe2\x37\x99\xb6\xc5\xcc\x3d\x83"

"\x4c\xcb\xe9\xac\xed\xa7\x0b\xd2\xc7\x3a\x15\x41\x37\xac\xdd\x65\xf4\x19"

"\x1e\x44\x70\x89\x3e\xb2\x4e\x4a\xb0\x07\x00\xc2\xc1\x35\x14\x9f\xb8\x66"

"\x44\xb5\xac\x0b\xe1\x66\x92\x88\xb9\xc2\x9a\x1f\x6f\x61\x51\x7d\x8b\x4f"
                "\x09\x61\x6e\x76\x7b\xd7\x2d\x13\xf8\x33",
                4096));
        syscall(__NR_lsetxattr, /*path=*/0x200001c0ul, /*name=*/0x200002c0ul,
                        /*val=*/0x20002040ul, /*size=*/0x1009ul, /*flags=*/3ul);
    }
    int main(void) {
        syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul,
/*prot=*/0ul,
                        /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
        syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul,
/*prot=*/7ul,
                        /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
        syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul,
/*prot=*/0ul,
                        /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
        install_segv_handler();
        for (procid = 0; procid < 4; procid++) {
            if (fork() == 0) {
                loop();
            }
        }
        sleep(1000000);
        return 0;
    }


=* repro.txt =*
syz_mount_image$vfat(&(0x7f0000000040),
&(0x7f0000000200)='./file0\x00', 0x220e002, 0x0, 0x1, 0x0,
&(0x7f0000000100))
mount(&(0x7f0000000040)=ANY=[@ANYBLOB='mtd', @ANYRESHEX=0x0],
&(0x7f00000000c0)='./file0\x00', &(0x7f0000001200)='jffs2\x00', 0x0,
0x0)
lsetxattr$security_evm(&(0x7f00000001c0)='./file0\x00',
&(0x7f00000002c0), &(0x7f0000002040)=@v2={0x3, 0x2, 0xb, 0x4, 0x1000,
"788d9cb299abd72ece913d53365e16688e51ace15984ab53d1666ae3f5dfbc860bef87389e21286be236ddc3d0fa2e51d5c5c7b35c5d503c5b2c3b6be0fc56e97df88faa0635363ba92b82c47a817ac97f1d638a1461821255ec23bd0ce5bf1094e3a8980d7e6d1976ba778745920e1718fddac4bd66b0a606801aaefded293c3fcebad3b2c06403dba9994971659b7f4a077addaeb8ae3e5aca7027fde1e40001c0bdd800bcc287e02c867e2782deaf676a261647db8c2f3945022057de768100a8bf73d9f9ff29229b46dead58b2ddf96433468e9eee8950df658711e411364e44145e682f3c053c6f5a1861eee6edf885a97c545805ac0c35a5e4623b2001861c593354b570ff3b4a45f1acde0a8dbd17c09ce448ed5dfd9e7472e68967decb769fa600cd30beb6c8030e9474c7ec4c1daf3e007bbc5765b366d4a176e38bdfabedd2b076a5ed7d50f5177b94a6a0f000cd3acadde8e80f66eada14018620b159e9e14c252d20c8dbb0fe3605b5698b53e4210b62fcbd00017eaa01eb1fa521bdb8d30e83951b4ea0286c8f0d464517a11d7922d6cce4d2058ec8cd7b02b73d825d7e0abbbd85e991220fc7995534b7b1998ca752890b079a7ca3fde56438cf82d5dd9edbd11fd293c17d1cf16657d0b352a8c6c36300ad09a78e3ee3913b9b6f53debffc7e32bfb64b0e8cbe07fe9b0dadb097aeb2c242430bec75630a3921828a7314de1404829e7afb3b8420e85f2c8f6e88de042314416e5c00c59b22208004bec161f8457c7f8e3a8ca4174a4b78df6e460d56d24e01ae1a2411270f79d020a6bac855f1a3ef7b3d0991882656b408dcdaf02db46ac8fcab0c875d1f2e8db366e6a20cb67a4db920382a6915715d3b4266f779fe8633bea6def28cc159138b834334cedef3dec54ea5303df56be87115315ec0f1478a0c0869e5f7c33da64b23af5811751055c90849484481d5a10d72e08ccd12710c4f2ff586a9ea175f4aa70b156c00c57e22c1360bfc7d36aa4792444f81d8a0ed41bf6a452ea5268b8605682ac63eaa465218f4d962db42154d01966d3ad8fc2fde48ef71be08be58e5ad6d5a3593efc9c1336e541372a34799d24ea00d4d4985bed1dab10620911e9f6967880826be5a1f1bb4b2a3948654c6935cafeb4925e107a01f9dda668e5fd7489e82139241a9190f090afe2094234c75fec074622748d4dd782a930f42b0e75d924bef68ffafbaa98916151a36ef2998afd3000955efbfa0a9a008358c11043c0f96b52fc78a42531aa5dfd8de09518cff008b339259b266c488bb1da058ba218cd64b3e413ca2889d1086e8c40ae11501984121dcfa2fde09d068f6dbbe8359980dad96ed220b8534aaef353dfc81560907d26c02442924ad55b11d3aee7e5516d96ad078c85ad1cdb18a45474305a8db350f9844380e2094f691a05ea09458bc53f3236a1f3fa5e144a575ba57e58d00f7653d2e6b6cbe18d28ce3f5792538ad20c0e0e10b03dac34009d6d3e4c7662cca88b53066e95efe45ee3e04da328690dae1aa0070f0945e269b75733b106ff6514555d54d958f7313441fa21f97615312c4f600a1430f629812f23cd21e703b966e04aa6d0bba6f2539369a3badebfaa8197d89e3294b44c0ea54ae6b7f4a496568043175a5666541b559a9feaf0c5454f12f230e97bcf84dae11d1a8359411b98bb6063ee8ae0ffa30b5757771c7b70e4fbb6e951a680873e6da531600e951110c34caacc8e978c06b4848c880c48ad8e6c54bc792ce54ea4b1c05ab04afb4d6cab25b85d1c4b6c474c7ec9267b501edaa20ee0e415868d87866426b1374e58a666530b94e342c8b2ebdd405fef0a26df82bbc502da2ca1550c28d3c0b69872ff861cd23cb6e1ff1e62f625ae92f90f30933fc827edd386121315352dbc9f4cab3dddadeb8df051d2f59cd59e97dc92ce4341f978003e48685e7673cf1e60260600e7cbf731dc168b9a411dc3c85f843bd2c5fca89c06d12bac08a61cf099ae5f23e5e908448e81f2779b385b31dcd5cf8aaad4b85ae7063624a7df573aeccc8b61977f8ec10e68b5df1c1b805c7e001228a65c0e772c5251466a49f10219bb718a4aa2e35c40811a972eb58530f7f0741d3be0c00e38f58994a5199547fc5150c781ffe2e56560f08eb75bfcd9085ff140ceefd0d6ed43dad39d2cda8694d420e861a1dec4a28d1cf5324c5c5ab81922154873b3f82df1bc06cb9565c08f774d9fa6fe575daf87b328ab10b912243f100712a27f4981faa372d736702c565a08c4d6b0aa312d3c9017fd1e7ab981de7ee1dfc1a849924aa92eab1b3e6e9742f6913a08b5699d670697a608d749e06c341421a809a365dca3f8d88d842685080f8ed93482888065b50bf9abde75fe37c8ff2ae4f24e26f83949ab5c4f4a96e13b2cdf742daf9c1b58305691456c6c190bfb7bbbb084ea9f97e99c3e028415d4e05ccf7717b5797ff5bafa2518a0acab434a188d4797a85f36557dd6aa39c75e80b72496372652544b1424901a6a9d4b7453086b6ba26a40521da94ab54de4a11b51b4ad7ab1d6805f323b044955f779cfe7c1c3586f4be0eab226a25ae16bd8dc7eb015024b7434b6408343a1be6e1dd3925c102b4c9c543983835b6bb45f80ea35bf7fcecab5d947224bfdb1c03b20fc07a5cac630beb4b3044ebe55c9023844c1fd64b4eb025536867f0afa388576c5b2564cd2e20ae2633f7b76cf6fbceff240f65e5eeba2843faa1e77108d35c59b3f570112660e9278da3127686dc2a965a6ad1672e29ff9edd62f49e41bdd65348d2657846be80479cea415bfb5927229f3b772ed9c9b7639d8f75ff6621841a7b64978131e86952bfe510715b25efbcf393320c1d6299ac6c19dd908870f96d92b8bdcf11e3c9878f2e37bdaf72718ad0bc2872c7a0b101f6e392997234e06c9b1bdc324971427d6b97c3c16531178f40a8ab52f98e066780977abd352e1efe6185f70233b30fdc96b6a289b9e0fcee555923ef590bd9cd2f0ef7024641450d1a9258046ac0e80acd44f267446946c096db9848f78cddba9f5409b090dd2344d8d45a16cd2ecce5bf22bd4cb89afd3067cb0bd9a7279be1b1e503498f39edce714f37597d0e6460716d09ea376d73e8a71fff1324fa2aeba75e8bbd0ea4c418b45784550153d492898e15da88b6ed3f67e85dbb111c2feac2fd78b6f9011c6864b9bb11653694f7f02568b768b6a27d080eadc0093744b9115aa2f8d03fa27faea2e356ef8ce62e4722ddd139f784ac3b8afb98c8d3984c8cf9438e83710330428b7830c1709a309bbac3bbdbd083e539938c5789e1709d2c0ee94dcb2fe64c31c87d25cc7f826bbf5e021d5aaa172970aae96a6858f8c11fdfb748328d97411edc10dd16fd10faa7c3b94ce19152fb2965690421d3c6db2e7e8888c7bb06443db3111e3db69a88dd097ab8c64d6bea30da247fcd117a30eef45cd9339a78375628cdbfa26d6b3419e69bbe8e88479129684b2304daa2d684304826eee97d346303cc631e10465a2f9243e84d322810388ba2d30626a63df9793eb963df234865cbb68cdbc04363e17a6a6eb1c8014177c99faacb8d7a8e99d897718bc51055727820d321f25fd15d24d029d4fad6fde97f091180ef2bc3913bc11f8f104bcc7ea0024157481b3537ce543fe8ab93a26cb9ba51fa78d337bf10ba29dc5febfe4ad014bd40f33330823d7f4573baebd9e063d59a87662bef859cee8a8e5318aae22e79fb4d31e088f0569c67bba41868fe464ed77ec7fe07dd3a5c2c81c1fded160598b37564513173f13feeb9df4b47ede8050aac431e1b2058c6afe7e44bcc6f28dc5833dded10e6917e15b93088cd90791826ca7c3b9a4211e9e2ffd4966223816db6e4ede5701b76988d8f34aa140ffb4bc3effccbe5af3942d4c5717700e592a17001d20b665fb7c6f65361108a1370a45db477a1f449e5c3f9a89f967290af231db82fedecfca2c3cedffeadb775728b45ce4bde0630e9e1dfcd98138a556dd40b655581b451a7164ad57c4fb2b5dc5b145e8733de33af844e400414f85c28ca1f888e70c45d28c823e07eddf30df7911df584ad458a25355084163a9a7cc3bac4276e957211626e288212005334dec742cfe57e6c8234e520d8bed45af476770f4718f799c1a1f637fc04a73780a35d2194e6017e405d3e0b1e9f2c7c0f6a0ed28a2eafdd7922762059fe0ebc77599245b12c9f0cef9edab1a25171a6a9a0562e24db76e25dfb5ecb7352d0bfc78d858e8aaac913efa4ff60489679e8c72019897a8a85a9ee29f10922315ba7db0a126f827c03fa5bbb90f991cb9866b3e03047cb1fabbbdbe5a35282f030c0dbdbd227f85b05721c45c8b2b85d3310bb41d6aa5614a60d9874d12f11f5a94b15f741db310c927b2e90607a2af8c4b57d6b6937d5a1eb14589d1e361642458cc2fbd296ac031d099df49a53e8f0d4506b2dcbb20f54560b695a4e0a4a5a13231985d53bb3533126add281fd38cddf7ef437201e8aea1ab63ad673cdcc6c604114aec771881b4fb7aa7ccbd397e703f10895619e15c71684bbbfa2b2c60a790de0e5059538b51d347a68ad057472a9f1eaf054df7791b58f638c059555bbb970edf877d5f623e2541dba27df8d713fe7c55f40fbf3dbdc3d042e92b83f94dd66d1cd2bc5cc98a6a502b5d8d8ee6efecacfb762464c6f8cea8bdad14a29199928e0cb07fbc306b9eeccc4c7a326185254414892b614ddcc20e9b5d258e66271430c0705c5a622fa5646da4897a088f68fdeb66842ad3d72f232f487b3db3b83d82622c91daf779634fa1b97c7d5adb5d53be5198bc59aef1aab60c3795296a84ac3f77399feed5b86f44b3a1ca35ee46891ee903a90340883cec41d577a8880945b504c7ea5bdc94d66bf25b4d2e064bd69dfce4f00f8dfade0739fab5275db11e999b25622c20ca0a9f10f27c800a4f5d19aa92d04cd282f96e990301874c5ddcfb13223c4f5fd37c449adde532a16aee66407bfeeeebda4f513f224e434a9c08a2281d5e1f4591c9a433ab1576c11edd0df9fb6f47b761fc878d532d7fc2a762461fd1473eb7c7c88668b749b9bbf43c937fa2bd73ae917ea2a903bf5f7d71ae1c7d71c60def1bbc4e8151bee5f4a396325907f4f2bcbe98038e46bc9fb30d199f025eabeb037ceaec3ee187f73a136b8566a943d5b3271199e6d19b7066d90b10d0c11e7cb0c0b5f73127cd685a7638b99a1c9aea4fbf3fac67a4b114ca9fa60d2c9c24723b037142e3e47503f3dfdffc487212090d221eb85f53cf6176c26b93c757b521d017ca17ac7889c26c6473fb44cc2ab79cd76fbf8fc5a81dc24bd7ba6d55d8036f4d60218e7c8fdf7f3b915efd0bd0edfac380e3717794ab46b2a5daed58fdb3ea66720c0e78a0ce825b155ebc0979cf77915db3df600bbd179f1d2d674d76b12aff087757d4aa480ee1566784074a5287be0088efbe12f550bad3b410cf04fba8f06d1120a1dad35de9c7a22c3caf83c1bf6ea57a055afcbc61b068feb5d17f5d0cd9e5911d2d9c8c6ff89fc37725a4b9ac3a8800d1731199c8201c0522e9af749fe36e14194310a5aafd944c321efb4ecf5c131ccf9de48c8b36a905f47eba8fb42ce435d1bd408dc87b1c91577ffba16e32b9be21982d3176320c8e23799b6c5cc3d834ccbe9aceda70bd2c73a154137acdd65f4191e4470893eb24e4ab00700c2c135149fb86644b5ac0be1669288b9c29a1f6f61517d8b4f09616e767bd72d13f833"},
0x1009, 0x3)

and see also in
https://gist.github.com/xrivendell7/fdc7fa3a7b55a9174666944c07732eec

I hope it helps.
Best regards


lee bruce <xrivendell7@xxxxxxxxx> 于2024年4月17日周三 20:48写道:
>
> Hello, I reproduced this bug and comfired in the latest upstream.
>
> If you fix this issue, please add the following tag to the commit:
> Reported-by: xingwei lee <xrivendell7@xxxxxxxxx>
> Reported-by: yue sun <samsun1006219@xxxxxxxxx>
>
> I use the same kernel as syzbot instance: https://syzkaller.appspot.com/bug?extid=5a281fe8aadf8f11230d
> Kernel Commit: upstream fe46a7dd189e25604716c03576d05ac8a5209743
> Kernel Config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=4d90a36f0cab495a with KASAN enabled
>
> root@syzkaller:~# ./0
> [  406.727577][ T8177] ------------[ cut here ]------------
> [  406.728272][ T8177] kernel BUG at fs/jffs2/summary.c:865!
> [  406.729014][ T8177] invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
> [  406.729850][ T8177] CPU: 2 PID: 8177 Comm: 0 Not tainted 6.8.0-08951-gfe46a7dd189e-dirty #6
> [  406.730904][ T8177] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
> [  406.732206][ T8177] RIP: 0010:jffs2_sum_write_sumnode+0x1f50/0x2630
> [  406.733061][ T8177] Code: 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 81 01 00 00 8b b3 c0 05 00 00 48 c7 c2 c0 7e a4 8b 48 c7 c7 c0 7a a4 8b e8 51 ba 82 fe 90 <0f> 0b e8 69 29 01 ff e9 70 e19
> [  406.735472][ T8177] RSP: 0018:ffffc9000396f4e0 EFLAGS: 00010286
> [  406.736416][ T8177] RAX: 0000000000000045 RBX: ffff888022a20040 RCX: ffff888022a20040
> [  406.737446][ T8177] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [  406.738435][ T8177] RBP: ffffc9000396f660 R08: 0000000000000005 R09: 0000000000000000
> [  406.739470][ T8177] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000000
> [  406.740463][ T8177] R13: 0000000000000000 R14: ffff888028bb1000 R15: 000000000000106c
> [  406.741459][ T8177] FS:  0000000007a66480(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
> [  406.742581][ T8177] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  406.743418][ T8177] CR2: 0000000020003029 CR3: 000000002be68000 CR4: 0000000000750ef0
> [  406.744407][ T8177] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [  406.745398][ T8177] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [  406.746373][ T8177] PKRU: 55555554
> [  406.746833][ T8177] Call Trace:
> [  406.747271][ T8177]  <TASK>
> [  406.747651][ T8177]  ? show_regs+0x97/0xa0
> [  406.748215][ T8177]  ? die+0x3b/0xb0
> [  406.748701][ T8177]  ? do_trap+0x245/0x440
> [  406.749262][ T8177]  ? jffs2_sum_write_sumnode+0x1f50/0x2630
> [  406.750005][ T8177]  ? jffs2_sum_write_sumnode+0x1f50/0x2630
> [  406.750711][ T8177]  ? do_error_trap+0xff/0x250
> [  406.751342][ T8177]  ? jffs2_sum_write_sumnode+0x1f50/0x2630
> [  406.752094][ T8177]  ? handle_invalid_op+0x39/0x40
> [  406.752740][ T8177]  ? jffs2_sum_write_sumnode+0x1f50/0x2630
> [  406.753479][ T8177]  ? exc_invalid_op+0x2e/0x50
> [  406.754090][ T8177]  ? asm_exc_invalid_op+0x1a/0x20
> [  406.754716][ T8177]  ? jffs2_sum_write_sumnode+0x1f50/0x2630
> [  406.755477][ T8177]  ? __pfx_jffs2_sum_write_sumnode+0x10/0x10
> [  406.756234][ T8177]  ? rcu_is_watching+0x12/0xc0
> [  406.756861][ T8177]  ? lock_acquire+0x1b1/0x540
> [  406.757489][ T8177]  ? __pfx_lock_acquire+0x10/0x10
> [  406.758117][ T8177]  ? __pfx___mutex_lock+0x10/0x10
> [  406.758769][ T8177]  ? jffs2_do_reserve_space+0xc59/0x1190
> [  406.759502][ T8177]  jffs2_do_reserve_space+0xc59/0x1190
> [  406.760223][ T8177]  jffs2_reserve_space+0x67e/0xc20
> [  406.760883][ T8177]  ? avc_has_perm_noaudit+0x152/0x3d0
> [  406.761584][ T8177]  ? __pfx_jffs2_reserve_space+0x10/0x10
> [  406.762302][ T8177]  ? avc_has_perm_noaudit+0x152/0x3d0
> [  406.763030][ T8177]  ? cred_has_capability.isra.0+0x19d/0x310
> [  406.763788][ T8177]  ? __pfx_jffs2_security_setxattr+0x10/0x10
> [  406.764567][ T8177]  do_jffs2_setxattr+0x1ab/0x1770
> [  406.765224][ T8177]  ? cap_capable+0x1e4/0x250
> [  406.765783][ T8177]  ? __pfx_do_jffs2_setxattr+0x10/0x10
> [  406.766514][ T8177]  ? xattr_resolve_name+0x292/0x440
> [  406.767220][ T8177]  ? __pfx_jffs2_security_setxattr+0x10/0x10
> [  406.768026][ T8177]  __vfs_setxattr+0x182/0x1f0
> [  406.768646][ T8177]  ? __pfx_evm_protect_xattr.isra.0+0x10/0x10
> [  406.769411][ T8177]  ? __pfx___vfs_setxattr+0x10/0x10
> [  406.770067][ T8177]  __vfs_setxattr_noperm+0x132/0x610
> [  406.770752][ T8177]  __vfs_setxattr_locked+0x195/0x270
> [  406.771452][ T8177]  vfs_setxattr+0x151/0x370
> [  406.772052][ T8177]  ? __pfx_vfs_setxattr+0x10/0x10
> [  406.772704][ T8177]  ? __might_fault+0xee/0x1a0
> [  406.773326][ T8177]  do_setxattr+0x153/0x180
> [  406.773881][ T8177]  setxattr+0x166/0x180
> [  406.774421][ T8177]  ? __pfx_setxattr+0x10/0x10
> [  406.775043][ T8177]  ? mnt_get_write_access+0x21d/0x320
> [  406.775743][ T8177]  path_setxattr+0x188/0x1f0
> [  406.776338][ T8177]  ? __pfx_path_setxattr+0x10/0x10
> [  406.776986][ T8177]  ? handle_mm_fault+0x541/0xab0
> [  406.777648][ T8177]  __x64_sys_lsetxattr+0xc6/0x160
> [  406.778281][ T8177]  ? do_syscall_64+0x91/0x260
> [  406.778927][ T8177]  ? lockdep_hardirqs_on+0x7c/0x110
> [  406.779598][ T8177]  do_syscall_64+0xd2/0x260
> [  406.780194][ T8177]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
> [  406.780944][ T8177] RIP: 0033:0x437d49
> [  406.781454][ T8177] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 488
> [  406.783841][ T8177] RSP: 002b:00007fff7cd51d28 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
> [  406.784889][ T8177] RAX: ffffffffffffffda RBX: 0000000020002047 RCX: 0000000000437d49
> [  406.785900][ T8177] RDX: 0000000020002040 RSI: 00000000200002c0 RDI: 00000000200001c0
> [  406.786886][ T8177] RBP: 00007fff7cd51d80 R08: 0000000000000003 R09: 000000017cd51d40
> [  406.787878][ T8177] R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000001
> [  406.788872][ T8177] R13: 00007fff7cd51f88 R14: 0000000000000001 R15: 0000000000000001
> [  406.789879][ T8177]  </TASK>
>
>
> =* repro.c =*
>     #define _GNU_SOURCE
>
>     #include <dirent.h>
>     #include <endian.h>
>     #include <errno.h>
>     #include <fcntl.h>
>     #include <setjmp.h>
>     #include <signal.h>
>     #include <stdarg.h>
>     #include <stdbool.h>
>     #include <stddef.h>
>     #include <stdint.h>
>     #include <stdio.h>
>     #include <stdlib.h>
>     #include <string.h>
>     #include <sys/ioctl.h>
>     #include <sys/mman.h>
>     #include <sys/mount.h>
>     #include <sys/prctl.h>
>     #include <sys/stat.h>
>     #include <sys/syscall.h>
>     #include <sys/types.h>
>     #include <sys/wait.h>
>     #include <time.h>
>     #include <unistd.h>
>
>     #include <linux/loop.h>
>
>     #ifndef __NR_memfd_create
>     #define __NR_memfd_create 319
>     #endif
>
>     static unsigned long long procid;
>
>     static __thread int clone_ongoing;
>     static __thread int skip_segv;
>     static __thread jmp_buf segv_env;
>
>     static void segv_handler(int sig, siginfo_t* info, void* ctx) {
>         if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
>             exit(sig);
>         }
>         uintptr_t addr = (uintptr_t)info->si_addr;
>         const uintptr_t prog_start = 1 << 20;
>         const uintptr_t prog_end = 100 << 20;
>         int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
>         int valid = addr < prog_start || addr > prog_end;
>         if (skip && valid) {
>             _longjmp(segv_env, 1);
>         }
>         exit(sig);
>     }
>
>     static void install_segv_handler(void) {
>         struct sigaction sa;
>         memset(&sa, 0, sizeof(sa));
>         sa.sa_handler = SIG_IGN;
>         syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
>         syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
>         memset(&sa, 0, sizeof(sa));
>         sa.sa_sigaction = segv_handler;
>         sa.sa_flags = SA_NODEFER | SA_SIGINFO;
>         sigaction(SIGSEGV, &sa, NULL);
>         sigaction(SIGBUS, &sa, NULL);
>     }
>
>     #define NONFAILING(...)                                  \
>         ({                                                     \
>             int ok = 1;                                          \
>             __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
>             if (_setjmp(segv_env) == 0) {                        \
>                 __VA_ARGS__;                                       \
>             } else                                               \
>                 ok = 0;                                            \
>             __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
>             ok;                                                  \
>         })
>
>     static void sleep_ms(uint64_t ms) {
>         usleep(ms * 1000);
>     }
>
>     static uint64_t current_time_ms(void) {
>         struct timespec ts;
>         if (clock_gettime(CLOCK_MONOTONIC, &ts))
>             exit(1);
>         return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
>     }
>
>     static bool write_file(const char* file, const char* what, ...) {
>         char buf[1024];
>         va_list args;
>         va_start(args, what);
>         vsnprintf(buf, sizeof(buf), what, args);
>         va_end(args);
>         buf[sizeof(buf) - 1] = 0;
>         int len = strlen(buf);
>         int fd = open(file, O_WRONLY | O_CLOEXEC);
>         if (fd == -1)
>             return false;
>         if (write(fd, buf, len) != len) {
>             int err = errno;
>             close(fd);
>             errno = err;
>             return false;
>         }
>         close(fd);
>         return true;
>     }
>
>     //% This code is derived from puff.{c,h}, found in the zlib development. The
>     //% original files come with the following copyright notice:
>
>     //% Copyright (C) 2002-2013 Mark Adler, all rights reserved
>     //% version 2.3, 21 Jan 2013
>     //% This software is provided 'as-is', without any express or implied
>     //% warranty.  In no event will the author be held liable for any damages
>     //% arising from the use of this software.
>     //% Permission is granted to anyone to use this software for any purpose,
>     //% including commercial applications, and to alter it and redistribute it
>     //% freely, subject to the following restrictions:
>     //% 1. The origin of this software must not be misrepresented; you must not
>     //%    claim that you wrote the original software. If you use this software
>     //%    in a product, an acknowledgment in the product documentation would be
>     //%    appreciated but is not required.
>     //% 2. Altered source versions must be plainly marked as such, and must not be
>     //%    misrepresented as being the original software.
>     //% 3. This notice may not be removed or altered from any source distribution.
>     //% Mark Adler    madler@xxxxxxxxxxxxxxxxxx
>
>     //% BEGIN CODE DERIVED FROM puff.{c,h}
>
>     #define MAXBITS 15
>     #define MAXLCODES 286
>     #define MAXDCODES 30
>     #define MAXCODES (MAXLCODES + MAXDCODES)
>     #define FIXLCODES 288
>
>     struct puff_state {
>         unsigned char* out;
>         unsigned long outlen;
>         unsigned long outcnt;
>         const unsigned char* in;
>         unsigned long inlen;
>         unsigned long incnt;
>         int bitbuf;
>         int bitcnt;
>         jmp_buf env;
>     };
>     static int puff_bits(struct puff_state* s, int need) {
>         long val = s->bitbuf;
>         while (s->bitcnt < need) {
>             if (s->incnt == s->inlen)
>                 longjmp(s->env, 1);
>             val |= (long)(s->in[s->incnt++]) << s->bitcnt;
>             s->bitcnt += 8;
>         }
>         s->bitbuf = (int)(val >> need);
>         s->bitcnt -= need;
>         return (int)(val & ((1L << need) - 1));
>     }
>     static int puff_stored(struct puff_state* s) {
>         s->bitbuf = 0;
>         s->bitcnt = 0;
>         if (s->incnt + 4 > s->inlen)
>             return 2;
>         unsigned len = s->in[s->incnt++];
>         len |= s->in[s->incnt++] << 8;
>         if (s->in[s->incnt++] != (~len & 0xff) ||
>                 s->in[s->incnt++] != ((~len >> 8) & 0xff))
>             return -2;
>         if (s->incnt + len > s->inlen)
>             return 2;
>         if (s->outcnt + len > s->outlen)
>             return 1;
>         for (; len--; s->outcnt++, s->incnt++) {
>             if (s->in[s->incnt])
>                 s->out[s->outcnt] = s->in[s->incnt];
>         }
>         return 0;
>     }
>     struct puff_huffman {
>         short* count;
>         short* symbol;
>     };
>     static int puff_decode(struct puff_state* s, const struct puff_huffman* h) {
>         int first = 0;
>         int index = 0;
>         int bitbuf = s->bitbuf;
>         int left = s->bitcnt;
>         int code = first = index = 0;
>         int len = 1;
>         short* next = h->count + 1;
>         while (1) {
>             while (left--) {
>                 code |= bitbuf & 1;
>                 bitbuf >>= 1;
>                 int count = *next++;
>                 if (code - count < first) {
>                     s->bitbuf = bitbuf;
>                     s->bitcnt = (s->bitcnt - len) & 7;
>                     return h->symbol[index + (code - first)];
>                 }
>                 index += count;
>                 first += count;
>                 first <<= 1;
>                 code <<= 1;
>                 len++;
>             }
>             left = (MAXBITS + 1) - len;
>             if (left == 0)
>                 break;
>             if (s->incnt == s->inlen)
>                 longjmp(s->env, 1);
>             bitbuf = s->in[s->incnt++];
>             if (left > 8)
>                 left = 8;
>         }
>         return -10;
>     }
>     static int puff_construct(struct puff_huffman* h, const short* length, int n) {
>         int len;
>         for (len = 0; len <= MAXBITS; len++)
>             h->count[len] = 0;
>         int symbol;
>         for (symbol = 0; symbol < n; symbol++)
>             (h->count[length[symbol]])++;
>         if (h->count[0] == n)
>             return 0;
>         int left = 1;
>         for (len = 1; len <= MAXBITS; len++) {
>             left <<= 1;
>             left -= h->count[len];
>             if (left < 0)
>                 return left;
>         }
>         short offs[MAXBITS + 1];
>         offs[1] = 0;
>         for (len = 1; len < MAXBITS; len++)
>             offs[len + 1] = offs[len] + h->count[len];
>         for (symbol = 0; symbol < n; symbol++)
>             if (length[symbol] != 0)
>                 h->symbol[offs[length[symbol]]++] = symbol;
>         return left;
>     }
>     static int puff_codes(struct puff_state* s,
>                                                 const struct puff_huffman* lencode,
>                                                 const struct puff_huffman* distcode) {
>         static const short lens[29] = {3,  4,  5,  6,   7,   8,   9,   10,  11, 13,
>                                                                      15, 17, 19, 23,  27,  31,  35,  43,  51, 59,
>                                                                      67, 83, 99, 115, 131, 163, 195, 227, 258};
>         static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2,
>                                                                      2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
>         static const short dists[30] = {
>                 1,    2,    3,    4,    5,    7,    9,    13,    17,    25,
>                 33,   49,   65,   97,   129,  193,  257,  385,   513,   769,
>                 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577};
>         static const short dext[30] = {0, 0, 0,  0,  1,  1,  2,  2,  3,  3,
>                                                                      4, 4, 5,  5,  6,  6,  7,  7,  8,  8,
>                                                                      9, 9, 10, 10, 11, 11, 12, 12, 13, 13};
>         int symbol;
>         do {
>             symbol = puff_decode(s, lencode);
>             if (symbol < 0)
>                 return symbol;
>             if (symbol < 256) {
>                 if (s->outcnt == s->outlen)
>                     return 1;
>                 if (symbol)
>                     s->out[s->outcnt] = symbol;
>                 s->outcnt++;
>             } else if (symbol > 256) {
>                 symbol -= 257;
>                 if (symbol >= 29)
>                     return -10;
>                 int len = lens[symbol] + puff_bits(s, lext[symbol]);
>                 symbol = puff_decode(s, distcode);
>                 if (symbol < 0)
>                     return symbol;
>                 unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
>                 if (dist > s->outcnt)
>                     return -11;
>                 if (s->outcnt + len > s->outlen)
>                     return 1;
>                 while (len--) {
>                     if (dist <= s->outcnt && s->out[s->outcnt - dist])
>                         s->out[s->outcnt] = s->out[s->outcnt - dist];
>                     s->outcnt++;
>                 }
>             }
>         } while (symbol != 256);
>         return 0;
>     }
>     static int puff_fixed(struct puff_state* s) {
>         static int virgin = 1;
>         static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
>         static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
>         static struct puff_huffman lencode, distcode;
>         if (virgin) {
>             lencode.count = lencnt;
>             lencode.symbol = lensym;
>             distcode.count = distcnt;
>             distcode.symbol = distsym;
>             short lengths[FIXLCODES];
>             int symbol;
>             for (symbol = 0; symbol < 144; symbol++)
>                 lengths[symbol] = 8;
>             for (; symbol < 256; symbol++)
>                 lengths[symbol] = 9;
>             for (; symbol < 280; symbol++)
>                 lengths[symbol] = 7;
>             for (; symbol < FIXLCODES; symbol++)
>                 lengths[symbol] = 8;
>             puff_construct(&lencode, lengths, FIXLCODES);
>             for (symbol = 0; symbol < MAXDCODES; symbol++)
>                 lengths[symbol] = 5;
>             puff_construct(&distcode, lengths, MAXDCODES);
>             virgin = 0;
>         }
>         return puff_codes(s, &lencode, &distcode);
>     }
>     static int puff_dynamic(struct puff_state* s) {
>         static const short order[19] = {16, 17, 18, 0, 8,  7, 9,  6, 10, 5,
>                                                                         11, 4,  12, 3, 13, 2, 14, 1, 15};
>         int nlen = puff_bits(s, 5) + 257;
>         int ndist = puff_bits(s, 5) + 1;
>         int ncode = puff_bits(s, 4) + 4;
>         if (nlen > MAXLCODES || ndist > MAXDCODES)
>             return -3;
>         short lengths[MAXCODES];
>         int index;
>         for (index = 0; index < ncode; index++)
>             lengths[order[index]] = puff_bits(s, 3);
>         for (; index < 19; index++)
>             lengths[order[index]] = 0;
>         short lencnt[MAXBITS + 1], lensym[MAXLCODES];
>         struct puff_huffman lencode = {lencnt, lensym};
>         int err = puff_construct(&lencode, lengths, 19);
>         if (err != 0)
>             return -4;
>         index = 0;
>         while (index < nlen + ndist) {
>             int symbol;
>             int len;
>             symbol = puff_decode(s, &lencode);
>             if (symbol < 0)
>                 return symbol;
>             if (symbol < 16)
>                 lengths[index++] = symbol;
>             else {
>                 len = 0;
>                 if (symbol == 16) {
>                     if (index == 0)
>                         return -5;
>                     len = lengths[index - 1];
>                     symbol = 3 + puff_bits(s, 2);
>                 } else if (symbol == 17)
>                     symbol = 3 + puff_bits(s, 3);
>                 else
>                     symbol = 11 + puff_bits(s, 7);
>                 if (index + symbol > nlen + ndist)
>                     return -6;
>                 while (symbol--)
>                     lengths[index++] = len;
>             }
>         }
>         if (lengths[256] == 0)
>             return -9;
>         err = puff_construct(&lencode, lengths, nlen);
>         if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
>             return -7;
>         short distcnt[MAXBITS + 1], distsym[MAXDCODES];
>         struct puff_huffman distcode = {distcnt, distsym};
>         err = puff_construct(&distcode, lengths + nlen, ndist);
>         if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
>             return -8;
>         return puff_codes(s, &lencode, &distcode);
>     }
>     static int puff(unsigned char* dest,
>                                     unsigned long* destlen,
>                                     const unsigned char* source,
>                                     unsigned long sourcelen) {
>         struct puff_state s = {
>                 .out = dest,
>                 .outlen = *destlen,
>                 .outcnt = 0,
>                 .in = source,
>                 .inlen = sourcelen,
>                 .incnt = 0,
>                 .bitbuf = 0,
>                 .bitcnt = 0,
>         };
>         int err;
>         if (setjmp(s.env) != 0)
>             err = 2;
>         else {
>             int last;
>             do {
>                 last = puff_bits(&s, 1);
>                 int type = puff_bits(&s, 2);
>                 err = type == 0 ? puff_stored(&s)
>                                                 : (type == 1 ? puff_fixed(&s)
>                                                                          : (type == 2 ? puff_dynamic(&s) : -1));
>                 if (err != 0)
>                     break;
>             } while (!last);
>         }
>         *destlen = s.outcnt;
>         return err;
>     }
>
>     //% END CODE DERIVED FROM puff.{c,h}
>
>     #define ZLIB_HEADER_WIDTH 2
>
>     static int puff_zlib_to_file(const unsigned char* source,
>                                                              unsigned long sourcelen,
>                                                              int dest_fd) {
>         if (sourcelen < ZLIB_HEADER_WIDTH)
>             return 0;
>         source += ZLIB_HEADER_WIDTH;
>         sourcelen -= ZLIB_HEADER_WIDTH;
>         const unsigned long max_destlen = 132 << 20;
>         void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ,
>                                          MAP_PRIVATE | MAP_ANON, -1, 0);
>         if (ret == MAP_FAILED)
>             return -1;
>         unsigned char* dest = (unsigned char*)ret;
>         unsigned long destlen = max_destlen;
>         int err = puff(dest, &destlen, source, sourcelen);
>         if (err) {
>             munmap(dest, max_destlen);
>             errno = -err;
>             return -1;
>         }
>         if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
>             munmap(dest, max_destlen);
>             return -1;
>         }
>         return munmap(dest, max_destlen);
>     }
>
>     static int setup_loop_device(unsigned char* data,
>                                                              unsigned long size,
>                                                              const char* loopname,
>                                                              int* loopfd_p) {
>         int err = 0, loopfd = -1;
>         int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
>         if (memfd == -1) {
>             err = errno;
>             goto error;
>         }
>         if (puff_zlib_to_file(data, size, memfd)) {
>             err = errno;
>             goto error_close_memfd;
>         }
>         loopfd = open(loopname, O_RDWR);
>         if (loopfd == -1) {
>             err = errno;
>             goto error_close_memfd;
>         }
>         if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
>             if (errno != EBUSY) {
>                 err = errno;
>                 goto error_close_loop;
>             }
>             ioctl(loopfd, LOOP_CLR_FD, 0);
>             usleep(1000);
>             if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
>                 err = errno;
>                 goto error_close_loop;
>             }
>         }
>         close(memfd);
>         *loopfd_p = loopfd;
>         return 0;
>
>     error_close_loop:
>         close(loopfd);
>     error_close_memfd:
>         close(memfd);
>     error:
>         errno = err;
>         return -1;
>     }
>
>     static long syz_mount_image(volatile long fsarg,
>                                                             volatile long dir,
>                                                             volatile long flags,
>                                                             volatile long optsarg,
>                                                             volatile long change_dir,
>                                                             volatile unsigned long size,
>                                                             volatile long image) {
>         unsigned char* data = (unsigned char*)image;
>         int res = -1, err = 0, loopfd = -1, need_loop_device = !!size;
>         char* mount_opts = (char*)optsarg;
>         char* target = (char*)dir;
>         char* fs = (char*)fsarg;
>         char* source = NULL;
>         char loopname[64];
>         if (need_loop_device) {
>             memset(loopname, 0, sizeof(loopname));
>             snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
>             if (setup_loop_device(data, size, loopname, &loopfd) == -1)
>                 return -1;
>             source = loopname;
>         }
>         mkdir(target, 0777);
>         char opts[256];
>         memset(opts, 0, sizeof(opts));
>         if (strlen(mount_opts) > (sizeof(opts) - 32)) {
>         }
>         strncpy(opts, mount_opts, sizeof(opts) - 32);
>         if (strcmp(fs, "iso9660") == 0) {
>             flags |= MS_RDONLY;
>         } else if (strncmp(fs, "ext", 3) == 0) {
>             bool has_remount_ro = false;
>             char* remount_ro_start = strstr(opts, "errors=remount-ro");
>             if (remount_ro_start != NULL) {
>                 char after = *(remount_ro_start + strlen("errors=remount-ro"));
>                 char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
>                 has_remount_ro = ((before == '\0' || before == ',') &&
>                                                     (after == '\0' || after == ','));
>             }
>             if (strstr(opts, "errors=panic") || !has_remount_ro)
>                 strcat(opts, ",errors=continue");
>         } else if (strcmp(fs, "xfs") == 0) {
>             strcat(opts, ",nouuid");
>         }
>         res = mount(source, target, fs, flags, opts);
>         if (res == -1) {
>             err = errno;
>             goto error_clear_loop;
>         }
>         res = open(target, O_RDONLY | O_DIRECTORY);
>         if (res == -1) {
>             err = errno;
>             goto error_clear_loop;
>         }
>         if (change_dir) {
>             res = chdir(target);
>             if (res == -1) {
>                 err = errno;
>             }
>         }
>
>     error_clear_loop:
>         if (need_loop_device) {
>             ioctl(loopfd, LOOP_CLR_FD, 0);
>             close(loopfd);
>         }
>         errno = err;
>         return res;
>     }
>
>     static void kill_and_wait(int pid, int* status) {
>         kill(-pid, SIGKILL);
>         kill(pid, SIGKILL);
>         for (int i = 0; i < 100; i++) {
>             if (waitpid(-1, status, WNOHANG | __WALL) == pid)
>                 return;
>             usleep(1000);
>         }
>         DIR* dir = opendir("/sys/fs/fuse/connections");
>         if (dir) {
>             for (;;) {
>                 struct dirent* ent = readdir(dir);
>                 if (!ent)
>                     break;
>                 if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
>                     continue;
>                 char abort[300];
>                 snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
>                                  ent->d_name);
>                 int fd = open(abort, O_WRONLY);
>                 if (fd == -1) {
>                     continue;
>                 }
>                 if (write(fd, abort, 1) < 0) {
>                 }
>                 close(fd);
>             }
>             closedir(dir);
>         } else {
>         }
>         while (waitpid(-1, status, __WALL) != pid) {
>         }
>     }
>
>     static void reset_loop() {
>         char buf[64];
>         snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);
>         int loopfd = open(buf, O_RDWR);
>         if (loopfd != -1) {
>             ioctl(loopfd, LOOP_CLR_FD, 0);
>             close(loopfd);
>         }
>     }
>
>     static void setup_test() {
>         prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
>         setpgrp();
>         write_file("/proc/self/oom_score_adj", "1000");
>     }
>
>     static void execute_one(void);
>
>     #define WAIT_FLAGS __WALL
>
>     static void loop(void) {
>         int iter = 0;
>         for (;; iter++) {
>             reset_loop();
>             int pid = fork();
>             if (pid < 0)
>                 exit(1);
>             if (pid == 0) {
>                 setup_test();
>                 execute_one();
>                 exit(0);
>             }
>             int status = 0;
>             uint64_t start = current_time_ms();
>             for (;;) {
>                 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
>                     break;
>                 sleep_ms(1);
>                 if (current_time_ms() - start < 5000)
>                     continue;
>                 kill_and_wait(pid, &status);
>                 break;
>             }
>         }
>     }
>
>     void execute_one(void) {
>         NONFAILING(memcpy((void*)0x20000040, "vfat\000", 5));
>         NONFAILING(memcpy((void*)0x20000200, "./file0\000", 8));
>         NONFAILING(syz_mount_image(/*fs=*/0x20000040, /*dir=*/0x20000200,
>                                                              /*flags=*/0x220e002, /*opts=*/0, /*chdir=*/1,
>                                                              /*size=*/0, /*img=*/0x20000100));
>         NONFAILING(memcpy((void*)0x20000040, "mtd", 3));
>         NONFAILING(sprintf((char*)0x20000043, "0x%016llx", (long long)0));
>         NONFAILING(memcpy((void*)0x200000c0, "./file0\000", 8));
>         NONFAILING(memcpy((void*)0x20001200, "jffs2\000", 6));
>         syscall(__NR_mount, /*src=*/0x20000040ul, /*dst=*/0x200000c0ul,
>                         /*type=*/0x20001200ul, /*flags=*/0ul, /*data=*/0ul);
>         NONFAILING(memcpy((void*)0x200001c0, "./file0\000", 8));
>         NONFAILING(memcpy((void*)0x200002c0, "security.evm\000", 13));
>         NONFAILING(*(uint8_t*)0x20002040 = 3);
>         NONFAILING(*(uint8_t*)0x20002041 = 2);
>         NONFAILING(*(uint8_t*)0x20002042 = 0xb);
>         NONFAILING(*(uint32_t*)0x20002043 = htobe32(4));
>         NONFAILING(*(uint16_t*)0x20002047 = htobe16(0x1000));
>         NONFAILING(memcpy(
>                 (void*)0x20002049,
>                 "\x78\x8d\x9c\xb2\x99\xab\xd7\x2e\xce\x91\x3d\x53\x36\x5e\x16\x68\x8e\x51"
>                 "\xac\xe1\x59\x84\xab\x53\xd1\x66\x6a\xe3\xf5\xdf\xbc\x86\x0b\xef\x87\x38"
>                 "\x9e\x21\x28\x6b\xe2\x36\xdd\xc3\xd0\xfa\x2e\x51\xd5\xc5\xc7\xb3\x5c\x5d"
>                 "\x50\x3c\x5b\x2c\x3b\x6b\xe0\xfc\x56\xe9\x7d\xf8\x8f\xaa\x06\x35\x36\x3b"
>                 "\xa9\x2b\x82\xc4\x7a\x81\x7a\xc9\x7f\x1d\x63\x8a\x14\x61\x82\x12\x55\xec"
>                 "\x23\xbd\x0c\xe5\xbf\x10\x94\xe3\xa8\x98\x0d\x7e\x6d\x19\x76\xba\x77\x87"
>                 "\x45\x92\x0e\x17\x18\xfd\xda\xc4\xbd\x66\xb0\xa6\x06\x80\x1a\xae\xfd\xed"
>                 "\x29\x3c\x3f\xce\xba\xd3\xb2\xc0\x64\x03\xdb\xa9\x99\x49\x71\x65\x9b\x7f"
>                 "\x4a\x07\x7a\xdd\xae\xb8\xae\x3e\x5a\xca\x70\x27\xfd\xe1\xe4\x00\x01\xc0"
>                 "\xbd\xd8\x00\xbc\xc2\x87\xe0\x2c\x86\x7e\x27\x82\xde\xaf\x67\x6a\x26\x16"
>                 "\x47\xdb\x8c\x2f\x39\x45\x02\x20\x57\xde\x76\x81\x00\xa8\xbf\x73\xd9\xf9"
>                 "\xff\x29\x22\x9b\x46\xde\xad\x58\xb2\xdd\xf9\x64\x33\x46\x8e\x9e\xee\x89"
>                 "\x50\xdf\x65\x87\x11\xe4\x11\x36\x4e\x44\x14\x5e\x68\x2f\x3c\x05\x3c\x6f"
>                 "\x5a\x18\x61\xee\xe6\xed\xf8\x85\xa9\x7c\x54\x58\x05\xac\x0c\x35\xa5\xe4"
>                 "\x62\x3b\x20\x01\x86\x1c\x59\x33\x54\xb5\x70\xff\x3b\x4a\x45\xf1\xac\xde"
>                 "\x0a\x8d\xbd\x17\xc0\x9c\xe4\x48\xed\x5d\xfd\x9e\x74\x72\xe6\x89\x67\xde"
>                 "\xcb\x76\x9f\xa6\x00\xcd\x30\xbe\xb6\xc8\x03\x0e\x94\x74\xc7\xec\x4c\x1d"
>                 "\xaf\x3e\x00\x7b\xbc\x57\x65\xb3\x66\xd4\xa1\x76\xe3\x8b\xdf\xab\xed\xd2"
>                 "\xb0\x76\xa5\xed\x7d\x50\xf5\x17\x7b\x94\xa6\xa0\xf0\x00\xcd\x3a\xca\xdd"
>                 "\xe8\xe8\x0f\x66\xea\xda\x14\x01\x86\x20\xb1\x59\xe9\xe1\x4c\x25\x2d\x20"
>                 "\xc8\xdb\xb0\xfe\x36\x05\xb5\x69\x8b\x53\xe4\x21\x0b\x62\xfc\xbd\x00\x01"
>                 "\x7e\xaa\x01\xeb\x1f\xa5\x21\xbd\xb8\xd3\x0e\x83\x95\x1b\x4e\xa0\x28\x6c"
>                 "\x8f\x0d\x46\x45\x17\xa1\x1d\x79\x22\xd6\xcc\xe4\xd2\x05\x8e\xc8\xcd\x7b"
>                 "\x02\xb7\x3d\x82\x5d\x7e\x0a\xbb\xbd\x85\xe9\x91\x22\x0f\xc7\x99\x55\x34"
>                 "\xb7\xb1\x99\x8c\xa7\x52\x89\x0b\x07\x9a\x7c\xa3\xfd\xe5\x64\x38\xcf\x82"
>                 "\xd5\xdd\x9e\xdb\xd1\x1f\xd2\x93\xc1\x7d\x1c\xf1\x66\x57\xd0\xb3\x52\xa8"
>                 "\xc6\xc3\x63\x00\xad\x09\xa7\x8e\x3e\xe3\x91\x3b\x9b\x6f\x53\xde\xbf\xfc"
>                 "\x7e\x32\xbf\xb6\x4b\x0e\x8c\xbe\x07\xfe\x9b\x0d\xad\xb0\x97\xae\xb2\xc2"
>                 "\x42\x43\x0b\xec\x75\x63\x0a\x39\x21\x82\x8a\x73\x14\xde\x14\x04\x82\x9e"
>                 "\x7a\xfb\x3b\x84\x20\xe8\x5f\x2c\x8f\x6e\x88\xde\x04\x23\x14\x41\x6e\x5c"
>                 "\x00\xc5\x9b\x22\x20\x80\x04\xbe\xc1\x61\xf8\x45\x7c\x7f\x8e\x3a\x8c\xa4"
>                 "\x17\x4a\x4b\x78\xdf\x6e\x46\x0d\x56\xd2\x4e\x01\xae\x1a\x24\x11\x27\x0f"
>                 "\x79\xd0\x20\xa6\xba\xc8\x55\xf1\xa3\xef\x7b\x3d\x09\x91\x88\x26\x56\xb4"
>                 "\x08\xdc\xda\xf0\x2d\xb4\x6a\xc8\xfc\xab\x0c\x87\x5d\x1f\x2e\x8d\xb3\x66"
>                 "\xe6\xa2\x0c\xb6\x7a\x4d\xb9\x20\x38\x2a\x69\x15\x71\x5d\x3b\x42\x66\xf7"
>                 "\x79\xfe\x86\x33\xbe\xa6\xde\xf2\x8c\xc1\x59\x13\x8b\x83\x43\x34\xce\xde"
>                 "\xf3\xde\xc5\x4e\xa5\x30\x3d\xf5\x6b\xe8\x71\x15\x31\x5e\xc0\xf1\x47\x8a"
>                 "\x0c\x08\x69\xe5\xf7\xc3\x3d\xa6\x4b\x23\xaf\x58\x11\x75\x10\x55\xc9\x08"
>                 "\x49\x48\x44\x81\xd5\xa1\x0d\x72\xe0\x8c\xcd\x12\x71\x0c\x4f\x2f\xf5\x86"
>                 "\xa9\xea\x17\x5f\x4a\xa7\x0b\x15\x6c\x00\xc5\x7e\x22\xc1\x36\x0b\xfc\x7d"
>                 "\x36\xaa\x47\x92\x44\x4f\x81\xd8\xa0\xed\x41\xbf\x6a\x45\x2e\xa5\x26\x8b"
>                 "\x86\x05\x68\x2a\xc6\x3e\xaa\x46\x52\x18\xf4\xd9\x62\xdb\x42\x15\x4d\x01"
>                 "\x96\x6d\x3a\xd8\xfc\x2f\xde\x48\xef\x71\xbe\x08\xbe\x58\xe5\xad\x6d\x5a"
>                 "\x35\x93\xef\xc9\xc1\x33\x6e\x54\x13\x72\xa3\x47\x99\xd2\x4e\xa0\x0d\x4d"
>                 "\x49\x85\xbe\xd1\xda\xb1\x06\x20\x91\x1e\x9f\x69\x67\x88\x08\x26\xbe\x5a"
>                 "\x1f\x1b\xb4\xb2\xa3\x94\x86\x54\xc6\x93\x5c\xaf\xeb\x49\x25\xe1\x07\xa0"
>                 "\x1f\x9d\xda\x66\x8e\x5f\xd7\x48\x9e\x82\x13\x92\x41\xa9\x19\x0f\x09\x0a"
>                 "\xfe\x20\x94\x23\x4c\x75\xfe\xc0\x74\x62\x27\x48\xd4\xdd\x78\x2a\x93\x0f"
>                 "\x42\xb0\xe7\x5d\x92\x4b\xef\x68\xff\xaf\xba\xa9\x89\x16\x15\x1a\x36\xef"
>                 "\x29\x98\xaf\xd3\x00\x09\x55\xef\xbf\xa0\xa9\xa0\x08\x35\x8c\x11\x04\x3c"
>                 "\x0f\x96\xb5\x2f\xc7\x8a\x42\x53\x1a\xa5\xdf\xd8\xde\x09\x51\x8c\xff\x00"
>                 "\x8b\x33\x92\x59\xb2\x66\xc4\x88\xbb\x1d\xa0\x58\xba\x21\x8c\xd6\x4b\x3e"
>                 "\x41\x3c\xa2\x88\x9d\x10\x86\xe8\xc4\x0a\xe1\x15\x01\x98\x41\x21\xdc\xfa"
>                 "\x2f\xde\x09\xd0\x68\xf6\xdb\xbe\x83\x59\x98\x0d\xad\x96\xed\x22\x0b\x85"
>                 "\x34\xaa\xef\x35\x3d\xfc\x81\x56\x09\x07\xd2\x6c\x02\x44\x29\x24\xad\x55"
>                 "\xb1\x1d\x3a\xee\x7e\x55\x16\xd9\x6a\xd0\x78\xc8\x5a\xd1\xcd\xb1\x8a\x45"
>                 "\x47\x43\x05\xa8\xdb\x35\x0f\x98\x44\x38\x0e\x20\x94\xf6\x91\xa0\x5e\xa0"
>                 "\x94\x58\xbc\x53\xf3\x23\x6a\x1f\x3f\xa5\xe1\x44\xa5\x75\xba\x57\xe5\x8d"
>                 "\x00\xf7\x65\x3d\x2e\x6b\x6c\xbe\x18\xd2\x8c\xe3\xf5\x79\x25\x38\xad\x20"
>                 "\xc0\xe0\xe1\x0b\x03\xda\xc3\x40\x09\xd6\xd3\xe4\xc7\x66\x2c\xca\x88\xb5"
>                 "\x30\x66\xe9\x5e\xfe\x45\xee\x3e\x04\xda\x32\x86\x90\xda\xe1\xaa\x00\x70"
>                 "\xf0\x94\x5e\x26\x9b\x75\x73\x3b\x10\x6f\xf6\x51\x45\x55\xd5\x4d\x95\x8f"
>                 "\x73\x13\x44\x1f\xa2\x1f\x97\x61\x53\x12\xc4\xf6\x00\xa1\x43\x0f\x62\x98"
>                 "\x12\xf2\x3c\xd2\x1e\x70\x3b\x96\x6e\x04\xaa\x6d\x0b\xba\x6f\x25\x39\x36"
>                 "\x9a\x3b\xad\xeb\xfa\xa8\x19\x7d\x89\xe3\x29\x4b\x44\xc0\xea\x54\xae\x6b"
>                 "\x7f\x4a\x49\x65\x68\x04\x31\x75\xa5\x66\x65\x41\xb5\x59\xa9\xfe\xaf\x0c"
>                 "\x54\x54\xf1\x2f\x23\x0e\x97\xbc\xf8\x4d\xae\x11\xd1\xa8\x35\x94\x11\xb9"
>                 "\x8b\xb6\x06\x3e\xe8\xae\x0f\xfa\x30\xb5\x75\x77\x71\xc7\xb7\x0e\x4f\xbb"
>                 "\x6e\x95\x1a\x68\x08\x73\xe6\xda\x53\x16\x00\xe9\x51\x11\x0c\x34\xca\xac"
>                 "\xc8\xe9\x78\xc0\x6b\x48\x48\xc8\x80\xc4\x8a\xd8\xe6\xc5\x4b\xc7\x92\xce"
>                 "\x54\xea\x4b\x1c\x05\xab\x04\xaf\xb4\xd6\xca\xb2\x5b\x85\xd1\xc4\xb6\xc4"
>                 "\x74\xc7\xec\x92\x67\xb5\x01\xed\xaa\x20\xee\x0e\x41\x58\x68\xd8\x78\x66"
>                 "\x42\x6b\x13\x74\xe5\x8a\x66\x65\x30\xb9\x4e\x34\x2c\x8b\x2e\xbd\xd4\x05"
>                 "\xfe\xf0\xa2\x6d\xf8\x2b\xbc\x50\x2d\xa2\xca\x15\x50\xc2\x8d\x3c\x0b\x69"
>                 "\x87\x2f\xf8\x61\xcd\x23\xcb\x6e\x1f\xf1\xe6\x2f\x62\x5a\xe9\x2f\x90\xf3"
>                 "\x09\x33\xfc\x82\x7e\xdd\x38\x61\x21\x31\x53\x52\xdb\xc9\xf4\xca\xb3\xdd"
>                 "\xda\xde\xb8\xdf\x05\x1d\x2f\x59\xcd\x59\xe9\x7d\xc9\x2c\xe4\x34\x1f\x97"
>                 "\x80\x03\xe4\x86\x85\xe7\x67\x3c\xf1\xe6\x02\x60\x60\x0e\x7c\xbf\x73\x1d"
>                 "\xc1\x68\xb9\xa4\x11\xdc\x3c\x85\xf8\x43\xbd\x2c\x5f\xca\x89\xc0\x6d\x12"
>                 "\xba\xc0\x8a\x61\xcf\x09\x9a\xe5\xf2\x3e\x5e\x90\x84\x48\xe8\x1f\x27\x79"
>                 "\xb3\x85\xb3\x1d\xcd\x5c\xf8\xaa\xad\x4b\x85\xae\x70\x63\x62\x4a\x7d\xf5"
>                 "\x73\xae\xcc\xc8\xb6\x19\x77\xf8\xec\x10\xe6\x8b\x5d\xf1\xc1\xb8\x05\xc7"
>                 "\xe0\x01\x22\x8a\x65\xc0\xe7\x72\xc5\x25\x14\x66\xa4\x9f\x10\x21\x9b\xb7"
>                 "\x18\xa4\xaa\x2e\x35\xc4\x08\x11\xa9\x72\xeb\x58\x53\x0f\x7f\x07\x41\xd3"
>                 "\xbe\x0c\x00\xe3\x8f\x58\x99\x4a\x51\x99\x54\x7f\xc5\x15\x0c\x78\x1f\xfe"
>                 "\x2e\x56\x56\x0f\x08\xeb\x75\xbf\xcd\x90\x85\xff\x14\x0c\xee\xfd\x0d\x6e"
>                 "\xd4\x3d\xad\x39\xd2\xcd\xa8\x69\x4d\x42\x0e\x86\x1a\x1d\xec\x4a\x28\xd1"
>                 "\xcf\x53\x24\xc5\xc5\xab\x81\x92\x21\x54\x87\x3b\x3f\x82\xdf\x1b\xc0\x6c"
>                 "\xb9\x56\x5c\x08\xf7\x74\xd9\xfa\x6f\xe5\x75\xda\xf8\x7b\x32\x8a\xb1\x0b"
>                 "\x91\x22\x43\xf1\x00\x71\x2a\x27\xf4\x98\x1f\xaa\x37\x2d\x73\x67\x02\xc5"
>                 "\x65\xa0\x8c\x4d\x6b\x0a\xa3\x12\xd3\xc9\x01\x7f\xd1\xe7\xab\x98\x1d\xe7"
>                 "\xee\x1d\xfc\x1a\x84\x99\x24\xaa\x92\xea\xb1\xb3\xe6\xe9\x74\x2f\x69\x13"
>                 "\xa0\x8b\x56\x99\xd6\x70\x69\x7a\x60\x8d\x74\x9e\x06\xc3\x41\x42\x1a\x80"
>                 "\x9a\x36\x5d\xca\x3f\x8d\x88\xd8\x42\x68\x50\x80\xf8\xed\x93\x48\x28\x88"
>                 "\x06\x5b\x50\xbf\x9a\xbd\xe7\x5f\xe3\x7c\x8f\xf2\xae\x4f\x24\xe2\x6f\x83"
>                 "\x94\x9a\xb5\xc4\xf4\xa9\x6e\x13\xb2\xcd\xf7\x42\xda\xf9\xc1\xb5\x83\x05"
>                 "\x69\x14\x56\xc6\xc1\x90\xbf\xb7\xbb\xbb\x08\x4e\xa9\xf9\x7e\x99\xc3\xe0"
>                 "\x28\x41\x5d\x4e\x05\xcc\xf7\x71\x7b\x57\x97\xff\x5b\xaf\xa2\x51\x8a\x0a"
>                 "\xca\xb4\x34\xa1\x88\xd4\x79\x7a\x85\xf3\x65\x57\xdd\x6a\xa3\x9c\x75\xe8"
>                 "\x0b\x72\x49\x63\x72\x65\x25\x44\xb1\x42\x49\x01\xa6\xa9\xd4\xb7\x45\x30"
>                 "\x86\xb6\xba\x26\xa4\x05\x21\xda\x94\xab\x54\xde\x4a\x11\xb5\x1b\x4a\xd7"
>                 "\xab\x1d\x68\x05\xf3\x23\xb0\x44\x95\x5f\x77\x9c\xfe\x7c\x1c\x35\x86\xf4"
>                 "\xbe\x0e\xab\x22\x6a\x25\xae\x16\xbd\x8d\xc7\xeb\x01\x50\x24\xb7\x43\x4b"
>                 "\x64\x08\x34\x3a\x1b\xe6\xe1\xdd\x39\x25\xc1\x02\xb4\xc9\xc5\x43\x98\x38"
>                 "\x35\xb6\xbb\x45\xf8\x0e\xa3\x5b\xf7\xfc\xec\xab\x5d\x94\x72\x24\xbf\xdb"
>                 "\x1c\x03\xb2\x0f\xc0\x7a\x5c\xac\x63\x0b\xeb\x4b\x30\x44\xeb\xe5\x5c\x90"
>                 "\x23\x84\x4c\x1f\xd6\x4b\x4e\xb0\x25\x53\x68\x67\xf0\xaf\xa3\x88\x57\x6c"
>                 "\x5b\x25\x64\xcd\x2e\x20\xae\x26\x33\xf7\xb7\x6c\xf6\xfb\xce\xff\x24\x0f"
>                 "\x65\xe5\xee\xba\x28\x43\xfa\xa1\xe7\x71\x08\xd3\x5c\x59\xb3\xf5\x70\x11"
>                 "\x26\x60\xe9\x27\x8d\xa3\x12\x76\x86\xdc\x2a\x96\x5a\x6a\xd1\x67\x2e\x29"
>                 "\xff\x9e\xdd\x62\xf4\x9e\x41\xbd\xd6\x53\x48\xd2\x65\x78\x46\xbe\x80\x47"
>                 "\x9c\xea\x41\x5b\xfb\x59\x27\x22\x9f\x3b\x77\x2e\xd9\xc9\xb7\x63\x9d\x8f"
>                 "\x75\xff\x66\x21\x84\x1a\x7b\x64\x97\x81\x31\xe8\x69\x52\xbf\xe5\x10\x71"
>                 "\x5b\x25\xef\xbc\xf3\x93\x32\x0c\x1d\x62\x99\xac\x6c\x19\xdd\x90\x88\x70"
>                 "\xf9\x6d\x92\xb8\xbd\xcf\x11\xe3\xc9\x87\x8f\x2e\x37\xbd\xaf\x72\x71\x8a"
>                 "\xd0\xbc\x28\x72\xc7\xa0\xb1\x01\xf6\xe3\x92\x99\x72\x34\xe0\x6c\x9b\x1b"
>                 "\xdc\x32\x49\x71\x42\x7d\x6b\x97\xc3\xc1\x65\x31\x17\x8f\x40\xa8\xab\x52"
>                 "\xf9\x8e\x06\x67\x80\x97\x7a\xbd\x35\x2e\x1e\xfe\x61\x85\xf7\x02\x33\xb3"
>                 "\x0f\xdc\x96\xb6\xa2\x89\xb9\xe0\xfc\xee\x55\x59\x23\xef\x59\x0b\xd9\xcd"
>                 "\x2f\x0e\xf7\x02\x46\x41\x45\x0d\x1a\x92\x58\x04\x6a\xc0\xe8\x0a\xcd\x44"
>                 "\xf2\x67\x44\x69\x46\xc0\x96\xdb\x98\x48\xf7\x8c\xdd\xba\x9f\x54\x09\xb0"
>                 "\x90\xdd\x23\x44\xd8\xd4\x5a\x16\xcd\x2e\xcc\xe5\xbf\x22\xbd\x4c\xb8\x9a"
>                 "\xfd\x30\x67\xcb\x0b\xd9\xa7\x27\x9b\xe1\xb1\xe5\x03\x49\x8f\x39\xed\xce"
>                 "\x71\x4f\x37\x59\x7d\x0e\x64\x60\x71\x6d\x09\xea\x37\x6d\x73\xe8\xa7\x1f"
>                 "\xff\x13\x24\xfa\x2a\xeb\xa7\x5e\x8b\xbd\x0e\xa4\xc4\x18\xb4\x57\x84\x55"
>                 "\x01\x53\xd4\x92\x89\x8e\x15\xda\x88\xb6\xed\x3f\x67\xe8\x5d\xbb\x11\x1c"
>                 "\x2f\xea\xc2\xfd\x78\xb6\xf9\x01\x1c\x68\x64\xb9\xbb\x11\x65\x36\x94\xf7"
>                 "\xf0\x25\x68\xb7\x68\xb6\xa2\x7d\x08\x0e\xad\xc0\x09\x37\x44\xb9\x11\x5a"
>                 "\xa2\xf8\xd0\x3f\xa2\x7f\xae\xa2\xe3\x56\xef\x8c\xe6\x2e\x47\x22\xdd\xd1"
>                 "\x39\xf7\x84\xac\x3b\x8a\xfb\x98\xc8\xd3\x98\x4c\x8c\xf9\x43\x8e\x83\x71"
>                 "\x03\x30\x42\x8b\x78\x30\xc1\x70\x9a\x30\x9b\xba\xc3\xbb\xdb\xd0\x83\xe5"
>                 "\x39\x93\x8c\x57\x89\xe1\x70\x9d\x2c\x0e\xe9\x4d\xcb\x2f\xe6\x4c\x31\xc8"
>                 "\x7d\x25\xcc\x7f\x82\x6b\xbf\x5e\x02\x1d\x5a\xaa\x17\x29\x70\xaa\xe9\x6a"
>                 "\x68\x58\xf8\xc1\x1f\xdf\xb7\x48\x32\x8d\x97\x41\x1e\xdc\x10\xdd\x16\xfd"
>                 "\x10\xfa\xa7\xc3\xb9\x4c\xe1\x91\x52\xfb\x29\x65\x69\x04\x21\xd3\xc6\xdb"
>                 "\x2e\x7e\x88\x88\xc7\xbb\x06\x44\x3d\xb3\x11\x1e\x3d\xb6\x9a\x88\xdd\x09"
>                 "\x7a\xb8\xc6\x4d\x6b\xea\x30\xda\x24\x7f\xcd\x11\x7a\x30\xee\xf4\x5c\xd9"
>                 "\x33\x9a\x78\x37\x56\x28\xcd\xbf\xa2\x6d\x6b\x34\x19\xe6\x9b\xbe\x8e\x88"
>                 "\x47\x91\x29\x68\x4b\x23\x04\xda\xa2\xd6\x84\x30\x48\x26\xee\xe9\x7d\x34"
>                 "\x63\x03\xcc\x63\x1e\x10\x46\x5a\x2f\x92\x43\xe8\x4d\x32\x28\x10\x38\x8b"
>                 "\xa2\xd3\x06\x26\xa6\x3d\xf9\x79\x3e\xb9\x63\xdf\x23\x48\x65\xcb\xb6\x8c"
>                 "\xdb\xc0\x43\x63\xe1\x7a\x6a\x6e\xb1\xc8\x01\x41\x77\xc9\x9f\xaa\xcb\x8d"
>                 "\x7a\x8e\x99\xd8\x97\x71\x8b\xc5\x10\x55\x72\x78\x20\xd3\x21\xf2\x5f\xd1"
>                 "\x5d\x24\xd0\x29\xd4\xfa\xd6\xfd\xe9\x7f\x09\x11\x80\xef\x2b\xc3\x91\x3b"
>                 "\xc1\x1f\x8f\x10\x4b\xcc\x7e\xa0\x02\x41\x57\x48\x1b\x35\x37\xce\x54\x3f"
>                 "\xe8\xab\x93\xa2\x6c\xb9\xba\x51\xfa\x78\xd3\x37\xbf\x10\xba\x29\xdc\x5f"
>                 "\xeb\xfe\x4a\xd0\x14\xbd\x40\xf3\x33\x30\x82\x3d\x7f\x45\x73\xba\xeb\xd9"
>                 "\xe0\x63\xd5\x9a\x87\x66\x2b\xef\x85\x9c\xee\x8a\x8e\x53\x18\xaa\xe2\x2e"
>                 "\x79\xfb\x4d\x31\xe0\x88\xf0\x56\x9c\x67\xbb\xa4\x18\x68\xfe\x46\x4e\xd7"
>                 "\x7e\xc7\xfe\x07\xdd\x3a\x5c\x2c\x81\xc1\xfd\xed\x16\x05\x98\xb3\x75\x64"
>                 "\x51\x31\x73\xf1\x3f\xee\xb9\xdf\x4b\x47\xed\xe8\x05\x0a\xac\x43\x1e\x1b"
>                 "\x20\x58\xc6\xaf\xe7\xe4\x4b\xcc\x6f\x28\xdc\x58\x33\xdd\xed\x10\xe6\x91"
>                 "\x7e\x15\xb9\x30\x88\xcd\x90\x79\x18\x26\xca\x7c\x3b\x9a\x42\x11\xe9\xe2"
>                 "\xff\xd4\x96\x62\x23\x81\x6d\xb6\xe4\xed\xe5\x70\x1b\x76\x98\x8d\x8f\x34"
>                 "\xaa\x14\x0f\xfb\x4b\xc3\xef\xfc\xcb\xe5\xaf\x39\x42\xd4\xc5\x71\x77\x00"
>                 "\xe5\x92\xa1\x70\x01\xd2\x0b\x66\x5f\xb7\xc6\xf6\x53\x61\x10\x8a\x13\x70"
>                 "\xa4\x5d\xb4\x77\xa1\xf4\x49\xe5\xc3\xf9\xa8\x9f\x96\x72\x90\xaf\x23\x1d"
>                 "\xb8\x2f\xed\xec\xfc\xa2\xc3\xce\xdf\xfe\xad\xb7\x75\x72\x8b\x45\xce\x4b"
>                 "\xde\x06\x30\xe9\xe1\xdf\xcd\x98\x13\x8a\x55\x6d\xd4\x0b\x65\x55\x81\xb4"
>                 "\x51\xa7\x16\x4a\xd5\x7c\x4f\xb2\xb5\xdc\x5b\x14\x5e\x87\x33\xde\x33\xaf"
>                 "\x84\x4e\x40\x04\x14\xf8\x5c\x28\xca\x1f\x88\x8e\x70\xc4\x5d\x28\xc8\x23"
>                 "\xe0\x7e\xdd\xf3\x0d\xf7\x91\x1d\xf5\x84\xad\x45\x8a\x25\x35\x50\x84\x16"
>                 "\x3a\x9a\x7c\xc3\xba\xc4\x27\x6e\x95\x72\x11\x62\x6e\x28\x82\x12\x00\x53"
>                 "\x34\xde\xc7\x42\xcf\xe5\x7e\x6c\x82\x34\xe5\x20\xd8\xbe\xd4\x5a\xf4\x76"
>                 "\x77\x0f\x47\x18\xf7\x99\xc1\xa1\xf6\x37\xfc\x04\xa7\x37\x80\xa3\x5d\x21"
>                 "\x94\xe6\x01\x7e\x40\x5d\x3e\x0b\x1e\x9f\x2c\x7c\x0f\x6a\x0e\xd2\x8a\x2e"
>                 "\xaf\xdd\x79\x22\x76\x20\x59\xfe\x0e\xbc\x77\x59\x92\x45\xb1\x2c\x9f\x0c"
>                 "\xef\x9e\xda\xb1\xa2\x51\x71\xa6\xa9\xa0\x56\x2e\x24\xdb\x76\xe2\x5d\xfb"
>                 "\x5e\xcb\x73\x52\xd0\xbf\xc7\x8d\x85\x8e\x8a\xaa\xc9\x13\xef\xa4\xff\x60"
>                 "\x48\x96\x79\xe8\xc7\x20\x19\x89\x7a\x8a\x85\xa9\xee\x29\xf1\x09\x22\x31"
>                 "\x5b\xa7\xdb\x0a\x12\x6f\x82\x7c\x03\xfa\x5b\xbb\x90\xf9\x91\xcb\x98\x66"
>                 "\xb3\xe0\x30\x47\xcb\x1f\xab\xbb\xdb\xe5\xa3\x52\x82\xf0\x30\xc0\xdb\xdb"
>                 "\xd2\x27\xf8\x5b\x05\x72\x1c\x45\xc8\xb2\xb8\x5d\x33\x10\xbb\x41\xd6\xaa"
>                 "\x56\x14\xa6\x0d\x98\x74\xd1\x2f\x11\xf5\xa9\x4b\x15\xf7\x41\xdb\x31\x0c"
>                 "\x92\x7b\x2e\x90\x60\x7a\x2a\xf8\xc4\xb5\x7d\x6b\x69\x37\xd5\xa1\xeb\x14"
>                 "\x58\x9d\x1e\x36\x16\x42\x45\x8c\xc2\xfb\xd2\x96\xac\x03\x1d\x09\x9d\xf4"
>                 "\x9a\x53\xe8\xf0\xd4\x50\x6b\x2d\xcb\xb2\x0f\x54\x56\x0b\x69\x5a\x4e\x0a"
>                 "\x4a\x5a\x13\x23\x19\x85\xd5\x3b\xb3\x53\x31\x26\xad\xd2\x81\xfd\x38\xcd"
>                 "\xdf\x7e\xf4\x37\x20\x1e\x8a\xea\x1a\xb6\x3a\xd6\x73\xcd\xcc\x6c\x60\x41"
>                 "\x14\xae\xc7\x71\x88\x1b\x4f\xb7\xaa\x7c\xcb\xd3\x97\xe7\x03\xf1\x08\x95"
>                 "\x61\x9e\x15\xc7\x16\x84\xbb\xbf\xa2\xb2\xc6\x0a\x79\x0d\xe0\xe5\x05\x95"
>                 "\x38\xb5\x1d\x34\x7a\x68\xad\x05\x74\x72\xa9\xf1\xea\xf0\x54\xdf\x77\x91"
>                 "\xb5\x8f\x63\x8c\x05\x95\x55\xbb\xb9\x70\xed\xf8\x77\xd5\xf6\x23\xe2\x54"
>                 "\x1d\xba\x27\xdf\x8d\x71\x3f\xe7\xc5\x5f\x40\xfb\xf3\xdb\xdc\x3d\x04\x2e"
>                 "\x92\xb8\x3f\x94\xdd\x66\xd1\xcd\x2b\xc5\xcc\x98\xa6\xa5\x02\xb5\xd8\xd8"
>                 "\xee\x6e\xfe\xca\xcf\xb7\x62\x46\x4c\x6f\x8c\xea\x8b\xda\xd1\x4a\x29\x19"
>                 "\x99\x28\xe0\xcb\x07\xfb\xc3\x06\xb9\xee\xcc\xc4\xc7\xa3\x26\x18\x52\x54"
>                 "\x41\x48\x92\xb6\x14\xdd\xcc\x20\xe9\xb5\xd2\x58\xe6\x62\x71\x43\x0c\x07"
>                 "\x05\xc5\xa6\x22\xfa\x56\x46\xda\x48\x97\xa0\x88\xf6\x8f\xde\xb6\x68\x42"
>                 "\xad\x3d\x72\xf2\x32\xf4\x87\xb3\xdb\x3b\x83\xd8\x26\x22\xc9\x1d\xaf\x77"
>                 "\x96\x34\xfa\x1b\x97\xc7\xd5\xad\xb5\xd5\x3b\xe5\x19\x8b\xc5\x9a\xef\x1a"
>                 "\xab\x60\xc3\x79\x52\x96\xa8\x4a\xc3\xf7\x73\x99\xfe\xed\x5b\x86\xf4\x4b"
>                 "\x3a\x1c\xa3\x5e\xe4\x68\x91\xee\x90\x3a\x90\x34\x08\x83\xce\xc4\x1d\x57"
>                 "\x7a\x88\x80\x94\x5b\x50\x4c\x7e\xa5\xbd\xc9\x4d\x66\xbf\x25\xb4\xd2\xe0"
>                 "\x64\xbd\x69\xdf\xce\x4f\x00\xf8\xdf\xad\xe0\x73\x9f\xab\x52\x75\xdb\x11"
>                 "\xe9\x99\xb2\x56\x22\xc2\x0c\xa0\xa9\xf1\x0f\x27\xc8\x00\xa4\xf5\xd1\x9a"
>                 "\xa9\x2d\x04\xcd\x28\x2f\x96\xe9\x90\x30\x18\x74\xc5\xdd\xcf\xb1\x32\x23"
>                 "\xc4\xf5\xfd\x37\xc4\x49\xad\xde\x53\x2a\x16\xae\xe6\x64\x07\xbf\xee\xee"
>                 "\xbd\xa4\xf5\x13\xf2\x24\xe4\x34\xa9\xc0\x8a\x22\x81\xd5\xe1\xf4\x59\x1c"
>                 "\x9a\x43\x3a\xb1\x57\x6c\x11\xed\xd0\xdf\x9f\xb6\xf4\x7b\x76\x1f\xc8\x78"
>                 "\xd5\x32\xd7\xfc\x2a\x76\x24\x61\xfd\x14\x73\xeb\x7c\x7c\x88\x66\x8b\x74"
>                 "\x9b\x9b\xbf\x43\xc9\x37\xfa\x2b\xd7\x3a\xe9\x17\xea\x2a\x90\x3b\xf5\xf7"
>                 "\xd7\x1a\xe1\xc7\xd7\x1c\x60\xde\xf1\xbb\xc4\xe8\x15\x1b\xee\x5f\x4a\x39"
>                 "\x63\x25\x90\x7f\x4f\x2b\xcb\xe9\x80\x38\xe4\x6b\xc9\xfb\x30\xd1\x99\xf0"
>                 "\x25\xea\xbe\xb0\x37\xce\xae\xc3\xee\x18\x7f\x73\xa1\x36\xb8\x56\x6a\x94"
>                 "\x3d\x5b\x32\x71\x19\x9e\x6d\x19\xb7\x06\x6d\x90\xb1\x0d\x0c\x11\xe7\xcb"
>                 "\x0c\x0b\x5f\x73\x12\x7c\xd6\x85\xa7\x63\x8b\x99\xa1\xc9\xae\xa4\xfb\xf3"
>                 "\xfa\xc6\x7a\x4b\x11\x4c\xa9\xfa\x60\xd2\xc9\xc2\x47\x23\xb0\x37\x14\x2e"
>                 "\x3e\x47\x50\x3f\x3d\xfd\xff\xc4\x87\x21\x20\x90\xd2\x21\xeb\x85\xf5\x3c"
>                 "\xf6\x17\x6c\x26\xb9\x3c\x75\x7b\x52\x1d\x01\x7c\xa1\x7a\xc7\x88\x9c\x26"
>                 "\xc6\x47\x3f\xb4\x4c\xc2\xab\x79\xcd\x76\xfb\xf8\xfc\x5a\x81\xdc\x24\xbd"
>                 "\x7b\xa6\xd5\x5d\x80\x36\xf4\xd6\x02\x18\xe7\xc8\xfd\xf7\xf3\xb9\x15\xef"
>                 "\xd0\xbd\x0e\xdf\xac\x38\x0e\x37\x17\x79\x4a\xb4\x6b\x2a\x5d\xae\xd5\x8f"
>                 "\xdb\x3e\xa6\x67\x20\xc0\xe7\x8a\x0c\xe8\x25\xb1\x55\xeb\xc0\x97\x9c\xf7"
>                 "\x79\x15\xdb\x3d\xf6\x00\xbb\xd1\x79\xf1\xd2\xd6\x74\xd7\x6b\x12\xaf\xf0"
>                 "\x87\x75\x7d\x4a\xa4\x80\xee\x15\x66\x78\x40\x74\xa5\x28\x7b\xe0\x08\x8e"
>                 "\xfb\xe1\x2f\x55\x0b\xad\x3b\x41\x0c\xf0\x4f\xba\x8f\x06\xd1\x12\x0a\x1d"
>                 "\xad\x35\xde\x9c\x7a\x22\xc3\xca\xf8\x3c\x1b\xf6\xea\x57\xa0\x55\xaf\xcb"
>                 "\xc6\x1b\x06\x8f\xeb\x5d\x17\xf5\xd0\xcd\x9e\x59\x11\xd2\xd9\xc8\xc6\xff"
>                 "\x89\xfc\x37\x72\x5a\x4b\x9a\xc3\xa8\x80\x0d\x17\x31\x19\x9c\x82\x01\xc0"
>                 "\x52\x2e\x9a\xf7\x49\xfe\x36\xe1\x41\x94\x31\x0a\x5a\xaf\xd9\x44\xc3\x21"
>                 "\xef\xb4\xec\xf5\xc1\x31\xcc\xf9\xde\x48\xc8\xb3\x6a\x90\x5f\x47\xeb\xa8"
>                 "\xfb\x42\xce\x43\x5d\x1b\xd4\x08\xdc\x87\xb1\xc9\x15\x77\xff\xba\x16\xe3"
>                 "\x2b\x9b\xe2\x19\x82\xd3\x17\x63\x20\xc8\xe2\x37\x99\xb6\xc5\xcc\x3d\x83"
>                 "\x4c\xcb\xe9\xac\xed\xa7\x0b\xd2\xc7\x3a\x15\x41\x37\xac\xdd\x65\xf4\x19"
>                 "\x1e\x44\x70\x89\x3e\xb2\x4e\x4a\xb0\x07\x00\xc2\xc1\x35\x14\x9f\xb8\x66"
>                 "\x44\xb5\xac\x0b\xe1\x66\x92\x88\xb9\xc2\x9a\x1f\x6f\x61\x51\x7d\x8b\x4f"
>                 "\x09\x61\x6e\x76\x7b\xd7\x2d\x13\xf8\x33",
>                 4096));
>         syscall(__NR_lsetxattr, /*path=*/0x200001c0ul, /*name=*/0x200002c0ul,
>                         /*val=*/0x20002040ul, /*size=*/0x1009ul, /*flags=*/3ul);
>     }
>     int main(void) {
>         syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
>                         /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
>         syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul,
>                         /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
>         syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
>                         /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
>         install_segv_handler();
>         for (procid = 0; procid < 4; procid++) {
>             if (fork() == 0) {
>                 loop();
>             }
>         }
>         sleep(1000000);
>         return 0;
>     }
>
>
> =* repro.txt =*
> syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x220e002, 0x0, 0x1, 0x0, &(0x7f0000000100))
> mount(&(0x7f0000000040)=ANY=[@ANYBLOB='mtd', @ANYRESHEX=0x0], &(0x7f00000000c0)='./file0\x00', &(0x7f0000001200)='jffs2\x00', 0x0, 0x0)
> lsetxattr$security_evm(&(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), &(0x7f0000002040)=@v2={0x3, 0x2, 0xb, 0x4, 0x1000, "788d9cb299abd72ece913d53365e16688e51ace15984ab53d1666ae3f5dfbc860bef87389e21286be236ddc3d0fa2e51d5c5c7b35c5d503c5b2c3b6be0fc56e97df88faa0635363ba92b82c47a817ac97f1d638a1461821255ec23bd0ce5bf1094e3a8980d7e6d1976ba778745920e1718fddac4bd66b0a606801aaefded293c3fcebad3b2c06403dba9994971659b7f4a077addaeb8ae3e5aca7027fde1e40001c0bdd800bcc287e02c867e2782deaf676a261647db8c2f3945022057de768100a8bf73d9f9ff29229b46dead58b2ddf96433468e9eee8950df658711e411364e44145e682f3c053c6f5a1861eee6edf885a97c545805ac0c35a5e4623b2001861c593354b570ff3b4a45f1acde0a8dbd17c09ce448ed5dfd9e7472e68967decb769fa600cd30beb6c8030e9474c7ec4c1daf3e007bbc5765b366d4a176e38bdfabedd2b076a5ed7d50f5177b94a6a0f000cd3acadde8e80f66eada14018620b159e9e14c252d20c8dbb0fe3605b5698b53e4210b62fcbd00017eaa01eb1fa521bdb8d30e83951b4ea0286c8f0d464517a11d7922d6cce4d2058ec8cd7b02b73d825d7e0abbbd85e991220fc7995534b7b1998ca752890b079a7ca3fde56438cf82d5dd9edbd11fd293c17d1cf16657d0b352a8c6c36300ad09a78e3ee3913b9b6f53debffc7e32bfb64b0e8cbe07fe9b0dadb097aeb2c242430bec75630a3921828a7314de1404829e7afb3b8420e85f2c8f6e88de042314416e5c00c59b22208004bec161f8457c7f8e3a8ca4174a4b78df6e460d56d24e01ae1a2411270f79d020a6bac855f1a3ef7b3d0991882656b408dcdaf02db46ac8fcab0c875d1f2e8db366e6a20cb67a4db920382a6915715d3b4266f779fe8633bea6def28cc159138b834334cedef3dec54ea5303df56be87115315ec0f1478a0c0869e5f7c33da64b23af5811751055c90849484481d5a10d72e08ccd12710c4f2ff586a9ea175f4aa70b156c00c57e22c1360bfc7d36aa4792444f81d8a0ed41bf6a452ea5268b8605682ac63eaa465218f4d962db42154d01966d3ad8fc2fde48ef71be08be58e5ad6d5a3593efc9c1336e541372a34799d24ea00d4d4985bed1dab10620911e9f6967880826be5a1f1bb4b2a3948654c6935cafeb4925e107a01f9dda668e5fd7489e82139241a9190f090afe2094234c75fec074622748d4dd782a930f42b0e75d924bef68ffafbaa98916151a36ef2998afd3000955efbfa0a9a008358c11043c0f96b52fc78a42531aa5dfd8de09518cff008b339259b266c488bb1da058ba218cd64b3e413ca2889d1086e8c40ae11501984121dcfa2fde09d068f6dbbe8359980dad96ed220b8534aaef353dfc81560907d26c02442924ad55b11d3aee7e5516d96ad078c85ad1cdb18a45474305a8db350f9844380e2094f691a05ea09458bc53f3236a1f3fa5e144a575ba57e58d00f7653d2e6b6cbe18d28ce3f5792538ad20c0e0e10b03dac34009d6d3e4c7662cca88b53066e95efe45ee3e04da328690dae1aa0070f0945e269b75733b106ff6514555d54d958f7313441fa21f97615312c4f600a1430f629812f23cd21e703b966e04aa6d0bba6f2539369a3badebfaa8197d89e3294b44c0ea54ae6b7f4a496568043175a5666541b559a9feaf0c5454f12f230e97bcf84dae11d1a8359411b98bb6063ee8ae0ffa30b5757771c7b70e4fbb6e951a680873e6da531600e951110c34caacc8e978c06b4848c880c48ad8e6c54bc792ce54ea4b1c05ab04afb4d6cab25b85d1c4b6c474c7ec9267b501edaa20ee0e415868d87866426b1374e58a666530b94e342c8b2ebdd405fef0a26df82bbc502da2ca1550c28d3c0b69872ff861cd23cb6e1ff1e62f625ae92f90f30933fc827edd386121315352dbc9f4cab3dddadeb8df051d2f59cd59e97dc92ce4341f978003e48685e7673cf1e60260600e7cbf731dc168b9a411dc3c85f843bd2c5fca89c06d12bac08a61cf099ae5f23e5e908448e81f2779b385b31dcd5cf8aaad4b85ae7063624a7df573aeccc8b61977f8ec10e68b5df1c1b805c7e001228a65c0e772c5251466a49f10219bb718a4aa2e35c40811a972eb58530f7f0741d3be0c00e38f58994a5199547fc5150c781ffe2e56560f08eb75bfcd9085ff140ceefd0d6ed43dad39d2cda8694d420e861a1dec4a28d1cf5324c5c5ab81922154873b3f82df1bc06cb9565c08f774d9fa6fe575daf87b328ab10b912243f100712a27f4981faa372d736702c565a08c4d6b0aa312d3c9017fd1e7ab981de7ee1dfc1a849924aa92eab1b3e6e9742f6913a08b5699d670697a608d749e06c341421a809a365dca3f8d88d842685080f8ed93482888065b50bf9abde75fe37c8ff2ae4f24e26f83949ab5c4f4a96e13b2cdf742daf9c1b58305691456c6c190bfb7bbbb084ea9f97e99c3e028415d4e05ccf7717b5797ff5bafa2518a0acab434a188d4797a85f36557dd6aa39c75e80b72496372652544b1424901a6a9d4b7453086b6ba26a40521da94ab54de4a11b51b4ad7ab1d6805f323b044955f779cfe7c1c3586f4be0eab226a25ae16bd8dc7eb015024b7434b6408343a1be6e1dd3925c102b4c9c543983835b6bb45f80ea35bf7fcecab5d947224bfdb1c03b20fc07a5cac630beb4b3044ebe55c9023844c1fd64b4eb025536867f0afa388576c5b2564cd2e20ae2633f7b76cf6fbceff240f65e5eeba2843faa1e77108d35c59b3f570112660e9278da3127686dc2a965a6ad1672e29ff9edd62f49e41bdd65348d2657846be80479cea415bfb5927229f3b772ed9c9b7639d8f75ff6621841a7b64978131e86952bfe510715b25efbcf393320c1d6299ac6c19dd908870f96d92b8bdcf11e3c9878f2e37bdaf72718ad0bc2872c7a0b101f6e392997234e06c9b1bdc324971427d6b97c3c16531178f40a8ab52f98e066780977abd352e1efe6185f70233b30fdc96b6a289b9e0fcee555923ef590bd9cd2f0ef7024641450d1a9258046ac0e80acd44f267446946c096db9848f78cddba9f5409b090dd2344d8d45a16cd2ecce5bf22bd4cb89afd3067cb0bd9a7279be1b1e503498f39edce714f37597d0e6460716d09ea376d73e8a71fff1324fa2aeba75e8bbd0ea4c418b45784550153d492898e15da88b6ed3f67e85dbb111c2feac2fd78b6f9011c6864b9bb11653694f7f02568b768b6a27d080eadc0093744b9115aa2f8d03fa27faea2e356ef8ce62e4722ddd139f784ac3b8afb98c8d3984c8cf9438e83710330428b7830c1709a309bbac3bbdbd083e539938c5789e1709d2c0ee94dcb2fe64c31c87d25cc7f826bbf5e021d5aaa172970aae96a6858f8c11fdfb748328d97411edc10dd16fd10faa7c3b94ce19152fb2965690421d3c6db2e7e8888c7bb06443db3111e3db69a88dd097ab8c64d6bea30da247fcd117a30eef45cd9339a78375628cdbfa26d6b3419e69bbe8e88479129684b2304daa2d684304826eee97d346303cc631e10465a2f9243e84d322810388ba2d30626a63df9793eb963df234865cbb68cdbc04363e17a6a6eb1c8014177c99faacb8d7a8e99d897718bc51055727820d321f25fd15d24d029d4fad6fde97f091180ef2bc3913bc11f8f104bcc7ea0024157481b3537ce543fe8ab93a26cb9ba51fa78d337bf10ba29dc5febfe4ad014bd40f33330823d7f4573baebd9e063d59a87662bef859cee8a8e5318aae22e79fb4d31e088f0569c67bba41868fe464ed77ec7fe07dd3a5c2c81c1fded160598b37564513173f13feeb9df4b47ede8050aac431e1b2058c6afe7e44bcc6f28dc5833dded10e6917e15b93088cd90791826ca7c3b9a4211e9e2ffd4966223816db6e4ede5701b76988d8f34aa140ffb4bc3effccbe5af3942d4c5717700e592a17001d20b665fb7c6f65361108a1370a45db477a1f449e5c3f9a89f967290af231db82fedecfca2c3cedffeadb775728b45ce4bde0630e9e1dfcd98138a556dd40b655581b451a7164ad57c4fb2b5dc5b145e8733de33af844e400414f85c28ca1f888e70c45d28c823e07eddf30df7911df584ad458a25355084163a9a7cc3bac4276e957211626e288212005334dec742cfe57e6c8234e520d8bed45af476770f4718f799c1a1f637fc04a73780a35d2194e6017e405d3e0b1e9f2c7c0f6a0ed28a2eafdd7922762059fe0ebc77599245b12c9f0cef9edab1a25171a6a9a0562e24db76e25dfb5ecb7352d0bfc78d858e8aaac913efa4ff60489679e8c72019897a8a85a9ee29f10922315ba7db0a126f827c03fa5bbb90f991cb9866b3e03047cb1fabbbdbe5a35282f030c0dbdbd227f85b05721c45c8b2b85d3310bb41d6aa5614a60d9874d12f11f5a94b15f741db310c927b2e90607a2af8c4b57d6b6937d5a1eb14589d1e361642458cc2fbd296ac031d099df49a53e8f0d4506b2dcbb20f54560b695a4e0a4a5a13231985d53bb3533126add281fd38cddf7ef437201e8aea1ab63ad673cdcc6c604114aec771881b4fb7aa7ccbd397e703f10895619e15c71684bbbfa2b2c60a790de0e5059538b51d347a68ad057472a9f1eaf054df7791b58f638c059555bbb970edf877d5f623e2541dba27df8d713fe7c55f40fbf3dbdc3d042e92b83f94dd66d1cd2bc5cc98a6a502b5d8d8ee6efecacfb762464c6f8cea8bdad14a29199928e0cb07fbc306b9eeccc4c7a326185254414892b614ddcc20e9b5d258e66271430c0705c5a622fa5646da4897a088f68fdeb66842ad3d72f232f487b3db3b83d82622c91daf779634fa1b97c7d5adb5d53be5198bc59aef1aab60c3795296a84ac3f77399feed5b86f44b3a1ca35ee46891ee903a90340883cec41d577a8880945b504c7ea5bdc94d66bf25b4d2e064bd69dfce4f00f8dfade0739fab5275db11e999b25622c20ca0a9f10f27c800a4f5d19aa92d04cd282f96e990301874c5ddcfb13223c4f5fd37c449adde532a16aee66407bfeeeebda4f513f224e434a9c08a2281d5e1f4591c9a433ab1576c11edd0df9fb6f47b761fc878d532d7fc2a762461fd1473eb7c7c88668b749b9bbf43c937fa2bd73ae917ea2a903bf5f7d71ae1c7d71c60def1bbc4e8151bee5f4a396325907f4f2bcbe98038e46bc9fb30d199f025eabeb037ceaec3ee187f73a136b8566a943d5b3271199e6d19b7066d90b10d0c11e7cb0c0b5f73127cd685a7638b99a1c9aea4fbf3fac67a4b114ca9fa60d2c9c24723b037142e3e47503f3dfdffc487212090d221eb85f53cf6176c26b93c757b521d017ca17ac7889c26c6473fb44cc2ab79cd76fbf8fc5a81dc24bd7ba6d55d8036f4d60218e7c8fdf7f3b915efd0bd0edfac380e3717794ab46b2a5daed58fdb3ea66720c0e78a0ce825b155ebc0979cf77915db3df600bbd179f1d2d674d76b12aff087757d4aa480ee1566784074a5287be0088efbe12f550bad3b410cf04fba8f06d1120a1dad35de9c7a22c3caf83c1bf6ea57a055afcbc61b068feb5d17f5d0cd9e5911d2d9c8c6ff89fc37725a4b9ac3a8800d1731199c8201c0522e9af749fe36e14194310a5aafd944c321efb4ecf5c131ccf9de48c8b36a905f47eba8fb42ce435d1bd408dc87b1c91577ffba16e32b9be21982d3176320c8e23799b6c5cc3d834ccbe9aceda70bd2c73a154137acdd65f4191e4470893eb24e4ab00700c2c135149fb86644b5ac0be1669288b9c29a1f6f61517d8b4f09616e767bd72d13f833"}, 0x1009, 0x3)
>
> and see also in https://gist.github.com/xrivendell7/fdc7fa3a7b55a9174666944c07732eec
>
> I hope it helps.
> Best regards





[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [NTFS 3]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [NTFS 3]     [Samba]     [Device Mapper]     [CEPH Development]

  Powered by Linux