[syzbot] [jffs2?] kernel BUG in jffs2_sum_write_sumnode

9 views

Skip to first unread message

syzbot

unread,

Apr 12, 2024, 5:00:34 AMApr 12

to dw...@infradead.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, linu...@lists.infradead.org, ric...@nod.at, syzkall...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 00dcf5d862e8 Merge tag 'acpi-6.9-rc4' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11a98eeb180000
kernel config: https://syzkaller.appspot.com/x/.config?x=c5a8421528fe0176
dashboard link: https://syzkaller.appspot.com/bug?extid=badbb16b0a5dd4c2f676
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-00dcf5d8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/68de786626b3/vmlinux-00dcf5d8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dba6f0189428/bzImage-00dcf5d8.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+badbb1...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/jffs2/summary.c:865!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 3 PID: 5545 Comm: syz-executor.3 Not tainted 6.9.0-rc3-syzkaller-00189-g00dcf5d862e8 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:jffs2_sum_write_sumnode+0x1cf6/0x2220 fs/jffs2/summary.c:865
Code: 0f b6 04 02 84 c0 74 08 3c 03 0f 8e d7 01 00 00 8b b3 c0 05 00 00 48 c7 c2 40 b7 44 8b 48 c7 c7 40 b3 44 8b e8 ab 09 8f fe 90 <0f> 0b e8 23 6b f1 07 e8 6e b6 0a ff e9 d9 e5 ff ff 48 89 cf 48 89
RSP: 0018:ffffc9000ca874d0 EFLAGS: 00010282
RAX: 0000000000000045 RBX: ffff88801fb6a440 RCX: ffffffff816f3829
RDX: 0000000000000000 RSI: ffffffff816fc366 RDI: 0000000000000005
RBP: ffffc9000ca87650 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000003 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88805e196898 R15: ffff888059d1a000
FS: 0000000000000000(0000) GS:ffff88802c500000(0063) knlGS:00000000f5ea1b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000c001927000 CR3: 000000005fbbe000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
jffs2_do_reserve_space+0xb52/0x1030 fs/jffs2/nodemgmt.c:388
jffs2_reserve_space+0x62e/0xba0 fs/jffs2/nodemgmt.c:197
do_jffs2_setxattr+0x1a1/0x16c0 fs/jffs2/xattr.c:1113
__vfs_setxattr+0x173/0x1e0 fs/xattr.c:200
__vfs_setxattr_noperm+0x127/0x5e0 fs/xattr.c:234
__vfs_setxattr_locked+0x182/0x260 fs/xattr.c:295
vfs_setxattr+0x146/0x350 fs/xattr.c:321
do_setxattr+0x146/0x170 fs/xattr.c:629
setxattr+0x15d/0x180 fs/xattr.c:652
path_setxattr+0x179/0x1e0 fs/xattr.c:671
__do_sys_lsetxattr fs/xattr.c:694 [inline]
__se_sys_lsetxattr fs/xattr.c:690 [inline]
__ia32_sys_lsetxattr+0xbd/0x160 fs/xattr.c:690
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x75/0x120 arch/x86/entry/common.c:321
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:346
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf72af579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f5ea15ac EFLAGS: 00000292 ORIG_RAX: 00000000000000e3
RAX: ffffffffffffffda RBX: 00000000200001c0 RCX: 00000000200002c0
RDX: 0000000020002040 RSI: 0000000000001009 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:jffs2_sum_write_sumnode+0x1cf6/0x2220 fs/jffs2/summary.c:865
Code: 0f b6 04 02 84 c0 74 08 3c 03 0f 8e d7 01 00 00 8b b3 c0 05 00 00 48 c7 c2 40 b7 44 8b 48 c7 c7 40 b3 44 8b e8 ab 09 8f fe 90 <0f> 0b e8 23 6b f1 07 e8 6e b6 0a ff e9 d9 e5 ff ff 48 89 cf 48 89
RSP: 0018:ffffc9000ca874d0 EFLAGS: 00010282
RAX: 0000000000000045 RBX: ffff88801fb6a440 RCX: ffffffff816f3829
RDX: 0000000000000000 RSI: ffffffff816fc366 RDI: 0000000000000005
RBP: ffffc9000ca87650 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000003 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88805e196898 R15: ffff888059d1a000
FS: 0000000000000000(0000) GS:ffff88802c500000(0063) knlGS:00000000f5ea1b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000c001927000 CR3: 000000005fbbe000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 10 06 adc %al,(%rsi)
2: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
6: 10 07 adc %al,(%rdi)
8: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
c: 10 08 adc %cl,(%rax)
e: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
1e: 00 51 52 add %dl,0x52(%rcx)
21: 55 push %rbp
22: 89 e5 mov %esp,%ebp
24: 0f 34 sysenter
26: cd 80 int $0x80
* 28: 5d pop %rbp <-- trapping instruction
29: 5a pop %rdx
2a: 59 pop %rcx
2b: c3 ret
2c: 90 nop
2d: 90 nop
2e: 90 nop
2f: 90 nop
30: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

lee bruce

unread,

Apr 17, 2024, 8:49:05 AM (13 days ago) Apr 17

to syzbot+badbb1...@syzkaller.appspotmail.com, dw...@infradead.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, linu...@lists.infradead.org, ric...@nod.at, syzkall...@googlegroups.com, samsun...@gmail.com

Hello, I reproduced this bug and comfired in the latest upstream.

If you fix this issue, please add the following tag to the commit:

Reported-by: xingwei lee <xrive...@gmail.com>

Reported-by: yue sun <samsun...@gmail.com>

I use the same kernel as syzbot instance: https://syzkaller.appspot.com/bug?extid=5a281fe8aadf8f11230d

Kernel Commit: upstream fe46a7dd189e25604716c03576d05ac8a5209743

Kernel Config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=4d90a36f0cab495a with KASAN enabled

root@syzkaller:~# ./0

[ 406.727577][ T8177] ------------[ cut here ]------------

[ 406.728272][ T8177] kernel BUG at fs/jffs2/summary.c:865!

[ 406.729014][ T8177] invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI

[ 406.729850][ T8177] CPU: 2 PID: 8177 Comm: 0 Not tainted 6.8.0-08951-gfe46a7dd189e-dirty #6

[ 406.730904][ T8177] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014

[ 406.732206][ T8177] RIP: 0010:jffs2_sum_write_sumnode+0x1f50/0x2630

[ 406.733061][ T8177] Code: 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 81 01 00 00 8b b3 c0 05 00 00 48 c7 c2 c0 7e a4 8b 48 c7 c7 c0 7a a4 8b e8 51 ba 82 fe 90 <0f> 0b e8 69 29 01 ff e9 70 e19

[ 406.735472][ T8177] RSP: 0018:ffffc9000396f4e0 EFLAGS: 00010286

[ 406.736416][ T8177] RAX: 0000000000000045 RBX: ffff888022a20040 RCX: ffff888022a20040

[ 406.737446][ T8177] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000

[ 406.738435][ T8177] RBP: ffffc9000396f660 R08: 0000000000000005 R09: 0000000000000000

[ 406.739470][ T8177] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000000

[ 406.740463][ T8177] R13: 0000000000000000 R14: ffff888028bb1000 R15: 000000000000106c

[ 406.741459][ T8177] FS: 0000000007a66480(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000

[ 406.742581][ T8177] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

[ 406.743418][ T8177] CR2: 0000000020003029 CR3: 000000002be68000 CR4: 0000000000750ef0

[ 406.744407][ T8177] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

[ 406.745398][ T8177] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

[ 406.746373][ T8177] PKRU: 55555554

[ 406.746833][ T8177] Call Trace:

[ 406.747271][ T8177] <TASK>

[ 406.747651][ T8177] ? show_regs+0x97/0xa0

[ 406.748215][ T8177] ? die+0x3b/0xb0

[ 406.748701][ T8177] ? do_trap+0x245/0x440

[ 406.749262][ T8177] ? jffs2_sum_write_sumnode+0x1f50/0x2630

[ 406.750005][ T8177] ? jffs2_sum_write_sumnode+0x1f50/0x2630

[ 406.750711][ T8177] ? do_error_trap+0xff/0x250

[ 406.751342][ T8177] ? jffs2_sum_write_sumnode+0x1f50/0x2630

[ 406.752094][ T8177] ? handle_invalid_op+0x39/0x40

[ 406.752740][ T8177] ? jffs2_sum_write_sumnode+0x1f50/0x2630

[ 406.753479][ T8177] ? exc_invalid_op+0x2e/0x50

[ 406.754090][ T8177] ? asm_exc_invalid_op+0x1a/0x20

[ 406.754716][ T8177] ? jffs2_sum_write_sumnode+0x1f50/0x2630

[ 406.755477][ T8177] ? __pfx_jffs2_sum_write_sumnode+0x10/0x10

[ 406.756234][ T8177] ? rcu_is_watching+0x12/0xc0

[ 406.756861][ T8177] ? lock_acquire+0x1b1/0x540

[ 406.757489][ T8177] ? __pfx_lock_acquire+0x10/0x10

[ 406.758117][ T8177] ? __pfx___mutex_lock+0x10/0x10

[ 406.758769][ T8177] ? jffs2_do_reserve_space+0xc59/0x1190

[ 406.759502][ T8177] jffs2_do_reserve_space+0xc59/0x1190

[ 406.760223][ T8177] jffs2_reserve_space+0x67e/0xc20

[ 406.760883][ T8177] ? avc_has_perm_noaudit+0x152/0x3d0

[ 406.761584][ T8177] ? __pfx_jffs2_reserve_space+0x10/0x10

[ 406.762302][ T8177] ? avc_has_perm_noaudit+0x152/0x3d0

[ 406.763030][ T8177] ? cred_has_capability.isra.0+0x19d/0x310

[ 406.763788][ T8177] ? __pfx_jffs2_security_setxattr+0x10/0x10

[ 406.764567][ T8177] do_jffs2_setxattr+0x1ab/0x1770

[ 406.765224][ T8177] ? cap_capable+0x1e4/0x250

[ 406.765783][ T8177] ? __pfx_do_jffs2_setxattr+0x10/0x10

[ 406.766514][ T8177] ? xattr_resolve_name+0x292/0x440

[ 406.767220][ T8177] ? __pfx_jffs2_security_setxattr+0x10/0x10

[ 406.768026][ T8177] __vfs_setxattr+0x182/0x1f0

[ 406.768646][ T8177] ? __pfx_evm_protect_xattr.isra.0+0x10/0x10

[ 406.769411][ T8177] ? __pfx___vfs_setxattr+0x10/0x10

[ 406.770067][ T8177] __vfs_setxattr_noperm+0x132/0x610

[ 406.770752][ T8177] __vfs_setxattr_locked+0x195/0x270

[ 406.771452][ T8177] vfs_setxattr+0x151/0x370

[ 406.772052][ T8177] ? __pfx_vfs_setxattr+0x10/0x10

[ 406.772704][ T8177] ? __might_fault+0xee/0x1a0

[ 406.773326][ T8177] do_setxattr+0x153/0x180

[ 406.773881][ T8177] setxattr+0x166/0x180

[ 406.774421][ T8177] ? __pfx_setxattr+0x10/0x10

[ 406.775043][ T8177] ? mnt_get_write_access+0x21d/0x320

[ 406.775743][ T8177] path_setxattr+0x188/0x1f0

[ 406.776338][ T8177] ? __pfx_path_setxattr+0x10/0x10

[ 406.776986][ T8177] ? handle_mm_fault+0x541/0xab0

[ 406.777648][ T8177] __x64_sys_lsetxattr+0xc6/0x160

[ 406.778281][ T8177] ? do_syscall_64+0x91/0x260

[ 406.778927][ T8177] ? lockdep_hardirqs_on+0x7c/0x110

[ 406.779598][ T8177] do_syscall_64+0xd2/0x260

[ 406.780194][ T8177] entry_SYSCALL_64_after_hwframe+0x6d/0x75

[ 406.780944][ T8177] RIP: 0033:0x437d49

[ 406.781454][ T8177] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 488

[ 406.783841][ T8177] RSP: 002b:00007fff7cd51d28 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd

[ 406.784889][ T8177] RAX: ffffffffffffffda RBX: 0000000020002047 RCX: 0000000000437d49

[ 406.785900][ T8177] RDX: 0000000020002040 RSI: 00000000200002c0 RDI: 00000000200001c0

[ 406.786886][ T8177] RBP: 00007fff7cd51d80 R08: 0000000000000003 R09: 000000017cd51d40

[ 406.787878][ T8177] R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000001

[ 406.788872][ T8177] R13: 00007fff7cd51f88 R14: 0000000000000001 R15: 0000000000000001

[ 406.789879][ T8177] </TASK>

=* repro.c =*

#define _GNU_SOURCE

#include <dirent.h>

#include <endian.h>

#include <errno.h>

#include <fcntl.h>

#include <setjmp.h>

#include <signal.h>

#include <stdarg.h>

#include <stdbool.h>

#include <stddef.h>

#include <stdint.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/ioctl.h>

#include <sys/mman.h>

#include <sys/mount.h>

#include <sys/prctl.h>

#include <sys/stat.h>

#include <sys/syscall.h>

#include <sys/types.h>

#include <sys/wait.h>

#include <time.h>

#include <unistd.h>

#include <linux/loop.h>

#ifndef __NR_memfd_create

#define __NR_memfd_create 319

#endif

static unsigned long long procid;

static __thread int clone_ongoing;

static __thread int skip_segv;

static __thread jmp_buf segv_env;

static void segv_handler(int sig, siginfo_t* info, void* ctx) {

if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {

exit(sig);

}

uintptr_t addr = (uintptr_t)info->si_addr;

const uintptr_t prog_start = 1 << 20;

const uintptr_t prog_end = 100 << 20;

int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;

int valid = addr < prog_start || addr > prog_end;

if (skip && valid) {

_longjmp(segv_env, 1);

}

exit(sig);

}

static void install_segv_handler(void) {

struct sigaction sa;

memset(&sa, 0, sizeof(sa));

sa.sa_handler = SIG_IGN;

syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);

syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);

memset(&sa, 0, sizeof(sa));

sa.sa_sigaction = segv_handler;

sa.sa_flags = SA_NODEFER | SA_SIGINFO;

sigaction(SIGSEGV, &sa, NULL);

sigaction(SIGBUS, &sa, NULL);

}

#define NONFAILING(...) \

({ \

int ok = 1; \

__atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \

if (_setjmp(segv_env) == 0) { \

__VA_ARGS__; \

} else \

ok = 0; \

__atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \

ok; \

})

static void sleep_ms(uint64_t ms) {

usleep(ms * 1000);

}

static uint64_t current_time_ms(void) {

struct timespec ts;

if (clock_gettime(CLOCK_MONOTONIC, &ts))

exit(1);

return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;

}

static bool write_file(const char* file, const char* what, ...) {

char buf[1024];

va_list args;

va_start(args, what);

vsnprintf(buf, sizeof(buf), what, args);

va_end(args);

buf[sizeof(buf) - 1] = 0;

int len = strlen(buf);

int fd = open(file, O_WRONLY | O_CLOEXEC);

if (fd == -1)

return false;

if (write(fd, buf, len) != len) {

int err = errno;

close(fd);

errno = err;

return false;

}

close(fd);

return true;

}

//% This code is derived from puff.{c,h}, found in the zlib development. The

//% original files come with the following copyright notice:

//% version 2.3, 21 Jan 2013

//% This software is provided 'as-is', without any express or implied

//% warranty. In no event will the author be held liable for any damages

//% arising from the use of this software.

//% Permission is granted to anyone to use this software for any purpose,

//% including commercial applications, and to alter it and redistribute it

//% freely, subject to the following restrictions:

//% 1. The origin of this software must not be misrepresented; you must not

//% claim that you wrote the original software. If you use this software

//% in a product, an acknowledgment in the product documentation would be

//% appreciated but is not required.

//% 2. Altered source versions must be plainly marked as such, and must not be

//% misrepresented as being the original software.

//% 3. This notice may not be removed or altered from any source distribution.

//% Mark Adler mad...@alumni.caltech.edu

//% BEGIN CODE DERIVED FROM puff.{c,h}

#define MAXBITS 15

#define MAXLCODES 286

#define MAXDCODES 30

#define MAXCODES (MAXLCODES + MAXDCODES)

#define FIXLCODES 288

struct puff_state {

unsigned char* out;

unsigned long outlen;

unsigned long outcnt;

const unsigned char* in;

unsigned long inlen;

unsigned long incnt;

int bitbuf;

int bitcnt;

jmp_buf env;

};

static int puff_bits(struct puff_state* s, int need) {

long val = s->bitbuf;

while (s->bitcnt < need) {

if (s->incnt == s->inlen)

longjmp(s->env, 1);

val |= (long)(s->in[s->incnt++]) << s->bitcnt;

s->bitcnt += 8;

}

s->bitbuf = (int)(val >> need);

s->bitcnt -= need;

return (int)(val & ((1L << need) - 1));

}

static int puff_stored(struct puff_state* s) {

s->bitbuf = 0;

s->bitcnt = 0;

if (s->incnt + 4 > s->inlen)

return 2;

unsigned len = s->in[s->incnt++];

len |= s->in[s->incnt++] << 8;

if (s->in[s->incnt++] != (~len & 0xff) ||

s->in[s->incnt++] != ((~len >> 8) & 0xff))

return -2;

if (s->incnt + len > s->inlen)

return 2;

if (s->outcnt + len > s->outlen)

return 1;

for (; len--; s->outcnt++, s->incnt++) {

if (s->in[s->incnt])

s->out[s->outcnt] = s->in[s->incnt];

}

return 0;

}

struct puff_huffman {

short* count;

short* symbol;

};

static int puff_decode(struct puff_state* s, const struct puff_huffman* h) {

int first = 0;

int index = 0;

int bitbuf = s->bitbuf;

int left = s->bitcnt;

int code = first = index = 0;

int len = 1;

short* next = h->count + 1;

while (1) {

while (left--) {

code |= bitbuf & 1;

bitbuf >>= 1;

int count = *next++;

if (code - count < first) {

s->bitbuf = bitbuf;

s->bitcnt = (s->bitcnt - len) & 7;

return h->symbol[index + (code - first)];

}

index += count;

first += count;

first <<= 1;

code <<= 1;

len++;

}

left = (MAXBITS + 1) - len;

if (left == 0)

break;

if (s->incnt == s->inlen)

longjmp(s->env, 1);

bitbuf = s->in[s->incnt++];

if (left > 8)

left = 8;

}

return -10;

}

static int puff_construct(struct puff_huffman* h, const short* length, int n) {

int len;

for (len = 0; len <= MAXBITS; len++)

h->count[len] = 0;

int symbol;

for (symbol = 0; symbol < n; symbol++)

(h->count[length[symbol]])++;

if (h->count[0] == n)

return 0;

int left = 1;

for (len = 1; len <= MAXBITS; len++) {

left <<= 1;

left -= h->count[len];

if (left < 0)

return left;

}

short offs[MAXBITS + 1];

offs[1] = 0;

for (len = 1; len < MAXBITS; len++)

offs[len + 1] = offs[len] + h->count[len];

for (symbol = 0; symbol < n; symbol++)

if (length[symbol] != 0)

h->symbol[offs[length[symbol]]++] = symbol;

return left;

}

static int puff_codes(struct puff_state* s,

const struct puff_huffman* lencode,

const struct puff_huffman* distcode) {

static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13,

15, 17, 19, 23, 27, 31, 35, 43, 51, 59,

67, 83, 99, 115, 131, 163, 195, 227, 258};

static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2,

2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};

static const short dists[30] = {

1, 2, 3, 4, 5, 7, 9, 13, 17, 25,

33, 49, 65, 97, 129, 193, 257, 385, 513, 769,

1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577};

static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3,

4, 4, 5, 5, 6, 6, 7, 7, 8, 8,

9, 9, 10, 10, 11, 11, 12, 12, 13, 13};

int symbol;

do {

symbol = puff_decode(s, lencode);

if (symbol < 0)

return symbol;

if (symbol < 256) {

if (s->outcnt == s->outlen)

return 1;

if (symbol)

s->out[s->outcnt] = symbol;

s->outcnt++;

} else if (symbol > 256) {

symbol -= 257;

if (symbol >= 29)

return -10;

int len = lens[symbol] + puff_bits(s, lext[symbol]);

symbol = puff_decode(s, distcode);

if (symbol < 0)

return symbol;

unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);

if (dist > s->outcnt)

return -11;

if (s->outcnt + len > s->outlen)

return 1;

while (len--) {

if (dist <= s->outcnt && s->out[s->outcnt - dist])

s->out[s->outcnt] = s->out[s->outcnt - dist];

s->outcnt++;

}

} while (symbol != 256);

return 0;

}

static int puff_fixed(struct puff_state* s) {

static int virgin = 1;

static short lencnt[MAXBITS + 1], lensym[FIXLCODES];

static short distcnt[MAXBITS + 1], distsym[MAXDCODES];

static struct puff_huffman lencode, distcode;

if (virgin) {

lencode.count = lencnt;

lencode.symbol = lensym;

distcode.count = distcnt;

distcode.symbol = distsym;

short lengths[FIXLCODES];

int symbol;

for (symbol = 0; symbol < 144; symbol++)

lengths[symbol] = 8;

for (; symbol < 256; symbol++)

lengths[symbol] = 9;

for (; symbol < 280; symbol++)

lengths[symbol] = 7;

for (; symbol < FIXLCODES; symbol++)

lengths[symbol] = 8;

puff_construct(&lencode, lengths, FIXLCODES);

for (symbol = 0; symbol < MAXDCODES; symbol++)

lengths[symbol] = 5;

puff_construct(&distcode, lengths, MAXDCODES);

virgin = 0;

}

return puff_codes(s, &lencode, &distcode);

}

static int puff_dynamic(struct puff_state* s) {

static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5,

11, 4, 12, 3, 13, 2, 14, 1, 15};

int nlen = puff_bits(s, 5) + 257;

int ndist = puff_bits(s, 5) + 1;

int ncode = puff_bits(s, 4) + 4;

if (nlen > MAXLCODES || ndist > MAXDCODES)

return -3;

short lengths[MAXCODES];

int index;

for (index = 0; index < ncode; index++)

lengths[order[index]] = puff_bits(s, 3);

for (; index < 19; index++)

lengths[order[index]] = 0;

short lencnt[MAXBITS + 1], lensym[MAXLCODES];

struct puff_huffman lencode = {lencnt, lensym};

int err = puff_construct(&lencode, lengths, 19);

if (err != 0)

return -4;

index = 0;

while (index < nlen + ndist) {

int symbol;

int len;

symbol = puff_decode(s, &lencode);

if (symbol < 0)

return symbol;

if (symbol < 16)

lengths[index++] = symbol;

else {

len = 0;

if (symbol == 16) {

if (index == 0)

return -5;

len = lengths[index - 1];

symbol = 3 + puff_bits(s, 2);

} else if (symbol == 17)

symbol = 3 + puff_bits(s, 3);

else

symbol = 11 + puff_bits(s, 7);

if (index + symbol > nlen + ndist)

return -6;

while (symbol--)

lengths[index++] = len;

}

if (lengths[256] == 0)

return -9;

err = puff_construct(&lencode, lengths, nlen);

if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))

return -7;

short distcnt[MAXBITS + 1], distsym[MAXDCODES];

struct puff_huffman distcode = {distcnt, distsym};

err = puff_construct(&distcode, lengths + nlen, ndist);

if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))

return -8;

return puff_codes(s, &lencode, &distcode);

}

static int puff(unsigned char* dest,

unsigned long* destlen,

const unsigned char* source,

unsigned long sourcelen) {

struct puff_state s = {

.out = dest,

.outlen = *destlen,

.outcnt = 0,

.in = source,

.inlen = sourcelen,

.incnt = 0,

.bitbuf = 0,

.bitcnt = 0,

};

int err;

if (setjmp(s.env) != 0)

err = 2;

else {

int last;

do {

last = puff_bits(&s, 1);

int type = puff_bits(&s, 2);

err = type == 0 ? puff_stored(&s)

: (type == 1 ? puff_fixed(&s)

: (type == 2 ? puff_dynamic(&s) : -1));

if (err != 0)

break;

} while (!last);

}

*destlen = s.outcnt;

return err;

}

//% END CODE DERIVED FROM puff.{c,h}

#define ZLIB_HEADER_WIDTH 2

static int puff_zlib_to_file(const unsigned char* source,

unsigned long sourcelen,

int dest_fd) {

if (sourcelen < ZLIB_HEADER_WIDTH)

return 0;

source += ZLIB_HEADER_WIDTH;

sourcelen -= ZLIB_HEADER_WIDTH;

const unsigned long max_destlen = 132 << 20;

void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ,

MAP_PRIVATE | MAP_ANON, -1, 0);

if (ret == MAP_FAILED)

return -1;

unsigned char* dest = (unsigned char*)ret;

unsigned long destlen = max_destlen;

int err = puff(dest, &destlen, source, sourcelen);

if (err) {

munmap(dest, max_destlen);

errno = -err;

return -1;

}

if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {

munmap(dest, max_destlen);

return -1;

}

return munmap(dest, max_destlen);

}

static int setup_loop_device(unsigned char* data,

unsigned long size,

const char* loopname,

int* loopfd_p) {

int err = 0, loopfd = -1;

int memfd = syscall(__NR_memfd_create, "syzkaller", 0);

if (memfd == -1) {

err = errno;

goto error;

}

if (puff_zlib_to_file(data, size, memfd)) {

err = errno;

goto error_close_memfd;

}

loopfd = open(loopname, O_RDWR);

if (loopfd == -1) {

err = errno;

goto error_close_memfd;

}

if (ioctl(loopfd, LOOP_SET_FD, memfd)) {

if (errno != EBUSY) {

err = errno;

goto error_close_loop;

}

ioctl(loopfd, LOOP_CLR_FD, 0);

usleep(1000);

if (ioctl(loopfd, LOOP_SET_FD, memfd)) {

err = errno;

goto error_close_loop;

}

close(memfd);

*loopfd_p = loopfd;

return 0;

error_close_loop:

close(loopfd);

error_close_memfd:

close(memfd);

error:

errno = err;

return -1;

}

static long syz_mount_image(volatile long fsarg,

volatile long dir,

volatile long flags,

volatile long optsarg,

volatile long change_dir,

volatile unsigned long size,

volatile long image) {

unsigned char* data = (unsigned char*)image;

int res = -1, err = 0, loopfd = -1, need_loop_device = !!size;

char* mount_opts = (char*)optsarg;

char* target = (char*)dir;

char* fs = (char*)fsarg;

char* source = NULL;

char loopname[64];

if (need_loop_device) {

memset(loopname, 0, sizeof(loopname));

snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);

if (setup_loop_device(data, size, loopname, &loopfd) == -1)

return -1;

source = loopname;

}

mkdir(target, 0777);

char opts[256];

memset(opts, 0, sizeof(opts));

if (strlen(mount_opts) > (sizeof(opts) - 32)) {

}

strncpy(opts, mount_opts, sizeof(opts) - 32);

if (strcmp(fs, "iso9660") == 0) {

flags |= MS_RDONLY;

} else if (strncmp(fs, "ext", 3) == 0) {

bool has_remount_ro = false;

char* remount_ro_start = strstr(opts, "errors=remount-ro");

if (remount_ro_start != NULL) {

char after = *(remount_ro_start + strlen("errors=remount-ro"));

char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);

has_remount_ro = ((before == '\0' || before == ',') &&

(after == '\0' || after == ','));

}

if (strstr(opts, "errors=panic") || !has_remount_ro)

strcat(opts, ",errors=continue");

} else if (strcmp(fs, "xfs") == 0) {

strcat(opts, ",nouuid");

}

res = mount(source, target, fs, flags, opts);

if (res == -1) {

err = errno;

goto error_clear_loop;

}

res = open(target, O_RDONLY | O_DIRECTORY);

if (res == -1) {

err = errno;

goto error_clear_loop;

}

if (change_dir) {

res = chdir(target);

if (res == -1) {

err = errno;

}

error_clear_loop:

if (need_loop_device) {

ioctl(loopfd, LOOP_CLR_FD, 0);

close(loopfd);

}

errno = err;

return res;

}

static void kill_and_wait(int pid, int* status) {

kill(-pid, SIGKILL);

kill(pid, SIGKILL);

for (int i = 0; i < 100; i++) {

if (waitpid(-1, status, WNOHANG | __WALL) == pid)

return;

usleep(1000);

}

DIR* dir = opendir("/sys/fs/fuse/connections");

if (dir) {

for (;;) {

struct dirent* ent = readdir(dir);

if (!ent)

break;

if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)

continue;

char abort[300];

snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",

ent->d_name);

int fd = open(abort, O_WRONLY);

if (fd == -1) {

continue;

}

if (write(fd, abort, 1) < 0) {

}

close(fd);

}

closedir(dir);

} else {

}

while (waitpid(-1, status, __WALL) != pid) {

}

static void reset_loop() {

char buf[64];

snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);

int loopfd = open(buf, O_RDWR);

if (loopfd != -1) {

ioctl(loopfd, LOOP_CLR_FD, 0);

close(loopfd);

}

static void setup_test() {

prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);

setpgrp();

write_file("/proc/self/oom_score_adj", "1000");

}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void) {

int iter = 0;

for (;; iter++) {

reset_loop();

int pid = fork();

if (pid < 0)

exit(1);

if (pid == 0) {

setup_test();

execute_one();

exit(0);

}

int status = 0;

uint64_t start = current_time_ms();

for (;;) {

if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)

break;

sleep_ms(1);

if (current_time_ms() - start < 5000)

continue;

kill_and_wait(pid, &status);

break;

}

void execute_one(void) {

NONFAILING(memcpy((void*)0x20000040, "vfat\000", 5));

NONFAILING(memcpy((void*)0x20000200, "./file0\000", 8));

NONFAILING(syz_mount_image(/*fs=*/0x20000040, /*dir=*/0x20000200,

/*flags=*/0x220e002, /*opts=*/0, /*chdir=*/1,

/*size=*/0, /*img=*/0x20000100));

NONFAILING(memcpy((void*)0x20000040, "mtd", 3));

NONFAILING(sprintf((char*)0x20000043, "0x%016llx", (long long)0));

NONFAILING(memcpy((void*)0x200000c0, "./file0\000", 8));

NONFAILING(memcpy((void*)0x20001200, "jffs2\000", 6));

syscall(__NR_mount, /*src=*/0x20000040ul, /*dst=*/0x200000c0ul,

/*type=*/0x20001200ul, /*flags=*/0ul, /*data=*/0ul);

NONFAILING(memcpy((void*)0x200001c0, "./file0\000", 8));

NONFAILING(memcpy((void*)0x200002c0, "security.evm\000", 13));

NONFAILING(*(uint8_t*)0x20002040 = 3);

NONFAILING(*(uint8_t*)0x20002041 = 2);

NONFAILING(*(uint8_t*)0x20002042 = 0xb);

NONFAILING(*(uint32_t*)0x20002043 = htobe32(4));

NONFAILING(*(uint16_t*)0x20002047 = htobe16(0x1000));

NONFAILING(memcpy(

(void*)0x20002049,

"\x78\x8d\x9c\xb2\x99\xab\xd7\x2e\xce\x91\x3d\x53\x36\x5e\x16\x68\x8e\x51"

"\xac\xe1\x59\x84\xab\x53\xd1\x66\x6a\xe3\xf5\xdf\xbc\x86\x0b\xef\x87\x38"

"\x9e\x21\x28\x6b\xe2\x36\xdd\xc3\xd0\xfa\x2e\x51\xd5\xc5\xc7\xb3\x5c\x5d"

"\x50\x3c\x5b\x2c\x3b\x6b\xe0\xfc\x56\xe9\x7d\xf8\x8f\xaa\x06\x35\x36\x3b"

"\xa9\x2b\x82\xc4\x7a\x81\x7a\xc9\x7f\x1d\x63\x8a\x14\x61\x82\x12\x55\xec"

"\x23\xbd\x0c\xe5\xbf\x10\x94\xe3\xa8\x98\x0d\x7e\x6d\x19\x76\xba\x77\x87"

"\x45\x92\x0e\x17\x18\xfd\xda\xc4\xbd\x66\xb0\xa6\x06\x80\x1a\xae\xfd\xed"

"\x29\x3c\x3f\xce\xba\xd3\xb2\xc0\x64\x03\xdb\xa9\x99\x49\x71\x65\x9b\x7f"

"\x4a\x07\x7a\xdd\xae\xb8\xae\x3e\x5a\xca\x70\x27\xfd\xe1\xe4\x00\x01\xc0"

"\xbd\xd8\x00\xbc\xc2\x87\xe0\x2c\x86\x7e\x27\x82\xde\xaf\x67\x6a\x26\x16"

"\x47\xdb\x8c\x2f\x39\x45\x02\x20\x57\xde\x76\x81\x00\xa8\xbf\x73\xd9\xf9"

"\xff\x29\x22\x9b\x46\xde\xad\x58\xb2\xdd\xf9\x64\x33\x46\x8e\x9e\xee\x89"

"\x50\xdf\x65\x87\x11\xe4\x11\x36\x4e\x44\x14\x5e\x68\x2f\x3c\x05\x3c\x6f"

"\x5a\x18\x61\xee\xe6\xed\xf8\x85\xa9\x7c\x54\x58\x05\xac\x0c\x35\xa5\xe4"

"\x62\x3b\x20\x01\x86\x1c\x59\x33\x54\xb5\x70\xff\x3b\x4a\x45\xf1\xac\xde"

"\x0a\x8d\xbd\x17\xc0\x9c\xe4\x48\xed\x5d\xfd\x9e\x74\x72\xe6\x89\x67\xde"

"\xcb\x76\x9f\xa6\x00\xcd\x30\xbe\xb6\xc8\x03\x0e\x94\x74\xc7\xec\x4c\x1d"

"\xaf\x3e\x00\x7b\xbc\x57\x65\xb3\x66\xd4\xa1\x76\xe3\x8b\xdf\xab\xed\xd2"

"\xb0\x76\xa5\xed\x7d\x50\xf5\x17\x7b\x94\xa6\xa0\xf0\x00\xcd\x3a\xca\xdd"

"\xe8\xe8\x0f\x66\xea\xda\x14\x01\x86\x20\xb1\x59\xe9\xe1\x4c\x25\x2d\x20"

"\xc8\xdb\xb0\xfe\x36\x05\xb5\x69\x8b\x53\xe4\x21\x0b\x62\xfc\xbd\x00\x01"

"\x7e\xaa\x01\xeb\x1f\xa5\x21\xbd\xb8\xd3\x0e\x83\x95\x1b\x4e\xa0\x28\x6c"

"\x8f\x0d\x46\x45\x17\xa1\x1d\x79\x22\xd6\xcc\xe4\xd2\x05\x8e\xc8\xcd\x7b"

"\x02\xb7\x3d\x82\x5d\x7e\x0a\xbb\xbd\x85\xe9\x91\x22\x0f\xc7\x99\x55\x34"

"\xb7\xb1\x99\x8c\xa7\x52\x89\x0b\x07\x9a\x7c\xa3\xfd\xe5\x64\x38\xcf\x82"

"\xd5\xdd\x9e\xdb\xd1\x1f\xd2\x93\xc1\x7d\x1c\xf1\x66\x57\xd0\xb3\x52\xa8"

"\xc6\xc3\x63\x00\xad\x09\xa7\x8e\x3e\xe3\x91\x3b\x9b\x6f\x53\xde\xbf\xfc"

"\x7e\x32\xbf\xb6\x4b\x0e\x8c\xbe\x07\xfe\x9b\x0d\xad\xb0\x97\xae\xb2\xc2"

"\x42\x43\x0b\xec\x75\x63\x0a\x39\x21\x82\x8a\x73\x14\xde\x14\x04\x82\x9e"

"\x7a\xfb\x3b\x84\x20\xe8\x5f\x2c\x8f\x6e\x88\xde\x04\x23\x14\x41\x6e\x5c"

"\x00\xc5\x9b\x22\x20\x80\x04\xbe\xc1\x61\xf8\x45\x7c\x7f\x8e\x3a\x8c\xa4"

"\x17\x4a\x4b\x78\xdf\x6e\x46\x0d\x56\xd2\x4e\x01\xae\x1a\x24\x11\x27\x0f"

"\x79\xd0\x20\xa6\xba\xc8\x55\xf1\xa3\xef\x7b\x3d\x09\x91\x88\x26\x56\xb4"

"\x08\xdc\xda\xf0\x2d\xb4\x6a\xc8\xfc\xab\x0c\x87\x5d\x1f\x2e\x8d\xb3\x66"

"\xe6\xa2\x0c\xb6\x7a\x4d\xb9\x20\x38\x2a\x69\x15\x71\x5d\x3b\x42\x66\xf7"

"\x79\xfe\x86\x33\xbe\xa6\xde\xf2\x8c\xc1\x59\x13\x8b\x83\x43\x34\xce\xde"

"\xf3\xde\xc5\x4e\xa5\x30\x3d\xf5\x6b\xe8\x71\x15\x31\x5e\xc0\xf1\x47\x8a"

"\x0c\x08\x69\xe5\xf7\xc3\x3d\xa6\x4b\x23\xaf\x58\x11\x75\x10\x55\xc9\x08"

"\x49\x48\x44\x81\xd5\xa1\x0d\x72\xe0\x8c\xcd\x12\x71\x0c\x4f\x2f\xf5\x86"

"\xa9\xea\x17\x5f\x4a\xa7\x0b\x15\x6c\x00\xc5\x7e\x22\xc1\x36\x0b\xfc\x7d"

"\x36\xaa\x47\x92\x44\x4f\x81\xd8\xa0\xed\x41\xbf\x6a\x45\x2e\xa5\x26\x8b"

"\x86\x05\x68\x2a\xc6\x3e\xaa\x46\x52\x18\xf4\xd9\x62\xdb\x42\x15\x4d\x01"

"\x96\x6d\x3a\xd8\xfc\x2f\xde\x48\xef\x71\xbe\x08\xbe\x58\xe5\xad\x6d\x5a"

"\x35\x93\xef\xc9\xc1\x33\x6e\x54\x13\x72\xa3\x47\x99\xd2\x4e\xa0\x0d\x4d"

"\x49\x85\xbe\xd1\xda\xb1\x06\x20\x91\x1e\x9f\x69\x67\x88\x08\x26\xbe\x5a"

"\x1f\x1b\xb4\xb2\xa3\x94\x86\x54\xc6\x93\x5c\xaf\xeb\x49\x25\xe1\x07\xa0"

"\x1f\x9d\xda\x66\x8e\x5f\xd7\x48\x9e\x82\x13\x92\x41\xa9\x19\x0f\x09\x0a"

"\xfe\x20\x94\x23\x4c\x75\xfe\xc0\x74\x62\x27\x48\xd4\xdd\x78\x2a\x93\x0f"

"\x42\xb0\xe7\x5d\x92\x4b\xef\x68\xff\xaf\xba\xa9\x89\x16\x15\x1a\x36\xef"

"\x29\x98\xaf\xd3\x00\x09\x55\xef\xbf\xa0\xa9\xa0\x08\x35\x8c\x11\x04\x3c"

"\x0f\x96\xb5\x2f\xc7\x8a\x42\x53\x1a\xa5\xdf\xd8\xde\x09\x51\x8c\xff\x00"

"\x8b\x33\x92\x59\xb2\x66\xc4\x88\xbb\x1d\xa0\x58\xba\x21\x8c\xd6\x4b\x3e"

"\x41\x3c\xa2\x88\x9d\x10\x86\xe8\xc4\x0a\xe1\x15\x01\x98\x41\x21\xdc\xfa"

"\x2f\xde\x09\xd0\x68\xf6\xdb\xbe\x83\x59\x98\x0d\xad\x96\xed\x22\x0b\x85"

"\x34\xaa\xef\x35\x3d\xfc\x81\x56\x09\x07\xd2\x6c\x02\x44\x29\x24\xad\x55"

"\xb1\x1d\x3a\xee\x7e\x55\x16\xd9\x6a\xd0\x78\xc8\x5a\xd1\xcd\xb1\x8a\x45"

"\x47\x43\x05\xa8\xdb\x35\x0f\x98\x44\x38\x0e\x20\x94\xf6\x91\xa0\x5e\xa0"

"\x94\x58\xbc\x53\xf3\x23\x6a\x1f\x3f\xa5\xe1\x44\xa5\x75\xba\x57\xe5\x8d"

"\x00\xf7\x65\x3d\x2e\x6b\x6c\xbe\x18\xd2\x8c\xe3\xf5\x79\x25\x38\xad\x20"

"\xc0\xe0\xe1\x0b\x03\xda\xc3\x40\x09\xd6\xd3\xe4\xc7\x66\x2c\xca\x88\xb5"

"\x30\x66\xe9\x5e\xfe\x45\xee\x3e\x04\xda\x32\x86\x90\xda\xe1\xaa\x00\x70"

"\xf0\x94\x5e\x26\x9b\x75\x73\x3b\x10\x6f\xf6\x51\x45\x55\xd5\x4d\x95\x8f"

"\x73\x13\x44\x1f\xa2\x1f\x97\x61\x53\x12\xc4\xf6\x00\xa1\x43\x0f\x62\x98"

"\x12\xf2\x3c\xd2\x1e\x70\x3b\x96\x6e\x04\xaa\x6d\x0b\xba\x6f\x25\x39\x36"

"\x9a\x3b\xad\xeb\xfa\xa8\x19\x7d\x89\xe3\x29\x4b\x44\xc0\xea\x54\xae\x6b"

"\x7f\x4a\x49\x65\x68\x04\x31\x75\xa5\x66\x65\x41\xb5\x59\xa9\xfe\xaf\x0c"

"\x54\x54\xf1\x2f\x23\x0e\x97\xbc\xf8\x4d\xae\x11\xd1\xa8\x35\x94\x11\xb9"

"\x8b\xb6\x06\x3e\xe8\xae\x0f\xfa\x30\xb5\x75\x77\x71\xc7\xb7\x0e\x4f\xbb"

"\x6e\x95\x1a\x68\x08\x73\xe6\xda\x53\x16\x00\xe9\x51\x11\x0c\x34\xca\xac"

"\xc8\xe9\x78\xc0\x6b\x48\x48\xc8\x80\xc4\x8a\xd8\xe6\xc5\x4b\xc7\x92\xce"

"\x54\xea\x4b\x1c\x05\xab\x04\xaf\xb4\xd6\xca\xb2\x5b\x85\xd1\xc4\xb6\xc4"

"\x74\xc7\xec\x92\x67\xb5\x01\xed\xaa\x20\xee\x0e\x41\x58\x68\xd8\x78\x66"

"\x42\x6b\x13\x74\xe5\x8a\x66\x65\x30\xb9\x4e\x34\x2c\x8b\x2e\xbd\xd4\x05"

"\xfe\xf0\xa2\x6d\xf8\x2b\xbc\x50\x2d\xa2\xca\x15\x50\xc2\x8d\x3c\x0b\x69"

"\x87\x2f\xf8\x61\xcd\x23\xcb\x6e\x1f\xf1\xe6\x2f\x62\x5a\xe9\x2f\x90\xf3"

"\x09\x33\xfc\x82\x7e\xdd\x38\x61\x21\x31\x53\x52\xdb\xc9\xf4\xca\xb3\xdd"

"\xda\xde\xb8\xdf\x05\x1d\x2f\x59\xcd\x59\xe9\x7d\xc9\x2c\xe4\x34\x1f\x97"

"\x80\x03\xe4\x86\x85\xe7\x67\x3c\xf1\xe6\x02\x60\x60\x0e\x7c\xbf\x73\x1d"

"\xc1\x68\xb9\xa4\x11\xdc\x3c\x85\xf8\x43\xbd\x2c\x5f\xca\x89\xc0\x6d\x12"

"\xba\xc0\x8a\x61\xcf\x09\x9a\xe5\xf2\x3e\x5e\x90\x84\x48\xe8\x1f\x27\x79"

"\xb3\x85\xb3\x1d\xcd\x5c\xf8\xaa\xad\x4b\x85\xae\x70\x63\x62\x4a\x7d\xf5"

"\x73\xae\xcc\xc8\xb6\x19\x77\xf8\xec\x10\xe6\x8b\x5d\xf1\xc1\xb8\x05\xc7"

"\xe0\x01\x22\x8a\x65\xc0\xe7\x72\xc5\x25\x14\x66\xa4\x9f\x10\x21\x9b\xb7"

"\x18\xa4\xaa\x2e\x35\xc4\x08\x11\xa9\x72\xeb\x58\x53\x0f\x7f\x07\x41\xd3"

"\xbe\x0c\x00\xe3\x8f\x58\x99\x4a\x51\x99\x54\x7f\xc5\x15\x0c\x78\x1f\xfe"

"\x2e\x56\x56\x0f\x08\xeb\x75\xbf\xcd\x90\x85\xff\x14\x0c\xee\xfd\x0d\x6e"

"\xd4\x3d\xad\x39\xd2\xcd\xa8\x69\x4d\x42\x0e\x86\x1a\x1d\xec\x4a\x28\xd1"

"\xcf\x53\x24\xc5\xc5\xab\x81\x92\x21\x54\x87\x3b\x3f\x82\xdf\x1b\xc0\x6c"

"\xb9\x56\x5c\x08\xf7\x74\xd9\xfa\x6f\xe5\x75\xda\xf8\x7b\x32\x8a\xb1\x0b"

"\x91\x22\x43\xf1\x00\x71\x2a\x27\xf4\x98\x1f\xaa\x37\x2d\x73\x67\x02\xc5"

"\x65\xa0\x8c\x4d\x6b\x0a\xa3\x12\xd3\xc9\x01\x7f\xd1\xe7\xab\x98\x1d\xe7"

"\xee\x1d\xfc\x1a\x84\x99\x24\xaa\x92\xea\xb1\xb3\xe6\xe9\x74\x2f\x69\x13"

"\xa0\x8b\x56\x99\xd6\x70\x69\x7a\x60\x8d\x74\x9e\x06\xc3\x41\x42\x1a\x80"

"\x9a\x36\x5d\xca\x3f\x8d\x88\xd8\x42\x68\x50\x80\xf8\xed\x93\x48\x28\x88"

"\x06\x5b\x50\xbf\x9a\xbd\xe7\x5f\xe3\x7c\x8f\xf2\xae\x4f\x24\xe2\x6f\x83"

"\x94\x9a\xb5\xc4\xf4\xa9\x6e\x13\xb2\xcd\xf7\x42\xda\xf9\xc1\xb5\x83\x05"

"\x69\x14\x56\xc6\xc1\x90\xbf\xb7\xbb\xbb\x08\x4e\xa9\xf9\x7e\x99\xc3\xe0"

"\x28\x41\x5d\x4e\x05\xcc\xf7\x71\x7b\x57\x97\xff\x5b\xaf\xa2\x51\x8a\x0a"

"\xca\xb4\x34\xa1\x88\xd4\x79\x7a\x85\xf3\x65\x57\xdd\x6a\xa3\x9c\x75\xe8"

"\x0b\x72\x49\x63\x72\x65\x25\x44\xb1\x42\x49\x01\xa6\xa9\xd4\xb7\x45\x30"

"\x86\xb6\xba\x26\xa4\x05\x21\xda\x94\xab\x54\xde\x4a\x11\xb5\x1b\x4a\xd7"

"\xab\x1d\x68\x05\xf3\x23\xb0\x44\x95\x5f\x77\x9c\xfe\x7c\x1c\x35\x86\xf4"

"\xbe\x0e\xab\x22\x6a\x25\xae\x16\xbd\x8d\xc7\xeb\x01\x50\x24\xb7\x43\x4b"

"\x64\x08\x34\x3a\x1b\xe6\xe1\xdd\x39\x25\xc1\x02\xb4\xc9\xc5\x43\x98\x38"

"\x35\xb6\xbb\x45\xf8\x0e\xa3\x5b\xf7\xfc\xec\xab\x5d\x94\x72\x24\xbf\xdb"

"\x1c\x03\xb2\x0f\xc0\x7a\x5c\xac\x63\x0b\xeb\x4b\x30\x44\xeb\xe5\x5c\x90"

"\x23\x84\x4c\x1f\xd6\x4b\x4e\xb0\x25\x53\x68\x67\xf0\xaf\xa3\x88\x57\x6c"

"\x5b\x25\x64\xcd\x2e\x20\xae\x26\x33\xf7\xb7\x6c\xf6\xfb\xce\xff\x24\x0f"

"\x65\xe5\xee\xba\x28\x43\xfa\xa1\xe7\x71\x08\xd3\x5c\x59\xb3\xf5\x70\x11"

"\x26\x60\xe9\x27\x8d\xa3\x12\x76\x86\xdc\x2a\x96\x5a\x6a\xd1\x67\x2e\x29"

"\xff\x9e\xdd\x62\xf4\x9e\x41\xbd\xd6\x53\x48\xd2\x65\x78\x46\xbe\x80\x47"

"\x9c\xea\x41\x5b\xfb\x59\x27\x22\x9f\x3b\x77\x2e\xd9\xc9\xb7\x63\x9d\x8f"

"\x75\xff\x66\x21\x84\x1a\x7b\x64\x97\x81\x31\xe8\x69\x52\xbf\xe5\x10\x71"

"\x5b\x25\xef\xbc\xf3\x93\x32\x0c\x1d\x62\x99\xac\x6c\x19\xdd\x90\x88\x70"

"\xf9\x6d\x92\xb8\xbd\xcf\x11\xe3\xc9\x87\x8f\x2e\x37\xbd\xaf\x72\x71\x8a"

"\xd0\xbc\x28\x72\xc7\xa0\xb1\x01\xf6\xe3\x92\x99\x72\x34\xe0\x6c\x9b\x1b"

"\xdc\x32\x49\x71\x42\x7d\x6b\x97\xc3\xc1\x65\x31\x17\x8f\x40\xa8\xab\x52"

"\xf9\x8e\x06\x67\x80\x97\x7a\xbd\x35\x2e\x1e\xfe\x61\x85\xf7\x02\x33\xb3"

"\x0f\xdc\x96\xb6\xa2\x89\xb9\xe0\xfc\xee\x55\x59\x23\xef\x59\x0b\xd9\xcd"

"\x2f\x0e\xf7\x02\x46\x41\x45\x0d\x1a\x92\x58\x04\x6a\xc0\xe8\x0a\xcd\x44"

"\xf2\x67\x44\x69\x46\xc0\x96\xdb\x98\x48\xf7\x8c\xdd\xba\x9f\x54\x09\xb0"

"\x90\xdd\x23\x44\xd8\xd4\x5a\x16\xcd\x2e\xcc\xe5\xbf\x22\xbd\x4c\xb8\x9a"

"\xfd\x30\x67\xcb\x0b\xd9\xa7\x27\x9b\xe1\xb1\xe5\x03\x49\x8f\x39\xed\xce"

"\x71\x4f\x37\x59\x7d\x0e\x64\x60\x71\x6d\x09\xea\x37\x6d\x73\xe8\xa7\x1f"

"\xff\x13\x24\xfa\x2a\xeb\xa7\x5e\x8b\xbd\x0e\xa4\xc4\x18\xb4\x57\x84\x55"

"\x01\x53\xd4\x92\x89\x8e\x15\xda\x88\xb6\xed\x3f\x67\xe8\x5d\xbb\x11\x1c"

"\x2f\xea\xc2\xfd\x78\xb6\xf9\x01\x1c\x68\x64\xb9\xbb\x11\x65\x36\x94\xf7"

"\xf0\x25\x68\xb7\x68\xb6\xa2\x7d\x08\x0e\xad\xc0\x09\x37\x44\xb9\x11\x5a"

"\xa2\xf8\xd0\x3f\xa2\x7f\xae\xa2\xe3\x56\xef\x8c\xe6\x2e\x47\x22\xdd\xd1"

"\x39\xf7\x84\xac\x3b\x8a\xfb\x98\xc8\xd3\x98\x4c\x8c\xf9\x43\x8e\x83\x71"

"\x03\x30\x42\x8b\x78\x30\xc1\x70\x9a\x30\x9b\xba\xc3\xbb\xdb\xd0\x83\xe5"

"\x39\x93\x8c\x57\x89\xe1\x70\x9d\x2c\x0e\xe9\x4d\xcb\x2f\xe6\x4c\x31\xc8"

"\x7d\x25\xcc\x7f\x82\x6b\xbf\x5e\x02\x1d\x5a\xaa\x17\x29\x70\xaa\xe9\x6a"

"\x68\x58\xf8\xc1\x1f\xdf\xb7\x48\x32\x8d\x97\x41\x1e\xdc\x10\xdd\x16\xfd"

"\x10\xfa\xa7\xc3\xb9\x4c\xe1\x91\x52\xfb\x29\x65\x69\x04\x21\xd3\xc6\xdb"

"\x2e\x7e\x88\x88\xc7\xbb\x06\x44\x3d\xb3\x11\x1e\x3d\xb6\x9a\x88\xdd\x09"

"\x7a\xb8\xc6\x4d\x6b\xea\x30\xda\x24\x7f\xcd\x11\x7a\x30\xee\xf4\x5c\xd9"

"\x33\x9a\x78\x37\x56\x28\xcd\xbf\xa2\x6d\x6b\x34\x19\xe6\x9b\xbe\x8e\x88"

"\x47\x91\x29\x68\x4b\x23\x04\xda\xa2\xd6\x84\x30\x48\x26\xee\xe9\x7d\x34"

"\x63\x03\xcc\x63\x1e\x10\x46\x5a\x2f\x92\x43\xe8\x4d\x32\x28\x10\x38\x8b"

"\xa2\xd3\x06\x26\xa6\x3d\xf9\x79\x3e\xb9\x63\xdf\x23\x48\x65\xcb\xb6\x8c"

"\xdb\xc0\x43\x63\xe1\x7a\x6a\x6e\xb1\xc8\x01\x41\x77\xc9\x9f\xaa\xcb\x8d"

"\x7a\x8e\x99\xd8\x97\x71\x8b\xc5\x10\x55\x72\x78\x20\xd3\x21\xf2\x5f\xd1"

"\x5d\x24\xd0\x29\xd4\xfa\xd6\xfd\xe9\x7f\x09\x11\x80\xef\x2b\xc3\x91\x3b"

"\xc1\x1f\x8f\x10\x4b\xcc\x7e\xa0\x02\x41\x57\x48\x1b\x35\x37\xce\x54\x3f"

"\xe8\xab\x93\xa2\x6c\xb9\xba\x51\xfa\x78\xd3\x37\xbf\x10\xba\x29\xdc\x5f"

"\xeb\xfe\x4a\xd0\x14\xbd\x40\xf3\x33\x30\x82\x3d\x7f\x45\x73\xba\xeb\xd9"

"\xe0\x63\xd5\x9a\x87\x66\x2b\xef\x85\x9c\xee\x8a\x8e\x53\x18\xaa\xe2\x2e"

"\x79\xfb\x4d\x31\xe0\x88\xf0\x56\x9c\x67\xbb\xa4\x18\x68\xfe\x46\x4e\xd7"

"\x7e\xc7\xfe\x07\xdd\x3a\x5c\x2c\x81\xc1\xfd\xed\x16\x05\x98\xb3\x75\x64"

"\x51\x31\x73\xf1\x3f\xee\xb9\xdf\x4b\x47\xed\xe8\x05\x0a\xac\x43\x1e\x1b"

"\x20\x58\xc6\xaf\xe7\xe4\x4b\xcc\x6f\x28\xdc\x58\x33\xdd\xed\x10\xe6\x91"

"\x7e\x15\xb9\x30\x88\xcd\x90\x79\x18\x26\xca\x7c\x3b\x9a\x42\x11\xe9\xe2"

"\xff\xd4\x96\x62\x23\x81\x6d\xb6\xe4\xed\xe5\x70\x1b\x76\x98\x8d\x8f\x34"

"\xaa\x14\x0f\xfb\x4b\xc3\xef\xfc\xcb\xe5\xaf\x39\x42\xd4\xc5\x71\x77\x00"

"\xe5\x92\xa1\x70\x01\xd2\x0b\x66\x5f\xb7\xc6\xf6\x53\x61\x10\x8a\x13\x70"

"\xa4\x5d\xb4\x77\xa1\xf4\x49\xe5\xc3\xf9\xa8\x9f\x96\x72\x90\xaf\x23\x1d"

"\xb8\x2f\xed\xec\xfc\xa2\xc3\xce\xdf\xfe\xad\xb7\x75\x72\x8b\x45\xce\x4b"

"\xde\x06\x30\xe9\xe1\xdf\xcd\x98\x13\x8a\x55\x6d\xd4\x0b\x65\x55\x81\xb4"

"\x51\xa7\x16\x4a\xd5\x7c\x4f\xb2\xb5\xdc\x5b\x14\x5e\x87\x33\xde\x33\xaf"

"\x84\x4e\x40\x04\x14\xf8\x5c\x28\xca\x1f\x88\x8e\x70\xc4\x5d\x28\xc8\x23"

"\xe0\x7e\xdd\xf3\x0d\xf7\x91\x1d\xf5\x84\xad\x45\x8a\x25\x35\x50\x84\x16"

"\x3a\x9a\x7c\xc3\xba\xc4\x27\x6e\x95\x72\x11\x62\x6e\x28\x82\x12\x00\x53"

"\x34\xde\xc7\x42\xcf\xe5\x7e\x6c\x82\x34\xe5\x20\xd8\xbe\xd4\x5a\xf4\x76"

"\x77\x0f\x47\x18\xf7\x99\xc1\xa1\xf6\x37\xfc\x04\xa7\x37\x80\xa3\x5d\x21"

"\x94\xe6\x01\x7e\x40\x5d\x3e\x0b\x1e\x9f\x2c\x7c\x0f\x6a\x0e\xd2\x8a\x2e"

"\xaf\xdd\x79\x22\x76\x20\x59\xfe\x0e\xbc\x77\x59\x92\x45\xb1\x2c\x9f\x0c"

"\xef\x9e\xda\xb1\xa2\x51\x71\xa6\xa9\xa0\x56\x2e\x24\xdb\x76\xe2\x5d\xfb"

"\x5e\xcb\x73\x52\xd0\xbf\xc7\x8d\x85\x8e\x8a\xaa\xc9\x13\xef\xa4\xff\x60"

"\x48\x96\x79\xe8\xc7\x20\x19\x89\x7a\x8a\x85\xa9\xee\x29\xf1\x09\x22\x31"

"\x5b\xa7\xdb\x0a\x12\x6f\x82\x7c\x03\xfa\x5b\xbb\x90\xf9\x91\xcb\x98\x66"

"\xb3\xe0\x30\x47\xcb\x1f\xab\xbb\xdb\xe5\xa3\x52\x82\xf0\x30\xc0\xdb\xdb"

"\xd2\x27\xf8\x5b\x05\x72\x1c\x45\xc8\xb2\xb8\x5d\x33\x10\xbb\x41\xd6\xaa"

"\x56\x14\xa6\x0d\x98\x74\xd1\x2f\x11\xf5\xa9\x4b\x15\xf7\x41\xdb\x31\x0c"

"\x92\x7b\x2e\x90\x60\x7a\x2a\xf8\xc4\xb5\x7d\x6b\x69\x37\xd5\xa1\xeb\x14"

"\x58\x9d\x1e\x36\x16\x42\x45\x8c\xc2\xfb\xd2\x96\xac\x03\x1d\x09\x9d\xf4"

"\x9a\x53\xe8\xf0\xd4\x50\x6b\x2d\xcb\xb2\x0f\x54\x56\x0b\x69\x5a\x4e\x0a"

"\x4a\x5a\x13\x23\x19\x85\xd5\x3b\xb3\x53\x31\x26\xad\xd2\x81\xfd\x38\xcd"

"\xdf\x7e\xf4\x37\x20\x1e\x8a\xea\x1a\xb6\x3a\xd6\x73\xcd\xcc\x6c\x60\x41"

"\x14\xae\xc7\x71\x88\x1b\x4f\xb7\xaa\x7c\xcb\xd3\x97\xe7\x03\xf1\x08\x95"

"\x61\x9e\x15\xc7\x16\x84\xbb\xbf\xa2\xb2\xc6\x0a\x79\x0d\xe0\xe5\x05\x95"

"\x38\xb5\x1d\x34\x7a\x68\xad\x05\x74\x72\xa9\xf1\xea\xf0\x54\xdf\x77\x91"

"\xb5\x8f\x63\x8c\x05\x95\x55\xbb\xb9\x70\xed\xf8\x77\xd5\xf6\x23\xe2\x54"

"\x1d\xba\x27\xdf\x8d\x71\x3f\xe7\xc5\x5f\x40\xfb\xf3\xdb\xdc\x3d\x04\x2e"

"\x92\xb8\x3f\x94\xdd\x66\xd1\xcd\x2b\xc5\xcc\x98\xa6\xa5\x02\xb5\xd8\xd8"

"\xee\x6e\xfe\xca\xcf\xb7\x62\x46\x4c\x6f\x8c\xea\x8b\xda\xd1\x4a\x29\x19"

"\x99\x28\xe0\xcb\x07\xfb\xc3\x06\xb9\xee\xcc\xc4\xc7\xa3\x26\x18\x52\x54"

"\x41\x48\x92\xb6\x14\xdd\xcc\x20\xe9\xb5\xd2\x58\xe6\x62\x71\x43\x0c\x07"

"\x05\xc5\xa6\x22\xfa\x56\x46\xda\x48\x97\xa0\x88\xf6\x8f\xde\xb6\x68\x42"

"\xad\x3d\x72\xf2\x32\xf4\x87\xb3\xdb\x3b\x83\xd8\x26\x22\xc9\x1d\xaf\x77"

"\x96\x34\xfa\x1b\x97\xc7\xd5\xad\xb5\xd5\x3b\xe5\x19\x8b\xc5\x9a\xef\x1a"

"\xab\x60\xc3\x79\x52\x96\xa8\x4a\xc3\xf7\x73\x99\xfe\xed\x5b\x86\xf4\x4b"

"\x3a\x1c\xa3\x5e\xe4\x68\x91\xee\x90\x3a\x90\x34\x08\x83\xce\xc4\x1d\x57"

"\x7a\x88\x80\x94\x5b\x50\x4c\x7e\xa5\xbd\xc9\x4d\x66\xbf\x25\xb4\xd2\xe0"

"\x64\xbd\x69\xdf\xce\x4f\x00\xf8\xdf\xad\xe0\x73\x9f\xab\x52\x75\xdb\x11"

"\xe9\x99\xb2\x56\x22\xc2\x0c\xa0\xa9\xf1\x0f\x27\xc8\x00\xa4\xf5\xd1\x9a"

"\xa9\x2d\x04\xcd\x28\x2f\x96\xe9\x90\x30\x18\x74\xc5\xdd\xcf\xb1\x32\x23"

"\xc4\xf5\xfd\x37\xc4\x49\xad\xde\x53\x2a\x16\xae\xe6\x64\x07\xbf\xee\xee"

"\xbd\xa4\xf5\x13\xf2\x24\xe4\x34\xa9\xc0\x8a\x22\x81\xd5\xe1\xf4\x59\x1c"

"\x9a\x43\x3a\xb1\x57\x6c\x11\xed\xd0\xdf\x9f\xb6\xf4\x7b\x76\x1f\xc8\x78"

"\xd5\x32\xd7\xfc\x2a\x76\x24\x61\xfd\x14\x73\xeb\x7c\x7c\x88\x66\x8b\x74"

"\x9b\x9b\xbf\x43\xc9\x37\xfa\x2b\xd7\x3a\xe9\x17\xea\x2a\x90\x3b\xf5\xf7"

"\xd7\x1a\xe1\xc7\xd7\x1c\x60\xde\xf1\xbb\xc4\xe8\x15\x1b\xee\x5f\x4a\x39"

"\x63\x25\x90\x7f\x4f\x2b\xcb\xe9\x80\x38\xe4\x6b\xc9\xfb\x30\xd1\x99\xf0"

"\x25\xea\xbe\xb0\x37\xce\xae\xc3\xee\x18\x7f\x73\xa1\x36\xb8\x56\x6a\x94"

"\x3d\x5b\x32\x71\x19\x9e\x6d\x19\xb7\x06\x6d\x90\xb1\x0d\x0c\x11\xe7\xcb"

"\x0c\x0b\x5f\x73\x12\x7c\xd6\x85\xa7\x63\x8b\x99\xa1\xc9\xae\xa4\xfb\xf3"

"\xfa\xc6\x7a\x4b\x11\x4c\xa9\xfa\x60\xd2\xc9\xc2\x47\x23\xb0\x37\x14\x2e"

"\x3e\x47\x50\x3f\x3d\xfd\xff\xc4\x87\x21\x20\x90\xd2\x21\xeb\x85\xf5\x3c"

"\xf6\x17\x6c\x26\xb9\x3c\x75\x7b\x52\x1d\x01\x7c\xa1\x7a\xc7\x88\x9c\x26"

"\xc6\x47\x3f\xb4\x4c\xc2\xab\x79\xcd\x76\xfb\xf8\xfc\x5a\x81\xdc\x24\xbd"

"\x7b\xa6\xd5\x5d\x80\x36\xf4\xd6\x02\x18\xe7\xc8\xfd\xf7\xf3\xb9\x15\xef"

"\xd0\xbd\x0e\xdf\xac\x38\x0e\x37\x17\x79\x4a\xb4\x6b\x2a\x5d\xae\xd5\x8f"

"\xdb\x3e\xa6\x67\x20\xc0\xe7\x8a\x0c\xe8\x25\xb1\x55\xeb\xc0\x97\x9c\xf7"

"\x79\x15\xdb\x3d\xf6\x00\xbb\xd1\x79\xf1\xd2\xd6\x74\xd7\x6b\x12\xaf\xf0"

"\x87\x75\x7d\x4a\xa4\x80\xee\x15\x66\x78\x40\x74\xa5\x28\x7b\xe0\x08\x8e"

"\xfb\xe1\x2f\x55\x0b\xad\x3b\x41\x0c\xf0\x4f\xba\x8f\x06\xd1\x12\x0a\x1d"

"\xad\x35\xde\x9c\x7a\x22\xc3\xca\xf8\x3c\x1b\xf6\xea\x57\xa0\x55\xaf\xcb"

"\xc6\x1b\x06\x8f\xeb\x5d\x17\xf5\xd0\xcd\x9e\x59\x11\xd2\xd9\xc8\xc6\xff"

"\x89\xfc\x37\x72\x5a\x4b\x9a\xc3\xa8\x80\x0d\x17\x31\x19\x9c\x82\x01\xc0"

"\x52\x2e\x9a\xf7\x49\xfe\x36\xe1\x41\x94\x31\x0a\x5a\xaf\xd9\x44\xc3\x21"

"\xef\xb4\xec\xf5\xc1\x31\xcc\xf9\xde\x48\xc8\xb3\x6a\x90\x5f\x47\xeb\xa8"

"\xfb\x42\xce\x43\x5d\x1b\xd4\x08\xdc\x87\xb1\xc9\x15\x77\xff\xba\x16\xe3"

"\x2b\x9b\xe2\x19\x82\xd3\x17\x63\x20\xc8\xe2\x37\x99\xb6\xc5\xcc\x3d\x83"

"\x4c\xcb\xe9\xac\xed\xa7\x0b\xd2\xc7\x3a\x15\x41\x37\xac\xdd\x65\xf4\x19"

"\x1e\x44\x70\x89\x3e\xb2\x4e\x4a\xb0\x07\x00\xc2\xc1\x35\x14\x9f\xb8\x66"

"\x44\xb5\xac\x0b\xe1\x66\x92\x88\xb9\xc2\x9a\x1f\x6f\x61\x51\x7d\x8b\x4f"

"\x09\x61\x6e\x76\x7b\xd7\x2d\x13\xf8\x33",

4096));

syscall(__NR_lsetxattr, /*path=*/0x200001c0ul, /*name=*/0x200002c0ul,

/*val=*/0x20002040ul, /*size=*/0x1009ul, /*flags=*/3ul);

}

int main(void) {

syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,

/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);

syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul,

/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);

syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,

/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);

install_segv_handler();

for (procid = 0; procid < 4; procid++) {

if (fork() == 0) {

loop();

}

sleep(1000000);

return 0;

}

=* repro.txt =*

syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x220e002, 0x0, 0x1, 0x0, &(0x7f0000000100))

mount(&(0x7f0000000040)=ANY=[@ANYBLOB='mtd', @ANYRESHEX=0x0], &(0x7f00000000c0)='./file0\x00', &(0x7f0000001200)='jffs2\x00', 0x0, 0x0)

lsetxattr$security_evm(&(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), &(0x7f0000002040)=@v2={0x3, 0x2, 0xb, 0x4, 0x1000, "788d9cb299abd72ece913d53365e16688e51ace15984ab53d1666ae3f5dfbc860bef87389e21286be236ddc3d0fa2e51d5c5c7b35c5d503c5b2c3b6be0fc56e97df88faa0635363ba92b82c47a817ac97f1d638a1461821255ec23bd0ce5bf1094e3a8980d7e6d1976ba778745920e1718fddac4bd66b0a606801aaefded293c3fcebad3b2c06403dba9994971659b7f4a077addaeb8ae3e5aca7027fde1e40001c0bdd800bcc287e02c867e2782deaf676a261647db8c2f3945022057de768100a8bf73d9f9ff29229b46dead58b2ddf96433468e9eee8950df658711e411364e44145e682f3c053c6f5a1861eee6edf885a97c545805ac0c35a5e4623b2001861c593354b570ff3b4a45f1acde0a8dbd17c09ce448ed5dfd9e7472e68967decb769fa600cd30beb6c8030e9474c7ec4c1daf3e007bbc5765b366d4a176e38bdfabedd2b076a5ed7d50f5177b94a6a0f000cd3acadde8e80f66eada14018620b159e9e14c252d20c8dbb0fe3605b5698b53e4210b62fcbd00017eaa01eb1fa521bdb8d30e83951b4ea0286c8f0d464517a11d7922d6cce4d2058ec8cd7b02b73d825d7e0abbbd85e991220fc7995534b7b1998ca752890b079a7ca3fde56438cf82d5dd9edbd11fd293c17d1cf16657d0b352a8c6c36300ad09a78e3ee3913b9b6f53debffc7e32bfb64b0e8cbe07fe9b0dadb097aeb2c242430bec75630a3921828a7314de1404829e7afb3b8420e85f2c8f6e88de042314416e5c00c59b22208004bec161f8457c7f8e3a8ca4174a4b78df6e460d56d24e01ae1a2411270f79d020a6bac855f1a3ef7b3d0991882656b408dcdaf02db46ac8fcab0c875d1f2e8db366e6a20cb67a4db920382a6915715d3b4266f779fe8633bea6def28cc159138b834334cedef3dec54ea5303df56be87115315ec0f1478a0c0869e5f7c33da64b23af5811751055c90849484481d5a10d72e08ccd12710c4f2ff586a9ea175f4aa70b156c00c57e22c1360bfc7d36aa4792444f81d8a0ed41bf6a452ea5268b8605682ac63eaa465218f4d962db42154d01966d3ad8fc2fde48ef71be08be58e5ad6d5a3593efc9c1336e541372a34799d24ea00d4d4985bed1dab10620911e9f6967880826be5a1f1bb4b2a3948654c6935cafeb4925e107a01f9dda668e5fd7489e82139241a9190f090afe2094234c75fec074622748d4dd782a930f42b0e75d924bef68ffafbaa98916151a36ef2998afd3000955efbfa0a9a008358c11043c0f96b52fc78a42531aa5dfd8de09518cff008b339259b266c488bb1da058ba218cd64b3e413ca2889d1086e8c40ae11501984121dcfa2fde09d068f6dbbe8359980dad96ed220b8534aaef353dfc81560907d26c02442924ad55b11d3aee7e5516d96ad078c85ad1cdb18a45474305a8db350f9844380e2094f691a05ea09458bc53f3236a1f3fa5e144a575ba57e58d00f7653d2e6b6cbe18d28ce3f5792538ad20c0e0e10b03dac34009d6d3e4c7662cca88b53066e95efe45ee3e04da328690dae1aa0070f0945e269b75733b106ff6514555d54d958f7313441fa21f97615312c4f600a1430f629812f23cd21e703b966e04aa6d0bba6f2539369a3badebfaa8197d89e3294b44c0ea54ae6b7f4a496568043175a5666541b559a9feaf0c5454f12f230e97bcf84dae11d1a8359411b98bb6063ee8ae0ffa30b5757771c7b70e4fbb6e951a680873e6da531600e951110c34caacc8e978c06b4848c880c48ad8e6c54bc792ce54ea4b1c05ab04afb4d6cab25b85d1c4b6c474c7ec9267b501edaa20ee0e415868d87866426b1374e58a666530b94e342c8b2ebdd405fef0a26df82bbc502da2ca1550c28d3c0b69872ff861cd23cb6e1ff1e62f625ae92f90f30933fc827edd386121315352dbc9f4cab3dddadeb8df051d2f59cd59e97dc92ce4341f978003e48685e7673cf1e60260600e7cbf731dc168b9a411dc3c85f843bd2c5fca89c06d12bac08a61cf099ae5f23e5e908448e81f2779b385b31dcd5cf8aaad4b85ae7063624a7df573aeccc8b61977f8ec10e68b5df1c1b805c7e001228a65c0e772c5251466a49f10219bb718a4aa2e35c40811a972eb58530f7f0741d3be0c00e38f58994a5199547fc5150c781ffe2e56560f08eb75bfcd9085ff140ceefd0d6ed43dad39d2cda8694d420e861a1dec4a28d1cf5324c5c5ab81922154873b3f82df1bc06cb9565c08f774d9fa6fe575daf87b328ab10b912243f100712a27f4981faa372d736702c565a08c4d6b0aa312d3c9017fd1e7ab981de7ee1dfc1a849924aa92eab1b3e6e9742f6913a08b5699d670697a608d749e06c341421a809a365dca3f8d88d842685080f8ed93482888065b50bf9abde75fe37c8ff2ae4f24e26f83949ab5c4f4a96e13b2cdf742daf9c1b58305691456c6c190bfb7bbbb084ea9f97e99c3e028415d4e05ccf7717b5797ff5bafa2518a0acab434a188d4797a85f36557dd6aa39c75e80b72496372652544b1424901a6a9d4b7453086b6ba26a40521da94ab54de4a11b51b4ad7ab1d6805f323b044955f779cfe7c1c3586f4be0eab226a25ae16bd8dc7eb015024b7434b6408343a1be6e1dd3925c102b4c9c543983835b6bb45f80ea35bf7fcecab5d947224bfdb1c03b20fc07a5cac630beb4b3044ebe55c9023844c1fd64b4eb025536867f0afa388576c5b2564cd2e20ae2633f7b76cf6fbceff240f65e5eeba2843faa1e77108d35c59b3f570112660e9278da3127686dc2a965a6ad1672e29ff9edd62f49e41bdd65348d2657846be80479cea415bfb5927229f3b772ed9c9b7639d8f75ff6621841a7b64978131e86952bfe510715b25efbcf393320c1d6299ac6c19dd908870f96d92b8bdcf11e3c9878f2e37bdaf72718ad0bc2872c7a0b101f6e392997234e06c9b1bdc324971427d6b97c3c16531178f40a8ab52f98e066780977abd352e1efe6185f70233b30fdc96b6a289b9e0fcee555923ef590bd9cd2f0ef7024641450d1a9258046ac0e80acd44f267446946c096db9848f78cddba9f5409b090dd2344d8d45a16cd2ecce5bf22bd4cb89afd3067cb0bd9a7279be1b1e503498f39edce714f37597d0e6460716d09ea376d73e8a71fff1324fa2aeba75e8bbd0ea4c418b45784550153d492898e15da88b6ed3f67e85dbb111c2feac2fd78b6f9011c6864b9bb11653694f7f02568b768b6a27d080eadc0093744b9115aa2f8d03fa27faea2e356ef8ce62e4722ddd139f784ac3b8afb98c8d3984c8cf9438e83710330428b7830c1709a309bbac3bbdbd083e539938c5789e1709d2c0ee94dcb2fe64c31c87d25cc7f826bbf5e021d5aaa172970aae96a6858f8c11fdfb748328d97411edc10dd16fd10faa7c3b94ce19152fb2965690421d3c6db2e7e8888c7bb06443db3111e3db69a88dd097ab8c64d6bea30da247fcd117a30eef45cd9339a78375628cdbfa26d6b3419e69bbe8e88479129684b2304daa2d684304826eee97d346303cc631e10465a2f9243e84d322810388ba2d30626a63df9793eb963df234865cbb68cdbc04363e17a6a6eb1c8014177c99faacb8d7a8e99d897718bc51055727820d321f25fd15d24d029d4fad6fde97f091180ef2bc3913bc11f8f104bcc7ea0024157481b3537ce543fe8ab93a26cb9ba51fa78d337bf10ba29dc5febfe4ad014bd40f33330823d7f4573baebd9e063d59a87662bef859cee8a8e5318aae22e79fb4d31e088f0569c67bba41868fe464ed77ec7fe07dd3a5c2c81c1fded160598b37564513173f13feeb9df4b47ede8050aac431e1b2058c6afe7e44bcc6f28dc5833dded10e6917e15b93088cd90791826ca7c3b9a4211e9e2ffd4966223816db6e4ede5701b76988d8f34aa140ffb4bc3effccbe5af3942d4c5717700e592a17001d20b665fb7c6f65361108a1370a45db477a1f449e5c3f9a89f967290af231db82fedecfca2c3cedffeadb775728b45ce4bde0630e9e1dfcd98138a556dd40b655581b451a7164ad57c4fb2b5dc5b145e8733de33af844e400414f85c28ca1f888e70c45d28c823e07eddf30df7911df584ad458a25355084163a9a7cc3bac4276e957211626e288212005334dec742cfe57e6c8234e520d8bed45af476770f4718f799c1a1f637fc04a73780a35d2194e6017e405d3e0b1e9f2c7c0f6a0ed28a2eafdd7922762059fe0ebc77599245b12c9f0cef9edab1a25171a6a9a0562e24db76e25dfb5ecb7352d0bfc78d858e8aaac913efa4ff60489679e8c72019897a8a85a9ee29f10922315ba7db0a126f827c03fa5bbb90f991cb9866b3e03047cb1fabbbdbe5a35282f030c0dbdbd227f85b05721c45c8b2b85d3310bb41d6aa5614a60d9874d12f11f5a94b15f741db310c927b2e90607a2af8c4b57d6b6937d5a1eb14589d1e361642458cc2fbd296ac031d099df49a53e8f0d4506b2dcbb20f54560b695a4e0a4a5a13231985d53bb3533126add281fd38cddf7ef437201e8aea1ab63ad673cdcc6c604114aec771881b4fb7aa7ccbd397e703f10895619e15c71684bbbfa2b2c60a790de0e5059538b51d347a68ad057472a9f1eaf054df7791b58f638c059555bbb970edf877d5f623e2541dba27df8d713fe7c55f40fbf3dbdc3d042e92b83f94dd66d1cd2bc5cc98a6a502b5d8d8ee6efecacfb762464c6f8cea8bdad14a29199928e0cb07fbc306b9eeccc4c7a326185254414892b614ddcc20e9b5d258e66271430c0705c5a622fa5646da4897a088f68fdeb66842ad3d72f232f487b3db3b83d82622c91daf779634fa1b97c7d5adb5d53be5198bc59aef1aab60c3795296a84ac3f77399feed5b86f44b3a1ca35ee46891ee903a90340883cec41d577a8880945b504c7ea5bdc94d66bf25b4d2e064bd69dfce4f00f8dfade0739fab5275db11e999b25622c20ca0a9f10f27c800a4f5d19aa92d04cd282f96e990301874c5ddcfb13223c4f5fd37c449adde532a16aee66407bfeeeebda4f513f224e434a9c08a2281d5e1f4591c9a433ab1576c11edd0df9fb6f47b761fc878d532d7fc2a762461fd1473eb7c7c88668b749b9bbf43c937fa2bd73ae917ea2a903bf5f7d71ae1c7d71c60def1bbc4e8151bee5f4a396325907f4f2bcbe98038e46bc9fb30d199f025eabeb037ceaec3ee187f73a136b8566a943d5b3271199e6d19b7066d90b10d0c11e7cb0c0b5f73127cd685a7638b99a1c9aea4fbf3fac67a4b114ca9fa60d2c9c24723b037142e3e47503f3dfdffc487212090d221eb85f53cf6176c26b93c757b521d017ca17ac7889c26c6473fb44cc2ab79cd76fbf8fc5a81dc24bd7ba6d55d8036f4d60218e7c8fdf7f3b915efd0bd0edfac380e3717794ab46b2a5daed58fdb3ea66720c0e78a0ce825b155ebc0979cf77915db3df600bbd179f1d2d674d76b12aff087757d4aa480ee1566784074a5287be0088efbe12f550bad3b410cf04fba8f06d1120a1dad35de9c7a22c3caf83c1bf6ea57a055afcbc61b068feb5d17f5d0cd9e5911d2d9c8c6ff89fc37725a4b9ac3a8800d1731199c8201c0522e9af749fe36e14194310a5aafd944c321efb4ecf5c131ccf9de48c8b36a905f47eba8fb42ce435d1bd408dc87b1c91577ffba16e32b9be21982d3176320c8e23799b6c5cc3d834ccbe9aceda70bd2c73a154137acdd65f4191e4470893eb24e4ab00700c2c135149fb86644b5ac0be1669288b9c29a1f6f61517d8b4f09616e767bd72d13f833"}, 0x1009, 0x3)

I hope it helps.

Best regards

lee bruce

unread,

Apr 17, 2024, 8:51:20 AM (13 days ago) Apr 17

Sorry for containing the HTML part, repeat.
Hello, I reproduced this bug and confirmed in the latest upstream.

lee bruce <xrive...@gmail.com> 于2024年4月17日周三 20:48写道：

Reply all

Reply to author

Forward

0 new messages