report

jffs2: warning: (13952) jffs2_sum_write_sumnode: Empty summary info!!!
------------[ cut here ]------------
kernel BUG at fs/jffs2/summary.c:865!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 3 PID: 13952 Comm: syz-executor.3 Not tainted 6.8.0-08951-gfe46a7dd189e-dirty #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:jffs2_sum_write_sumnode+0x1f50/0x2630 fs/jffs2/summary.c:865
Code: 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 81 01 00 00 8b b3 c0 05 00 00 48 c7 c2 c0 7e a4 8b 48 c7 c7 c0 7a a4 8b e8 51 ba 82 fe 90 <0f> 0b e8 69 29 01 ff e9 70 e1 ff ff 48 8b bd e0 fe ff ff e8 58 29
RSP: 0018:ffffc90015aff4e0 EFLAGS: 00010286
RAX: 0000000000000046 RBX: ffff888108d52500 RCX: 0000000000040000
RDX: 0000000000000000 RSI: ffffc90003042000 RDI: 0000000000000000
RBP: ffffc90015aff660 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: ffff888028986000 R15: 000000000000106c
FS:  00007f303469e6c0(0000) GS:ffff888135d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33978000 CR3: 000000012deba000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 jffs2_do_reserve_space+0xc59/0x1190 fs/jffs2/nodemgmt.c:388
 jffs2_reserve_space+0x67e/0xc20 fs/jffs2/nodemgmt.c:197
 do_jffs2_setxattr+0x1ab/0x1770 fs/jffs2/xattr.c:1113
 __vfs_setxattr+0x182/0x1f0 fs/xattr.c:200
 __vfs_setxattr_noperm+0x132/0x610 fs/xattr.c:234
 __vfs_setxattr_locked+0x195/0x270 fs/xattr.c:295
 vfs_setxattr+0x151/0x370 fs/xattr.c:321
 do_setxattr+0x153/0x180 fs/xattr.c:629
 setxattr+0x166/0x180 fs/xattr.c:652
 path_setxattr+0x188/0x1f0 fs/xattr.c:671
 __do_sys_lsetxattr fs/xattr.c:694 [inline]
 __se_sys_lsetxattr fs/xattr.c:690 [inline]
 __x64_sys_lsetxattr+0xc6/0x160 fs/xattr.c:690
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd2/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f303387dde9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f303469e0c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 00007f30339abf80 RCX: 00007f303387dde9
RDX: 0000000020002040 RSI: 00000000200002c0 RDI: 00000000200001c0
RBP: 00007f30338ca47a R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f30339abf80 R15: 00007ffc85eb4448
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:jffs2_sum_write_sumnode+0x1f50/0x2630 fs/jffs2/summary.c:865
Code: 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 81 01 00 00 8b b3 c0 05 00 00 48 c7 c2 c0 7e a4 8b 48 c7 c7 c0 7a a4 8b e8 51 ba 82 fe 90 <0f> 0b e8 69 29 01 ff e9 70 e1 ff ff 48 8b bd e0 fe ff ff e8 58 29
RSP: 0018:ffffc90015aff4e0 EFLAGS: 00010286
RAX: 0000000000000046 RBX: ffff888108d52500 RCX: 0000000000040000
RDX: 0000000000000000 RSI: ffffc90003042000 RDI: 0000000000000000
RBP: ffffc90015aff660 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: ffff888028986000 R15: 000000000000106c
FS:  00007f303469e6c0(0000) GS:ffff888135d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33978000 CR3: 000000012deba000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554

repro.c

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/loop.h>

#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif

static unsigned long long procid;

static __thread int clone_ongoing;
static __thread int skip_segv;
static __thread jmp_buf segv_env;

static void segv_handler(int sig, siginfo_t* info, void* ctx) {
    if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
        exit(sig);
    }
    uintptr_t addr = (uintptr_t)info->si_addr;
    const uintptr_t prog_start = 1 << 20;
    const uintptr_t prog_end = 100 << 20;
    int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
    int valid = addr < prog_start || addr > prog_end;
    if (skip && valid) {
        _longjmp(segv_env, 1);
    }
    exit(sig);
}

static void install_segv_handler(void) {
    struct sigaction sa;
    memset(&sa, 0, sizeof(sa));
    sa.sa_handler = SIG_IGN;
    syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
    syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
    memset(&sa, 0, sizeof(sa));
    sa.sa_sigaction = segv_handler;
    sa.sa_flags = SA_NODEFER | SA_SIGINFO;
    sigaction(SIGSEGV, &sa, NULL);
    sigaction(SIGBUS, &sa, NULL);
}

#define NONFAILING(...)                                  \
    ({                                                     \
        int ok = 1;                                          \
        __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
        if (_setjmp(segv_env) == 0) {                        \
            __VA_ARGS__;                                       \
        } else                                               \
            ok = 0;                                            \
        __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
        ok;                                                  \
    })

static void sleep_ms(uint64_t ms) {
    usleep(ms * 1000);
}

static uint64_t current_time_ms(void) {
    struct timespec ts;
    if (clock_gettime(CLOCK_MONOTONIC, &ts))
        exit(1);
    return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...) {
    char buf[1024];
    va_list args;
    va_start(args, what);
    vsnprintf(buf, sizeof(buf), what, args);
    va_end(args);
    buf[sizeof(buf) - 1] = 0;
    int len = strlen(buf);
    int fd = open(file, O_WRONLY | O_CLOEXEC);
    if (fd == -1)
        return false;
    if (write(fd, buf, len) != len) {
        int err = errno;
        close(fd);
        errno = err;
        return false;
    }
    close(fd);
    return true;
}

//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:

//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty.  In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//%    claim that you wrote the original software. If you use this software
//%    in a product, an acknowledgment in the product documentation would be
//%    appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//%    misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler    madler@alumni.caltech.edu

//% BEGIN CODE DERIVED FROM puff.{c,h}

#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288

struct puff_state {
    unsigned char* out;
    unsigned long outlen;
    unsigned long outcnt;
    const unsigned char* in;
    unsigned long inlen;
    unsigned long incnt;
    int bitbuf;
    int bitcnt;
    jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need) {
    long val = s->bitbuf;
    while (s->bitcnt < need) {
        if (s->incnt == s->inlen)
            longjmp(s->env, 1);
        val |= (long)(s->in[s->incnt++]) << s->bitcnt;
        s->bitcnt += 8;
    }
    s->bitbuf = (int)(val >> need);
    s->bitcnt -= need;
    return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s) {
    s->bitbuf = 0;
    s->bitcnt = 0;
    if (s->incnt + 4 > s->inlen)
        return 2;
    unsigned len = s->in[s->incnt++];
    len |= s->in[s->incnt++] << 8;
    if (s->in[s->incnt++] != (~len & 0xff) ||
            s->in[s->incnt++] != ((~len >> 8) & 0xff))
        return -2;
    if (s->incnt + len > s->inlen)
        return 2;
    if (s->outcnt + len > s->outlen)
        return 1;
    for (; len--; s->outcnt++, s->incnt++) {
        if (s->in[s->incnt])
            s->out[s->outcnt] = s->in[s->incnt];
    }
    return 0;
}
struct puff_huffman {
    short* count;
    short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h) {
    int first = 0;
    int index = 0;
    int bitbuf = s->bitbuf;
    int left = s->bitcnt;
    int code = first = index = 0;
    int len = 1;
    short* next = h->count + 1;
    while (1) {
        while (left--) {
            code |= bitbuf & 1;
            bitbuf >>= 1;
            int count = *next++;
            if (code - count < first) {
                s->bitbuf = bitbuf;
                s->bitcnt = (s->bitcnt - len) & 7;
                return h->symbol[index + (code - first)];
            }
            index += count;
            first += count;
            first <<= 1;
            code <<= 1;
            len++;
        }
        left = (MAXBITS + 1) - len;
        if (left == 0)
            break;
        if (s->incnt == s->inlen)
            longjmp(s->env, 1);
        bitbuf = s->in[s->incnt++];
        if (left > 8)
            left = 8;
    }
    return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n) {
    int len;
    for (len = 0; len <= MAXBITS; len++)
        h->count[len] = 0;
    int symbol;
    for (symbol = 0; symbol < n; symbol++)
        (h->count[length[symbol]])++;
    if (h->count[0] == n)
        return 0;
    int left = 1;
    for (len = 1; len <= MAXBITS; len++) {
        left <<= 1;
        left -= h->count[len];
        if (left < 0)
            return left;
    }
    short offs[MAXBITS + 1];
    offs[1] = 0;
    for (len = 1; len < MAXBITS; len++)
        offs[len + 1] = offs[len] + h->count[len];
    for (symbol = 0; symbol < n; symbol++)
        if (length[symbol] != 0)
            h->symbol[offs[length[symbol]]++] = symbol;
    return left;
}
static int puff_codes(struct puff_state* s,
                                            const struct puff_huffman* lencode,
                                            const struct puff_huffman* distcode) {
    static const short lens[29] = {3,  4,  5,  6,   7,   8,   9,   10,  11, 13,
                                                                 15, 17, 19, 23,  27,  31,  35,  43,  51, 59,
                                                                 67, 83, 99, 115, 131, 163, 195, 227, 258};
    static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2,
                                                                 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
    static const short dists[30] = {
            1,    2,    3,    4,    5,    7,    9,    13,    17,    25,
            33,   49,   65,   97,   129,  193,  257,  385,   513,   769,
            1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577};
    static const short dext[30] = {0, 0, 0,  0,  1,  1,  2,  2,  3,  3,
                                                                 4, 4, 5,  5,  6,  6,  7,  7,  8,  8,
                                                                 9, 9, 10, 10, 11, 11, 12, 12, 13, 13};
    int symbol;
    do {
        symbol = puff_decode(s, lencode);
        if (symbol < 0)
            return symbol;
        if (symbol < 256) {
            if (s->outcnt == s->outlen)
                return 1;
            if (symbol)
                s->out[s->outcnt] = symbol;
            s->outcnt++;
        } else if (symbol > 256) {
            symbol -= 257;
            if (symbol >= 29)
                return -10;
            int len = lens[symbol] + puff_bits(s, lext[symbol]);
            symbol = puff_decode(s, distcode);
            if (symbol < 0)
                return symbol;
            unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
            if (dist > s->outcnt)
                return -11;
            if (s->outcnt + len > s->outlen)
                return 1;
            while (len--) {
                if (dist <= s->outcnt && s->out[s->outcnt - dist])
                    s->out[s->outcnt] = s->out[s->outcnt - dist];
                s->outcnt++;
            }
        }
    } while (symbol != 256);
    return 0;
}
static int puff_fixed(struct puff_state* s) {
    static int virgin = 1;
    static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
    static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
    static struct puff_huffman lencode, distcode;
    if (virgin) {
        lencode.count = lencnt;
        lencode.symbol = lensym;
        distcode.count = distcnt;
        distcode.symbol = distsym;
        short lengths[FIXLCODES];
        int symbol;
        for (symbol = 0; symbol < 144; symbol++)
            lengths[symbol] = 8;
        for (; symbol < 256; symbol++)
            lengths[symbol] = 9;
        for (; symbol < 280; symbol++)
            lengths[symbol] = 7;
        for (; symbol < FIXLCODES; symbol++)
            lengths[symbol] = 8;
        puff_construct(&lencode, lengths, FIXLCODES);
        for (symbol = 0; symbol < MAXDCODES; symbol++)
            lengths[symbol] = 5;
        puff_construct(&distcode, lengths, MAXDCODES);
        virgin = 0;
    }
    return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s) {
    static const short order[19] = {16, 17, 18, 0, 8,  7, 9,  6, 10, 5,
                                                                    11, 4,  12, 3, 13, 2, 14, 1, 15};
    int nlen = puff_bits(s, 5) + 257;
    int ndist = puff_bits(s, 5) + 1;
    int ncode = puff_bits(s, 4) + 4;
    if (nlen > MAXLCODES || ndist > MAXDCODES)
        return -3;
    short lengths[MAXCODES];
    int index;
    for (index = 0; index < ncode; index++)
        lengths[order[index]] = puff_bits(s, 3);
    for (; index < 19; index++)
        lengths[order[index]] = 0;
    short lencnt[MAXBITS + 1], lensym[MAXLCODES];
    struct puff_huffman lencode = {lencnt, lensym};
    int err = puff_construct(&lencode, lengths, 19);
    if (err != 0)
        return -4;
    index = 0;
    while (index < nlen + ndist) {
        int symbol;
        int len;
        symbol = puff_decode(s, &lencode);
        if (symbol < 0)
            return symbol;
        if (symbol < 16)
            lengths[index++] = symbol;
        else {
            len = 0;
            if (symbol == 16) {
                if (index == 0)
                    return -5;
                len = lengths[index - 1];
                symbol = 3 + puff_bits(s, 2);
            } else if (symbol == 17)
                symbol = 3 + puff_bits(s, 3);
            else
                symbol = 11 + puff_bits(s, 7);
            if (index + symbol > nlen + ndist)
                return -6;
            while (symbol--)
                lengths[index++] = len;
        }
    }
    if (lengths[256] == 0)
        return -9;
    err = puff_construct(&lencode, lengths, nlen);
    if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
        return -7;
    short distcnt[MAXBITS + 1], distsym[MAXDCODES];
    struct puff_huffman distcode = {distcnt, distsym};
    err = puff_construct(&distcode, lengths + nlen, ndist);
    if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
        return -8;
    return puff_codes(s, &lencode, &distcode);
}
static int puff(unsigned char* dest,
                                unsigned long* destlen,
                                const unsigned char* source,
                                unsigned long sourcelen) {
    struct puff_state s = {
            .out = dest,
            .outlen = *destlen,
            .outcnt = 0,
            .in = source,
            .inlen = sourcelen,
            .incnt = 0,
            .bitbuf = 0,
            .bitcnt = 0,
    };
    int err;
    if (setjmp(s.env) != 0)
        err = 2;
    else {
        int last;
        do {
            last = puff_bits(&s, 1);
            int type = puff_bits(&s, 2);
            err = type == 0 ? puff_stored(&s)
                                            : (type == 1 ? puff_fixed(&s)
                                                                     : (type == 2 ? puff_dynamic(&s) : -1));
            if (err != 0)
                break;
        } while (!last);
    }
    *destlen = s.outcnt;
    return err;
}

//% END CODE DERIVED FROM puff.{c,h}

#define ZLIB_HEADER_WIDTH 2

static int puff_zlib_to_file(const unsigned char* source,
                                                         unsigned long sourcelen,
                                                         int dest_fd) {
    if (sourcelen < ZLIB_HEADER_WIDTH)
        return 0;
    source += ZLIB_HEADER_WIDTH;
    sourcelen -= ZLIB_HEADER_WIDTH;
    const unsigned long max_destlen = 132 << 20;
    void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ,
                                     MAP_PRIVATE | MAP_ANON, -1, 0);
    if (ret == MAP_FAILED)
        return -1;
    unsigned char* dest = (unsigned char*)ret;
    unsigned long destlen = max_destlen;
    int err = puff(dest, &destlen, source, sourcelen);
    if (err) {
        munmap(dest, max_destlen);
        errno = -err;
        return -1;
    }
    if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
        munmap(dest, max_destlen);
        return -1;
    }
    return munmap(dest, max_destlen);
}

static int setup_loop_device(unsigned char* data,
                                                         unsigned long size,
                                                         const char* loopname,
                                                         int* loopfd_p) {
    int err = 0, loopfd = -1;
    int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
    if (memfd == -1) {
        err = errno;
        goto error;
    }
    if (puff_zlib_to_file(data, size, memfd)) {
        err = errno;
        goto error_close_memfd;
    }
    loopfd = open(loopname, O_RDWR);
    if (loopfd == -1) {
        err = errno;
        goto error_close_memfd;
    }
    if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
        if (errno != EBUSY) {
            err = errno;
            goto error_close_loop;
        }
        ioctl(loopfd, LOOP_CLR_FD, 0);
        usleep(1000);
        if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
            err = errno;
            goto error_close_loop;
        }
    }
    close(memfd);
    *loopfd_p = loopfd;
    return 0;

error_close_loop:
    close(loopfd);
error_close_memfd:
    close(memfd);
error:
    errno = err;
    return -1;
}

static long syz_mount_image(volatile long fsarg,
                                                        volatile long dir,
                                                        volatile long flags,
                                                        volatile long optsarg,
                                                        volatile long change_dir,
                                                        volatile unsigned long size,
                                                        volatile long image) {
    unsigned char* data = (unsigned char*)image;
    int res = -1, err = 0, loopfd = -1, need_loop_device = !!size;
    char* mount_opts = (char*)optsarg;
    char* target = (char*)dir;
    char* fs = (char*)fsarg;
    char* source = NULL;
    char loopname[64];
    if (need_loop_device) {
        memset(loopname, 0, sizeof(loopname));
        snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
        if (setup_loop_device(data, size, loopname, &loopfd) == -1)
            return -1;
        source = loopname;
    }
    mkdir(target, 0777);
    char opts[256];
    memset(opts, 0, sizeof(opts));
    if (strlen(mount_opts) > (sizeof(opts) - 32)) {
    }
    strncpy(opts, mount_opts, sizeof(opts) - 32);
    if (strcmp(fs, "iso9660") == 0) {
        flags |= MS_RDONLY;
    } else if (strncmp(fs, "ext", 3) == 0) {
        bool has_remount_ro = false;
        char* remount_ro_start = strstr(opts, "errors=remount-ro");
        if (remount_ro_start != NULL) {
            char after = *(remount_ro_start + strlen("errors=remount-ro"));
            char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
            has_remount_ro = ((before == '\0' || before == ',') &&
                                                (after == '\0' || after == ','));
        }
        if (strstr(opts, "errors=panic") || !has_remount_ro)
            strcat(opts, ",errors=continue");
    } else if (strcmp(fs, "xfs") == 0) {
        strcat(opts, ",nouuid");
    }
    res = mount(source, target, fs, flags, opts);
    if (res == -1) {
        err = errno;
        goto error_clear_loop;
    }
    res = open(target, O_RDONLY | O_DIRECTORY);
    if (res == -1) {
        err = errno;
        goto error_clear_loop;
    }
    if (change_dir) {
        res = chdir(target);
        if (res == -1) {
            err = errno;
        }
    }

error_clear_loop:
    if (need_loop_device) {
        ioctl(loopfd, LOOP_CLR_FD, 0);
        close(loopfd);
    }
    errno = err;
    return res;
}

static void kill_and_wait(int pid, int* status) {
    kill(-pid, SIGKILL);
    kill(pid, SIGKILL);
    for (int i = 0; i < 100; i++) {
        if (waitpid(-1, status, WNOHANG | __WALL) == pid)
            return;
        usleep(1000);
    }
    DIR* dir = opendir("/sys/fs/fuse/connections");
    if (dir) {
        for (;;) {
            struct dirent* ent = readdir(dir);
            if (!ent)
                break;
            if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
                continue;
            char abort[300];
            snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
                             ent->d_name);
            int fd = open(abort, O_WRONLY);
            if (fd == -1) {
                continue;
            }
            if (write(fd, abort, 1) < 0) {
            }
            close(fd);
        }
        closedir(dir);
    } else {
    }
    while (waitpid(-1, status, __WALL) != pid) {
    }
}

static void reset_loop() {
    char buf[64];
    snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);
    int loopfd = open(buf, O_RDWR);
    if (loopfd != -1) {
        ioctl(loopfd, LOOP_CLR_FD, 0);
        close(loopfd);
    }
}

static void setup_test() {
    prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
    setpgrp();
    write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void) {
    int iter = 0;
    for (;; iter++) {
        reset_loop();
        int pid = fork();
        if (pid < 0)
            exit(1);
        if (pid == 0) {
            setup_test();
            execute_one();
            exit(0);
        }
        int status = 0;
        uint64_t start = current_time_ms();
        for (;;) {
            if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
                break;
            sleep_ms(1);
            if (current_time_ms() - start < 5000)
                continue;
            kill_and_wait(pid, &status);
            break;
        }
    }
}

void execute_one(void) {
    NONFAILING(memcpy((void*)0x20000040, "vfat\000", 5));
    NONFAILING(memcpy((void*)0x20000200, "./file0\000", 8));
    NONFAILING(syz_mount_image(/*fs=*/0x20000040, /*dir=*/0x20000200,
                                                         /*flags=*/0x220e002, /*opts=*/0, /*chdir=*/1,
                                                         /*size=*/0, /*img=*/0x20000100));
    NONFAILING(memcpy((void*)0x20000040, "mtd", 3));
    NONFAILING(sprintf((char*)0x20000043, "0x%016llx", (long long)0));
    NONFAILING(memcpy((void*)0x200000c0, "./file0\000", 8));
    NONFAILING(memcpy((void*)0x20001200, "jffs2\000", 6));
    syscall(__NR_mount, /*src=*/0x20000040ul, /*dst=*/0x200000c0ul,
                    /*type=*/0x20001200ul, /*flags=*/0ul, /*data=*/0ul);
    NONFAILING(memcpy((void*)0x200001c0, "./file0\000", 8));
    NONFAILING(memcpy((void*)0x200002c0, "security.evm\000", 13));
    NONFAILING(*(uint8_t*)0x20002040 = 3);
    NONFAILING(*(uint8_t*)0x20002041 = 2);
    NONFAILING(*(uint8_t*)0x20002042 = 0xb);
    NONFAILING(*(uint32_t*)0x20002043 = htobe32(4));
    NONFAILING(*(uint16_t*)0x20002047 = htobe16(0x1000));
    NONFAILING(memcpy(
            (void*)0x20002049,
            "\x78\x8d\x9c\xb2\x99\xab\xd7\x2e\xce\x91\x3d\x53\x36\x5e\x16\x68\x8e\x51"
            "\xac\xe1\x59\x84\xab\x53\xd1\x66\x6a\xe3\xf5\xdf\xbc\x86\x0b\xef\x87\x38"
            "\x9e\x21\x28\x6b\xe2\x36\xdd\xc3\xd0\xfa\x2e\x51\xd5\xc5\xc7\xb3\x5c\x5d"
            "\x50\x3c\x5b\x2c\x3b\x6b\xe0\xfc\x56\xe9\x7d\xf8\x8f\xaa\x06\x35\x36\x3b"
            "\xa9\x2b\x82\xc4\x7a\x81\x7a\xc9\x7f\x1d\x63\x8a\x14\x61\x82\x12\x55\xec"
            "\x23\xbd\x0c\xe5\xbf\x10\x94\xe3\xa8\x98\x0d\x7e\x6d\x19\x76\xba\x77\x87"
            "\x45\x92\x0e\x17\x18\xfd\xda\xc4\xbd\x66\xb0\xa6\x06\x80\x1a\xae\xfd\xed"
            "\x29\x3c\x3f\xce\xba\xd3\xb2\xc0\x64\x03\xdb\xa9\x99\x49\x71\x65\x9b\x7f"
            "\x4a\x07\x7a\xdd\xae\xb8\xae\x3e\x5a\xca\x70\x27\xfd\xe1\xe4\x00\x01\xc0"
            "\xbd\xd8\x00\xbc\xc2\x87\xe0\x2c\x86\x7e\x27\x82\xde\xaf\x67\x6a\x26\x16"
            "\x47\xdb\x8c\x2f\x39\x45\x02\x20\x57\xde\x76\x81\x00\xa8\xbf\x73\xd9\xf9"
            "\xff\x29\x22\x9b\x46\xde\xad\x58\xb2\xdd\xf9\x64\x33\x46\x8e\x9e\xee\x89"
            "\x50\xdf\x65\x87\x11\xe4\x11\x36\x4e\x44\x14\x5e\x68\x2f\x3c\x05\x3c\x6f"
            "\x5a\x18\x61\xee\xe6\xed\xf8\x85\xa9\x7c\x54\x58\x05\xac\x0c\x35\xa5\xe4"
            "\x62\x3b\x20\x01\x86\x1c\x59\x33\x54\xb5\x70\xff\x3b\x4a\x45\xf1\xac\xde"
            "\x0a\x8d\xbd\x17\xc0\x9c\xe4\x48\xed\x5d\xfd\x9e\x74\x72\xe6\x89\x67\xde"
            "\xcb\x76\x9f\xa6\x00\xcd\x30\xbe\xb6\xc8\x03\x0e\x94\x74\xc7\xec\x4c\x1d"
            "\xaf\x3e\x00\x7b\xbc\x57\x65\xb3\x66\xd4\xa1\x76\xe3\x8b\xdf\xab\xed\xd2"
            "\xb0\x76\xa5\xed\x7d\x50\xf5\x17\x7b\x94\xa6\xa0\xf0\x00\xcd\x3a\xca\xdd"
            "\xe8\xe8\x0f\x66\xea\xda\x14\x01\x86\x20\xb1\x59\xe9\xe1\x4c\x25\x2d\x20"
            "\xc8\xdb\xb0\xfe\x36\x05\xb5\x69\x8b\x53\xe4\x21\x0b\x62\xfc\xbd\x00\x01"
            "\x7e\xaa\x01\xeb\x1f\xa5\x21\xbd\xb8\xd3\x0e\x83\x95\x1b\x4e\xa0\x28\x6c"
            "\x8f\x0d\x46\x45\x17\xa1\x1d\x79\x22\xd6\xcc\xe4\xd2\x05\x8e\xc8\xcd\x7b"
            "\x02\xb7\x3d\x82\x5d\x7e\x0a\xbb\xbd\x85\xe9\x91\x22\x0f\xc7\x99\x55\x34"
            "\xb7\xb1\x99\x8c\xa7\x52\x89\x0b\x07\x9a\x7c\xa3\xfd\xe5\x64\x38\xcf\x82"
            "\xd5\xdd\x9e\xdb\xd1\x1f\xd2\x93\xc1\x7d\x1c\xf1\x66\x57\xd0\xb3\x52\xa8"
            "\xc6\xc3\x63\x00\xad\x09\xa7\x8e\x3e\xe3\x91\x3b\x9b\x6f\x53\xde\xbf\xfc"
            "\x7e\x32\xbf\xb6\x4b\x0e\x8c\xbe\x07\xfe\x9b\x0d\xad\xb0\x97\xae\xb2\xc2"
            "\x42\x43\x0b\xec\x75\x63\x0a\x39\x21\x82\x8a\x73\x14\xde\x14\x04\x82\x9e"
            "\x7a\xfb\x3b\x84\x20\xe8\x5f\x2c\x8f\x6e\x88\xde\x04\x23\x14\x41\x6e\x5c"
            "\x00\xc5\x9b\x22\x20\x80\x04\xbe\xc1\x61\xf8\x45\x7c\x7f\x8e\x3a\x8c\xa4"
            "\x17\x4a\x4b\x78\xdf\x6e\x46\x0d\x56\xd2\x4e\x01\xae\x1a\x24\x11\x27\x0f"
            "\x79\xd0\x20\xa6\xba\xc8\x55\xf1\xa3\xef\x7b\x3d\x09\x91\x88\x26\x56\xb4"
            "\x08\xdc\xda\xf0\x2d\xb4\x6a\xc8\xfc\xab\x0c\x87\x5d\x1f\x2e\x8d\xb3\x66"
            "\xe6\xa2\x0c\xb6\x7a\x4d\xb9\x20\x38\x2a\x69\x15\x71\x5d\x3b\x42\x66\xf7"
            "\x79\xfe\x86\x33\xbe\xa6\xde\xf2\x8c\xc1\x59\x13\x8b\x83\x43\x34\xce\xde"
            "\xf3\xde\xc5\x4e\xa5\x30\x3d\xf5\x6b\xe8\x71\x15\x31\x5e\xc0\xf1\x47\x8a"
            "\x0c\x08\x69\xe5\xf7\xc3\x3d\xa6\x4b\x23\xaf\x58\x11\x75\x10\x55\xc9\x08"
            "\x49\x48\x44\x81\xd5\xa1\x0d\x72\xe0\x8c\xcd\x12\x71\x0c\x4f\x2f\xf5\x86"
            "\xa9\xea\x17\x5f\x4a\xa7\x0b\x15\x6c\x00\xc5\x7e\x22\xc1\x36\x0b\xfc\x7d"
            "\x36\xaa\x47\x92\x44\x4f\x81\xd8\xa0\xed\x41\xbf\x6a\x45\x2e\xa5\x26\x8b"
            "\x86\x05\x68\x2a\xc6\x3e\xaa\x46\x52\x18\xf4\xd9\x62\xdb\x42\x15\x4d\x01"
            "\x96\x6d\x3a\xd8\xfc\x2f\xde\x48\xef\x71\xbe\x08\xbe\x58\xe5\xad\x6d\x5a"
            "\x35\x93\xef\xc9\xc1\x33\x6e\x54\x13\x72\xa3\x47\x99\xd2\x4e\xa0\x0d\x4d"
            "\x49\x85\xbe\xd1\xda\xb1\x06\x20\x91\x1e\x9f\x69\x67\x88\x08\x26\xbe\x5a"
            "\x1f\x1b\xb4\xb2\xa3\x94\x86\x54\xc6\x93\x5c\xaf\xeb\x49\x25\xe1\x07\xa0"
            "\x1f\x9d\xda\x66\x8e\x5f\xd7\x48\x9e\x82\x13\x92\x41\xa9\x19\x0f\x09\x0a"
            "\xfe\x20\x94\x23\x4c\x75\xfe\xc0\x74\x62\x27\x48\xd4\xdd\x78\x2a\x93\x0f"
            "\x42\xb0\xe7\x5d\x92\x4b\xef\x68\xff\xaf\xba\xa9\x89\x16\x15\x1a\x36\xef"
            "\x29\x98\xaf\xd3\x00\x09\x55\xef\xbf\xa0\xa9\xa0\x08\x35\x8c\x11\x04\x3c"
            "\x0f\x96\xb5\x2f\xc7\x8a\x42\x53\x1a\xa5\xdf\xd8\xde\x09\x51\x8c\xff\x00"
            "\x8b\x33\x92\x59\xb2\x66\xc4\x88\xbb\x1d\xa0\x58\xba\x21\x8c\xd6\x4b\x3e"
            "\x41\x3c\xa2\x88\x9d\x10\x86\xe8\xc4\x0a\xe1\x15\x01\x98\x41\x21\xdc\xfa"
            "\x2f\xde\x09\xd0\x68\xf6\xdb\xbe\x83\x59\x98\x0d\xad\x96\xed\x22\x0b\x85"
            "\x34\xaa\xef\x35\x3d\xfc\x81\x56\x09\x07\xd2\x6c\x02\x44\x29\x24\xad\x55"
            "\xb1\x1d\x3a\xee\x7e\x55\x16\xd9\x6a\xd0\x78\xc8\x5a\xd1\xcd\xb1\x8a\x45"
            "\x47\x43\x05\xa8\xdb\x35\x0f\x98\x44\x38\x0e\x20\x94\xf6\x91\xa0\x5e\xa0"
            "\x94\x58\xbc\x53\xf3\x23\x6a\x1f\x3f\xa5\xe1\x44\xa5\x75\xba\x57\xe5\x8d"
            "\x00\xf7\x65\x3d\x2e\x6b\x6c\xbe\x18\xd2\x8c\xe3\xf5\x79\x25\x38\xad\x20"
            "\xc0\xe0\xe1\x0b\x03\xda\xc3\x40\x09\xd6\xd3\xe4\xc7\x66\x2c\xca\x88\xb5"
            "\x30\x66\xe9\x5e\xfe\x45\xee\x3e\x04\xda\x32\x86\x90\xda\xe1\xaa\x00\x70"
            "\xf0\x94\x5e\x26\x9b\x75\x73\x3b\x10\x6f\xf6\x51\x45\x55\xd5\x4d\x95\x8f"
            "\x73\x13\x44\x1f\xa2\x1f\x97\x61\x53\x12\xc4\xf6\x00\xa1\x43\x0f\x62\x98"
            "\x12\xf2\x3c\xd2\x1e\x70\x3b\x96\x6e\x04\xaa\x6d\x0b\xba\x6f\x25\x39\x36"
            "\x9a\x3b\xad\xeb\xfa\xa8\x19\x7d\x89\xe3\x29\x4b\x44\xc0\xea\x54\xae\x6b"
            "\x7f\x4a\x49\x65\x68\x04\x31\x75\xa5\x66\x65\x41\xb5\x59\xa9\xfe\xaf\x0c"
            "\x54\x54\xf1\x2f\x23\x0e\x97\xbc\xf8\x4d\xae\x11\xd1\xa8\x35\x94\x11\xb9"
            "\x8b\xb6\x06\x3e\xe8\xae\x0f\xfa\x30\xb5\x75\x77\x71\xc7\xb7\x0e\x4f\xbb"
            "\x6e\x95\x1a\x68\x08\x73\xe6\xda\x53\x16\x00\xe9\x51\x11\x0c\x34\xca\xac"
            "\xc8\xe9\x78\xc0\x6b\x48\x48\xc8\x80\xc4\x8a\xd8\xe6\xc5\x4b\xc7\x92\xce"
            "\x54\xea\x4b\x1c\x05\xab\x04\xaf\xb4\xd6\xca\xb2\x5b\x85\xd1\xc4\xb6\xc4"
            "\x74\xc7\xec\x92\x67\xb5\x01\xed\xaa\x20\xee\x0e\x41\x58\x68\xd8\x78\x66"
            "\x42\x6b\x13\x74\xe5\x8a\x66\x65\x30\xb9\x4e\x34\x2c\x8b\x2e\xbd\xd4\x05"
            "\xfe\xf0\xa2\x6d\xf8\x2b\xbc\x50\x2d\xa2\xca\x15\x50\xc2\x8d\x3c\x0b\x69"
            "\x87\x2f\xf8\x61\xcd\x23\xcb\x6e\x1f\xf1\xe6\x2f\x62\x5a\xe9\x2f\x90\xf3"
            "\x09\x33\xfc\x82\x7e\xdd\x38\x61\x21\x31\x53\x52\xdb\xc9\xf4\xca\xb3\xdd"
            "\xda\xde\xb8\xdf\x05\x1d\x2f\x59\xcd\x59\xe9\x7d\xc9\x2c\xe4\x34\x1f\x97"
            "\x80\x03\xe4\x86\x85\xe7\x67\x3c\xf1\xe6\x02\x60\x60\x0e\x7c\xbf\x73\x1d"
            "\xc1\x68\xb9\xa4\x11\xdc\x3c\x85\xf8\x43\xbd\x2c\x5f\xca\x89\xc0\x6d\x12"
            "\xba\xc0\x8a\x61\xcf\x09\x9a\xe5\xf2\x3e\x5e\x90\x84\x48\xe8\x1f\x27\x79"
            "\xb3\x85\xb3\x1d\xcd\x5c\xf8\xaa\xad\x4b\x85\xae\x70\x63\x62\x4a\x7d\xf5"
            "\x73\xae\xcc\xc8\xb6\x19\x77\xf8\xec\x10\xe6\x8b\x5d\xf1\xc1\xb8\x05\xc7"
            "\xe0\x01\x22\x8a\x65\xc0\xe7\x72\xc5\x25\x14\x66\xa4\x9f\x10\x21\x9b\xb7"
            "\x18\xa4\xaa\x2e\x35\xc4\x08\x11\xa9\x72\xeb\x58\x53\x0f\x7f\x07\x41\xd3"
            "\xbe\x0c\x00\xe3\x8f\x58\x99\x4a\x51\x99\x54\x7f\xc5\x15\x0c\x78\x1f\xfe"
            "\x2e\x56\x56\x0f\x08\xeb\x75\xbf\xcd\x90\x85\xff\x14\x0c\xee\xfd\x0d\x6e"
            "\xd4\x3d\xad\x39\xd2\xcd\xa8\x69\x4d\x42\x0e\x86\x1a\x1d\xec\x4a\x28\xd1"
            "\xcf\x53\x24\xc5\xc5\xab\x81\x92\x21\x54\x87\x3b\x3f\x82\xdf\x1b\xc0\x6c"
            "\xb9\x56\x5c\x08\xf7\x74\xd9\xfa\x6f\xe5\x75\xda\xf8\x7b\x32\x8a\xb1\x0b"
            "\x91\x22\x43\xf1\x00\x71\x2a\x27\xf4\x98\x1f\xaa\x37\x2d\x73\x67\x02\xc5"
            "\x65\xa0\x8c\x4d\x6b\x0a\xa3\x12\xd3\xc9\x01\x7f\xd1\xe7\xab\x98\x1d\xe7"
            "\xee\x1d\xfc\x1a\x84\x99\x24\xaa\x92\xea\xb1\xb3\xe6\xe9\x74\x2f\x69\x13"
            "\xa0\x8b\x56\x99\xd6\x70\x69\x7a\x60\x8d\x74\x9e\x06\xc3\x41\x42\x1a\x80"
            "\x9a\x36\x5d\xca\x3f\x8d\x88\xd8\x42\x68\x50\x80\xf8\xed\x93\x48\x28\x88"
            "\x06\x5b\x50\xbf\x9a\xbd\xe7\x5f\xe3\x7c\x8f\xf2\xae\x4f\x24\xe2\x6f\x83"
            "\x94\x9a\xb5\xc4\xf4\xa9\x6e\x13\xb2\xcd\xf7\x42\xda\xf9\xc1\xb5\x83\x05"
            "\x69\x14\x56\xc6\xc1\x90\xbf\xb7\xbb\xbb\x08\x4e\xa9\xf9\x7e\x99\xc3\xe0"
            "\x28\x41\x5d\x4e\x05\xcc\xf7\x71\x7b\x57\x97\xff\x5b\xaf\xa2\x51\x8a\x0a"
            "\xca\xb4\x34\xa1\x88\xd4\x79\x7a\x85\xf3\x65\x57\xdd\x6a\xa3\x9c\x75\xe8"
            "\x0b\x72\x49\x63\x72\x65\x25\x44\xb1\x42\x49\x01\xa6\xa9\xd4\xb7\x45\x30"
            "\x86\xb6\xba\x26\xa4\x05\x21\xda\x94\xab\x54\xde\x4a\x11\xb5\x1b\x4a\xd7"
            "\xab\x1d\x68\x05\xf3\x23\xb0\x44\x95\x5f\x77\x9c\xfe\x7c\x1c\x35\x86\xf4"
            "\xbe\x0e\xab\x22\x6a\x25\xae\x16\xbd\x8d\xc7\xeb\x01\x50\x24\xb7\x43\x4b"
            "\x64\x08\x34\x3a\x1b\xe6\xe1\xdd\x39\x25\xc1\x02\xb4\xc9\xc5\x43\x98\x38"
            "\x35\xb6\xbb\x45\xf8\x0e\xa3\x5b\xf7\xfc\xec\xab\x5d\x94\x72\x24\xbf\xdb"
            "\x1c\x03\xb2\x0f\xc0\x7a\x5c\xac\x63\x0b\xeb\x4b\x30\x44\xeb\xe5\x5c\x90"
            "\x23\x84\x4c\x1f\xd6\x4b\x4e\xb0\x25\x53\x68\x67\xf0\xaf\xa3\x88\x57\x6c"
            "\x5b\x25\x64\xcd\x2e\x20\xae\x26\x33\xf7\xb7\x6c\xf6\xfb\xce\xff\x24\x0f"
            "\x65\xe5\xee\xba\x28\x43\xfa\xa1\xe7\x71\x08\xd3\x5c\x59\xb3\xf5\x70\x11"
            "\x26\x60\xe9\x27\x8d\xa3\x12\x76\x86\xdc\x2a\x96\x5a\x6a\xd1\x67\x2e\x29"
            "\xff\x9e\xdd\x62\xf4\x9e\x41\xbd\xd6\x53\x48\xd2\x65\x78\x46\xbe\x80\x47"
            "\x9c\xea\x41\x5b\xfb\x59\x27\x22\x9f\x3b\x77\x2e\xd9\xc9\xb7\x63\x9d\x8f"
            "\x75\xff\x66\x21\x84\x1a\x7b\x64\x97\x81\x31\xe8\x69\x52\xbf\xe5\x10\x71"
            "\x5b\x25\xef\xbc\xf3\x93\x32\x0c\x1d\x62\x99\xac\x6c\x19\xdd\x90\x88\x70"
            "\xf9\x6d\x92\xb8\xbd\xcf\x11\xe3\xc9\x87\x8f\x2e\x37\xbd\xaf\x72\x71\x8a"
            "\xd0\xbc\x28\x72\xc7\xa0\xb1\x01\xf6\xe3\x92\x99\x72\x34\xe0\x6c\x9b\x1b"
            "\xdc\x32\x49\x71\x42\x7d\x6b\x97\xc3\xc1\x65\x31\x17\x8f\x40\xa8\xab\x52"
            "\xf9\x8e\x06\x67\x80\x97\x7a\xbd\x35\x2e\x1e\xfe\x61\x85\xf7\x02\x33\xb3"
            "\x0f\xdc\x96\xb6\xa2\x89\xb9\xe0\xfc\xee\x55\x59\x23\xef\x59\x0b\xd9\xcd"
            "\x2f\x0e\xf7\x02\x46\x41\x45\x0d\x1a\x92\x58\x04\x6a\xc0\xe8\x0a\xcd\x44"
            "\xf2\x67\x44\x69\x46\xc0\x96\xdb\x98\x48\xf7\x8c\xdd\xba\x9f\x54\x09\xb0"
            "\x90\xdd\x23\x44\xd8\xd4\x5a\x16\xcd\x2e\xcc\xe5\xbf\x22\xbd\x4c\xb8\x9a"
            "\xfd\x30\x67\xcb\x0b\xd9\xa7\x27\x9b\xe1\xb1\xe5\x03\x49\x8f\x39\xed\xce"
            "\x71\x4f\x37\x59\x7d\x0e\x64\x60\x71\x6d\x09\xea\x37\x6d\x73\xe8\xa7\x1f"
            "\xff\x13\x24\xfa\x2a\xeb\xa7\x5e\x8b\xbd\x0e\xa4\xc4\x18\xb4\x57\x84\x55"
            "\x01\x53\xd4\x92\x89\x8e\x15\xda\x88\xb6\xed\x3f\x67\xe8\x5d\xbb\x11\x1c"
            "\x2f\xea\xc2\xfd\x78\xb6\xf9\x01\x1c\x68\x64\xb9\xbb\x11\x65\x36\x94\xf7"
            "\xf0\x25\x68\xb7\x68\xb6\xa2\x7d\x08\x0e\xad\xc0\x09\x37\x44\xb9\x11\x5a"
            "\xa2\xf8\xd0\x3f\xa2\x7f\xae\xa2\xe3\x56\xef\x8c\xe6\x2e\x47\x22\xdd\xd1"
            "\x39\xf7\x84\xac\x3b\x8a\xfb\x98\xc8\xd3\x98\x4c\x8c\xf9\x43\x8e\x83\x71"
            "\x03\x30\x42\x8b\x78\x30\xc1\x70\x9a\x30\x9b\xba\xc3\xbb\xdb\xd0\x83\xe5"
            "\x39\x93\x8c\x57\x89\xe1\x70\x9d\x2c\x0e\xe9\x4d\xcb\x2f\xe6\x4c\x31\xc8"
            "\x7d\x25\xcc\x7f\x82\x6b\xbf\x5e\x02\x1d\x5a\xaa\x17\x29\x70\xaa\xe9\x6a"
            "\x68\x58\xf8\xc1\x1f\xdf\xb7\x48\x32\x8d\x97\x41\x1e\xdc\x10\xdd\x16\xfd"
            "\x10\xfa\xa7\xc3\xb9\x4c\xe1\x91\x52\xfb\x29\x65\x69\x04\x21\xd3\xc6\xdb"
            "\x2e\x7e\x88\x88\xc7\xbb\x06\x44\x3d\xb3\x11\x1e\x3d\xb6\x9a\x88\xdd\x09"
            "\x7a\xb8\xc6\x4d\x6b\xea\x30\xda\x24\x7f\xcd\x11\x7a\x30\xee\xf4\x5c\xd9"
            "\x33\x9a\x78\x37\x56\x28\xcd\xbf\xa2\x6d\x6b\x34\x19\xe6\x9b\xbe\x8e\x88"
            "\x47\x91\x29\x68\x4b\x23\x04\xda\xa2\xd6\x84\x30\x48\x26\xee\xe9\x7d\x34"
            "\x63\x03\xcc\x63\x1e\x10\x46\x5a\x2f\x92\x43\xe8\x4d\x32\x28\x10\x38\x8b"
            "\xa2\xd3\x06\x26\xa6\x3d\xf9\x79\x3e\xb9\x63\xdf\x23\x48\x65\xcb\xb6\x8c"
            "\xdb\xc0\x43\x63\xe1\x7a\x6a\x6e\xb1\xc8\x01\x41\x77\xc9\x9f\xaa\xcb\x8d"
            "\x7a\x8e\x99\xd8\x97\x71\x8b\xc5\x10\x55\x72\x78\x20\xd3\x21\xf2\x5f\xd1"
            "\x5d\x24\xd0\x29\xd4\xfa\xd6\xfd\xe9\x7f\x09\x11\x80\xef\x2b\xc3\x91\x3b"
            "\xc1\x1f\x8f\x10\x4b\xcc\x7e\xa0\x02\x41\x57\x48\x1b\x35\x37\xce\x54\x3f"
            "\xe8\xab\x93\xa2\x6c\xb9\xba\x51\xfa\x78\xd3\x37\xbf\x10\xba\x29\xdc\x5f"
            "\xeb\xfe\x4a\xd0\x14\xbd\x40\xf3\x33\x30\x82\x3d\x7f\x45\x73\xba\xeb\xd9"
            "\xe0\x63\xd5\x9a\x87\x66\x2b\xef\x85\x9c\xee\x8a\x8e\x53\x18\xaa\xe2\x2e"
            "\x79\xfb\x4d\x31\xe0\x88\xf0\x56\x9c\x67\xbb\xa4\x18\x68\xfe\x46\x4e\xd7"
            "\x7e\xc7\xfe\x07\xdd\x3a\x5c\x2c\x81\xc1\xfd\xed\x16\x05\x98\xb3\x75\x64"
            "\x51\x31\x73\xf1\x3f\xee\xb9\xdf\x4b\x47\xed\xe8\x05\x0a\xac\x43\x1e\x1b"
            "\x20\x58\xc6\xaf\xe7\xe4\x4b\xcc\x6f\x28\xdc\x58\x33\xdd\xed\x10\xe6\x91"
            "\x7e\x15\xb9\x30\x88\xcd\x90\x79\x18\x26\xca\x7c\x3b\x9a\x42\x11\xe9\xe2"
            "\xff\xd4\x96\x62\x23\x81\x6d\xb6\xe4\xed\xe5\x70\x1b\x76\x98\x8d\x8f\x34"
            "\xaa\x14\x0f\xfb\x4b\xc3\xef\xfc\xcb\xe5\xaf\x39\x42\xd4\xc5\x71\x77\x00"
            "\xe5\x92\xa1\x70\x01\xd2\x0b\x66\x5f\xb7\xc6\xf6\x53\x61\x10\x8a\x13\x70"
            "\xa4\x5d\xb4\x77\xa1\xf4\x49\xe5\xc3\xf9\xa8\x9f\x96\x72\x90\xaf\x23\x1d"
            "\xb8\x2f\xed\xec\xfc\xa2\xc3\xce\xdf\xfe\xad\xb7\x75\x72\x8b\x45\xce\x4b"
            "\xde\x06\x30\xe9\xe1\xdf\xcd\x98\x13\x8a\x55\x6d\xd4\x0b\x65\x55\x81\xb4"
            "\x51\xa7\x16\x4a\xd5\x7c\x4f\xb2\xb5\xdc\x5b\x14\x5e\x87\x33\xde\x33\xaf"
            "\x84\x4e\x40\x04\x14\xf8\x5c\x28\xca\x1f\x88\x8e\x70\xc4\x5d\x28\xc8\x23"
            "\xe0\x7e\xdd\xf3\x0d\xf7\x91\x1d\xf5\x84\xad\x45\x8a\x25\x35\x50\x84\x16"
            "\x3a\x9a\x7c\xc3\xba\xc4\x27\x6e\x95\x72\x11\x62\x6e\x28\x82\x12\x00\x53"
            "\x34\xde\xc7\x42\xcf\xe5\x7e\x6c\x82\x34\xe5\x20\xd8\xbe\xd4\x5a\xf4\x76"
            "\x77\x0f\x47\x18\xf7\x99\xc1\xa1\xf6\x37\xfc\x04\xa7\x37\x80\xa3\x5d\x21"
            "\x94\xe6\x01\x7e\x40\x5d\x3e\x0b\x1e\x9f\x2c\x7c\x0f\x6a\x0e\xd2\x8a\x2e"
            "\xaf\xdd\x79\x22\x76\x20\x59\xfe\x0e\xbc\x77\x59\x92\x45\xb1\x2c\x9f\x0c"
            "\xef\x9e\xda\xb1\xa2\x51\x71\xa6\xa9\xa0\x56\x2e\x24\xdb\x76\xe2\x5d\xfb"
            "\x5e\xcb\x73\x52\xd0\xbf\xc7\x8d\x85\x8e\x8a\xaa\xc9\x13\xef\xa4\xff\x60"
            "\x48\x96\x79\xe8\xc7\x20\x19\x89\x7a\x8a\x85\xa9\xee\x29\xf1\x09\x22\x31"
            "\x5b\xa7\xdb\x0a\x12\x6f\x82\x7c\x03\xfa\x5b\xbb\x90\xf9\x91\xcb\x98\x66"
            "\xb3\xe0\x30\x47\xcb\x1f\xab\xbb\xdb\xe5\xa3\x52\x82\xf0\x30\xc0\xdb\xdb"
            "\xd2\x27\xf8\x5b\x05\x72\x1c\x45\xc8\xb2\xb8\x5d\x33\x10\xbb\x41\xd6\xaa"
            "\x56\x14\xa6\x0d\x98\x74\xd1\x2f\x11\xf5\xa9\x4b\x15\xf7\x41\xdb\x31\x0c"
            "\x92\x7b\x2e\x90\x60\x7a\x2a\xf8\xc4\xb5\x7d\x6b\x69\x37\xd5\xa1\xeb\x14"
            "\x58\x9d\x1e\x36\x16\x42\x45\x8c\xc2\xfb\xd2\x96\xac\x03\x1d\x09\x9d\xf4"
            "\x9a\x53\xe8\xf0\xd4\x50\x6b\x2d\xcb\xb2\x0f\x54\x56\x0b\x69\x5a\x4e\x0a"
            "\x4a\x5a\x13\x23\x19\x85\xd5\x3b\xb3\x53\x31\x26\xad\xd2\x81\xfd\x38\xcd"
            "\xdf\x7e\xf4\x37\x20\x1e\x8a\xea\x1a\xb6\x3a\xd6\x73\xcd\xcc\x6c\x60\x41"
            "\x14\xae\xc7\x71\x88\x1b\x4f\xb7\xaa\x7c\xcb\xd3\x97\xe7\x03\xf1\x08\x95"
            "\x61\x9e\x15\xc7\x16\x84\xbb\xbf\xa2\xb2\xc6\x0a\x79\x0d\xe0\xe5\x05\x95"
            "\x38\xb5\x1d\x34\x7a\x68\xad\x05\x74\x72\xa9\xf1\xea\xf0\x54\xdf\x77\x91"
            "\xb5\x8f\x63\x8c\x05\x95\x55\xbb\xb9\x70\xed\xf8\x77\xd5\xf6\x23\xe2\x54"
            "\x1d\xba\x27\xdf\x8d\x71\x3f\xe7\xc5\x5f\x40\xfb\xf3\xdb\xdc\x3d\x04\x2e"
            "\x92\xb8\x3f\x94\xdd\x66\xd1\xcd\x2b\xc5\xcc\x98\xa6\xa5\x02\xb5\xd8\xd8"
            "\xee\x6e\xfe\xca\xcf\xb7\x62\x46\x4c\x6f\x8c\xea\x8b\xda\xd1\x4a\x29\x19"
            "\x99\x28\xe0\xcb\x07\xfb\xc3\x06\xb9\xee\xcc\xc4\xc7\xa3\x26\x18\x52\x54"
            "\x41\x48\x92\xb6\x14\xdd\xcc\x20\xe9\xb5\xd2\x58\xe6\x62\x71\x43\x0c\x07"
            "\x05\xc5\xa6\x22\xfa\x56\x46\xda\x48\x97\xa0\x88\xf6\x8f\xde\xb6\x68\x42"
            "\xad\x3d\x72\xf2\x32\xf4\x87\xb3\xdb\x3b\x83\xd8\x26\x22\xc9\x1d\xaf\x77"
            "\x96\x34\xfa\x1b\x97\xc7\xd5\xad\xb5\xd5\x3b\xe5\x19\x8b\xc5\x9a\xef\x1a"
            "\xab\x60\xc3\x79\x52\x96\xa8\x4a\xc3\xf7\x73\x99\xfe\xed\x5b\x86\xf4\x4b"
            "\x3a\x1c\xa3\x5e\xe4\x68\x91\xee\x90\x3a\x90\x34\x08\x83\xce\xc4\x1d\x57"
            "\x7a\x88\x80\x94\x5b\x50\x4c\x7e\xa5\xbd\xc9\x4d\x66\xbf\x25\xb4\xd2\xe0"
            "\x64\xbd\x69\xdf\xce\x4f\x00\xf8\xdf\xad\xe0\x73\x9f\xab\x52\x75\xdb\x11"
            "\xe9\x99\xb2\x56\x22\xc2\x0c\xa0\xa9\xf1\x0f\x27\xc8\x00\xa4\xf5\xd1\x9a"
            "\xa9\x2d\x04\xcd\x28\x2f\x96\xe9\x90\x30\x18\x74\xc5\xdd\xcf\xb1\x32\x23"
            "\xc4\xf5\xfd\x37\xc4\x49\xad\xde\x53\x2a\x16\xae\xe6\x64\x07\xbf\xee\xee"
            "\xbd\xa4\xf5\x13\xf2\x24\xe4\x34\xa9\xc0\x8a\x22\x81\xd5\xe1\xf4\x59\x1c"
            "\x9a\x43\x3a\xb1\x57\x6c\x11\xed\xd0\xdf\x9f\xb6\xf4\x7b\x76\x1f\xc8\x78"
            "\xd5\x32\xd7\xfc\x2a\x76\x24\x61\xfd\x14\x73\xeb\x7c\x7c\x88\x66\x8b\x74"
            "\x9b\x9b\xbf\x43\xc9\x37\xfa\x2b\xd7\x3a\xe9\x17\xea\x2a\x90\x3b\xf5\xf7"
            "\xd7\x1a\xe1\xc7\xd7\x1c\x60\xde\xf1\xbb\xc4\xe8\x15\x1b\xee\x5f\x4a\x39"
            "\x63\x25\x90\x7f\x4f\x2b\xcb\xe9\x80\x38\xe4\x6b\xc9\xfb\x30\xd1\x99\xf0"
            "\x25\xea\xbe\xb0\x37\xce\xae\xc3\xee\x18\x7f\x73\xa1\x36\xb8\x56\x6a\x94"
            "\x3d\x5b\x32\x71\x19\x9e\x6d\x19\xb7\x06\x6d\x90\xb1\x0d\x0c\x11\xe7\xcb"
            "\x0c\x0b\x5f\x73\x12\x7c\xd6\x85\xa7\x63\x8b\x99\xa1\xc9\xae\xa4\xfb\xf3"
            "\xfa\xc6\x7a\x4b\x11\x4c\xa9\xfa\x60\xd2\xc9\xc2\x47\x23\xb0\x37\x14\x2e"
            "\x3e\x47\x50\x3f\x3d\xfd\xff\xc4\x87\x21\x20\x90\xd2\x21\xeb\x85\xf5\x3c"
            "\xf6\x17\x6c\x26\xb9\x3c\x75\x7b\x52\x1d\x01\x7c\xa1\x7a\xc7\x88\x9c\x26"
            "\xc6\x47\x3f\xb4\x4c\xc2\xab\x79\xcd\x76\xfb\xf8\xfc\x5a\x81\xdc\x24\xbd"
            "\x7b\xa6\xd5\x5d\x80\x36\xf4\xd6\x02\x18\xe7\xc8\xfd\xf7\xf3\xb9\x15\xef"
            "\xd0\xbd\x0e\xdf\xac\x38\x0e\x37\x17\x79\x4a\xb4\x6b\x2a\x5d\xae\xd5\x8f"
            "\xdb\x3e\xa6\x67\x20\xc0\xe7\x8a\x0c\xe8\x25\xb1\x55\xeb\xc0\x97\x9c\xf7"
            "\x79\x15\xdb\x3d\xf6\x00\xbb\xd1\x79\xf1\xd2\xd6\x74\xd7\x6b\x12\xaf\xf0"
            "\x87\x75\x7d\x4a\xa4\x80\xee\x15\x66\x78\x40\x74\xa5\x28\x7b\xe0\x08\x8e"
            "\xfb\xe1\x2f\x55\x0b\xad\x3b\x41\x0c\xf0\x4f\xba\x8f\x06\xd1\x12\x0a\x1d"
            "\xad\x35\xde\x9c\x7a\x22\xc3\xca\xf8\x3c\x1b\xf6\xea\x57\xa0\x55\xaf\xcb"
            "\xc6\x1b\x06\x8f\xeb\x5d\x17\xf5\xd0\xcd\x9e\x59\x11\xd2\xd9\xc8\xc6\xff"
            "\x89\xfc\x37\x72\x5a\x4b\x9a\xc3\xa8\x80\x0d\x17\x31\x19\x9c\x82\x01\xc0"
            "\x52\x2e\x9a\xf7\x49\xfe\x36\xe1\x41\x94\x31\x0a\x5a\xaf\xd9\x44\xc3\x21"
            "\xef\xb4\xec\xf5\xc1\x31\xcc\xf9\xde\x48\xc8\xb3\x6a\x90\x5f\x47\xeb\xa8"
            "\xfb\x42\xce\x43\x5d\x1b\xd4\x08\xdc\x87\xb1\xc9\x15\x77\xff\xba\x16\xe3"
            "\x2b\x9b\xe2\x19\x82\xd3\x17\x63\x20\xc8\xe2\x37\x99\xb6\xc5\xcc\x3d\x83"
            "\x4c\xcb\xe9\xac\xed\xa7\x0b\xd2\xc7\x3a\x15\x41\x37\xac\xdd\x65\xf4\x19"
            "\x1e\x44\x70\x89\x3e\xb2\x4e\x4a\xb0\x07\x00\xc2\xc1\x35\x14\x9f\xb8\x66"
            "\x44\xb5\xac\x0b\xe1\x66\x92\x88\xb9\xc2\x9a\x1f\x6f\x61\x51\x7d\x8b\x4f"
            "\x09\x61\x6e\x76\x7b\xd7\x2d\x13\xf8\x33",
            4096));
    syscall(__NR_lsetxattr, /*path=*/0x200001c0ul, /*name=*/0x200002c0ul,
                    /*val=*/0x20002040ul, /*size=*/0x1009ul, /*flags=*/3ul);
}
int main(void) {
    syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
                    /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
    syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul,
                    /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
    syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
                    /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
    install_segv_handler();
    for (procid = 0; procid < 4; procid++) {
        if (fork() == 0) {
            loop();
        }
    }
    sleep(1000000);
    return 0;
}

repro.txt

syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x220e002, 0x0, 0x1, 0x0, &(0x7f0000000100))
mount(&(0x7f0000000040)=ANY=[@ANYBLOB='mtd', @ANYRESHEX=0x0], &(0x7f00000000c0)='./file0\x00', &(0x7f0000001200)='jffs2\x00', 0x0, 0x0)
lsetxattr$security_evm(&(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), &(0x7f0000002040)=@v2={0x3, 0x2, 0xb, 0x4, 0x1000, "788d9cb299abd72ece913d53365e16688e51ace15984ab53d1666ae3f5dfbc860bef87389e21286be236ddc3d0fa2e51d5c5c7b35c5d503c5b2c3b6be0fc56e97df88faa0635363ba92b82c47a817ac97f1d638a1461821255ec23bd0ce5bf1094e3a8980d7e6d1976ba778745920e1718fddac4bd66b0a606801aaefded293c3fcebad3b2c06403dba9994971659b7f4a077addaeb8ae3e5aca7027fde1e40001c0bdd800bcc287e02c867e2782deaf676a261647db8c2f3945022057de768100a8bf73d9f9ff29229b46dead58b2ddf96433468e9eee8950df658711e411364e44145e682f3c053c6f5a1861eee6edf885a97c545805ac0c35a5e4623b2001861c593354b570ff3b4a45f1acde0a8dbd17c09ce448ed5dfd9e7472e68967decb769fa600cd30beb6c8030e9474c7ec4c1daf3e007bbc5765b366d4a176e38bdfabedd2b076a5ed7d50f5177b94a6a0f000cd3acadde8e80f66eada14018620b159e9e14c252d20c8dbb0fe3605b5698b53e4210b62fcbd00017eaa01eb1fa521bdb8d30e83951b4ea0286c8f0d464517a11d7922d6cce4d2058ec8cd7b02b73d825d7e0abbbd85e991220fc7995534b7b1998ca752890b079a7ca3fde56438cf82d5dd9edbd11fd293c17d1cf16657d0b352a8c6c36300ad09a78e3ee3913b9b6f53debffc7e32bfb64b0e8cbe07fe9b0dadb097aeb2c242430bec75630a3921828a7314de1404829e7afb3b8420e85f2c8f6e88de042314416e5c00c59b22208004bec161f8457c7f8e3a8ca4174a4b78df6e460d56d24e01ae1a2411270f79d020a6bac855f1a3ef7b3d0991882656b408dcdaf02db46ac8fcab0c875d1f2e8db366e6a20cb67a4db920382a6915715d3b4266f779fe8633bea6def28cc159138b834334cedef3dec54ea5303df56be87115315ec0f1478a0c0869e5f7c33da64b23af5811751055c90849484481d5a10d72e08ccd12710c4f2ff586a9ea175f4aa70b156c00c57e22c1360bfc7d36aa4792444f81d8a0ed41bf6a452ea5268b8605682ac63eaa465218f4d962db42154d01966d3ad8fc2fde48ef71be08be58e5ad6d5a3593efc9c1336e541372a34799d24ea00d4d4985bed1dab10620911e9f6967880826be5a1f1bb4b2a3948654c6935cafeb4925e107a01f9dda668e5fd7489e82139241a9190f090afe2094234c75fec074622748d4dd782a930f42b0e75d924bef68ffafbaa98916151a36ef2998afd3000955efbfa0a9a008358c11043c0f96b52fc78a42531aa5dfd8de09518cff008b339259b266c488bb1da058ba218cd64b3e413ca2889d1086e8c40ae11501984121dcfa2fde09d068f6dbbe8359980dad96ed220b8534aaef353dfc81560907d26c02442924ad55b11d3aee7e5516d96ad078c85ad1cdb18a45474305a8db350f9844380e2094f691a05ea09458bc53f3236a1f3fa5e144a575ba57e58d00f7653d2e6b6cbe18d28ce3f5792538ad20c0e0e10b03dac34009d6d3e4c7662cca88b53066e95efe45ee3e04da328690dae1aa0070f0945e269b75733b106ff6514555d54d958f7313441fa21f97615312c4f600a1430f629812f23cd21e703b966e04aa6d0bba6f2539369a3badebfaa8197d89e3294b44c0ea54ae6b7f4a496568043175a5666541b559a9feaf0c5454f12f230e97bcf84dae11d1a8359411b98bb6063ee8ae0ffa30b5757771c7b70e4fbb6e951a680873e6da531600e951110c34caacc8e978c06b4848c880c48ad8e6c54bc792ce54ea4b1c05ab04afb4d6cab25b85d1c4b6c474c7ec9267b501edaa20ee0e415868d87866426b1374e58a666530b94e342c8b2ebdd405fef0a26df82bbc502da2ca1550c28d3c0b69872ff861cd23cb6e1ff1e62f625ae92f90f30933fc827edd386121315352dbc9f4cab3dddadeb8df051d2f59cd59e97dc92ce4341f978003e48685e7673cf1e60260600e7cbf731dc168b9a411dc3c85f843bd2c5fca89c06d12bac08a61cf099ae5f23e5e908448e81f2779b385b31dcd5cf8aaad4b85ae7063624a7df573aeccc8b61977f8ec10e68b5df1c1b805c7e001228a65c0e772c5251466a49f10219bb718a4aa2e35c40811a972eb58530f7f0741d3be0c00e38f58994a5199547fc5150c781ffe2e56560f08eb75bfcd9085ff140ceefd0d6ed43dad39d2cda8694d420e861a1dec4a28d1cf5324c5c5ab81922154873b3f82df1bc06cb9565c08f774d9fa6fe575daf87b328ab10b912243f100712a27f4981faa372d736702c565a08c4d6b0aa312d3c9017fd1e7ab981de7ee1dfc1a849924aa92eab1b3e6e9742f6913a08b5699d670697a608d749e06c341421a809a365dca3f8d88d842685080f8ed93482888065b50bf9abde75fe37c8ff2ae4f24e26f83949ab5c4f4a96e13b2cdf742daf9c1b58305691456c6c190bfb7bbbb084ea9f97e99c3e028415d4e05ccf7717b5797ff5bafa2518a0acab434a188d4797a85f36557dd6aa39c75e80b72496372652544b1424901a6a9d4b7453086b6ba26a40521da94ab54de4a11b51b4ad7ab1d6805f323b044955f779cfe7c1c3586f4be0eab226a25ae16bd8dc7eb015024b7434b6408343a1be6e1dd3925c102b4c9c543983835b6bb45f80ea35bf7fcecab5d947224bfdb1c03b20fc07a5cac630beb4b3044ebe55c9023844c1fd64b4eb025536867f0afa388576c5b2564cd2e20ae2633f7b76cf6fbceff240f65e5eeba2843faa1e77108d35c59b3f570112660e9278da3127686dc2a965a6ad1672e29ff9edd62f49e41bdd65348d2657846be80479cea415bfb5927229f3b772ed9c9b7639d8f75ff6621841a7b64978131e86952bfe510715b25efbcf393320c1d6299ac6c19dd908870f96d92b8bdcf11e3c9878f2e37bdaf72718ad0bc2872c7a0b101f6e392997234e06c9b1bdc324971427d6b97c3c16531178f40a8ab52f98e066780977abd352e1efe6185f70233b30fdc96b6a289b9e0fcee555923ef590bd9cd2f0ef7024641450d1a9258046ac0e80acd44f267446946c096db9848f78cddba9f5409b090dd2344d8d45a16cd2ecce5bf22bd4cb89afd3067cb0bd9a7279be1b1e503498f39edce714f37597d0e6460716d09ea376d73e8a71fff1324fa2aeba75e8bbd0ea4c418b45784550153d492898e15da88b6ed3f67e85dbb111c2feac2fd78b6f9011c6864b9bb11653694f7f02568b768b6a27d080eadc0093744b9115aa2f8d03fa27faea2e356ef8ce62e4722ddd139f784ac3b8afb98c8d3984c8cf9438e83710330428b7830c1709a309bbac3bbdbd083e539938c5789e1709d2c0ee94dcb2fe64c31c87d25cc7f826bbf5e021d5aaa172970aae96a6858f8c11fdfb748328d97411edc10dd16fd10faa7c3b94ce19152fb2965690421d3c6db2e7e8888c7bb06443db3111e3db69a88dd097ab8c64d6bea30da247fcd117a30eef45cd9339a78375628cdbfa26d6b3419e69bbe8e88479129684b2304daa2d684304826eee97d346303cc631e10465a2f9243e84d322810388ba2d30626a63df9793eb963df234865cbb68cdbc04363e17a6a6eb1c8014177c99faacb8d7a8e99d897718bc51055727820d321f25fd15d24d029d4fad6fde97f091180ef2bc3913bc11f8f104bcc7ea0024157481b3537ce543fe8ab93a26cb9ba51fa78d337bf10ba29dc5febfe4ad014bd40f33330823d7f4573baebd9e063d59a87662bef859cee8a8e5318aae22e79fb4d31e088f0569c67bba41868fe464ed77ec7fe07dd3a5c2c81c1fded160598b37564513173f13feeb9df4b47ede8050aac431e1b2058c6afe7e44bcc6f28dc5833dded10e6917e15b93088cd90791826ca7c3b9a4211e9e2ffd4966223816db6e4ede5701b76988d8f34aa140ffb4bc3effccbe5af3942d4c5717700e592a17001d20b665fb7c6f65361108a1370a45db477a1f449e5c3f9a89f967290af231db82fedecfca2c3cedffeadb775728b45ce4bde0630e9e1dfcd98138a556dd40b655581b451a7164ad57c4fb2b5dc5b145e8733de33af844e400414f85c28ca1f888e70c45d28c823e07eddf30df7911df584ad458a25355084163a9a7cc3bac4276e957211626e288212005334dec742cfe57e6c8234e520d8bed45af476770f4718f799c1a1f637fc04a73780a35d2194e6017e405d3e0b1e9f2c7c0f6a0ed28a2eafdd7922762059fe0ebc77599245b12c9f0cef9edab1a25171a6a9a0562e24db76e25dfb5ecb7352d0bfc78d858e8aaac913efa4ff60489679e8c72019897a8a85a9ee29f10922315ba7db0a126f827c03fa5bbb90f991cb9866b3e03047cb1fabbbdbe5a35282f030c0dbdbd227f85b05721c45c8b2b85d3310bb41d6aa5614a60d9874d12f11f5a94b15f741db310c927b2e90607a2af8c4b57d6b6937d5a1eb14589d1e361642458cc2fbd296ac031d099df49a53e8f0d4506b2dcbb20f54560b695a4e0a4a5a13231985d53bb3533126add281fd38cddf7ef437201e8aea1ab63ad673cdcc6c604114aec771881b4fb7aa7ccbd397e703f10895619e15c71684bbbfa2b2c60a790de0e5059538b51d347a68ad057472a9f1eaf054df7791b58f638c059555bbb970edf877d5f623e2541dba27df8d713fe7c55f40fbf3dbdc3d042e92b83f94dd66d1cd2bc5cc98a6a502b5d8d8ee6efecacfb762464c6f8cea8bdad14a29199928e0cb07fbc306b9eeccc4c7a326185254414892b614ddcc20e9b5d258e66271430c0705c5a622fa5646da4897a088f68fdeb66842ad3d72f232f487b3db3b83d82622c91daf779634fa1b97c7d5adb5d53be5198bc59aef1aab60c3795296a84ac3f77399feed5b86f44b3a1ca35ee46891ee903a90340883cec41d577a8880945b504c7ea5bdc94d66bf25b4d2e064bd69dfce4f00f8dfade0739fab5275db11e999b25622c20ca0a9f10f27c800a4f5d19aa92d04cd282f96e990301874c5ddcfb13223c4f5fd37c449adde532a16aee66407bfeeeebda4f513f224e434a9c08a2281d5e1f4591c9a433ab1576c11edd0df9fb6f47b761fc878d532d7fc2a762461fd1473eb7c7c88668b749b9bbf43c937fa2bd73ae917ea2a903bf5f7d71ae1c7d71c60def1bbc4e8151bee5f4a396325907f4f2bcbe98038e46bc9fb30d199f025eabeb037ceaec3ee187f73a136b8566a943d5b3271199e6d19b7066d90b10d0c11e7cb0c0b5f73127cd685a7638b99a1c9aea4fbf3fac67a4b114ca9fa60d2c9c24723b037142e3e47503f3dfdffc487212090d221eb85f53cf6176c26b93c757b521d017ca17ac7889c26c6473fb44cc2ab79cd76fbf8fc5a81dc24bd7ba6d55d8036f4d60218e7c8fdf7f3b915efd0bd0edfac380e3717794ab46b2a5daed58fdb3ea66720c0e78a0ce825b155ebc0979cf77915db3df600bbd179f1d2d674d76b12aff087757d4aa480ee1566784074a5287be0088efbe12f550bad3b410cf04fba8f06d1120a1dad35de9c7a22c3caf83c1bf6ea57a055afcbc61b068feb5d17f5d0cd9e5911d2d9c8c6ff89fc37725a4b9ac3a8800d1731199c8201c0522e9af749fe36e14194310a5aafd944c321efb4ecf5c131ccf9de48c8b36a905f47eba8fb42ce435d1bd408dc87b1c91577ffba16e32b9be21982d3176320c8e23799b6c5cc3d834ccbe9aceda70bd2c73a154137acdd65f4191e4470893eb24e4ab00700c2c135149fb86644b5ac0be1669288b9c29a1f6f61517d8b4f09616e767bd72d13f833"}, 0x1009, 0x3)