// https://syzkaller.appspot.com/bug?id=8cce7c2c0566b3a1bdb55c5b1026833a88cf8b0f
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <netinet/in.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/if_addr.h>
#include <linux/if_ether.h>
#include <linux/if_link.h>
#include <linux/if_tun.h>
#include <linux/in6.h>
#include <linux/ip.h>
#include <linux/neighbour.h>
#include <linux/net.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/tcp.h>
#include <linux/veth.h>

unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static struct {
  char* pos;
  int nesting;
  struct nlattr* nested[8];
  char buf[1024];
} nlmsg;

static void netlink_init(int typ, int flags, const void* data, int size)
{
  memset(&nlmsg, 0, sizeof(nlmsg));
  struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg.buf;
  hdr->nlmsg_type = typ;
  hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
  memcpy(hdr + 1, data, size);
  nlmsg.pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
}

static void netlink_attr(int typ, const void* data, int size)
{
  struct nlattr* attr = (struct nlattr*)nlmsg.pos;
  attr->nla_len = sizeof(*attr) + size;
  attr->nla_type = typ;
  memcpy(attr + 1, data, size);
  nlmsg.pos += NLMSG_ALIGN(attr->nla_len);
}

static void netlink_nest(int typ)
{
  struct nlattr* attr = (struct nlattr*)nlmsg.pos;
  attr->nla_type = typ;
  nlmsg.pos += sizeof(*attr);
  nlmsg.nested[nlmsg.nesting++] = attr;
}

static void netlink_done(void)
{
  struct nlattr* attr = nlmsg.nested[--nlmsg.nesting];
  attr->nla_len = nlmsg.pos - (char*)attr;
}

static int netlink_send(int sock)
{
  if (nlmsg.pos > nlmsg.buf + sizeof(nlmsg.buf) || nlmsg.nesting)
    exit(1);
  struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg.buf;
  hdr->nlmsg_len = nlmsg.pos - nlmsg.buf;
  struct sockaddr_nl addr;
  memset(&addr, 0, sizeof(addr));
  addr.nl_family = AF_NETLINK;
  unsigned n = sendto(sock, nlmsg.buf, hdr->nlmsg_len, 0,
                      (struct sockaddr*)&addr, sizeof(addr));
  if (n != hdr->nlmsg_len)
    exit(1);
  n = recv(sock, nlmsg.buf, sizeof(nlmsg.buf), 0);
  if (n < sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))
    exit(1);
  if (hdr->nlmsg_type != NLMSG_ERROR)
    exit(1);
  return -((struct nlmsgerr*)(hdr + 1))->error;
}

static void netlink_add_device_impl(const char* type, const char* name)
{
  struct ifinfomsg hdr;
  memset(&hdr, 0, sizeof(hdr));
  netlink_init(RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr));
  if (name)
    netlink_attr(IFLA_IFNAME, name, strlen(name));
  netlink_nest(IFLA_LINKINFO);
  netlink_attr(IFLA_INFO_KIND, type, strlen(type));
}

static void netlink_add_device(int sock, const char* type, const char* name)
{
  netlink_add_device_impl(type, name);
  netlink_done();
  int err = netlink_send(sock);
  (void)err;
}

static void netlink_add_veth(int sock, const char* name, const char* peer)
{
  netlink_add_device_impl("veth", name);
  netlink_nest(IFLA_INFO_DATA);
  netlink_nest(VETH_INFO_PEER);
  nlmsg.pos += sizeof(struct ifinfomsg);
  netlink_attr(IFLA_IFNAME, peer, strlen(peer));
  netlink_done();
  netlink_done();
  netlink_done();
  int err = netlink_send(sock);
  (void)err;
}

static void netlink_add_hsr(int sock, const char* name, const char* slave1,
                            const char* slave2)
{
  netlink_add_device_impl("hsr", name);
  netlink_nest(IFLA_INFO_DATA);
  int ifindex1 = if_nametoindex(slave1);
  netlink_attr(IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1));
  int ifindex2 = if_nametoindex(slave2);
  netlink_attr(IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2));
  netlink_done();
  netlink_done();
  int err = netlink_send(sock);
  (void)err;
}

static void netlink_device_change(int sock, const char* name, bool up,
                                  const char* master, const void* mac,
                                  int macsize)
{
  struct ifinfomsg hdr;
  memset(&hdr, 0, sizeof(hdr));
  if (up)
    hdr.ifi_flags = hdr.ifi_change = IFF_UP;
  netlink_init(RTM_NEWLINK, 0, &hdr, sizeof(hdr));
  netlink_attr(IFLA_IFNAME, name, strlen(name));
  if (master) {
    int ifindex = if_nametoindex(master);
    netlink_attr(IFLA_MASTER, &ifindex, sizeof(ifindex));
  }
  if (macsize)
    netlink_attr(IFLA_ADDRESS, mac, macsize);
  int err = netlink_send(sock);
  (void)err;
}

static int netlink_add_addr(int sock, const char* dev, const void* addr,
                            int addrsize)
{
  struct ifaddrmsg hdr;
  memset(&hdr, 0, sizeof(hdr));
  hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6;
  hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120;
  hdr.ifa_scope = RT_SCOPE_UNIVERSE;
  hdr.ifa_index = if_nametoindex(dev);
  netlink_init(RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr));
  netlink_attr(IFA_LOCAL, addr, addrsize);
  netlink_attr(IFA_ADDRESS, addr, addrsize);
  return netlink_send(sock);
}

static void netlink_add_addr4(int sock, const char* dev, const char* addr)
{
  struct in_addr in_addr;
  inet_pton(AF_INET, addr, &in_addr);
  int err = netlink_add_addr(sock, dev, &in_addr, sizeof(in_addr));
  (void)err;
}

static void netlink_add_addr6(int sock, const char* dev, const char* addr)
{
  struct in6_addr in6_addr;
  inet_pton(AF_INET6, addr, &in6_addr);
  int err = netlink_add_addr(sock, dev, &in6_addr, sizeof(in6_addr));
  (void)err;
}

#define DEV_IPV4 "172.20.20.%d"
#define DEV_IPV6 "fe80::%02x"
#define DEV_MAC 0x00aaaaaaaaaa
static void initialize_netdevices(void)
{
  char netdevsim[16];
  sprintf(netdevsim, "netdevsim%d", (int)procid);
  struct {
    const char* type;
    const char* dev;
  } devtypes[] = {
      {"ip6gretap", "ip6gretap0"}, {"bridge", "bridge0"},
      {"vcan", "vcan0"},           {"bond", "bond0"},
      {"team", "team0"},           {"dummy", "dummy0"},
      {"nlmon", "nlmon0"},         {"caif", "caif0"},
      {"batadv", "batadv0"},       {"vxcan", "vxcan1"},
      {"netdevsim", netdevsim},    {"veth", 0},
  };
  const char* devmasters[] = {"bridge", "bond", "team"};
  struct {
    const char* name;
    int macsize;
    bool noipv6;
  } devices[] = {
      {"lo", ETH_ALEN},
      {"sit0", 0},
      {"bridge0", ETH_ALEN},
      {"vcan0", 0, true},
      {"tunl0", 0},
      {"gre0", 0},
      {"gretap0", ETH_ALEN},
      {"ip_vti0", 0},
      {"ip6_vti0", 0},
      {"ip6tnl0", 0},
      {"ip6gre0", 0},
      {"ip6gretap0", ETH_ALEN},
      {"erspan0", ETH_ALEN},
      {"bond0", ETH_ALEN},
      {"veth0", ETH_ALEN},
      {"veth1", ETH_ALEN},
      {"team0", ETH_ALEN},
      {"veth0_to_bridge", ETH_ALEN},
      {"veth1_to_bridge", ETH_ALEN},
      {"veth0_to_bond", ETH_ALEN},
      {"veth1_to_bond", ETH_ALEN},
      {"veth0_to_team", ETH_ALEN},
      {"veth1_to_team", ETH_ALEN},
      {"veth0_to_hsr", ETH_ALEN},
      {"veth1_to_hsr", ETH_ALEN},
      {"hsr0", 0},
      {"dummy0", ETH_ALEN},
      {"nlmon0", 0},
      {"vxcan1", 0, true},
      {"caif0", ETH_ALEN},
      {"batadv0", ETH_ALEN},
      {netdevsim, ETH_ALEN},
  };
  int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  if (sock == -1)
    exit(1);
  unsigned i;
  for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++)
    netlink_add_device(sock, devtypes[i].type, devtypes[i].dev);
  for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) {
    char master[32], slave0[32], veth0[32], slave1[32], veth1[32];
    sprintf(slave0, "%s_slave_0", devmasters[i]);
    sprintf(veth0, "veth0_to_%s", devmasters[i]);
    netlink_add_veth(sock, slave0, veth0);
    sprintf(slave1, "%s_slave_1", devmasters[i]);
    sprintf(veth1, "veth1_to_%s", devmasters[i]);
    netlink_add_veth(sock, slave1, veth1);
    sprintf(master, "%s0", devmasters[i]);
    netlink_device_change(sock, slave0, false, master, 0, 0);
    netlink_device_change(sock, slave1, false, master, 0, 0);
  }
  netlink_device_change(sock, "bridge_slave_0", true, 0, 0, 0);
  netlink_device_change(sock, "bridge_slave_1", true, 0, 0, 0);
  netlink_add_veth(sock, "hsr_slave_0", "veth0_to_hsr");
  netlink_add_veth(sock, "hsr_slave_1", "veth1_to_hsr");
  netlink_add_hsr(sock, "hsr0", "hsr_slave_0", "hsr_slave_1");
  netlink_device_change(sock, "hsr_slave_0", true, 0, 0, 0);
  netlink_device_change(sock, "hsr_slave_1", true, 0, 0, 0);
  for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) {
    char addr[32];
    sprintf(addr, DEV_IPV4, i + 10);
    netlink_add_addr4(sock, devices[i].name, addr);
    if (!devices[i].noipv6) {
      sprintf(addr, DEV_IPV6, i + 10);
      netlink_add_addr6(sock, devices[i].name, addr);
    }
    uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40);
    netlink_device_change(sock, devices[i].name, true, 0, &macaddr,
                          devices[i].macsize);
  }
  close(sock);
}
static void initialize_netdevices_init(void)
{
  int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  if (sock == -1)
    exit(1);
  struct {
    const char* type;
    int macsize;
    bool noipv6;
    bool noup;
  } devtypes[] = {
      {"nr", 7, true}, {"rose", 5, true, true},
  };
  unsigned i;
  for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) {
    char dev[32], addr[32];
    sprintf(dev, "%s%d", devtypes[i].type, (int)procid);
    sprintf(addr, "172.30.%d.%d", i, (int)procid + 1);
    netlink_add_addr4(sock, dev, addr);
    if (!devtypes[i].noipv6) {
      sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1);
      netlink_add_addr6(sock, dev, addr);
    }
    int macsize = devtypes[i].macsize;
    uint64_t macaddr = 0xbbbbbb +
                       ((unsigned long long)i << (8 * (macsize - 2))) +
                       (procid << (8 * (macsize - 1)));
    netlink_device_change(sock, dev, !devtypes[i].noup, 0, &macaddr, macsize);
  }
  close(sock);
}

static void setup_common()
{
  if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
  }
}

static void loop();

static void sandbox_common()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  setsid();
  struct rlimit rlim;
  rlim.rlim_cur = rlim.rlim_max = (200 << 20);
  setrlimit(RLIMIT_AS, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 32 << 20;
  setrlimit(RLIMIT_MEMLOCK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 136 << 20;
  setrlimit(RLIMIT_FSIZE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 1 << 20;
  setrlimit(RLIMIT_STACK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 0;
  setrlimit(RLIMIT_CORE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 256;
  setrlimit(RLIMIT_NOFILE, &rlim);
  if (unshare(CLONE_NEWNS)) {
  }
  if (unshare(CLONE_NEWIPC)) {
  }
  if (unshare(0x02000000)) {
  }
  if (unshare(CLONE_NEWUTS)) {
  }
  if (unshare(CLONE_SYSVSEM)) {
  }
  typedef struct {
    const char* name;
    const char* value;
  } sysctl_t;
  static const sysctl_t sysctls[] = {
      {"/proc/sys/kernel/shmmax", "16777216"},
      {"/proc/sys/kernel/shmall", "536870912"},
      {"/proc/sys/kernel/shmmni", "1024"},
      {"/proc/sys/kernel/msgmax", "8192"},
      {"/proc/sys/kernel/msgmni", "1024"},
      {"/proc/sys/kernel/msgmnb", "1024"},
      {"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
  };
  unsigned i;
  for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
    write_file(sysctls[i].name, sysctls[i].value);
}

int wait_for_loop(int pid)
{
  if (pid < 0)
    exit(1);
  int status = 0;
  while (waitpid(-1, &status, __WALL) != pid) {
  }
  return WEXITSTATUS(status);
}

static int do_sandbox_none(void)
{
  if (unshare(CLONE_NEWPID)) {
  }
  int pid = fork();
  if (pid != 0)
    return wait_for_loop(pid);
  setup_common();
  sandbox_common();
  initialize_netdevices_init();
  if (unshare(CLONE_NEWNET)) {
  }
  initialize_netdevices();
  loop();
  exit(1);
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  int i;
  for (i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void close_fds()
{
  int fd;
  for (fd = 3; fd < 30; fd++)
    close(fd);
}

#define KMEMLEAK_FILE "/sys/kernel/debug/kmemleak"

static void setup_leak()
{
  if (!write_file(KMEMLEAK_FILE, "scan"))
    exit(1);
  sleep(5);
  if (!write_file(KMEMLEAK_FILE, "scan"))
    exit(1);
  if (!write_file(KMEMLEAK_FILE, "clear"))
    exit(1);
}

static void check_leaks(void)
{
  int fd = open(KMEMLEAK_FILE, O_RDWR);
  if (fd == -1)
    exit(1);
  uint64_t start = current_time_ms();
  if (write(fd, "scan", 4) != 4)
    exit(1);
  sleep(1);
  while (current_time_ms() - start < 4 * 1000)
    sleep(1);
  if (write(fd, "scan", 4) != 4)
    exit(1);
  static char buf[128 << 10];
  ssize_t n = read(fd, buf, sizeof(buf) - 1);
  if (n < 0)
    exit(1);
  int nleaks = 0;
  if (n != 0) {
    sleep(1);
    if (write(fd, "scan", 4) != 4)
      exit(1);
    if (lseek(fd, 0, SEEK_SET) < 0)
      exit(1);
    n = read(fd, buf, sizeof(buf) - 1);
    if (n < 0)
      exit(1);
    buf[n] = 0;
    char* pos = buf;
    char* end = buf + n;
    while (pos < end) {
      char* next = strstr(pos + 1, "unreferenced object");
      if (!next)
        next = end;
      char prev = *next;
      *next = 0;
      fprintf(stderr, "BUG: memory leak\n%s\n", pos);
      *next = prev;
      pos = next;
      nleaks++;
    }
  }
  if (write(fd, "clear", 5) != 5)
    exit(1);
  close(fd);
  if (nleaks)
    exit(1);
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter;
  for (iter = 0;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      close_fds();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5 * 1000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
    check_leaks();
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  res = syscall(__NR_socket, 0xa, 3, 0x3c);
  if (res != -1)
    r[0] = res;
  *(uint16_t*)0x20000100 = 0xa;
  *(uint16_t*)0x20000102 = htobe16(0);
  *(uint32_t*)0x20000104 = htobe32(0);
  *(uint8_t*)0x20000108 = -1;
  *(uint8_t*)0x20000109 = 2;
  *(uint8_t*)0x2000010a = 0;
  *(uint8_t*)0x2000010b = 0;
  *(uint8_t*)0x2000010c = 0;
  *(uint8_t*)0x2000010d = 0;
  *(uint8_t*)0x2000010e = 0;
  *(uint8_t*)0x2000010f = 0;
  *(uint8_t*)0x20000110 = 0;
  *(uint8_t*)0x20000111 = 0;
  *(uint8_t*)0x20000112 = 0;
  *(uint8_t*)0x20000113 = 0;
  *(uint8_t*)0x20000114 = 0;
  *(uint8_t*)0x20000115 = 0;
  *(uint8_t*)0x20000116 = 0;
  *(uint8_t*)0x20000117 = 1;
  *(uint32_t*)0x20000118 = 9;
  syscall(__NR_connect, r[0], 0x20000100, 0x1c);
  *(uint64_t*)0x200000c0 = 0;
  *(uint32_t*)0x200000c8 = 0;
  *(uint64_t*)0x200000d0 = 0x20000140;
  *(uint64_t*)0x20000140 = 0x200001c0;
  memcpy((void*)0x200001c0, ",", 1);
  *(uint64_t*)0x20000148 = 1;
  *(uint64_t*)0x200000d8 = 1;
  *(uint64_t*)0x200000e0 = 0;
  *(uint64_t*)0x200000e8 = 0;
  *(uint32_t*)0x200000f0 = 0;
  syscall(__NR_sendmsg, r[0], 0x200000c0, 0xc100);
  memcpy(
      (void*)0x20001c80,
      "\xe6\xa2\xe0\x09\x1b\x61\x50\x1e\xa8\x78\x50\xc6\xd2\x58\x20\x1c\xbf\x3f"
      "\xe9\xfe\x75\xbc\x31\x03\x2c\x1b\xd6\x95\xe6\xf8\x9f\xff\xb8\xdd\x1b\xb3"
      "\x27\xcd\xe2\xfa\xef\x7e\x81\x15\xc8\x94\x91\x09\xdd\xdb\x33\x32\xb2\x86"
      "\x03\xa1\xe3\x5d\x08\xe3\xd0\x76\x06\x31\x4b\xc0\xe1\xcf\x58\xb6\x28\x64"
      "\xf0\x02\x38\x07\x00\x33\x54\x54\xa2\xa6\xd9\xcc\x29\xa3\xfc\x3d\x2c\x30"
      "\xff\x29\x07\xf1\x4f\x80\xfc\xe3\xc4\x68\x06\x73\x24\x18\x66\x3b\xbb\x11"
      "\xe3\x4e\x1f\x9e\x81\x9d\x01\x2f\x49\x28\xb5\xfb\x59\xfb\x31\x75\x5c\x98"
      "\x64\x9f\x35\xc5\x87\x26\x3c\xbf\x78\x30\xdd\xde\x04\xed\x4e\x4a\x9f\xda"
      "\x19\x23\xd0\x65\x59\xd4\xe9\xdf\x91\x17\x97\x33\x3a\x46\xb8\xd2\x26\x81"
      "\x33\xda\x26\xa6\xe5\x9e\x35\xa6\x60\x21\x40\x4b\xa0\x8e\x9b\x55\x0c\xd1"
      "\x32\xed\xa9\xa9\x70\xae\x2e\xf5\x0b\x25\xdb\xe1\xc3\xda\x78\x07\x4a\xf2"
      "\xa7\x62\xc2\x7e\xeb\x9b\x22\x63\x0b\xee\xc5\x24\x75\xe7\xa8\xa1\x59\xfa"
      "\xd8\x8d\x41\xe8\x30\x9b\x5e\x32\x98\x3e\x31\x50\x25\xfb\xc9\xc7\x60\x3d"
      "\x67\x6a\x53\x16\xff\xfc\xb4\x26\x42\x15\x0c\xd4\x98\xd5\x97\x48\xff\x62"
      "\x00\xa7\x3c\x31\xb4\x03\xeb\x73\xa2\x0b\x57\xa4\x7e\x7d\x69\xaa\x0b\xb5"
      "\xc5\x92\x35\xf2\xfd\x89\x3d\x6b\x5b\x86\xef\xa9\xb0\x5a\x2b\x56\x61\x6c"
      "\xe4\xf8\xa3\x58\x9d\x5d\x5e\x09\x33\x7f\x16\x15\x17\xcd\xca\xc4\x1b\x57"
      "\x32\x06\x49\x19\x35\x8d\x7c\xd6\xa9\xb1\xfb\x0a\x5a\xd5\xc4\x10\x61\x24"
      "\xda\x93\x43\x7f\xed\x9f\x25\x03\x22\x3c\x3e\xb1\x10\x3c\xd9\xb1\xa9\xec"
      "\xf2\x96\x74\xea\x86\x92\x1b\xd5\xb0\x09\x4e\x39\x37\xa1\x28\x6a\x44\x08"
      "\x9e\xf4\xb4\x2c\xca\x8e\x46\xcf\xda\x35\x5c\xfe\x86\x22\xe8\x60\xf4\x16"
      "\xb6\x0a\xf1\x19\x6f\x7c\x01\x96\xda\xa0\xbf\x0d\xd3\x79\x7d\x0b\x81\x99"
      "\xac\x4e\x23\x81\xd9\x2f\x47\x33\x93\xb8\x60\xc9\xf9\x7a\x08\x32\x4c\x83"
      "\xc3\x72\x55\x30\x42\xc7\xf2\x47\x09\x10\x6c\x01\x6f\xf1\xe2\x0c\x93\xd6"
      "\x45\xe7\x34\xda\xaf\x50\xf1\x3a\xd8\x45\x37\x7b\x89\x5c\x1d\xed\xe9\xb7"
      "\x34\x32\xd2\x4c\x9f\x62\x07\xbc\xb1\xfe\x8f\xb9\x90\x03\x77\xb3\x87\xf8"
      "\x78\x7f\x20\x84\x9e\xc0\x5b\x0d\x44\x98\x2a\x78\xa6\x50\xe1\x23\x06\xef"
      "\xff\x6f\x4e\xf8\x9b\x0e\xb1\x75\xbf\xff\x54\x5f\xda\x86\x92\x31\x4d\x7f"
      "\xc9\xe8\xf4\xfd\xff\xd0\x1b\x56\xa6\xb1\x35\x8a\xda\xb6\xd7\x8f\x3d\x69"
      "\x3e\x67\x81\xc8\xbf\x39\x90\x24\xaa\xa8\x88\xd5\x72\xd5\x9c\xf7\xcd\xb7"
      "\x4a\xa9\x74\xd2\x05\x49\xa4\x76\x24\xf3\x5c\xaf\x09\x56\x65\x1e\x8d\x24"
      "\x07\x9e\x08\x66\xe0\x17\x2f\x2f\xc2\x6a\xf1\x4c\x62\x8f\x99\x05\x1e\x04"
      "\xe5\x0f\xba\x06\xde\x93\x8d\x52\xd9\x34\xa7\x89\x21\xd5\x14\x4d\x18\xe8"
      "\xc5\xd1\xf4\xfd\x2d\x0e\x7c\xa2\x21\x19\xbe\x06\x55\x74\xf5\xf7\xdf\xba"
      "\xbb\xc4\x4d\x42\xb5\x1d\x62\xd6\x58\xed\x2e\xd1\x25\x0d\x78\x21\xa0\x9d"
      "\x26\x76\x0b\xca\x0f\x8b\xc1\xb1\x86\xe5\xcf\x93\x13\x77\xb2\xad\xef\xca"
      "\x5a\x75\x2c\x7f\x9e\x82\x22\x4c\x57\x34\xc8\x8d\x27\xc3\xaf\xb7\xd7\x85"
      "\xee\x51\x0f\xb3\x80\x6f\x42\xbb\xff\x9f\xe9\xbc\x1d\x50\xcb\x32\x9b\xb6"
      "\x66\xa1\xd7\x66\x18\x2f\xfd\x6b\x6a\xee\x85\x35\x40\x6b\x2a\x77\xe2\x32"
      "\x8d\x90\xb9\x09\x50\x03\x4d\xd4\x68\x57\x76\x93\x57\x1b\xc9\xa9\xfb\x9f"
      "\x8a\xea\xe6\x7d\x5a\x87\x47\xf8\x5e\x38\x31\x8d\x97\xf4\x58\xc6\xc9\xfe"
      "\xd9\xc3\xb8\xf0\xaf\xfe\x63\xa2\xad\xaa\x57\xe4\x72\x44\x9c\x76\xb5\x3a"
      "\xf7\xf0\xcf\x90\x87\xe6\x2b\xd5\x55\x69\x47\xe6\x81\x87\x3a\x00\x2c\x78"
      "\xd0\x83\x26\x29\x0a\x34\x48\x9f\x5e\xb7\xac\xb3\x83\x67\x77\x84\x60\x47"
      "\x3e\x6b\x5e\x4a\x8c\x5c\xaa\x82\x13\x09\x2c\xf5\x9a\x2f\x38\x34\x54\x87"
      "\x93\xef\x1a\x55\x98\x3a\xf6\x7a\x30\x4c\x18\x7d\xed\x35\x3c\x4b\x3f\x95"
      "\xb9\xec\x56\x9f\xdc\x39\xb6\x06\x13\xf8\xf6\x22\xa7\x59\xb7\xb6\xa5\x99"
      "\x01\xd3\x2a\x27\x25\xc7\xdb\x77\x68\x25\x9a\xd8\x96\xa7\x31\x5d\x07\xc8"
      "\x50\x03\x5b\x67\xdd\x4b\xa1\xab\x8b\xe6\x4d\x2d\xcf\x83\x98\x8b\x66\xf3"
      "\x80\x1c\x26\x16\x4b\x3c\xeb\x65\x77\x8e\x2d\xb9\x72\x12\xca\xc9\x66\x16"
      "\x7f\xfe\xa6\x5a\xf6\x21\xe0\x27\x58\x8b\x76\xa2\x3d\x01\x99\x5d\x91\xe8"
      "\x3b\x6b\xa1\x04\x27\x27\x89\xf8\x57\xe7\x5c\xb9\x59\xa2\x20\x6a\x43\x9d"
      "\x56\xfd\x89\x10\x8d\x4d\x65\x90\xac\x1c\x6d\xa8\x8c\xdc\x53\x91\x3a\x51"
      "\xc4\xb6\x8c\x17\xaa\x26\xa0\x50\xd0\x26\xd6\xaf\xf7\x23\x29\xf5\x97\xf5"
      "\x06\x28\x02\x68\xc6\x15\x07\xd6\x25\x35\x34\x5d\x6d\x2c\x9e\x48\x34\x38"
      "\x25\xfc\x36\x64\x8a\xa6\x8b\x2d\x01\xc4\x04\xdf\xd1\xde\xdc\xba\x75\x32"
      "\xf5\x10\x31\x6d\x7b\x18\xba\xa8\x78\x6b\xd5\xfa\x2d\x1b\x56\xc8\x75\xde"
      "\x3e\xa8\x82\x01\x00\x3b\x92\xf6\xd7\x0e\xe1\xe9\x40\x8c\xce\xb5\x61\xea"
      "\x51\x1d\xb3\xa8\xc8\x5d\xa5\x93\x90\x66\x8c\x48\x6f\xe1\xe5\x55\xb3\x17"
      "\xe7\x67\x04\x6f\x69\xee\x03\x1d\x60\x21\x36\x9a\x01\xa4\x74\xbb\xb3\xd6"
      "\xf5\xb0\x94\xd7\x87\x45\xce\x3f\x8a\xd8\x9e\x37\x3c\x18\xec\x3c\x2d\xd8"
      "\x5a\xf0\x0a\x79\xeb\xaa\xff\xb7\xc0\x49\x38\x60\x78\xbf\x0b\x9b\x56\xb6"
      "\x86\xc1\xf0\xa8\x85\x5f\xb1\x00\x7e\xb3\x06\xa6\x8f\xd8\x40\x17\x6f\xf0"
      "\x97\x97\xed\xfb\xac\xe3\x3d\x4f\x21\x3e\xa3\x59\x9d\x97\xd6\x43\x56\x9e"
      "\xd4\x0a\x69\xa4\x10\x83\xc6\x55\x92\x50\x83\x05\xb2\x34\x58\x7a\x79\xaa"
      "\xe0\x96\x45\x41\x68\x98\xa6\x59\xb1\x7a\x2c\x77\x8f\x5b\xb2\xf8\x08\x78"
      "\xf0\x1f\x3a\x14\xa0\x48\x8e\x48\xfd\x9d\x46\x70\xcf\x21\x8b\x4d\xa0\x4e"
      "\x79\xc0\x3f\x77\x17\x47\x17\xe3\xc2\x5a\x82\x8b\xd6\x28\x6d\xd9\x1f\x08"
      "\xaf\x9d\x28\x1d\xa4\xba\xe8\xd0\x33\x19\x71\x71\xc4\xfd\x25\x03\xed\x39"
      "\x80\x59\xa7\x8d\x0e\xd1\xfb\xd9\x8d\xba\x83\x14\x00\x8e\xd3\x99\xab\x3c"
      "\xcb\x56\x84\x7d\x30\xff\xf2\xb2\x6a\x3b\xe5\xd8\x4a\xf2\x30\xe1\x91\x5c"
      "\x2a\xb7\xee\xf4\xb0\x1b\x29\x98\x69\x85\xdb\x14\x21\x3b\x9b\x05\x81\x6e"
      "\xf7\x72\x4a\xa8\x96\x07\x36\x41\xa7\xbc\x6e\xb9\x40\x6e\x79\xfa\x96\x1e"
      "\xb8\xaf\xbe\xba\x75\x29\x3c\x1f\x78\x6e\x3c\x8c\x05\x17\x33\x1d\x06\x40"
      "\xdc\xfb\x0f\x45\xa0\x36\xfd\x07\xd4\x23\x8b\x9b\x01\xe2\x5b\xe3\x29\x1f"
      "\x0f\x5e\xba\x95\x23\xba\x16\x79\xa3\x5a\xeb\xbc\xfa\x89\x6a\xb6\x40\x12"
      "\x96\x27\x0b\xa8\x74\x22\x59\xad\xaf\x5a\x52\x60\x6c\x32\x39\xb8\xec\xc2"
      "\x08\xe3\x9e\xe9\x16\xd0\x9f\x55\xe5\x78\x9d\x5b\x08\xc7\x29\x84\xdf\xfb"
      "\x45\x11\xee\x23\xcd\x74\x1a\x73\xab\xa0\x19\xf1\x47\x12\x56\x82\x21\xfe"
      "\xb8\x03\xa1\xd1\xe6\x3d\xf1\x08\xd4\x35\xb4\x2f\xb0\xf3\x8e\x3c\x64\x10"
      "\xf1\x5d\x0f\x56\x14\x2d\x4a\xba\x83\xd7\xbf\xe3\xef\x58\x44\xd4\xed\x36"
      "\xf0\xbf\xa6\x04\x66\x97\x74\x2a\x89\x68\x99\x41\xfa\x04\xa6\x8d\xa4\xe7"
      "\xcb\xaf\x6e\x28\x4d\x08\xa8\xfc\x3f\xb9\x15\x0a\x6e\x26\x2b\x55\xd6\x16"
      "\xcc\xb3\x99\x9a\x2f\xf1\x6f\x6b\x06\x00\x00\x00\x61\xd9\xe5\x1d\x2f\x4b"
      "\xd2\x94\x36\x1f\xa2\xbf\x7f\xa1\x93\xfa\xc1\x35\x35\x23\x3d\xe1\x37\x89"
      "\xa1\x13\x1d\xae\xd8\x3b\xd6\xd4\x03\xbe\x2e\xf6\xed\xd7\xd4\x5b\x9d\x3c"
      "\xf7\x7c\x2a\xa4\xd7\x9f\xcb\xad\x52\x46\x2b\x21\xbf\xc8\x99\x20\x57\x8e"
      "\x2a\x60\x36\x3f\xb2\x74\xe2\x42\xd6\x40\x10\x9e\xf5\xdd\xe5\xf2\x18\xe2"
      "\x56\xda\x68\xac\xa7\x62\x88\x3b\x7c\xbe\xfd\xea\x6e\xdd\xc0\x13\x25\x72"
      "\x14\xd9\xbb\x58\x8e\xd8\x3a\x51\x7d\xd9\xd3\x4f\xcc\x32\x82\x4f\x9d\x88"
      "\x07\x12\xc2\xfe\x48\xf4\xe8\x94\x97\x28\x47\x3a\x6b\xf9\x68\x8f\x99\x9a"
      "\xdf\x2e\x21\x94\x23\x09\x0a\x75\xb1\xac\xfc\x8e\xa9\x61\x05\xe2\x2d\xe7"
      "\x7e\x41\x5e\x7b\x40\x6b\x47\xff\xb5\x7b\xdc\x26\xea\xd4\x3b\xa9\x46\xa2"
      "\xbe\x66\x02\xc6\x4c\x79\x27\x5a\x0e\xd0\xfd\xbb\xae\x08\x25\xb6\x3c\x93"
      "\x9a\x0e\x3a\xe6\xdc\xfb\xc2\xf1\xb6\xdd\xb3\xd4\xec\x74\x79\xe8\x54\x07"
      "\xfb\x70\xac\x48\x13\x95\x17\x05\xd6\xcf\x1a\x25\xd7\x3e\x97\xf6\xfe\xd3"
      "\xad\x2d\x4e\x60\xaf\x3e\x9c\x53\x93\x20\x0d\xc6\xb7\xbb\x80\x9d\x5d\x44"
      "\x24\x7b\x2b\x22\x4e\x42\x32\xb7\xad\xb9\x7f\x06\x0e\xa8\x5b\xf2\x2c\xdd"
      "\x8a\x2f\x75\x33\xd7\x03\xfd\x75\xd6\x49\x8e\x51\x74\x78\xe1\x44\xda\x0c"
      "\x27\x3e\xdc\xd3\x1f\xea\x21\x43\xbe\xd3\x7c\x93\x0c\x02\xc2\xd7\x42\x61"
      "\x96\x6e\x18\xb3\xee\x1c\x1a\xa1\xf0\x51\x8f\x63\xaa\x84\x0a\x15\x17\x85"
      "\xd9\x41\xff\xbd\x70\x68\x3b\x16\x5e\x3a\x31\x39\x5d\x1d\x7d\x91\x18\x9a"
      "\xb7\x98\x59\x01\xf1\x13\xd1\x1a\x9e\x58\x79\xf2\xe5\x00\x00\x00\x00\x00"
      "\x00",
      1855);
  syscall(__NR_write, r[0], 0x20001c80, 0x73f);
}
int main(void)
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  setup_leak();
  do_sandbox_none();
  return 0;
}