| 0/0 |
2026/05/24 06:00 |
flow |
assessment-security |
1h04m
Results: map[DenialOfService:true Explanation:**Bug Analysis:**
The reported bug is a lock order inversion (deadlock) between the `i_pages`
xarray lock (`xa_lock`) and the flex_proportions sequence counter
(`p->sequence`).
Here is the sequence of events that leads to the deadlock:
1. **Writer Context:** The `p->sequence` seqcount is acquired for write in
`fprop_new_period()`. This function is called from the `writeout_period` timer
callback, which runs in softirq context (`run_timer_softirq`). Crucially,
softirqs run with hard interrupts **enabled**, meaning this writer can be
interrupted by a hardware interrupt.
2. **Reader Context:** The `xa_lock` is acquired in hardirq context by block
device drivers (such as the NVMe driver via `nvme_irq`) when completing a
writeback request (`__folio_end_writeback`).
3. **The Deadlock:** While holding the `xa_lock` with interrupts disabled,
`__folio_end_writeback` calls `__wb_writeout_add` -> `wb_domain_writeout_add` ->
`__fprop_add_percpu_max`, which attempts to acquire `p->sequence` for read
(`read_seqcount_begin`).
If an NVMe interrupt fires on a CPU that is currently executing
`fprop_new_period()` (and thus holding `p->sequence` for write), the interrupt
handler will preempt the writer, take the `xa_lock`, and then spin forever
waiting for `p->sequence` to be released (waiting for the sequence number to
become even). However, the writer cannot make progress because it was
interrupted by this exact hardirq on the same CPU, resulting in a classic
deadlock.
**Security Impact Assessment:**
* **Exploitable:** **No.** This is a pure deadlock issue. There is no memory
corruption, use-after-free, or out-of-bounds access involved that could be
leveraged for privilege escalation or arbitrary code execution.
* **Denial Of Service:** **Yes.** The deadlock will cause the CPU to spin
indefinitely in the hardirq handler. This will quickly stall the system and
eventually trigger the hard lockup detector (NMI watchdog), resulting in a
kernel panic and halting the system.
* **Accessible From Unprivileged Processes & User Namespaces:** **Yes.** Any
unprivileged user can trigger page writeback simply by writing data to a file on
an NVMe-backed filesystem (or any block device that completes IO in hardirq
context). The `writeout_period` timer and the block device interrupts will fire
automatically as part of normal system operation, making the race condition
reachable without any special privileges or capabilities.
* **VM Guest Trigger:** **Yes.** A guest performing heavy disk I/O can cause the
host to perform disk I/O on the backing storage. If the host uses NVMe, the
guest's workload can trigger the deadlock in the host kernel.
* **VM Host Trigger in The Confidential Computing Context:** **Yes.** A
malicious host can precisely control and inject virtual interrupts into a
confidential guest. By injecting a block completion interrupt at the exact
moment the guest is executing `fprop_new_period()`, the host can
deterministically trigger the deadlock in the guest kernel.
* **Network / Remote / Peripheral / Filesystem Trigger:** **No.** The bug
resides in the core memory management and block layer writeback code. It is not
related to parsing network packets, handling untrusted USB peripherals, or
mounting malicious filesystem images. Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:true VMHostTrigger:true]
|
| 1/1 |
2026/05/24 06:00 |
action |
syz-repro-to-c-repro |
0m
Results: map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#define FUSE_MIN_READ_BUFFER 8192
enum fuse_opcode {
FUSE_LOOKUP = 1,
FUSE_FORGET = 2,
FUSE_GETATTR = 3,
FUSE_SETATTR = 4,
FUSE_READLINK = 5,
FUSE_SYMLINK = 6,
FUSE_MKNOD = 8,
FUSE_MKDIR = 9,
FUSE_UNLINK = 10,
FUSE_RMDIR = 11,
FUSE_RENAME = 12,
FUSE_LINK = 13,
FUSE_OPEN = 14,
FUSE_READ = 15,
FUSE_WRITE = 16,
FUSE_STATFS = 17,
FUSE_RELEASE = 18,
FUSE_FSYNC = 20,
FUSE_SETXATTR = 21,
FUSE_GETXATTR = 22,
FUSE_LISTXATTR = 23,
FUSE_REMOVEXATTR = 24,
FUSE_FLUSH = 25,
FUSE_INIT = 26,
FUSE_OPENDIR = 27,
FUSE_READDIR = 28,
FUSE_RELEASEDIR = 29,
FUSE_FSYNCDIR = 30,
FUSE_GETLK = 31,
FUSE_SETLK = 32,
FUSE_SETLKW = 33,
FUSE_ACCESS = 34,
FUSE_CREATE = 35,
FUSE_INTERRUPT = 36,
FUSE_BMAP = 37,
FUSE_DESTROY = 38,
FUSE_IOCTL = 39,
FUSE_POLL = 40,
FUSE_NOTIFY_REPLY = 41,
FUSE_BATCH_FORGET = 42,
FUSE_FALLOCATE = 43,
FUSE_READDIRPLUS = 44,
FUSE_RENAME2 = 45,
FUSE_LSEEK = 46,
FUSE_COPY_FILE_RANGE = 47,
FUSE_SETUPMAPPING = 48,
FUSE_REMOVEMAPPING = 49,
FUSE_SYNCFS = 50,
FUSE_TMPFILE = 51,
FUSE_STATX = 52,
CUSE_INIT = 4096,
CUSE_INIT_BSWAP_RESERVED = 1048576,
FUSE_INIT_BSWAP_RESERVED = 436207616,
};
struct fuse_in_header {
uint32_t len;
uint32_t opcode;
uint64_t unique;
uint64_t nodeid;
uint32_t uid;
uint32_t gid;
uint32_t pid;
uint32_t padding;
};
struct fuse_out_header {
uint32_t len;
uint32_t error;
uint64_t unique;
};
struct syz_fuse_req_out {
struct fuse_out_header* init;
struct fuse_out_header* lseek;
struct fuse_out_header* bmap;
struct fuse_out_header* poll;
struct fuse_out_header* getxattr;
struct fuse_out_header* lk;
struct fuse_out_header* statfs;
struct fuse_out_header* write;
struct fuse_out_header* read;
struct fuse_out_header* open;
struct fuse_out_header* attr;
struct fuse_out_header* entry;
struct fuse_out_header* dirent;
struct fuse_out_header* direntplus;
struct fuse_out_header* create_open;
struct fuse_out_header* ioctl;
struct fuse_out_header* statx;
};
static int fuse_send_response(int fd,
const struct fuse_in_header* in_hdr,
struct fuse_out_header* out_hdr)
{
if (!out_hdr) {
return -1;
}
out_hdr->unique = in_hdr->unique;
if (write(fd, out_hdr, out_hdr->len) == -1) {
return -1;
}
return 0;
}
static volatile long syz_fuse_handle_req(volatile long a0,
volatile long a1,
volatile long a2,
volatile long a3)
{
struct syz_fuse_req_out* req_out = (struct syz_fuse_req_out*)a3;
struct fuse_out_header* out_hdr = NULL;
char* buf = (char*)a1;
int buf_len = (int)a2;
int fd = (int)a0;
if (!req_out) {
return -1;
}
if (buf_len < FUSE_MIN_READ_BUFFER) {
return -1;
}
int ret = read(fd, buf, buf_len);
if (ret == -1) {
return -1;
}
if ((size_t)ret < sizeof(struct fuse_in_header)) {
return -1;
}
const struct fuse_in_header* in_hdr = (const struct fuse_in_header*)buf;
if (in_hdr->len > (uint32_t)ret) {
return -1;
}
switch (in_hdr->opcode) {
case FUSE_GETATTR:
case FUSE_SETATTR:
out_hdr = req_out->attr;
break;
case FUSE_LOOKUP:
case FUSE_SYMLINK:
case FUSE_LINK:
case FUSE_MKNOD:
case FUSE_MKDIR:
out_hdr = req_out->entry;
break;
case FUSE_OPEN:
case FUSE_OPENDIR:
out_hdr = req_out->open;
break;
case FUSE_STATFS:
out_hdr = req_out->statfs;
break;
case FUSE_RMDIR:
case FUSE_RENAME:
case FUSE_RENAME2:
case FUSE_FALLOCATE:
case FUSE_SETXATTR:
case FUSE_REMOVEXATTR:
case FUSE_FSYNCDIR:
case FUSE_FSYNC:
case FUSE_SETLKW:
case FUSE_SETLK:
case FUSE_ACCESS:
case FUSE_FLUSH:
case FUSE_RELEASE:
case FUSE_RELEASEDIR:
case FUSE_UNLINK:
case FUSE_DESTROY:
out_hdr = req_out->init;
if (!out_hdr) {
return -1;
}
out_hdr->len = sizeof(struct fuse_out_header);
break;
case FUSE_READ:
out_hdr = req_out->read;
break;
case FUSE_READDIR:
out_hdr = req_out->dirent;
break;
case FUSE_READDIRPLUS:
out_hdr = req_out->direntplus;
break;
case FUSE_INIT:
out_hdr = req_out->init;
break;
case FUSE_LSEEK:
out_hdr = req_out->lseek;
break;
case FUSE_GETLK:
out_hdr = req_out->lk;
break;
case FUSE_BMAP:
out_hdr = req_out->bmap;
break;
case FUSE_POLL:
out_hdr = req_out->poll;
break;
case FUSE_GETXATTR:
case FUSE_LISTXATTR:
out_hdr = req_out->getxattr;
break;
case FUSE_WRITE:
case FUSE_COPY_FILE_RANGE:
out_hdr = req_out->write;
break;
case FUSE_FORGET:
case FUSE_BATCH_FORGET:
return 0;
case FUSE_CREATE:
out_hdr = req_out->create_open;
break;
case FUSE_IOCTL:
out_hdr = req_out->ioctl;
break;
case FUSE_STATX:
out_hdr = req_out->statx;
break;
default:
return -1;
}
return fuse_send_response(fd, in_hdr, out_hdr);
}
uint64_t r[4] = {0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// flags: open_flags = 0x40 (4 bytes)
// mode: open_mode = 0x0 (2 bytes)
// ]
// returns fd
memcpy((void*)0x20000000c380, "./file0\000", 8);
syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000000c380ul, /*flags=O_CREAT*/0x40, /*mode=*/0);
// openat$fuse arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 64 65 76 2f 66 75 73 65 00} (length 0xa)
// }
// flags: const = 0x42 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_fuse
memcpy((void*)0x200000002080, "/dev/fuse\000", 10);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000002080ul, /*flags=*/0x42, /*mode=*/0);
if (res != -1)
r[0] = res;
// mount$fuse arguments: [
// src: const = 0x0 (8 bytes)
// dst: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// type: ptr[in, buffer] {
// buffer: {66 75 73 65 00} (length 0x5)
// }
// flags: mount_flags = 0x0 (8 bytes)
// opts: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {66 64 3d} (length 0x3)
// }
// union ANYUNION {
// ANYRESHEX: ANYRES64 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {2c 72 6f 6f 74 6d 6f 64 65 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 2c 75 73 65 72 5f 69 64 3d} (length 0x2a)
// }
// union ANYUNION {
// ANYRESDEC: ANYRES64 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {2c 67 72 6f 75 70 5f 69 64 3d} (length 0xa)
// }
// union ANYUNION {
// ANYRESDEC: ANYRES64 (resource)
// }
// }
// }
// ]
memcpy((void*)0x2000000020c0, "./file0\000", 8);
memcpy((void*)0x200000002100, "fuse\000", 5);
memcpy((void*)0x200000002140, "fd=", 3);
sprintf((char*)0x200000002143, "0x%016llx", (long long)r[0]);
memcpy((void*)0x200000002155, ",rootmode=00000000000000000100000,user_id=", 42);
sprintf((char*)0x20000000217f, "%020llu", (long long)0);
memcpy((void*)0x200000002193, ",group_id=", 10);
sprintf((char*)0x20000000219d, "%020llu", (long long)0);
syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x2000000020c0ul, /*type=*/0x200000002100ul, /*flags=*/0ul, /*opts=*/0x200000002140ul);
// read$FUSE arguments: [
// fd: fd_fuse (resource)
// buf: ptr[out, fuse_in[read_buffer]] {
// fuse_in[read_buffer] {
// len: len = 0x2020 (4 bytes)
// opcode: int32 = 0x0 (4 bytes)
// unique: fuse_unique (resource)
// uid: uid (resource)
// gid: gid (resource)
// pid: pid (resource)
// padding: int32 = 0x0 (4 bytes)
// payload: buffer: (DirOut)
// }
// }
// len: bytesize = 0x2020 (8 bytes)
// ]
res = syscall(__NR_read, /*fd=*/r[0], /*buf=*/0x2000000021c0ul, /*len=*/0x2020ul);
if (res != -1) {
r[1] = *(uint64_t*)0x2000000021c8;
r[2] = *(uint32_t*)0x2000000021d4;
}
// write$FUSE_INIT arguments: [
// fd: fd_fuse (resource)
// arg: ptr[in, fuse_out_t[fuse_unique, fuse_init_out]] {
// fuse_out_t[fuse_unique, fuse_init_out] {
// len: len = 0x50 (4 bytes)
// err: fuse_errors = 0x0 (4 bytes)
// unique: fuse_unique (resource)
// payload: fuse_init_out {
// major: const = 0x7 (4 bytes)
// minor: const = 0x1f (4 bytes)
// max_readahead: int32 = 0xe0000000 (4 bytes)
// flags: fuse_init_flags = 0x564b043a (4 bytes)
// max_background: int16 = 0x83 (2 bytes)
// congestion_threshold: int16 = 0xffff (2 bytes)
// max_write: int32 = 0x5 (4 bytes)
// time_gran: int32 = 0x2 (4 bytes)
// max_pages: const = 0x0 (2 bytes)
// map_alignment: const = 0x0 (2 bytes)
// flags2: fuse_init_flags2 = 0x80 (4 bytes)
// max_stack_depth: int32 = 0x80000001 (4 bytes)
// unused: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x18)
// }
// }
// }
// len: bytesize = 0x50 (8 bytes)
// ]
*(uint32_t*)0x200000000040 = 0x50;
*(uint32_t*)0x200000000044 = 0;
*(uint64_t*)0x200000000048 = r[1];
*(uint32_t*)0x200000000050 = 7;
*(uint32_t*)0x200000000054 = 0x1f;
*(uint32_t*)0x200000000058 = 0xe0000000;
*(uint32_t*)0x20000000005c = 0x564b043a;
*(uint16_t*)0x200000000060 = 0x83;
*(uint16_t*)0x200000000062 = -1;
*(uint32_t*)0x200000000064 = 5;
*(uint32_t*)0x200000000068 = 2;
*(uint16_t*)0x20000000006c = 0;
*(uint16_t*)0x20000000006e = 0;
*(uint32_t*)0x200000000070 = 0x80;
*(uint32_t*)0x200000000074 = 0x80000001;
memset((void*)0x200000000078, 0, 24);
syscall(__NR_write, /*fd=*/r[0], /*arg=*/0x200000000040ul, /*len=*/0x50ul);
// syz_fuse_handle_req arguments: [
// fd: fd_fuse (resource)
// buf: ptr[in, buffer] {
// buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ba 04 5a bc d5 df c6 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 38 aa e8 c0 5d d2 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 9b fd 66 ee a2 10 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 54 c4 b6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x2000)
// }
// len: bytesize = 0x2000 (8 bytes)
// res: ptr[in, syz_fuse_req_out] {
// syz_fuse_req_out {
// init: nil
// lseek: nil
// bmap: nil
// poll: nil
// getxattr: nil
// lk: nil
// statfs: nil
// write: nil
// read: nil
// open: ptr[in, fuse_out_t[int64, fuse_open_out]] {
// fuse_out_t[int64, fuse_open_out] {
// len: len = 0x20 (4 bytes)
// err: fuse_errors = 0x0 (4 bytes)
// unique: int64 = 0x0 (8 bytes)
// payload: fuse_open_out {
// fh: const = 0x0 (8 bytes)
// open_flags: fuse_open_flags = 0x0 (4 bytes)
// padding: const = 0x0 (4 bytes)
// }
// }
// }
// attr: nil
// entry: nil
// dirent: nil
// direntplus: nil
// create_open: nil
// ioctl: nil
// statx: nil
// }
// }
// ]
memcpy((void*)0x20000000e3c0, "... [truncated large byte array] ...", 8192);
*(uint64_t*)0x2000000062c0 = 0;
*(uint64_t*)0x2000000062c8 = 0;
*(uint64_t*)0x2000000062d0 = 0;
*(uint64_t*)0x2000000062d8 = 0;
*(uint64_t*)0x2000000062e0 = 0;
*(uint64_t*)0x2000000062e8 = 0;
*(uint64_t*)0x2000000062f0 = 0;
*(uint64_t*)0x2000000062f8 = 0;
*(uint64_t*)0x200000006300 = 0;
*(uint64_t*)0x200000006308 = 0x2000000001c0;
*(uint32_t*)0x2000000001c0 = 0x20;
*(uint32_t*)0x2000000001c4 = 0;
*(uint64_t*)0x2000000001c8 = 0;
*(uint64_t*)0x2000000001d0 = 0;
*(uint32_t*)0x2000000001d8 = 0;
*(uint32_t*)0x2000000001dc = 0;
*(uint64_t*)0x200000006310 = 0;
*(uint64_t*)0x200000006318 = 0;
*(uint64_t*)0x200000006320 = 0;
*(uint64_t*)0x200000006328 = 0;
*(uint64_t*)0x200000006330 = 0;
*(uint64_t*)0x200000006338 = 0;
*(uint64_t*)0x200000006340 = 0;
syz_fuse_handle_req(/*fd=*/r[0], /*buf=*/0x20000000e3c0, /*len=*/0x2000, /*res=*/0x2000000062c0);
// syz_fuse_handle_req arguments: [
// fd: fd_fuse (resource)
// buf: ptr[in, buffer] {
// buffer: {a2 80 96 c8 0a bf 35 43 ec de 75 64 ab ff 50 85 d2 22 7e bc b0 f1 64 ae 92 70 6a d0 b0 83 a3 f4 69 a3 ef d1 5b 49 21 e9 c3 06 3b 98 b3 08 20 68 e7 c3 19 50 dd e8 42 ea c5 5d f0 f9 91 45 3c ad 62 a6 95 6b 0b 6f 7b 8c f4 9b 50 6a 30 60 fe 11 27 ec a9 96 63 ad e8 ef a8 9e e1 89 ac b5 f3 b9 2f 6b c4 c4 66 21 c8 03 ee d0 d0 bb 5f 32 38 48 70 ed 08 f8 9d 4f 74 44 57 62 fb 99 71 5e 08 3c 4c 92 a8 87 8b e1 9f fa cc 30 d0 f2 da 64 f9 71 cd 40 56 31 63 ad c1 56 70 ec f2 5c d3 ad 96 13 89 67 c4 b5 3a d9 d0 4b 51 93 ab 5f b6 74 aa 00 30 a9 d7 03 d1 ba f8 10 ce 89 7f 96 91 21 f1 42 16 19 19 e5 83 c2 75 67 1b 99 9e 7f 36 38 91 df df df 35 56 d0 1b 86 ee 29 ec a8 fc cb fe af 17 71 39 51 48 70 6c c6 e6 be 7c e2 9f c9 ff ef 06 1b 54 20 95 0c 1a 52 5b f7 5a d0 6e de c5 15 38 d1 c5 bb c7 7d a7 2d c9 0f d9 99 89 36 ff fd da 24 27 e5 a6 89 66 c7 e2 20 8f 76 30 46 80 18 2e c7 30 07 e4 82 f0 34 19 57 12 af 92 2d b2 72 61 95 d9 97 70 87 34 db 9e 78 25 a8 64 be 00 b2 a4 f8 00 88 1f c0 36 3f 5e 61 83 98 45 4f 35 b1 48 b4 cc b8 8d 41 82 69 fa c8 68 a8 ba 4a 2d 5b 4f 06 a1 ac 01 b5 ad 15 8b 84 2e 05 ad ca 22 c7 37 25 85 bf 4c e9 55 60 b6 c1 e0 21 a3 ed 2f f7 bd 3b 6b 3c 77 34 c3 b6 6d 7e 4c 46 00 96 31 20 82 f8 9b 16 ba a6 e7 38 14 aa 60 92 57 80 cd 92 cd 65 08 7e 26 0e c0 46 fc 36 32 64 36 6a 9d f2 c8 49 c0 64 49 11 30 39 46 ad ad 54 45 21 ce b4 69 a3 e1 93 ec c9 a7 87 64 03 fa c4 61 a4 a7 0d 61 93 b2 45 11 89 a5 c5 12 0b 35 35 e9 ed f6 19 10 8a f7 f5 17 b5 8a bd 3f a7 fb 1a b8 32 21 34 30 d2 e6 90 10 76 fb a9 c9 e1 ac c6 c6 f4 8f f0 e4 19 bb c4 55 89 74 5a 17 6f 52 a7 40 7a d5 e3 dd 49 ac b3 1b 47 86 28 06 f4 70 77 dd a0 49 05 e4 5a 80 a1 2c bc d4 d2 dd 9f e6 6c 2d 1f 99 39 4f ed 8e c6 09 61 cd 2d c7 11 5a 96 ec e4 32 fa c8 6d 51 be bb 08 b9 5f 44 7a 83 79 2f e8 02 91 fc a7 b2 98 c9 04 3e f2 c2 6f 0f 7e 42 79 8d 3f 54 c8 4b 94 c2 4c 76 c5 55 d8 3e cc 53 b9 9b b2 2d 71 84 5e 5c f2 1a 5b a7 fb ef fe b6 30 6e 17 30 db 14 56 1b 95 0a 3f 24 bc fd 78 d4 ab 0d 97 de 80 54 bb 1a 60 77 ae 7c ca 6e 45 d8 46 d3 df 82 29 8d 07 21 29 22 74 2c b0 fa ca c3 b7 7e df ba b9 0e 9e e2 d4 f7 b0 ee 9b 17 bb 11 ec 5e 57 21 34 0d 84 cb 6b d9 34 28 16 7e 69 b4 77 59 17 25 57 ac da 31 3c 3d ec df c6 fe 93 36 bf ad e4 59 f4 3b 39 d0 f2 28 9f 91 42 db 28 0f 4e e6 68 e6 50 e1 28 58 c5 77 e1 2e 2b 9a 57 ee 66 c8 34 be 97 97 9b cb e9 47 47 fa 5d 8d 0b 7d 3a 9f 8f 21 8d f1 bf 96 0f 82 84 29 a1 ef e8 38 61 6b 18 fa f6 62 92 36 dd bd ed 43 a0 93 ef ae 16 32 28 e5 c3 8f d7 71 47 43 c2 fc ca 47 e3 38 2b cf b1 ab 89 3f d7 37 75 27 b4 ec 43 f3 fa 60 eb d3 38 16 1d 8d e7 ca d6 5b 15 57 9e 4a f2 58 f5 fe 3a 63 c2 63 7a 15 70 32 07 02 9b 08 99 b5 42 77 67 64 7b ae f1 1e 29 13 58 e6 e5 4f 6f 13 d3 d2 ca 7a 5e 79 69 e0 4d 27 33 b3 b9 ab 82 2c 69 a3 cf ac 09 73 84 de 50 71 a9 b7 4a 65 61 36 d5 5e b1 90 df 08 74 7b 50 9f d6 10 ff 62 b4 95 0e f7 1c 93 4f e2 1a 48 a4 93 1d 3d 94 58 b4 15 f1 12 ce e6 5c 66 0f 54 90 e9 82 34 1d a1 c5 86 34 b3 96 7c a6 f3 59 6d 20 cc 90 f5 08 38 21 56 e3 6f 16 53 90 93 24 0e f5 f2 aa 6a 2c 0d ff 2a 67 df 30 dc f5 0b f6 e0 b8 2a 3d 49 f2 d5 32 a8 dd e1 b3 ce ef cf 08 37 19 0b 74 18 60 90 d1 c1 8b 59 91 7d 7e fc e1 ad fb 23 8e f4 a7 b1 d2 2c 4c ef 09 32 02 21 de 88 3e 97 e6 88 24 66 50 8d e0 6f cd ab ad 3b 74 1b dc a2 cf f8 79 d5 7d dd a5 2f 42 b3 dc b8 a7 8c fc 05 82 6a f7 e4 ff 15 59 60 ff 84 91 19 4f 4d 32 1e f1 95 99 0a ba ee ef dc b8 52 d1 e1 e3 70 3f 31 73 85 a9 45 8b 6c 2d d9 db 83 0f 75 7e c2 9c 99 39 fc 73 13 e6 39 fe 48 5b c1 e4 1d da ae f3 fb f1 f7 cc 52 7c 8f ad 0d 21 b8 08 24 82 ca ad 7b ee 44 0e 50 97 66 5f 63 6c 3d fe c8 2f 8c 98 af b6 24 3b c3 94 49 39 67 5a 59 42 77 d2 78 ba 43 61 46 1f 7d a5 2e 22 4e 4c e5 de e4 a4 67 bf 6a e9 f6 7b 61 ac 6e b0 a4 40 40 6a ba c2 01 6e ec 90 7e 24 1c 57 f5 f4 4b e4 72 90 fd 0f ef 78 5f f0 4d f3 81 0c cd 63 7b 4d 97 a8 4b ae 84 86 a3 6f 75 d8 72 e6 45 fe 46 62 59 69 fc 2d 1f 03 2c 56 ed 44 bd 98 ea 27 bd 9b 6d dc 8e b2 dc 2e c9 f9 0f 2f 1c a1 bd 20 e3 7a c5 8b 03 c8 4c 87 2f 4b a4 73 10 65 49 86 64 14 60 df dd 53 1a c6 2a 76 ad 87 b8 9c 10 3a c5 c9 c2 e7 e7 0c 66 44 7b 34 12 d4 a1 e5 cb c3 0e 16 93 95 05 11 6c 04 de 33 ae 05 4e d3 66 de 8d 1f 97 1c 2d e4 39 95 7a 19 4e 22 a4 88 f5 8d 7e fd 46 43 91 77 f3 f3 c4 5a 14 75 92 7e ec d8 46 d3 d2 e6 a2 ab 5c 7f 8a dd d9 90 62 c2 fc 6b 27 2d 1f 51 bb 8f 22 f1 b6 f8 bb 3f af 8a a8 5e 5e b9 ab f7 df 5c f8 f2 62 67 32 38 08 b0 83 3a 98 79 89 cb e5 92 05 e7 ad 06 55 6e 2d 1b 8a 48 73 ca 1c bc bc 8d 43 ab c1 45 fd 4e b8 32 e7 a5 8a b2 c7 93 d0 03 ce 7b 18 50 ce 45 eb 74 80 41 7a 1e 9e b9 d3 9a 10 28 a2 a0 4a 2a a6 49 c0 98 c4 f8 ee e5 14 db 5f 60 21 17 3b b2 54 b8 e2 2b 15 0b 2c a0 1d c7 ff 23 5d b4 6e d7 8d 07 f4 3d 1a da b1 3b 84 45 d1 b3 20 69 eb 45 f9 d3 89 fc f5 a3 f7 d3 eb e2 43 c5 b1 fe 17 b1 f5 a3 d5 71 b6 5f 21 b9 e4 71 e8 18 17 25 54 dc 95 67 49 b9 9c b7 a5 f3 03 ec 48 0d 71 94 a2 ba 86 e2 04 f0 6a a1 be cd dd c8 c4 90 82 c5 27 e7 06 4a c2 ad 77 dc 05 63 9d 3d 2a 77 78 f6 94 3e d6 10 5e bf 6f 0b 9e 94 fd db e0 5c 23 6e c0 00 f4 d1 d4 e4 96 b1 00 68 21 1a b6 8a da 4c 7f 7a c6 1f 5f 5b a5 f1 81 0d 5b be 87 ff 4f 83 56 af 0d 3f 68 2b ae db 0a d8 f8 48 8b 27 74 21 f0 a0 3f c5 e3 09 5e e3 4b c4 47 2d 8f 17 e3 f7 01 3c f2 f7 9f 5f f3 ea 4b 6b ae 56 d1 36 5a 33 b0 9b fa 9a 49 63 23 f7 da 92 3b 7e 29 dc e4 be b8 10 35 f1 31 30 00 4c 96 e5 6d 7e f6 ca 6c 10 1d 20 c2 7a 21 8e 62 32 27 c3 3c 9e 48 8b 17 e7 ae 9a c2 0d a8 24 05 01 f7 b6 14 a1 73 0f 16 45 53 fe 47 9e f1 49 86 6e 4e a4 72 96 81 42 84 a3 d3 eb 7c bb 29 42 89 ff b9 96 e0 eb 05 3b 9c 16 e5 4c f2 67 83 2e 3d 36 0e b1 96 ed 51 30 56 30 22 33 09 ea 97 21 56 28 f0 1e c9 d3 ea 48 09 64 18 d5 e9 62 ca c5 06 34 60 f0 a1 87 72 ec 7c e6 6d 14 a1 cc e1 4b 52 c4 0b bb fa fc cb f1 e7 6f 09 e5 7f f0 71 80 48 e5 b9 93 15 7a 6c f4 71 88 26 b1 e0 94 30 41 3a 35 96 a1 5c 4a 62 0f a8 c8 e1 d1 66 3e 57 39 f9 f7 90 dd bb 3b e0 e0 01 87 d4 37 17 d6 59 24 24 67 d8 68 1a c1 03 03 34 61 57 f8 94 d9 03 76 41 41 70 10 e9 65 4c 6a 5b 22 26 3e 73 a5 a3 71 28 f5 00 78 a9 80 c3 09 30 32 1a a5 c5 e7 85 1d 5d 39 2d dc e3 a1 4a 96 91 6f a8 42 1a e6 72 8f 37 f5 de 7c 3e 98 fe b4 ba bd 4e 1b d2 31 5d 59 5e 20 9d 52 74 8f 70 ad c2 28 4f cd aa 6a d8 80 47 0d 2a 07 1f 34 90 aa f3 49 1f b6 4b 45 47 41 9e 8e cc dc 49 1a 89 21 15 6c b4 81 1a d1 e6 65 14 a3 2b 0b 31 b6 41 43 88 81 f2 8c 1e 64 61 b4 f4 51 93 89 99 af 67 1e 8c 6a 5c d0 c0 72 a9 fe 4c db ef e2 4c a6 16 f3 d0 a1 5a c9 7c ca 83 5b 1a 44 0e 04 fa 28 34 0c 60 44 17 6c 8e cc 8e e0 d0 33 d4 7d b8 a0 aa cf a0 ea bd fa 1c 95 09 fc 26 04 00 8f 01 cb af eb 5b d2 b5 03 b8 09 ed 67 23 40 b9 a5 76 59 3f 1e f3 88 39 1b 54 b6 05 e7 a1 5b ef 7b 13 45 62 7a 34 fc a5 77 38 b0 f8 f4 f1 9e ea 93 c9 03 49 52 74 a4 42 5a 1a 1c c6 c4 c6 e3 35 b6 31 df 51 85 c9 5b 48 5e 42 57 86 7b 53 47 a4 0e 4e 14 dc c5 60 f0 61 fd 4f d2 65 13 7d c6 8a fd 54 8a dd e7 78 f1 33 0f 76 9a cb 1c cf 5d a1 4f f6 99 2c 24 e2 10 ea 6e 61 79 42 18 81 b8 03 39 3b c6 97 4e 37 10 6c 5b 5b 3b 5d 0b 34 69 f8 96 9b ff b7 e4 ce b2 c9 8e 92 8e 74 36 64 92 d2 72 35 ae 4c 74 a2 f4 85 11 ae ea a5 3a 2b ea fa 7a 33 1b 50 e4 54 c5 07 af 1b 63 35 0a 5c ef 35 66 8a 5b 93 25 01 41 92 27 7e 50 95 61 00 8b 36 01 08 8f 79 d4 2e aa 8b 1e 4a e2 00 0b 31 74 9e 2b 80 94 31 2d db 7f 3c 1c d6 25 ef 88 5c 11 fa 22 a6 6e 37 4b 52 b3 42 5e 0b 80 16 15 4e 1f d8 47 13 39 e3 2e 73 73 d6 3a b6 46 d8 93 fb e0 9a e0 7b 06 07 4c 01 40 1e a7 6b 3c 38 2a 9d 32 f2 4f 93 c7 89 96 4e 16 bc 42 06 ec d7 5c 10 91 7a b8 4f fd 8d 6c df 4c d2 8f d9 03 75 ff 28 51 8f 8c 1a 3b ef c5 38 e1 b9 e4 27 fb 67 19 88 d2 9f 2f b2 fc d0 39 f4 d3 41 c8 4e b4 d7 cf 60 0d da ba 88 bb 09 4e 4d 87 a1 41 91 80 14 9f 49 13 68 e6 48 b6 99 85 b0 5a c3 9a 4e cd d3 c5 13 5f 3a 5c 8a d7 79 2d ac b6 47 01 44 bb 9e 67 80 5a 21 1e fb 3e c9 cc af 8e 09 01 34 5f b1 9e 4d a5 79 e1 fb e8 6a 12 07 f4 f1 3c 34 36 00 9c 2c 64 0b 7c f3 f8 b7 7c a7 bd 99 4b f9 33 08 02 73 59 c6 dd 1b 7d b1 e1 53 fc 08 21 96 8e f3 6c 00 3b 6c 73 fe 89 0f 4d e2 4f 5c 64 58 db aa f3 81 9e de aa 91 78 3c 3c fc 7e 77 36 89 23 62 48 19 5c 7b bd 60 11 3f 24 76 fa 36 87 62 1d 66 8d 17 28 ee 43 3d 2f 8f 4d b7 07 34 5d 30 f1 e5 2a b8 7a 2a 0a fd 54 7c 6b b0 65 00 f5 9f 17 fa cd e4 8f 69 34 90 e2 24 94 b7 5d 11 df 1a 14 3b 85 06 8d 14 3e f6 a9 bb 59 37 a9 df 38 0c 89 48 f1 a0 1e 96 75 e1 84 09 ed b0 f6 b9 60 5b 68 e3 46 32 fc ce 47 2d c5 0b 90 b0 f6 dc d5 79 31 f7 8e 1e 88 61 a0 fb 62 e7 2b 0b aa d6 f9 d2 3c 1c fb 0f 19 b2 50 13 c8 d9 fc d7 86 a2 f6 f7 97 68 b5 fb 39 8f 7b 2b aa 31 ce 81 56 d1 fc 4a 46 c1 c4 63 fd f3 03 60 d4 2a ee d2 ef 11 61 1d 0b 7f 65 4b b5 10 52 fd 4d c3 93 28 f8 ec 4c 58 bb da 05 e6 f1 b3 c8 f6 d8 ad ca 02 68 f2 41 0e 9a 4a 7d 63 b6 61 60 06 d0 e0 2f 6e da cc 10 e5 c5 4f d8 5f 15 a8 bd 76 48 a2 93 f2 3d 6a 69 9b d9 a6 75 25 04 75 a7 3a 96 d7 47 5e 4f ab b8 9f b5 e7 de 5d 7a 34 79 aa 48 5c 0b ef c6 0d 0a c4 fd 5a c6 db ec ce b0 6c ad 86 e2 19 fc 0c e4 72 07 58 91 78 11 a3 21 5f 8d 13 e4 13 bf b6 4f c0 65 fc 42 1a ed e0 b5 66 91 79 7d ac 42 8c 7e 46 34 79 fa 59 1b 90 72 c3 09 b7 53 3e 42 7c 5c c1 1a 1f 6c f9 a5 b9 95 d3 28 d7 96 d8 74 c5 b5 5d fc 12 a5 03 9b 41 3c e3 19 cf 5b a1 f3 55 c4 e0 71 7d 32 65 0b 43 e1 80 10 f3 7f 04 87 31 93 1c 52 c4 f3 6e b9 69 dd a7 02 af e9 6c 2a 52 41 35 0a 67 ba 2d 02 69 46 18 9c 5e 28 12 93 c9 a8 e2 cf f3 78 47 76 f1 de 78 b9 17 10 1b 54 e5 ab 00 c0 45 ea 15 f2 8a 0e 3f 50 99 62 cf 8b d3 38 5d 85 25 07 37 ea e5 c3 4e ce 86 b8 66 69 c1 3b 00 30 8a 3b 13 c0 ac 3c 83 ff 26 fb 52 a4 aa 83 c1 23 3a 94 90 cb 9c a9 17 a0 56 90 89 31 75 1b dd b8 8a 62 37 9a 71 33 95 f0 76 4e 4a 39 3f af 25 3a 40 26 d0 47 22 70 e6 03 62 87 d5 68 50 df 17 51 54 34 84 d6 5b 30 62 15 5b 63 00 e0 02 42 41 c5 9a 86 2a e7 69 c1 a9 23 2a 2d 9f b2 47 05 17 7a 09 cc eb 3e ef bf 9f 10 6f 67 e0 1b e1 4c de b4 d2 fc 7d 86 61 df 3e 75 de 5c cd 09 a7 e5 59 f0 28 fb 98 37 c6 21 ea 00 45 b4 d1 b6 79 06 7f 24 63 39 c9 74 63 1a a7 13 4d 4e 91 0e fb 28 d3 c4 89 29 ce f1 df 7e 6c 73 66 87 62 d5 50 86 b6 c5 9c 36 ac 90 15 41 35 fd 7c a4 e4 04 7d d0 aa 16 1f a9 82 d8 ed f9 c0 cb 96 66 47 7e 09 6c 55 71 8f 6e 47 42 41 5f ef d4 f6 96 d1 f1 cc d6 32 2b c1 94 96 dd eb d3 62 82 a7 c7 07 d5 b4 41 13 e3 06 78 e6 e3 3a b7 d3 4b e0 4a 59 ac 61 4d 6a 54 13 44 90 99 8b e0 26 36 fa 91 63 3d 62 94 78 1c 2b 9a 54 c6 11 c0 04 5c fc fe 81 f4 9a a2 1b 29 d8 35 cd 20 47 c8 54 48 6f d8 e6 5a 2e bf 62 9f 7c ed 60 2b 9d d1 07 bf de 48 3e 5c 9b 5c bb a4 a0 8c dc e0 99 20 bd a9 97 8b 7f c2 b4 a8 9b f1 57 3a 26 38 9e 52 09 0f df 5d cc f2 21 11 dc 8c 42 fd 3c 8c 47 70 92 89 53 98 08 6c c2 2c ca 66 52 69 e1 93 fc 65 07 42 a3 61 a4 4b 85 7d 25 84 29 f7 01 f2 2e 9b 76 15 bc 3d ab 78 c1 47 9a 41 cf 85 75 cd b1 71 69 47 0b 34 7a df c0 3e 03 da ea 3e 26 97 25 cf c7 2d f5 66 4b 9d f3 6d 2f 2b 55 01 3b 71 13 3e 0b 80 57 7a 47 18 25 11 eb b3 08 b6 24 8d 45 7b d2 af 7b 28 e7 71 82 c3 05 24 11 78 c4 12 4a b1 02 77 1f d5 a8 c3 da cb 87 75 de 88 13 01 d7 15 87 c7 6b cf 0a 97 a7 2a d2 44 d0 c4 2f d7 1a ce ec 32 dd 48 bb 5c 9a 95 b3 91 16 6c 83 2a c5 ba c8 c7 ca e4 d1 8b 3f 7d 9f 2e 47 82 fd f9 77 32 e3 d5 1f 67 bb b5 7f 98 9e e0 d7 58 9d bd 0c 2a 5c 63 84 0e 91 4b 9d 7d 72 0f a1 20 ac bf fe bf 81 6b 58 8b 2c cc 05 2e 7f a7 89 92 e0 ea 39 dd 21 a1 22 ad d4 11 95 f8 e2 e1 ac d7 77 c1 a4 e8 ef 43 62 fe f4 41 fe b4 d9 25 2c 6b fb d2 74 21 52 30 0a 32 02 77 76 e3 34 16 20 d3 c8 d9 36 5e 10 e8 1a dc ca 7d 87 a0 e5 55 c9 8a 03 53 c6 92 55 7d 90 ee 9b e3 fb aa b7 66 ab f9 3e 24 62 14 9f d9 9c 92 a5 fc 58 d8 99 ee 75 53 5c d1 fe 13 86 c5 ab 0b 15 7c 21 02 03 9d 60 15 25 8f 59 ce f3 f1 5b 95 18 93 a3 0a e8 39 f7 40 40 2a 30 b3 4e 7b e7 37 96 28 64 03 c5 be b0 85 3d 85 6d 83 f1 b0 0b 48 32 8f 56 dc b3 2e 1f aa b0 8a 34 35 b1 48 2b f1 8b 21 c9 5a ef ea af a7 fd 76 1c 7f 28 d4 16 fc de 06 bf 7a ee 5c 6e 9e b5 0e 55 87 42 53 ba 3f 1d 0c e2 50 5b 4f c7 c3 fc 99 6b fb b8 44 6b af e8 4f 5b ea 94 bf d7 ca 5a ea f2 37 fe 79 3b 66 e5 c5 21 d4 09 2e 4e 1f 9b de 1d fc fe 53 fa 55 00 5d 21 cf a8 33 a3 38 fd 97 92 61 41 29 33 60 60 e1 0d 19 11 86 20 70 76 1a a2 0c 29 02 eb 7c 5a 35 5e ff 4c f6 25 3d 71 02 a2 ca 1f ea d4 c5 3b 57 d5 76 d1 04 c0 81 31 0d 92 79 7e 4e 2e 8c 26 9d 19 91 0d 0d 4c ed f3 0f a2 8b a6 80 c0 01 37 f8 3d e9 40 62 42 29 b6 a1 25 ce 52 33 c6 cf 4a 36 40 b7 4f 58 f2 88 da d8 45 1f be 37 64 1c 55 59 a5 f3 ca f1 29 9c 8b fb 23 07 23 65 22 78 fe 37 8e fd 8e 45 9b 9d a2 6c ff eb 58 46 8a 63 01 db c0 6d 71 3b a2 d8 d4 3d 90 38 f5 f2 dc 8b 83 1b a5 8a 88 ee b5 b1 78 6b 21 e3 98 ae ee b7 c1 f3 d6 f0 1d 82 b3 94 78 62 fb 9e 7c bd 7d a5 d0 4c 5f cd 34 da 28 d5 3e 22 46 e3 ac 1e 3a 61 9a d1 74 ef a6 43 5e aa 0f c9 4d 61 07 99 ce 01 58 42 1d ce 04 63 06 eb 50 42 14 3d aa 33 6d 52 20 6b 12 61 0e a6 38 9c dd a4 9b f5 af 1d 4e e4 2a c0 90 a9 4a e7 b7 61 20 73 f3 a5 c3 6a 22 05 ed a8 87 f4 14 78 f7 d2 0f 18 66 7f 94 1f 71 ee bc fa 76 c1 ab 28 f2 a4 9a 3b d5 6b d3 f4 e6 bd 07 9a b3 fe 2d 94 78 22 36 e8 35 85 a0 3e 52 90 7a ba ef 74 56 a9 5d 5d 3f 3d 37 ef dc 03 5d bf d7 c4 1b 8b a0 af 2d f8 ad f1 cf 24 f7 ff 0b ec cd 3d 26 bc 91 ca f4 23 14 ef 7e 46 6f 74 e1 9a e0 df 2e 22 98 fc 2f 69 4a 7e c1 34 63 20 35 58 5d 53 0e 7e 19 f6 5c 25 6f 00 1d 75 38 2d 98 25 ef 74 1b c2 13 af 18 63 77 d9 ca 10 d3 72 23 54 e1 89 7c a5 c2 3a c6 a5 2c 9a d0 e6 b6 86 e1 77 6f 7e c6 5d f0 33 e8 f4 d5 db 80 c1 bc 35 40 93 b3 19 cb 70 df 93 d6 10 66 76 75 81 63 28 c9 93 22 f1 4e 63 6b 95 f0 4e 64 97 f1 39 d5 08 b4 53 f5 3d db 5c 28 9d 84 9f d5 40 7c 9b dc ef d1 64 2a bd 46 e2 8c b4 e9 43 71 bd c6 06 ee b6 7c 9f e1 77 47 c6 8f 2d 50 e8 27 11 da 4d 3e db 0e da 06 f4 1b 7f 93 fa 8f b4 d8 3c f2 1c 79 da 67 00 0b ac 22 75 50 82 17 ad e1 65 9f a8 d2 4e 5f 8e fb 9f 4b d2 10 73 eb ef 3d 06 36 8e b0 3f a3 cf 0d 63 84 48 bd 05 5e d2 0d 29 20 33 ff db a5 38 55 9c 8f f9 a2 a5 c8 f8 3b 5c 39 36 43 d6 58 5d 1d f9 94 c3 be 43 e7 2b 8f 3f 53 11 4d 2a 5f 6b ce db 57 38 42 b2 3b 6a 3e b7 fc a8 49 5b f0 3b d0 3f de 7b 19 bd 39 a1 6c ec 49 e0 1f 38 e6 71 af 33 ca e0 82 d9 78 8e 32 02 79 9b c4 66 ba be c2 08 05 28 d0 60 9c 0b 73 19 64 71 90 93 73 5b 4c 1e 73 bd 07 05 63 7c 47 51 69 22 19 7c 55 2b ae af 35 16 b5 e3 bb c2 cd 1a fa 3e f8 21 51 96 ed 58 0d 95 61 09 2f 62 0b 89 7e 98 e7 86 a0 c7 cb b0 ee dd a8 06 32 92 ba 64 82 49 7f 5f 6b b6 2f b5 ab 4c 97 cb 76 58 dc 65 79 71 8e b9 7b 54 7f cf 47 ce d1 42 65 61 af 93 a1 5f b4 dc 6d 3d 93 b8 68 64 49 43 c2 c9 4b 23 b0 57 0b bb 81 df 26 66 c2 4f 5a bc cf cd d7 1e 20 9f 3b b4 3c 01 d1 7f 9b c8 b9 af 2c 26 76 2f c6 a7 41 a1 50 b7 d1 18 6e 4f 35 17 5f 3c 31 52 43 e1 c1 1e 92 c4 3a 1f c4 92 ee f5 a1 3c 77 a8 1f cf 51 4e bf d0 f8 e6 45 da e1 5a 07 e8 6b 2f 01 fd a0 65 db 45 05 a5 ee a8 3c b6 16 f7 44 f6 be e7 31 be 19 1c 65 44 9c 02 60 35 56 d5 a5 14 22 cf 9c 2f 19 f8 d6 84 3e 0c 10 91 e0 70 8a a2 71 e9 1f 71 c8 60 2b 9f a7 21 89 e0 36 b7 cb 6a f1 56 9f 21 26 92 83 de 94 a6 d7 fe 58 49 fd 43 3d 5b 71 9c 80 41 98 73 db 05 87 fc 29 78 6c c5 98 d8 96 fb 16 36 0b dd d2 ce 12 e5 4d 05 41 8f 4f 5e 5f 2d 7a af e9 fc d6 26 8c be 2e 9e 63 29 ff b6 c6 7f ab 8f 3c e6 73 02 8c c0 6a aa 6b 85 75 56 bb a3 b4 4d 3f ab 5b 6e 87 5e 70 a2 f3 ad 4b 2f f7 6f 31 ea d3 46 2d 38 01 ba 37 3b 3c 2f 54 5e 94 f5 70 21 57 5e 29 47 f8 1f 53 28 3f c0 a5 13 7f d4 4f a3 d0 74 c9 2d e5 4a 0a 34 65 c8 58 f5 a7 ef 08 31 3f ad db c3 66 3e 4e 01 67 f3 cb a3 96 12 05 7a 75 18 fb fb 03 1f 5a d0 f9 f7 58 31 97 3e bd 73 3b 82 e5 54 bf 3f de c8 4e 51 f6 5d ab 60 28 c6 c5 13 66 d9 d4 70 0f df 25 5e 4c 7b d7 07 66 e7 f2 28 1b 3f 2a 53 63 f8 5c e4 9f 91 35 90 4d 14 bc b1 17 ad 75 4c 25 94 dc dc a2 d3 0e 40 ff 26 5b 5a cc fb 11 6f 64 ed 99 aa d5 70 c4 c5 a9 1e fd bb 98 4a c6 51 d8 72 14 05 a0 34 2c f7 7f 44 8c 17 a1 52 ea bf 29 e8 89 50 55 8a 86 d0 07 4e 1c ef ab 1e b7 c3 66 68 2f 68 6e e1 33 87 37 e6 75 ea 58 eb 8b 4c 86 b9 f2 8a 6f 6e 96 45 9f 29 e3 b4 dc 59 ff 04 4c 61 a0 dc c5 c3 1d 80 3e 6e 98 42 0e 44 62 29 cc de c3 d0 f7 05 e9 2f fe 01 6b b3 69 63 73 ea da b7 f3 5c cf 65 ab 4d 9b e0 9a 08 5c e2 1b bd 7c 05 55 37 6e 4d 7f e6 8b 5e 7a 64 f4 8b 51 27 82 5f b2 be 59 8d 99 1f 9c 1a 54 bf 52 71 34 17 dc c5 99 e8 12 d8 55 13 a5 37 e6 ea fa 73 8e dc 97 2b 67 e0 65 59 5d 11 67 84 49 bc e6 cd 3d 69 80 0a 64 9b 56 0d 0e 05 7c 50 2c a3 e7 2e 97 82 08 29 ec fe a8 01 19 2c 3f 4e 2c 87 63 c0 95 a4 3e e6 fe 45 fe 87 30 13 09 37 66 8d f1 d4 ee 57 7a da 28 23 8b e0 32 86 48 1f 2d 2a 00 4c c4 d4 88 56 e7 1f bd 64 f1 a0 04 3a 45 20 ec bb f1 b3 ab dc 96 b8 7a 27 be 84 95 a2 05 42 96 7a a4 cd 3a 44 a1 15 02 41 9a 08 3d 84 e9 7a bf de 09 01 b6 6d de 48 38 86 49 a0 ed 6d 93 b9 f2 0c 53 0e 99 0c 7c 52 37 0a 11 4d 80 0d 6a b3 f6 68 7d 6b bc 10 5b 63 73 8f e0 5f a6 ca c9 8a d6 66 39 36 bb 18 cb 92 32 64 e4 43 12 c2 4c 2c e8 e6 42 bb 73 c9 21 01 2b 68 a2 6a 70 97 74 46 b8 f1 5f 9d 62 46 7d 8b 35 65 60 c1 83 a6 bd 6c d7 6e c8 68 c3 bd 94 a5 95 cd 7b f9 96 75 5a 50 8a 81 49 80 c5 e5 88 b2 75 20 0c 45 af d9 00 c8 c2 de 32 9e c2 48 4b 0e 3e cd 7b 09 60 e5 e3 42 58 81 d1 ff 7f 8b d8 b2 0f 5c c9 8f fc 3a cb 77 f5 e8 87 75 a4 bd 3a b9 f9 eb 02 7e 27 d3 af 55 eb df 4e eb ab 48 ea 91 11 28 d6 68 d0 0f c3 f5 b5 48 0a a0 d9 a4 af 56 3b a5 77 38 44 48 e5 42 51 57 13 3d 59 e1 ce f3 c7 22 f3 37 00 bd 37 28 25 04 6b 1f a5 82 4e 40 51 54 a3 af 14 40 bc 2b 75 ac fb d0 7c f9 2e 8c 16 25 87 e7 4b 5a b6 6b 1c 6a ea b3 ad 5f a3 ee 91 da 49 00 ef 30 ad 04 ba ea 32 6d f9 12 51 7d d9 6e 16 96 b4 a9 1f aa 66 67 59 78 a3 75 e8 1f 25 46 4a 10 73 dc 67 37 af 08 d7 e2 59 56 bb 31 d4 38 54 8a 7d a3 86 62 d4 9d b8 12 a8 cf 1d 6c c6 5f 5c 63 87 9f d9 ee 7f d2 a6 6c a3 fc 1a 76 8c b2 39 aa b8 8c 87 20 64 70 b4 c6 05 92 af eb 6d 69 ed 97 a8 f9 90 15 58 62 ba 4e 22 b6 48 04 14 2c 13 1a 23 79 29 37 aa 8a 86 96 e1 65 c2 4d 76 92 a0 4b b4 47 1b 0f 0d 25 07 fe 7c 86 18 42 14 28 fc 7a 0a cc 98 4c a5 cc 6b ac b7 72 e8 a7 17 bb aa 64 6f 96 43 27 59 10 a6 03 7a fa f5 a8 06 78 d1 8e dd a1 38 a4 e1 3d 06 d0 4a 5d 06 43 1e ab 48 73 82 25 cf 15 67 e9 60 e7 65 72 8d c1 2e 91 b9 1c 6f 2b 33 df b6 e0 33 aa 68 c1 c2 33 4d 24 33 5a bc 4a 7a 1d f5 63 6d ec 29 09 1d a5 4d 5f 5a 1f ff 41 e4 a3 5a 0c 2f 04 f9 68 f7 d7 8e 2f 51 c7 35 77 e2 19 2b b2 0f 28 9a ab a5 a1 75 c2 ed 53 38 55 bd 9e d9 a8 42 ad 48 21 36 dd 5e 0c f4 5e b5 e2 d3 1f f6 2a 3b e1 cf 8a 94 a5 83 16 e7 4f 4a b9 fc 54 f3 a0 bb 83 be ef 0f 35 59 93 bd ea 2c 83 e6 1c dc 79 6b f2 56 4a e5 1f ae 61 67 99 e8 71 19 98 cd 88 d3 5c d9 82 44 52 fd d6 52 26 17 4b 46 79 2c b8 7f 4d d2 82 e4 e6 f6 7e b6 6d a4 13 ad 87 7e d6 ce 77 5f 7e 19 bc 93 f4 8b b9 e5 ec 04 00 9d e3 c0 42 ae ac f7 f4 b2 5a d6 b3 0e 01 73 03 f6 4f e0 7a c7 9e 87 44 aa b6 92 6d 11 7f 13 51 3d 04 69 ce f3 35 fe 1d 0d 78 7c 2d 0b 2c 03 1a 95 21 78 6a c1 0e 9f 8b 76 82 71 68 03 37 f2 c3 26 2a bd cc b5 d3 10 7c 63 2b f1 f7 4c 83 ee 91 f4 99 88 22 2f b0 80 cc 8f aa 9b 1a 02 52 6d 8b 60 87 e0 b2 35 41 73 d2 90 16 b3 30 95 87 c1 6f 05 7d d8 12 aa 63 c3 16 91 50 de 81 f3 af 97 d0 82 a8 f8 da 4c e4 f9 09 ff 64 98 21 d7 f9 6d 97 61 35 52 e8 cc 49 02 e0 46 ec fa 32 9b 1d 98 0f f5 ec e6 9b 8f 16 15 fd ff 52 44 f4 1c ec 0a f9 24 62 4a e1 64 1e ca e5 fa 26 c5 fb 90 06 e5 71 00 ee 71 37 7c ed 7c 25 5a e1 7a 08 45 e2 ee 02 87 c6 2c 18 52 f9 38 77 f9 f8 61 57 ca 96 75 d3 83 ff f5 cd 6f 2b 00 1e c0 13 6c 07 cf 37 f5 ac e1 85 31 22 c2 ba a1 09 2d 41 8e 2a 49 0c 4a 5c 8f 56 b8 28 ce 1b af ee f4 e7 7f 09 5d 6b 4e d9 9d 56 f6 68 12 cb 19 be 54 0e be 5d 52 e7 ef f2 d6 9c bb 84 77 e1 15 14 f7 e3 60 4b f9 99 9f 78 c2 f1 ca 6f 60 a2 21 6b 87 fa 0f 25 26 9c 42 5b 7d 50 70 9b 20 09 12 b3 b7 89 9c 95 e1 2d 6e 9c 4d ac c1 9e 32 77 21 86 0e 04 77 a5 3e 67 93 fb b7 fb 97 04 a8 48 f3 95 f4 8c 24 a6 e7 9b 9e 13 58 cc 34 97 25 1d e8 8b 8d 3a 7b 22 c6 d8 af 1a 7f ab 81 53 0d 9f 0c c9 8f 62 de bb 22 2b 54 78 0d 89 79 42 38 53 27 17 b4 47 d7 1b 46 a6 0e d4 81 c2 1d b8 5b 59 0b 31 72 00 09 69 5e cf fd 4e f0 29 96 4e 5d 51 49 62 22 33 ac 01 3e 96 0a 00 5c 92 4f 73 ea 82 c3 18 45 55 46 c5 3d 74 aa 3f 7e 2f f2 6a a0 74 c4 0a 55 ab a8 b0 80 27 fc 19 b5 96 ee c6 c4 f8 9b ae 39 e7 4b 9a ad 88 34 4f 7c c5 ad 3e ef a5 09 5f 2a b4 72 22 e9 a3 57 ec d7 1c 67 00 ac 57 60 25 20 14 90 d9 e4 46 60 3d fd 4b da 76 17 dd 50 09 81 b2 d2 ab 8c 43 88 2a 52 08 49 4c b3 f8 eb c7 20 bc a8 a7 cf 6c 80 bd 7a aa f8 95 07 bb 34 12 ea 49 0a 78 97 3f 12 cc 30 41 3e 9d f1 45 89 17 ea 3d 68 b4 38 d4 24 c1 31 4b c8 d0 19 39 c5 a5 a8 42 43 82 81 e6 2d 0c 80 0d ee 70 4b 2a 6c d3 e1 e4 b8 85 a6 b2 6b 89 4a 98 76 5f a3 30 8c 9e 4b 87 f9 36 25 fa ec db 17 c2 9a 27 cd 24 3b f6 03 0a 67 87 4e c9 f2 44 3c f8 15 42 61 ac 2a 83 4c 01 cb e1 f3 14 ee 7a a3 ca 55 2e 16 48 cf 8b 42 a6 3f 24 9e 35 38 02 6e 09 e4 4d 69 dc 25 9a db 0d 1a 0c bc cb 5a 5d d5 d0 dc cc 90 d0 23 da 79 d5 63 41 88 ff 06 0f 7e 35 a5 f9 d7 ad 99 54 68 24 d6 39 75 d4 45 2d e8 76 09 3f 4e 99 7d c4 6e ed cd 80 a9 ee bf 5e 4f 07 7f bb 10 c7 d9 e1 9a 34 19 e7 b8 45 97 2a 3b 62 61 3c 54 04 a2 09 b1 6f a8 8e 0f f4 9d 7b 4f 21 fe cc 1f 77 3c 5b 4b e6 10 21 e0 ca b8 60 2c 6e 82 57 64 93 03 aa ea fc bb 17 8e 7a 46 0f f0 7f 21 9c 46 eb 6f e5 bf 81 13 72 3e 45 40 03 bd 70 77 67 c1 07 da f4 25 57 51 da af 8d ec f3 52 62 64 00 58 92 4e b6 58 78 68 b2 c0 82 30 b3 17 e9 73 96 eb c9 28 ba 8d 27 4c a0 ee d0 bf cb 63 76 76 00 3c 64 e8 c1 e1 a0 42 0b 6c 96 a4 42 26 06 1c ed 41 b8 44 83 82 ab d2 f3 d0 c4 72 af cd e2 31 fb c9 ee 90 c2 f1 13 2f 8e 23 91 24 6f 95 ad 93 35 4c 74 60 e2 0d e9 96 ad 0f 61 b1 3b 27 64 68 87 a6 37 ce de 90 b9 4b 7d 8c 31 30 f0 fe 06 0e 8d 95 5c 71 1a 27 00 b3 02 a7 5b de b3 2a 0a 68 02 ea 79 5c b1 14 f5 f8 2a 1a 38 1a 86 bb ff 88 b2 99 e4 77 28 b7 46 df f9 64 c9 4c 52 b6 61 b9 42 93 76 b1 32 0b 46 08 14 26 b7 c3 40 20 6d c0 da 15 1b f8 4b e2 a4 9e 78 b6 b5 93 87 53 d2 b1 be 8d 9e 67 c4 3c 5d 70 e7 25 19 f5 f9 0d 05 00 e8 4e e3 8f 82 b1 91 ac 4d 96 8b 0a 37 90 1f d9 23 cb 28 9d 58 56 93 ac 3c 3f 8a 94 fc a6 df 45 e6 94 e1 99 a9 cd 0b 1b c1 fa 73 94 bc c9 6a ae 67 0d ca 66 05 a9 98 79 3b 7e 06 7a c4 10 ba 63 10 57 b8 b7 6f cb e9 52 4d f8 20 c0 2e fe f1 60 8b 74 3c d2 aa 6d 60 d3 d8 e4 76 fa 12 d3 ac c3 29 f8 27 2b 08 7d 89 47 11 77 ed 53 1f ec 1f 9c 24 a9 75 ca 2f cd 8c 24 6a 33 e2 91 a3 f0 0b 7f 23 40 52 06 7a 00 59 c8 67 62 47 52 56 bb 5e 7d ac 6f 12 1a 09 25 50 6b 18 93 3c 6e 31 49 15 d4 b3 b2 13 0a af c2 48 3e f2 2f f8 bb 7b 88 75 65 b1 bd 22 fa bc a2 20 37 d8 fc 94 37 f6 75 c5 31 35 26 26 6f 60 bb 7c 7c 47 f3 0c 7d 56 7e d1 42 ea 5e c3 67 c4 29 83 28 d2 0e 53 44 f0 1c 0c 90 cf 8a 63 02 f4 d8 4b 6b a7 49 5f ba 31 4a 05 ba 29 b6 3b b6 d4 58 fd b0 5a 44 11 13 69 58 30 9f 41 8f b1 78 e1 9a a0 9f f9 e6 2b 29 73 2f b2 98 6c 96 e7 38 f7 a6 88 cb 21 22 db b8 f2 ad 9a 5f 28 bc 49 ec 0c 46 24 13 55 2a fe e8 e4 03 25 9b 55 ad 6d c3 34 dd e7 f2 d3 06 92 9d d0 1f 2a a6 03 6c af d4 18 74 52 26 89 30 1b 81 c9 e5 0e 86 82 88 94 14 03 56 db 0a 33 17 b0 81 ed 9d 81 48 c4 1e 77 e6 bd a6 28 77 62 53 2b 86 eb 91 f5 48 09 15 68 0d eb 8a 91 fb 86 56 b7 f0 10 90 64 86 5d 2b 84 6a f0 86 1f 67 d3 f7 20 d6 e3 06 54 0c d7 b6 8f 09 5e f3 69 0b 88 ea 93 fb 6a 40 2f f5 69 75 97 cd a8 31 71 f1 59 e8 53 07 d1 a8 c0 16 11 18 9b d4 eb 4f 04 53 ab 88 d4 3a e1 81 a5 62 a7 69 02 a6 7c 68 75 14 07 9d 6f 43 04 d9 a7 c0 fa 24 b6 e8 60 74 ea 0a 9f d8 18 7c 12 03 12 07 8f 5e bf a6 74 ad c0 30 37 34 bf 8f 6b 55 85 94 37 06 59 41 92 ad 24 c9 f7 d9 79 4f b8 37 58 92 4f 86 28 55 dd d5 0b ff 58 b5 22 c4 3d 73 c0 32 89 ba ec 62 8c d6 93 ca b9 31 01 b1 e4 73 b7 65 32 51 0e 10 f0 3e 86 81 2f ea 6f 2d 6f 54 67 dc f2 9e 6d 7c f8 52 4f 38 3a 0d ed 3f 09 51 c3 ff b1 71 a6 b8 a6 d9 7b 5f a8 89 9a 19 f1 a3 d0 e9 34 a1 d4 74 10 76 e4 39 4b a2 25 15 8f 69 7b f7 d5 65 17 17 c6 95 02 29 a0 be 22 e8 12 0d 76 a4 14 ed bc d0 3d 50 52 64 b7 ed e8 27 2c cb d6 db dc eb af 11 da f6 a6 52 f6 f9 eb 74 ba 7a 3e cc 94 28 92 89 13 88 00 5a e5 d9 71 e4 e7 9d 69 65 64 90 6d ff d4 48 45 b7 04 a9 ab c2 fa 5b a1 bb 69 a5 48 42 3a 08 04 4a d6 d0 e3 65 db 7e 6b ea 0f 38 44 a4 52 75 97 16 cb 98 dc f3 26 00 1e c9 0c 1c 34 31 74 09 8c df 47 ea 2e 13 34 10 58 ca 01 4d 2a 30 e9 ba 3c 52 6d e7 2a 6e 38 71 81 bf 76 a2 78 c9 cb c5 18 d8 c3 74 a3 f1 d9 80 2a 39 46 4a 10 09 03 db ec 16 f8 f0 95 f5 d8 2d 9d 09 50 72 81 e4 f7 fe 0c e4 fb ec ed 19 39 02 a5 f6 58 af 2a 4c 1d 09 52 da bd c6 ae 58 30 b6 b5 a2 c3 f5 b8 d3 3a 73 66 59 90 82 2e 5f 4a 7c e5 36 67 55 a1 61 55 43 bd f7 82 99 c7 1e 89 0e 0b ed b6 ec 27 7b 10 a3 89 d6 a3 ba 9c 03 72 21 42 12 79 e5 1a b5 0f b1 15 de 20 76 cc 99 44 42 02 e8 8e bd 9d 0f be 4e 60 23 4b 7b 76 14 95 ac 6c 9e 61 5d da c8 17 61 64 a8 8f b6 d6 cc 2b 52 67 2c 89 49 af e3 ef c1 e8 7a 59 88 96 bc 93 e4 21 42 38 44 fc aa fe 65 af 89 8a 01 5b 3b ca f6 23 eb ee f9 a5 71 55 af 52 78 ce b5 2b 99 5f 7c a4 66 d9 e1 8b 05 e8 63 80 67 9e 02 57 cf f6 d0 c6 75 00 78 46 2f 2e e4 70 1d 6d 82 89 ed 84 8b 87 7c f5 91 86 25 b7 93 70 60 d6 67 c1 11 19 88 1c 30 80 90 56 89 23 52 c6 c5 3c 01 e3 95 af 68 66 ea 35 0e 6f 21 fa 3d b7 72 c1 17 7c 75 99 99 97 3b 51 e1 1f fc 59 08} (length 0x2000)
// }
// len: bytesize = 0x2000 (8 bytes)
// res: ptr[in, syz_fuse_req_out] {
// syz_fuse_req_out {
// init: nil
// lseek: nil
// bmap: nil
// poll: nil
// getxattr: nil
// lk: nil
// statfs: nil
// write: nil
// read: nil
// open: nil
// attr: ptr[in, fuse_out_t[int64, fuse_attr_out]] {
// fuse_out_t[int64, fuse_attr_out] {
// len: len = 0x78 (4 bytes)
// err: fuse_errors = 0x0 (4 bytes)
// unique: int64 = 0x80 (8 bytes)
// payload: fuse_attr_out {
// attr_valid: int64 = 0xc (8 bytes)
// attr_valid_nsec: int32 = 0x3 (4 bytes)
// dummy: const = 0x0 (4 bytes)
// attr: fuse_attr {
// ino: int64 = 0xfffffffffffffffd (8 bytes)
// size: int64 = 0x0 (8 bytes)
// blocks: int64 = 0xfffffffffffffffc (8 bytes)
// atime: int64 = 0x0 (8 bytes)
// mtime: int64 = 0x8 (8 bytes)
// ctime: int64 = 0xffffffff (8 bytes)
// atimensec: int32 = 0xfffffffe (4 bytes)
// mtimensec: int32 = 0x0 (4 bytes)
// ctimensec: int32 = 0x80000 (4 bytes)
// mode: fuse_mode = 0x8000 (4 bytes)
// nlink: int32 = 0x0 (4 bytes)
// uid: uid (resource)
// gid: gid (resource)
// rdev: int32 = 0x1 (4 bytes)
// blksize: int32 = 0x3 (4 bytes)
// padding: const = 0x0 (4 bytes)
// }
// }
// }
// }
// entry: nil
// dirent: nil
// direntplus: nil
// create_open: nil
// ioctl: nil
// statx: nil
// }
// }
// ]
memcpy((void*)0x200000004200, "... [truncated large byte array] ...", 8192);
*(uint64_t*)0x2000000000c0 = 0;
*(uint64_t*)0x2000000000c8 = 0;
*(uint64_t*)0x2000000000d0 = 0;
*(uint64_t*)0x2000000000d8 = 0;
*(uint64_t*)0x2000000000e0 = 0;
*(uint64_t*)0x2000000000e8 = 0;
*(uint64_t*)0x2000000000f0 = 0;
*(uint64_t*)0x2000000000f8 = 0;
*(uint64_t*)0x200000000100 = 0;
*(uint64_t*)0x200000000108 = 0;
*(uint64_t*)0x200000000110 = 0x200000000340;
*(uint32_t*)0x200000000340 = 0x78;
*(uint32_t*)0x200000000344 = 0;
*(uint64_t*)0x200000000348 = 0x80;
*(uint64_t*)0x200000000350 = 0xc;
*(uint32_t*)0x200000000358 = 3;
*(uint32_t*)0x20000000035c = 0;
*(uint64_t*)0x200000000360 = 0xfffffffffffffffd;
*(uint64_t*)0x200000000368 = 0;
*(uint64_t*)0x200000000370 = 0xfffffffffffffffc;
*(uint64_t*)0x200000000378 = 0;
*(uint64_t*)0x200000000380 = 8;
*(uint64_t*)0x200000000388 = 0xffffffff;
*(uint32_t*)0x200000000390 = 0xfffffffe;
*(uint32_t*)0x200000000394 = 0;
*(uint32_t*)0x200000000398 = 0x80000;
*(uint32_t*)0x20000000039c = 0x8000;
*(uint32_t*)0x2000000003a0 = 0;
*(uint32_t*)0x2000000003a4 = 0;
*(uint32_t*)0x2000000003a8 = r[2];
*(uint32_t*)0x2000000003ac = 1;
*(uint32_t*)0x2000000003b0 = 3;
*(uint32_t*)0x2000000003b4 = 0;
*(uint64_t*)0x200000000118 = 0;
*(uint64_t*)0x200000000120 = 0;
*(uint64_t*)0x200000000128 = 0;
*(uint64_t*)0x200000000130 = 0;
*(uint64_t*)0x200000000138 = 0;
*(uint64_t*)0x200000000140 = 0;
syz_fuse_handle_req(/*fd=*/r[0], /*buf=*/0x200000004200, /*len=*/0x2000, /*res=*/0x2000000000c0);
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// flags: open_flags = 0x20c01 (4 bytes)
// mode: open_mode = 0x0 (2 bytes)
// ]
// returns fd
memcpy((void*)0x200000000000, "./file0\000", 8);
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000000ul, /*flags=O_NONBLOCK|O_NOFOLLOW|O_APPEND|O_WRONLY*/0x20c01, /*mode=*/0);
if (res != -1)
r[3] = res;
// writev arguments: [
// fd: fd (resource)
// vec: ptr[in, array[iovec[in, array[int8]]]] {
// array[iovec[in, array[int8]]] {
// iovec[in, array[int8]] {
// addr: ptr[in, buffer] {
// buffer: {6e} (length 0x1)
// }
// len: len = 0xfdef (8 bytes)
// }
// }
// }
// vlen: len = 0x1 (8 bytes)
// ]
*(uint64_t*)0x200000000200 = 0x2000000003c0;
memset((void*)0x2000000003c0, 110, 1);
*(uint64_t*)0x200000000208 = 0xfdef;
syscall(__NR_writev, /*fd=*/r[3], /*vec=*/0x200000000200ul, /*vlen=*/1ul);
return 0;
}
]
|
| 2/1 |
2026/05/24 06:00 |
action |
kernel-checkouter |
1m
Results: map[KernelSrc:/app/workdir/cache/src/0673e8e2d0cbee3c149e04b8200be38e4c7661d2]
|
| 3/1 |
2026/05/24 06:02 |
action |
kernel-builder |
31m
Results: map[KernelObj:/app/workdir/cache/build/00ff67c34e8936e22bde1110abac0a94908ea0ce]
|
| 4/1 |
2026/05/24 06:33 |
action |
codesearch-prepare |
28m
Results: map[Index:codesearch-index]
|
| 5/1 |
2026/05/24 07:01 |
agent |
expert |
3m
Model:
Results: map[DenialOfService:true Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:true VMHostTrigger:true]
Instruction:
You are an experienced Linux kernel security engineer. Your task is to analyze given kernel bug report
and determine its security impact based on the following dimensions.
Use the provided tools to examine the source code, check for capability checks (e.g., capable(), ns_capable()),
and understand the nature of the bug. Analyze the given kernel build and configuration.
You can check the kernel config by grepping ".config" file; you can check kernel cmdline by greeping
".config" file for "CONFIG_CMDLINE=". Assume sysctl parameters have default values.
But analyze for the corresponding production build w/o debugging tools enabled (like KASAN, KMSAN, UBSAN).
Try different strategies when analyzing the bug:
- think of ways in which the vulnerable code is unreachable
- or the other way around: try to come up with different ideas of how an unprivileged user can reach the bug
If still unsure err on the side of the bug being non-exploitable/not-accessible.
In the final reply, provide a reasoning for your assessment.
Analysis dimensions:
* Exploitable:
Determine if the bug can result in memory corruption or elevated privileges.
Memory safety issues are almost always exploitable (KASAN or UBSAN reports for use-after-free, out-of-bounds;
refcounting issues, corrupted lists, etc). When kernel is crashing on a completly wild pointer access
(e.g. user-space address, or non-canonical address, but not on NULL or address corresponding to KASAN shadow
for NULL address), including both data accesses and control tranfers, that's also usually implies possibility
of exploitation. Such reports usually say "unable to handle kernel paging request".
Uses of uninitialized values detected by KMSAN may be exploitable b/c attacker frequently can affect uninit
values with spraying techniques. However, for these exploitabability depends on how exactly the uninit value
is used in the code, and what it affects.
Think of what happens after the bug is triggered. Some bugs cause kernel panic and halt execution,
they are harder to exploit. For example, BUG reports halts the kernel. However, WARNING reports don't halt
execution in production builds. Debug bug detection tools (like KASAN, KMSAN, KCSAN, UBSAN) are also not enabled
in production builds, so attacker can freely exploit these bugs w/o being detected by these tools.
If you see an integer overflow, think how the overflowed value used later (if it's used as allocation size,
or an array index). If you see an out-of-bounds read, think if it's followed by an out-of-bounds write as well.
Some KCSAN data-races may be exploitable by skilled attackers as well. Think what data structures got corrupted
as the result of data races and how. However, note that kernel has lots of "benign" data races that don't lead
to any runtime misbehavior at all.
* Denial Of Service:
Determine if the bug can result in denial-of-service. Most bugs can, since they cause system crash,
hangs, deadlocks, or resource leaks. This is mostly applicable to WARNING bugs that won't cause system crash
in production. For these think what will be consequences of the violation of the kernel assumptions flagged
by the WARNING. In some cases the unexpected condition is also properly handled by the normal control flow
(e.g. with "if (WARN_ON(...))"), these won't cause denial-of-service. If the condition is not handled,
then it may or may not cause denial-of-service.
* Accessible From Unprivileged Processes:
Determine if the bug can be reached from a typical (non-root) user process that does NOT have any special capabilities
(like CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON) or access to device nodes restricted to root.
Assume that unprivileged_bpf_disabled=1, that is eBPF loading is not accessible. However, cBPF (classical BPF)
is still accessible to non-root processes.
Assume that user namespaces are not accessible, that is, the process cannot get the mentioned capabilities even
within a new user namespace (checked by ns_capable() function in the kernel sources).
* Accessible From User Namespaces:
Determine if the bug can be reached within a user-namespace where the process has all capabilities
(including CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON). Such capabilities are checked with ns_capable()
function in the kernel sources.
* VM Guest Trigger:
Determine if the bug can be triggered from the context of a typical KVM guest (e.g., set up by a QEMU VMM).
Consider accesses to standard Linux host paravirtualized features (virtio-blk, virtio-net, etc.),
and handling of VM exits in the KVM code.
* VM Host Trigger in The Confidetial Computing Context:
Determine if the bug can be triggered in a confidential computing guest kernel from the context of a KVM host.
Consider access to standard Linux guest paravirtualized features (virtio-blk, virtio-net, etc.).
* Ethernet Network Trigger:
Determine if the bug can be triggered by processing ingress network Ethernet traffic, either directly (network stack)
or via drivers exposed to network data.
* Other Remote Trigger:
Determine if the bug can be triggered by processing remote traffic other than Ethernet (Wifi, Bluetooth, NFC, etc).
* Peripheral Trigger:
Determine if the bug can be triggered via an untrusted peripheral device that can be physically plugged
into a system, such as a USB device or a niche hardware driver handling external hardware inputs.
This is particularly important for mobile and desktop environments where users can plug in unknown devices.
* Malicious Filesystem Trigger:
Determine if the bug can be triggered by the kernel mounting and parsing a malicious filesystem image.
This is highly critical for Desktop and Mobile environments where external media or downloaded images
might be auto-mounted.
Don't make assumptions about the kernel source code (it may be different from what you assume it is).
Extensively use the provided code access tools (codesearch-*, git-*, grepper, etc)
to examine the actual source code, and confirm any assumptions.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt:
The kernel bug report is:
=====================================================
WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
syzkaller #0 Not tainted
-----------------------------------------------------
syz.4.21/6846 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
ffff800097625150 (&p->sequence){+.-.}-{0:0}, at: __fprop_add_percpu_max+0x130/0x1f4 lib/flex_proportions.c:186
and this task is already holding:
ffff0000f7d10240 (&xa->xa_lock#10){-.-.}-{3:3}, at: __folio_end_writeback+0x10c/0x6f8 mm/page-writeback.c:2990
which would create a new lock dependency:
(&xa->xa_lock#10){-.-.}-{3:3} -> (&p->sequence){+.-.}-{0:0}
but this new dependency connects a HARDIRQ-irq-safe lock:
(&xa->xa_lock#10){-.-.}-{3:3}
... which became HARDIRQ-irq-safe at:
lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
__folio_end_writeback+0x10c/0x6f8 mm/page-writeback.c:2990
folio_end_writeback_no_dropbehind+0xd0/0x204 mm/filemap.c:1661
folio_end_writeback+0xd8/0x248 mm/filemap.c:1687
end_buffer_async_write+0x20c/0x350 fs/buffer.c:419
end_bio_bh_io_sync+0xb0/0x184 fs/buffer.c:2776
bio_endio+0x8d4/0x910 block/bio.c:1675
blk_complete_request block/blk-mq.c:908 [inline]
blk_mq_end_request_batch+0x49c/0x105c block/blk-mq.c:1202
nvme_complete_batch drivers/nvme/host/nvme.h:802 [inline]
nvme_pci_complete_batch drivers/nvme/host/pci.c:1348 [inline]
nvme_irq+0x1ec/0x240 drivers/nvme/host/pci.c:1450
__handle_irq_event_percpu+0x20c/0x8e4 kernel/irq/handle.c:211
handle_irq_event_percpu kernel/irq/handle.c:248 [inline]
handle_irq_event+0x9c/0x1d0 kernel/irq/handle.c:265
handle_fasteoi_irq+0x328/0x8d8 kernel/irq/chip.c:764
generic_handle_irq_desc include/linux/irqdesc.h:172 [inline]
handle_irq_desc kernel/irq/irqdesc.c:669 [inline]
generic_handle_domain_irq+0xe0/0x140 kernel/irq/irqdesc.c:725
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:876 [inline]
gic_handle_irq+0x6c/0x18c drivers/irqchip/irq-gic-v3.c:920
do_interrupt_handler+0xe0/0x138 arch/arm64/kernel/entry-common.c:137
__el1_irq arch/arm64/kernel/entry-common.c:497 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:510
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:515
el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:592
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline]
arch_local_irq_restore+0x8/0xc arch/arm64/include/asm/irqflags.h:195
lock_is_held include/linux/lockdep.h:249 [inline]
rcu_read_lock_held+0x34/0x50 kernel/rcu/update.c:351
__find_rr_leaf+0x2d4/0x5c8 net/ipv6/route.c:833
find_rr_leaf net/ipv6/route.c:889 [inline]
rt6_select net/ipv6/route.c:933 [inline]
fib6_table_lookup+0x308/0x8b8 net/ipv6/route.c:2233
ip6_pol_route+0x1f8/0x101c net/ipv6/route.c:2269
ip6_pol_route_input+0x74/0x94 net/ipv6/route.c:2326
pol_lookup_func include/net/ip6_fib.h:617 [inline]
fib6_rule_lookup+0x174/0x45c net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2338 [inline]
ip6_route_input+0x5d0/0x930 net/ipv6/route.c:2641
ip6_rcv_finish_core+0x218/0x3c8 net/ipv6/ip6_input.c:66
ip6_rcv_finish+0x120/0x21c net/ipv6/ip6_input.c:77
NF_HOOK+0x2c4/0x358 include/linux/netfilter.h:318
ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:311
__netif_receive_skb_one_core net/core/dev.c:6137 [inline]
__netif_receive_skb+0xcc/0x2a8 net/core/dev.c:6250
process_backlog+0x608/0x10e8 net/core/dev.c:6602
__napi_poll+0xb0/0x310 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x548/0xcf0 net/core/dev.c:7881
handle_softirqs+0x31c/0xc88 kernel/softirq.c:622
__do_softirq+0x14/0x20 kernel/softirq.c:656
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
do_softirq+0x90/0xf8 kernel/softirq.c:523
__local_bh_enable_ip+0x240/0x35c kernel/softirq.c:450
local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33
rcu_read_unlock_bh include/linux/rcupdate.h:936 [inline]
__dev_queue_xmit+0x1464/0x2a68 net/core/dev.c:4844
dev_queue_xmit include/linux/netdevice.h:3381 [inline]
neigh_hh_output include/net/neighbour.h:540 [inline]
neigh_output include/net/neighbour.h:554 [inline]
ip6_finish_output2+0x1150/0x1a78 net/ipv6/ip6_output.c:136
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x418/0x7b4 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x2c8/0x640 net/ipv6/ip6_output.c:247
dst_output include/net/dst.h:464 [inline]
NF_HOOK+0x15c/0x430 include/linux/netfilter.h:318
mld_sendpack+0x7fc/0x100c net/ipv6/mcast.c:1855
mld_send_initial_cr+0x34c/0x534 net/ipv6/mcast.c:2271
ipv6_mc_dad_complete+0x74/0x3a8 net/ipv6/mcast.c:2279
addrconf_dad_completed+0x604/0xb74 net/ipv6/addrconf.c:4340
addrconf_dad_work+0x928/0x10cc net/ipv6/addrconf.c:-1
process_one_work+0x7c0/0x1558 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x958/0xed8 kernel/workqueue.c:3421
kthread+0x5fc/0x75c kernel/kthread.c:463
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
to a HARDIRQ-irq-unsafe lock:
(&p->sequence){+.-.}-{0:0}
... which became HARDIRQ-irq-unsafe at:
...
lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
do_write_seqcount_begin_nested include/linux/seqlock.h:477 [inline]
do_write_seqcount_begin include/linux/seqlock.h:503 [inline]
fprop_new_period+0x3b8/0x718 lib/flex_proportions.c:74
writeout_period+0x94/0x11c mm/page-writeback.c:615
call_timer_fn+0x19c/0x814 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x51c/0x76c kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0x11c/0x194 kernel/time/timer.c:2405
handle_softirqs+0x31c/0xc88 kernel/softirq.c:622
__do_softirq+0x14/0x20 kernel/softirq.c:656
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
invoke_softirq kernel/softirq.c:503 [inline]
__irq_exit_rcu+0x1b0/0x478 kernel/softirq.c:723
irq_exit_rcu+0x14/0x84 kernel/softirq.c:739
__el1_irq arch/arm64/kernel/entry-common.c:498 [inline]
el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:510
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:515
el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:592
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline]
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
unlock_task_sighand include/linux/sched/signal.h:756 [inline]
do_send_sig_info kernel/signal.c:1270 [inline]
do_send_specific+0x1cc/0x2cc kernel/signal.c:4131
do_tkill kernel/signal.c:4152 [inline]
__do_sys_tgkill kernel/signal.c:4171 [inline]
__se_sys_tgkill kernel/signal.c:4165 [inline]
__arm64_sys_tgkill+0x12c/0x188 kernel/signal.c:4165
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&p->sequence);
local_irq_disable();
lock(&xa->xa_lock#10);
lock(&p->sequence);
<Interrupt>
lock(&xa->xa_lock#10);
*** DEADLOCK ***
2 locks held by syz.4.21/6846:
#0: ffff0000f7d10638 (&fi->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#0: ffff0000f7d10638 (&fi->lock){+.+.}-{3:3}, at: fuse_writepages_send fs/fuse/file.c:2156 [inline]
#0: ffff0000f7d10638 (&fi->lock){+.+.}-{3:3}, at: fuse_iomap_writeback_range+0x674/0x149c fs/fuse/file.c:2225
#1: ffff0000f7d10240 (&xa->xa_lock#10){-.-.}-{3:3}, at: __folio_end_writeback+0x10c/0x6f8 mm/page-writeback.c:2990
the dependencies between HARDIRQ-irq-safe lock and the holding lock:
-> (&xa->xa_lock#10){-.-.}-{3:3} {
IN-HARDIRQ-W at:
lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
__folio_end_writeback+0x10c/0x6f8 mm/page-writeback.c:2990
folio_end_writeback_no_dropbehind+0xd0/0x204 mm/filemap.c:1661
folio_end_writeback+0xd8/0x248 mm/filemap.c:1687
end_buffer_async_write+0x20c/0x350 fs/buffer.c:419
end_bio_bh_io_sync+0xb0/0x184 fs/buffer.c:2776
bio_endio+0x8d4/0x910 block/bio.c:1675
blk_complete_request block/blk-mq.c:908 [inline]
blk_mq_end_request_batch+0x49c/0x105c block/blk-mq.c:1202
nvme_complete_batch drivers/nvme/host/nvme.h:802 [inline]
nvme_pci_complete_batch drivers/nvme/host/pci.c:1348 [inline]
nvme_irq+0x1ec/0x240 drivers/nvme/host/pci.c:1450
__handle_irq_event_percpu+0x20c/0x8e4 kernel/irq/handle.c:211
handle_irq_event_percpu kernel/irq/handle.c:248 [inline]
handle_irq_event+0x9c/0x1d0 kernel/irq/handle.c:265
handle_fasteoi_irq+0x328/0x8d8 kernel/irq/chip.c:764
generic_handle_irq_desc include/linux/irqdesc.h:172 [inline]
handle_irq_desc kernel/irq/irqdesc.c:669 [inline]
generic_handle_domain_irq+0xe0/0x140 kernel/irq/irqdesc.c:725
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:876 [inline]
gic_handle_irq+0x6c/0x18c drivers/irqchip/irq-gic-v3.c:920
do_interrupt_handler+0xe0/0x138 arch/arm64/kernel/entry-common.c:137
__el1_irq arch/arm64/kernel/entry-common.c:497 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:510
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:515
el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:592
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline]
arch_local_irq_restore+0x8/0xc arch/arm64/include/asm/irqflags.h:195
lock_is_held include/linux/lockdep.h:249 [inline]
rcu_read_lock_held+0x34/0x50 kernel/rcu/update.c:351
__find_rr_leaf+0x2d4/0x5c8 net/ipv6/route.c:833
find_rr_leaf net/ipv6/route.c:889 [inline]
rt6_select net/ipv6/route.c:933 [inline]
fib6_table_lookup+0x308/0x8b8 net/ipv6/route.c:2233
ip6_pol_route+0x1f8/0x101c net/ipv6/route.c:2269
ip6_pol_route_input+0x74/0x94 net/ipv6/route.c:2326
pol_lookup_func include/net/ip6_fib.h:617 [inline]
fib6_rule_lookup+0x174/0x45c net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2338 [inline]
ip6_route_input+0x5d0/0x930 net/ipv6/route.c:2641
ip6_rcv_finish_core+0x218/0x3c8 net/ipv6/ip6_input.c:66
ip6_rcv_finish+0x120/0x21c net/ipv6/ip6_input.c:77
NF_HOOK+0x2c4/0x358 include/linux/netfilter.h:318
ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:311
__netif_receive_skb_one_core net/core/dev.c:6137 [inline]
__netif_receive_skb+0xcc/0x2a8 net/core/dev.c:6250
process_backlog+0x608/0x10e8 net/core/dev.c:6602
__napi_poll+0xb0/0x310 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x548/0xcf0 net/core/dev.c:7881
handle_softirqs+0x31c/0xc88 kernel/softirq.c:622
__do_softirq+0x14/0x20 kernel/softirq.c:656
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
do_softirq+0x90/0xf8 kernel/softirq.c:523
__local_bh_enable_ip+0x240/0x35c kernel/softirq.c:450
local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33
rcu_read_unlock_bh include/linux/rcupdate.h:936 [inline]
__dev_queue_xmit+0x1464/0x2a68 net/core/dev.c:4844
dev_queue_xmit include/linux/netdevice.h:3381 [inline]
neigh_hh_output include/net/neighbour.h:540 [inline]
neigh_output include/net/neighbour.h:554 [inline]
ip6_finish_output2+0x1150/0x1a78 net/ipv6/ip6_output.c:136
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x418/0x7b4 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x2c8/0x640 net/ipv6/ip6_output.c:247
dst_output include/net/dst.h:464 [inline]
NF_HOOK+0x15c/0x430 include/linux/netfilter.h:318
mld_sendpack+0x7fc/0x100c net/ipv6/mcast.c:1855
mld_send_initial_cr+0x34c/0x534 net/ipv6/mcast.c:2271
ipv6_mc_dad_complete+0x74/0x3a8 net/ipv6/mcast.c:2279
addrconf_dad_completed+0x604/0xb74 net/ipv6/addrconf.c:4340
addrconf_dad_work+0x928/0x10cc net/ipv6/addrconf.c:-1
process_one_work+0x7c0/0x1558 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x958/0xed8 kernel/workqueue.c:3421
kthread+0x5fc/0x75c kernel/kthread.c:463
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
IN-SOFTIRQ-W at:
lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
__folio_end_writeback+0x10c/0x6f8 mm/page-writeback.c:2990
folio_end_writeback_no_dropbehind+0xd0/0x204 mm/filemap.c:1661
folio_end_writeback+0xd8/0x248 mm/filemap.c:1687
end_buffer_async_write+0x20c/0x350 fs/buffer.c:419
end_bio_bh_io_sync+0xb0/0x184 fs/buffer.c:2776
bio_endio+0x8d4/0x910 block/bio.c:1675
blk_complete_request block/blk-mq.c:908 [inline]
blk_mq_end_request_batch+0x49c/0x105c block/blk-mq.c:1202
nvme_complete_batch drivers/nvme/host/nvme.h:802 [inline]
nvme_pci_complete_batch drivers/nvme/host/pci.c:1348 [inline]
nvme_irq+0x1ec/0x240 drivers/nvme/host/pci.c:1450
__handle_irq_event_percpu+0x20c/0x8e4 kernel/irq/handle.c:211
handle_irq_event_percpu kernel/irq/handle.c:248 [inline]
handle_irq_event+0x9c/0x1d0 kernel/irq/handle.c:265
handle_fasteoi_irq+0x328/0x8d8 kernel/irq/chip.c:764
generic_handle_irq_desc include/linux/irqdesc.h:172 [inline]
handle_irq_desc kernel/irq/irqdesc.c:669 [inline]
generic_handle_domain_irq+0xe0/0x140 kernel/irq/irqdesc.c:725
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:876 [inline]
gic_handle_irq+0x6c/0x18c drivers/irqchip/irq-gic-v3.c:920
do_interrupt_handler+0xe0/0x138 arch/arm64/kernel/entry-common.c:137
__el1_irq arch/arm64/kernel/entry-common.c:497 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:510
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:515
el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:592
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline]
arch_local_irq_restore+0x8/0xc arch/arm64/include/asm/irqflags.h:195
lock_is_held include/linux/lockdep.h:249 [inline]
rcu_read_lock_held+0x34/0x50 kernel/rcu/update.c:351
__find_rr_leaf+0x2d4/0x5c8 net/ipv6/route.c:833
find_rr_leaf net/ipv6/route.c:889 [inline]
rt6_select net/ipv6/route.c:933 [inline]
fib6_table_lookup+0x308/0x8b8 net/ipv6/route.c:2233
ip6_pol_route+0x1f8/0x101c net/ipv6/route.c:2269
ip6_pol_route_input+0x74/0x94 net/ipv6/route.c:2326
pol_lookup_func include/net/ip6_fib.h:617 [inline]
fib6_rule_lookup+0x174/0x45c net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2338 [inline]
ip6_route_input+0x5d0/0x930 net/ipv6/route.c:2641
ip6_rcv_finish_core+0x218/0x3c8 net/ipv6/ip6_input.c:66
ip6_rcv_finish+0x120/0x21c net/ipv6/ip6_input.c:77
NF_HOOK+0x2c4/0x358 include/linux/netfilter.h:318
ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:311
__netif_receive_skb_one_core net/core/dev.c:6137 [inline]
__netif_receive_skb+0xcc/0x2a8 net/core/dev.c:6250
process_backlog+0x608/0x10e8 net/core/dev.c:6602
__napi_poll+0xb0/0x310 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x548/0xcf0 net/core/dev.c:7881
handle_softirqs+0x31c/0xc88 kernel/softirq.c:622
__do_softirq+0x14/0x20 kernel/softirq.c:656
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
do_softirq+0x90/0xf8 kernel/softirq.c:523
__local_bh_enable_ip+0x240/0x35c kernel/softirq.c:450
local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33
rcu_read_unlock_bh include/linux/rcupdate.h:936 [inline]
__dev_queue_xmit+0x1464/0x2a68 net/core/dev.c:4844
dev_queue_xmit include/linux/netdevice.h:3381 [inline]
neigh_hh_output include/net/neighbour.h:540 [inline]
neigh_output include/net/neighbour.h:554 [inline]
ip6_finish_output2+0x1150/0x1a78 net/ipv6/ip6_output.c:136
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x418/0x7b4 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x2c8/0x640 net/ipv6/ip6_output.c:247
dst_output include/net/dst.h:464 [inline]
NF_HOOK+0x15c/0x430 include/linux/netfilter.h:318
mld_sendpack+0x7fc/0x100c net/ipv6/mcast.c:1855
mld_send_initial_cr+0x34c/0x534 net/ipv6/mcast.c:2271
ipv6_mc_dad_complete+0x74/0x3a8 net/ipv6/mcast.c:2279
addrconf_dad_completed+0x604/0xb74 net/ipv6/addrconf.c:4340
addrconf_dad_work+0x928/0x10cc net/ipv6/addrconf.c:-1
process_one_work+0x7c0/0x1558 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x958/0xed8 kernel/workqueue.c:3421
kthread+0x5fc/0x75c kernel/kthread.c:463
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
INITIAL USE at:
lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
_raw_spin_lock_irq+0x58/0x70 kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:376 [inline]
shmem_add_to_page_cache+0x564/0xa24 mm/shmem.c:904
shmem_alloc_and_add_folio+0x758/0x10c4 mm/shmem.c:1958
shmem_get_folio_gfp+0x4d4/0x159c mm/shmem.c:2556
shmem_read_folio_gfp+0x8c/0xf0 mm/shmem.c:5974
drm_gem_get_pages+0x1cc/0x7c0 drivers/gpu/drm/drm_gem.c:654
drm_gem_shmem_get_pages_locked+0x1d4/0x364 drivers/gpu/drm/drm_gem_shmem_helper.c:239
drm_gem_shmem_pin_locked+0x1f8/0x410 drivers/gpu/drm/drm_gem_shmem_helper.c:300
drm_gem_shmem_vmap_locked+0x3cc/0x658 drivers/gpu/drm/drm_gem_shmem_helper.c:404
drm_gem_shmem_object_vmap+0x28/0x38 include/drm/drm_gem_shmem_helper.h:245
drm_gem_vmap_locked drivers/gpu/drm/drm_gem.c:1269 [inline]
drm_gem_vmap+0x104/0x1d8 drivers/gpu/drm/drm_gem.c:1311
drm_client_buffer_vmap+0x68/0xb0 drivers/gpu/drm/drm_client.c:355
drm_fbdev_shmem_driver_fbdev_probe+0x1f4/0x700 drivers/gpu/drm/drm_fbdev_shmem.c:159
drm_fb_helper_single_fb_probe drivers/gpu/drm/drm_fb_helper.c:1562 [inline]
__drm_fb_helper_initial_config_and_unlock+0x108c/0x1728 drivers/gpu/drm/drm_fb_helper.c:1741
drm_fb_helper_initial_config+0x3c/0x58 drivers/gpu/drm/drm_fb_helper.c:1828
drm_fbdev_client_hotplug+0x154/0x22c drivers/gpu/drm/clients/drm_fbdev_client.c:66
drm_client_register+0x13c/0x1d4 drivers/gpu/drm/drm_client.c:143
drm_fbdev_client_setup+0x194/0x3d0 drivers/gpu/drm/clients/drm_fbdev_client.c:168
drm_client_setup+0x114/0x228 drivers/gpu/drm/clients/drm_client_setup.c:46
vkms_create+0x370/0x420 drivers/gpu/drm/vkms/vkms_drv.c:211
vkms_init+0x64/0x9c drivers/gpu/drm/vkms/vkms_drv.c:239
do_one_initcall+0x248/0x9b4 init/main.c:1378
do_initcall_level+0x128/0x1c4 init/main.c:1440
do_initcalls+0x70/0xd0 init/main.c:1456
do_basic_setup+0x78/0x8c init/main.c:1475
kernel_init_freeable+0x268/0x39c init/main.c:1688
kernel_init+0x24/0x1dc init/main.c:1578
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
}
... key at: [<ffff800097649620>] xa_init_flags.__key+0x0/0x20
the dependencies between the lock to be acquired
and HARDIRQ-irq-unsafe lock:
-> (&p->sequence){+.-.}-{0:0} {
HARDIRQ-ON-W at:
lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
do_write_seqcount_begin_nested include/linux/seqlock.h:477 [inline]
do_write_seqcount_begin include/linux/seqlock.h:503 [inline]
fprop_new_period+0x3b8/0x718 lib/flex_proportions.c:74
writeout_period+0x94/0x11c mm/page-writeback.c:615
call_timer_fn+0x19c/0x814 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x51c/0x76c kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0x11c/0x194 kernel/time/timer.c:2405
handle_softirqs+0x31c/0xc88 kernel/softirq.c:622
__do_softirq+0x14/0x20 kernel/softirq.c:656
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
invoke_softirq kernel/softirq.c:503 [inline]
__irq_exit_rcu+0x1b0/0x478 kernel/softirq.c:723
irq_exit_rcu+0x14/0x84 kernel/softirq.c:739
__el1_irq arch/arm64/kernel/entry-common.c:498 [inline]
el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:510
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:515
el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:592
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline]
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
unlock_task_sighand include/linux/sched/signal.h:756 [inline]
do_send_sig_info kernel/signal.c:1270 [inline]
do_send_specific+0x1cc/0x2cc kernel/signal.c:4131
do_tkill kernel/signal.c:4152 [inline]
__do_sys_tgkill kernel/signal.c:4171 [inline]
__se_sys_tgkill kernel/signal.c:4165 [inline]
__arm64_sys_tgkill+0x12c/0x188 kernel/signal.c:4165
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
IN-SOFTIRQ-W at:
lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
do_write_seqcount_begin_nested include/linux/seqlock.h:477 [inline]
do_write_seqcount_begin include/linux/seqlock.h:503 [inline]
fprop_new_period+0x3b8/0x718 lib/flex_proportions.c:74
writeout_period+0x94/0x11c mm/page-writeback.c:615
call_timer_fn+0x19c/0x814 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x51c/0x76c kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0x11c/0x194 kernel/time/timer.c:2405
handle_softirqs+0x31c/0xc88 kernel/softirq.c:622
__do_softirq+0x14/0x20 kernel/softirq.c:656
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
invoke_softirq kernel/softirq.c:503 [inline]
__irq_exit_rcu+0x1b0/0x478 kernel/softirq.c:723
irq_exit_rcu+0x14/0x84 kernel/softirq.c:739
__el1_irq arch/arm64/kernel/entry-common.c:498 [inline]
el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:510
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:515
el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:592
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline]
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
unlock_task_sighand include/linux/sched/signal.h:756 [inline]
do_send_sig_info kernel/signal.c:1270 [inline]
do_send_specific+0x1cc/0x2cc kernel/signal.c:4131
do_tkill kernel/signal.c:4152 [inline]
__do_sys_tgkill kernel/signal.c:4171 [inline]
__se_sys_tgkill kernel/signal.c:4165 [inline]
__arm64_sys_tgkill+0x12c/0x188 kernel/signal.c:4165
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
INITIAL USE at:
lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
do_write_seqcount_begin_nested include/linux/seqlock.h:477 [inline]
do_write_seqcount_begin include/linux/seqlock.h:503 [inline]
fprop_new_period+0x3b8/0x718 lib/flex_proportions.c:74
writeout_period+0x94/0x11c mm/page-writeback.c:615
call_timer_fn+0x19c/0x814 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x51c/0x76c kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0x11c/0x194 kernel/time/timer.c:2405
handle_softirqs+0x31c/0xc88 kernel/softirq.c:622
__do_softirq+0x14/0x20 kernel/softirq.c:656
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
invoke_softirq kernel/softirq.c:503 [inline]
__irq_exit_rcu+0x1b0/0x478 kernel/softirq.c:723
irq_exit_rcu+0x14/0x84 kernel/softirq.c:739
__el1_irq arch/arm64/kernel/entry-common.c:498 [inline]
el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:510
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:515
el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:592
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline]
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
unlock_task_sighand include/linux/sched/signal.h:756 [inline]
do_send_sig_info kernel/signal.c:1270 [inline]
do_send_specific+0x1cc/0x2cc kernel/signal.c:4131
do_tkill kernel/signal.c:4152 [inline]
__do_sys_tgkill kernel/signal.c:4171 [inline]
__se_sys_tgkill kernel/signal.c:4165 [inline]
__arm64_sys_tgkill+0x12c/0x188 kernel/signal.c:4165
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
INITIAL READ USE at:
lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
seqcount_lockdep_reader_access include/linux/seqlock.h:72 [inline]
fprop_fraction_percpu+0xac/0x270 lib/flex_proportions.c:155
__wb_calc_thresh+0xfc/0x3b0 mm/page-writeback.c:913
wb_bg_dirty_limits mm/page-writeback.c:2130 [inline]
domain_over_bg_thresh+0xb8/0x1f0 mm/page-writeback.c:2144
wb_over_bg_thresh+0xf8/0x17c mm/page-writeback.c:2165
wb_check_background_flush fs/fs-writeback.c:2278 [inline]
wb_do_writeback fs/fs-writeback.c:2376 [inline]
wb_workfn+0xa30/0xdc0 fs/fs-writeback.c:2403
process_one_work+0x7c0/0x1558 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x958/0xed8 kernel/workqueue.c:3421
kthread+0x5fc/0x75c kernel/kthread.c:463
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
}
... key at: [<ffff800097b99300>] fprop_global_init.__key.1+0x0/0x20
... acquired at:
seqcount_lockdep_reader_access include/linux/seqlock.h:72 [inline]
fprop_fraction_percpu+0xf0/0x270 lib/flex_proportions.c:155
__fprop_add_percpu_max+0x130/0x1f4 lib/flex_proportions.c:186
wb_domain_writeout_add mm/page-writeback.c:562 [inline]
__wb_writeout_add+0xbc/0x27c mm/page-writeback.c:586
__folio_end_writeback+0x380/0x6f8 mm/page-writeback.c:2997
folio_end_writeback_no_dropbehind+0xd0/0x204 mm/filemap.c:1661
folio_end_writeback+0xd8/0x248 mm/filemap.c:1687
iomap_finish_folio_write+0x1c0/0x2a4 fs/iomap/buffered-io.c:1713
fuse_writepage_finish fs/fuse/file.c:1903 [inline]
fuse_send_writepage fs/fuse/file.c:1954 [inline]
fuse_flush_writepages+0x578/0x788 fs/fuse/file.c:1979
fuse_writepages_send fs/fuse/file.c:2158 [inline]
fuse_iomap_writeback_range+0x744/0x149c fs/fuse/file.c:2225
iomap_writeback_range fs/iomap/buffered-io.c:1724 [inline]
iomap_writeback_folio+0x1064/0x1fc4 fs/iomap/buffered-io.c:1842
iomap_writepages+0x128/0x25c fs/iomap/buffered-io.c:1902
fuse_writepages+0x208/0x2bc fs/fuse/file.c:2295
do_writepages+0x270/0x468 mm/page-writeback.c:2598
__writeback_single_inode+0x144/0x16b8 fs/fs-writeback.c:1737
writeback_single_inode+0x3e4/0xc2c fs/fs-writeback.c:1858
write_inode_now+0x13c/0x1a4 fs/fs-writeback.c:2924
fuse_flush+0x20c/0x6a0 fs/fuse/file.c:472
filp_flush+0xb8/0x190 fs/open.c:1533
filp_close+0x28/0x48 fs/open.c:1546
__range_close fs/file.c:790 [inline]
__do_sys_close_range fs/file.c:849 [inline]
__se_sys_close_range fs/file.c:813 [inline]
__arm64_sys_close_range+0x318/0x5c4 fs/file.c:813
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
stack backtrace:
CPU: 1 UID: 0 PID: 6846 Comm: syz.4.21 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
dump_stack+0x1c/0x28 lib/dump_stack.c:129
print_bad_irq_dependency kernel/locking/lockdep.c:2616 [inline]
check_irq_usage kernel/locking/lockdep.c:2857 [inline]
check_prev_add kernel/locking/lockdep.c:3169 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x3058/0x30a4 kernel/locking/lockdep.c:5237
lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
seqcount_lockdep_reader_access include/linux/seqlock.h:72 [inline]
fprop_fraction_percpu+0xf0/0x270 lib/flex_proportions.c:155
__fprop_add_percpu_max+0x130/0x1f4 lib/flex_proportions.c:186
wb_domain_writeout_add mm/page-writeback.c:562 [inline]
__wb_writeout_add+0xbc/0x27c mm/page-writeback.c:586
__folio_end_writeback+0x380/0x6f8 mm/page-writeback.c:2997
folio_end_writeback_no_dropbehind+0xd0/0x204 mm/filemap.c:1661
folio_end_writeback+0xd8/0x248 mm/filemap.c:1687
iomap_finish_folio_write+0x1c0/0x2a4 fs/iomap/buffered-io.c:1713
fuse_writepage_finish fs/fuse/file.c:1903 [inline]
fuse_send_writepage fs/fuse/file.c:1954 [inline]
fuse_flush_writepages+0x578/0x788 fs/fuse/file.c:1979
fuse_writepages_send fs/fuse/file.c:2158 [inline]
fuse_iomap_writeback_range+0x744/0x149c fs/fuse/file.c:2225
iomap_writeback_range fs/iomap/buffered-io.c:1724 [inline]
iomap_writeback_folio+0x1064/0x1fc4 fs/iomap/buffered-io.c:1842
iomap_writepages+0x128/0x25c fs/iomap/buffered-io.c:1902
fuse_writepages+0x208/0x2bc fs/fuse/file.c:2295
do_writepages+0x270/0x468 mm/page-writeback.c:2598
__writeback_single_inode+0x144/0x16b8 fs/fs-writeback.c:1737
writeback_single_inode+0x3e4/0xc2c fs/fs-writeback.c:1858
write_inode_now+0x13c/0x1a4 fs/fs-writeback.c:2924
fuse_flush+0x20c/0x6a0 fs/fuse/file.c:472
filp_flush+0xb8/0x190 fs/open.c:1533
filp_close+0x28/0x48 fs/open.c:1546
__range_close fs/file.c:790 [inline]
__do_sys_close_range fs/file.c:849 [inline]
__se_sys_close_range fs/file.c:813 [inline]
__arm64_sys_close_range+0x318/0x5c4 fs/file.c:813
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
It is reproducible with the followint program.
Keep in mind that it may lack the precise threading, sandboxing, and some arguments of a working reproducer.
But it should give an idea of the involved syscalls.
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#define FUSE_MIN_READ_BUFFER 8192
enum fuse_opcode {
FUSE_LOOKUP = 1,
FUSE_FORGET = 2,
FUSE_GETATTR = 3,
FUSE_SETATTR = 4,
FUSE_READLINK = 5,
FUSE_SYMLINK = 6,
FUSE_MKNOD = 8,
FUSE_MKDIR = 9,
FUSE_UNLINK = 10,
FUSE_RMDIR = 11,
FUSE_RENAME = 12,
FUSE_LINK = 13,
FUSE_OPEN = 14,
FUSE_READ = 15,
FUSE_WRITE = 16,
FUSE_STATFS = 17,
FUSE_RELEASE = 18,
FUSE_FSYNC = 20,
FUSE_SETXATTR = 21,
FUSE_GETXATTR = 22,
FUSE_LISTXATTR = 23,
FUSE_REMOVEXATTR = 24,
FUSE_FLUSH = 25,
FUSE_INIT = 26,
FUSE_OPENDIR = 27,
FUSE_READDIR = 28,
FUSE_RELEASEDIR = 29,
FUSE_FSYNCDIR = 30,
FUSE_GETLK = 31,
FUSE_SETLK = 32,
FUSE_SETLKW = 33,
FUSE_ACCESS = 34,
FUSE_CREATE = 35,
FUSE_INTERRUPT = 36,
FUSE_BMAP = 37,
FUSE_DESTROY = 38,
FUSE_IOCTL = 39,
FUSE_POLL = 40,
FUSE_NOTIFY_REPLY = 41,
FUSE_BATCH_FORGET = 42,
FUSE_FALLOCATE = 43,
FUSE_READDIRPLUS = 44,
FUSE_RENAME2 = 45,
FUSE_LSEEK = 46,
FUSE_COPY_FILE_RANGE = 47,
FUSE_SETUPMAPPING = 48,
FUSE_REMOVEMAPPING = 49,
FUSE_SYNCFS = 50,
FUSE_TMPFILE = 51,
FUSE_STATX = 52,
CUSE_INIT = 4096,
CUSE_INIT_BSWAP_RESERVED = 1048576,
FUSE_INIT_BSWAP_RESERVED = 436207616,
};
struct fuse_in_header {
uint32_t len;
uint32_t opcode;
uint64_t unique;
uint64_t nodeid;
uint32_t uid;
uint32_t gid;
uint32_t pid;
uint32_t padding;
};
struct fuse_out_header {
uint32_t len;
uint32_t error;
uint64_t unique;
};
struct syz_fuse_req_out {
struct fuse_out_header* init;
struct fuse_out_header* lseek;
struct fuse_out_header* bmap;
struct fuse_out_header* poll;
struct fuse_out_header* getxattr;
struct fuse_out_header* lk;
struct fuse_out_header* statfs;
struct fuse_out_header* write;
struct fuse_out_header* read;
struct fuse_out_header* open;
struct fuse_out_header* attr;
struct fuse_out_header* entry;
struct fuse_out_header* dirent;
struct fuse_out_header* direntplus;
struct fuse_out_header* create_open;
struct fuse_out_header* ioctl;
struct fuse_out_header* statx;
};
static int fuse_send_response(int fd,
const struct fuse_in_header* in_hdr,
struct fuse_out_header* out_hdr)
{
if (!out_hdr) {
return -1;
}
out_hdr->unique = in_hdr->unique;
if (write(fd, out_hdr, out_hdr->len) == -1) {
return -1;
}
return 0;
}
static volatile long syz_fuse_handle_req(volatile long a0,
volatile long a1,
volatile long a2,
volatile long a3)
{
struct syz_fuse_req_out* req_out = (struct syz_fuse_req_out*)a3;
struct fuse_out_header* out_hdr = NULL;
char* buf = (char*)a1;
int buf_len = (int)a2;
int fd = (int)a0;
if (!req_out) {
return -1;
}
if (buf_len < FUSE_MIN_READ_BUFFER) {
return -1;
}
int ret = read(fd, buf, buf_len);
if (ret == -1) {
return -1;
}
if ((size_t)ret < sizeof(struct fuse_in_header)) {
return -1;
}
const struct fuse_in_header* in_hdr = (const struct fuse_in_header*)buf;
if (in_hdr->len > (uint32_t)ret) {
return -1;
}
switch (in_hdr->opcode) {
case FUSE_GETATTR:
case FUSE_SETATTR:
out_hdr = req_out->attr;
break;
case FUSE_LOOKUP:
case FUSE_SYMLINK:
case FUSE_LINK:
case FUSE_MKNOD:
case FUSE_MKDIR:
out_hdr = req_out->entry;
break;
case FUSE_OPEN:
case FUSE_OPENDIR:
out_hdr = req_out->open;
break;
case FUSE_STATFS:
out_hdr = req_out->statfs;
break;
case FUSE_RMDIR:
case FUSE_RENAME:
case FUSE_RENAME2:
case FUSE_FALLOCATE:
case FUSE_SETXATTR:
case FUSE_REMOVEXATTR:
case FUSE_FSYNCDIR:
case FUSE_FSYNC:
case FUSE_SETLKW:
case FUSE_SETLK:
case FUSE_ACCESS:
case FUSE_FLUSH:
case FUSE_RELEASE:
case FUSE_RELEASEDIR:
case FUSE_UNLINK:
case FUSE_DESTROY:
out_hdr = req_out->init;
if (!out_hdr) {
return -1;
}
out_hdr->len = sizeof(struct fuse_out_header);
break;
case FUSE_READ:
out_hdr = req_out->read;
break;
case FUSE_READDIR:
out_hdr = req_out->dirent;
break;
case FUSE_READDIRPLUS:
out_hdr = req_out->direntplus;
break;
case FUSE_INIT:
out_hdr = req_out->init;
break;
case FUSE_LSEEK:
out_hdr = req_out->lseek;
break;
case FUSE_GETLK:
out_hdr = req_out->lk;
break;
case FUSE_BMAP:
out_hdr = req_out->bmap;
break;
case FUSE_POLL:
out_hdr = req_out->poll;
break;
case FUSE_GETXATTR:
case FUSE_LISTXATTR:
out_hdr = req_out->getxattr;
break;
case FUSE_WRITE:
case FUSE_COPY_FILE_RANGE:
out_hdr = req_out->write;
break;
case FUSE_FORGET:
case FUSE_BATCH_FORGET:
return 0;
case FUSE_CREATE:
out_hdr = req_out->create_open;
break;
case FUSE_IOCTL:
out_hdr = req_out->ioctl;
break;
case FUSE_STATX:
out_hdr = req_out->statx;
break;
default:
return -1;
}
return fuse_send_response(fd, in_hdr, out_hdr);
}
uint64_t r[4] = {0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// flags: open_flags = 0x40 (4 bytes)
// mode: open_mode = 0x0 (2 bytes)
// ]
// returns fd
memcpy((void*)0x20000000c380, "./file0\000", 8);
syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000000c380ul, /*flags=O_CREAT*/0x40, /*mode=*/0);
// openat$fuse arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 64 65 76 2f 66 75 73 65 00} (length 0xa)
// }
// flags: const = 0x42 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_fuse
memcpy((void*)0x200000002080, "/dev/fuse\000", 10);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000002080ul, /*flags=*/0x42, /*mode=*/0);
if (res != -1)
r[0] = res;
// mount$fuse arguments: [
// src: const = 0x0 (8 bytes)
// dst: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// type: ptr[in, buffer] {
// buffer: {66 75 73 65 00} (length 0x5)
// }
// flags: mount_flags = 0x0 (8 bytes)
// opts: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {66 64 3d} (length 0x3)
// }
// union ANYUNION {
// ANYRESHEX: ANYRES64 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {2c 72 6f 6f 74 6d 6f 64 65 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 2c 75 73 65 72 5f 69 64 3d} (length 0x2a)
// }
// union ANYUNION {
// ANYRESDEC: ANYRES64 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {2c 67 72 6f 75 70 5f 69 64 3d} (length 0xa)
// }
// union ANYUNION {
// ANYRESDEC: ANYRES64 (resource)
// }
// }
// }
// ]
memcpy((void*)0x2000000020c0, "./file0\000", 8);
memcpy((void*)0x200000002100, "fuse\000", 5);
memcpy((void*)0x200000002140, "fd=", 3);
sprintf((char*)0x200000002143, "0x%016llx", (long long)r[0]);
memcpy((void*)0x200000002155, ",rootmode=00000000000000000100000,user_id=", 42);
sprintf((char*)0x20000000217f, "%020llu", (long long)0);
memcpy((void*)0x200000002193, ",group_id=", 10);
sprintf((char*)0x20000000219d, "%020llu", (long long)0);
syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x2000000020c0ul, /*type=*/0x200000002100ul, /*flags=*/0ul, /*opts=*/0x200000002140ul);
// read$FUSE arguments: [
// fd: fd_fuse (resource)
// buf: ptr[out, fuse_in[read_buffer]] {
// fuse_in[read_buffer] {
// len: len = 0x2020 (4 bytes)
// opcode: int32 = 0x0 (4 bytes)
// unique: fuse_unique (resource)
// uid: uid (resource)
// gid: gid (resource)
// pid: pid (resource)
// padding: int32 = 0x0 (4 bytes)
// payload: buffer: (DirOut)
// }
// }
// len: bytesize = 0x2020 (8 bytes)
// ]
res = syscall(__NR_read, /*fd=*/r[0], /*buf=*/0x2000000021c0ul, /*len=*/0x2020ul);
if (res != -1) {
r[1] = *(uint64_t*)0x2000000021c8;
r[2] = *(uint32_t*)0x2000000021d4;
}
// write$FUSE_INIT arguments: [
// fd: fd_fuse (resource)
// arg: ptr[in, fuse_out_t[fuse_unique, fuse_init_out]] {
// fuse_out_t[fuse_unique, fuse_init_out] {
// len: len = 0x50 (4 bytes)
// err: fuse_errors = 0x0 (4 bytes)
// unique: fuse_unique (resource)
// payload: fuse_init_out {
// major: const = 0x7 (4 bytes)
// minor: const = 0x1f (4 bytes)
// max_readahead: int32 = 0xe0000000 (4 bytes)
// flags: fuse_init_flags = 0x564b043a (4 bytes)
// max_background: int16 = 0x83 (2 bytes)
// congestion_threshold: int16 = 0xffff (2 bytes)
// max_write: int32 = 0x5 (4 bytes)
// time_gran: int32 = 0x2 (4 bytes)
// max_pages: const = 0x0 (2 bytes)
// map_alignment: const = 0x0 (2 bytes)
// flags2: fuse_init_flags2 = 0x80 (4 bytes)
// max_stack_depth: int32 = 0x80000001 (4 bytes)
// unused: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x18)
// }
// }
// }
// len: bytesize = 0x50 (8 bytes)
// ]
*(uint32_t*)0x200000000040 = 0x50;
*(uint32_t*)0x200000000044 = 0;
*(uint64_t*)0x200000000048 = r[1];
*(uint32_t*)0x200000000050 = 7;
*(uint32_t*)0x200000000054 = 0x1f;
*(uint32_t*)0x200000000058 = 0xe0000000;
*(uint32_t*)0x20000000005c = 0x564b043a;
*(uint16_t*)0x200000000060 = 0x83;
*(uint16_t*)0x200000000062 = -1;
*(uint32_t*)0x200000000064 = 5;
*(uint32_t*)0x200000000068 = 2;
*(uint16_t*)0x20000000006c = 0;
*(uint16_t*)0x20000000006e = 0;
*(uint32_t*)0x200000000070 = 0x80;
*(uint32_t*)0x200000000074 = 0x80000001;
memset((void*)0x200000000078, 0, 24);
syscall(__NR_write, /*fd=*/r[0], /*arg=*/0x200000000040ul, /*len=*/0x50ul);
// syz_fuse_handle_req arguments: [
// fd: fd_fuse (resource)
// buf: ptr[in, buffer] {
// buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ba 04 5a bc d5 df c6 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 38 aa e8 c0 5d d2 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 9b fd 66 ee a2 10 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 54 c4 b6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x2000)
// }
// len: bytesize = 0x2000 (8 bytes)
// res: ptr[in, syz_fuse_req_out] {
// syz_fuse_req_out {
// init: nil
// lseek: nil
// bmap: nil
// poll: nil
// getxattr: nil
// lk: nil
// statfs: nil
// write: nil
// read: nil
// open: ptr[in, fuse_out_t[int64, fuse_open_out]] {
// fuse_out_t[int64, fuse_open_out] {
// len: len = 0x20 (4 bytes)
// err: fuse_errors = 0x0 (4 bytes)
// unique: int64 = 0x0 (8 bytes)
// payload: fuse_open_out {
// fh: const = 0x0 (8 bytes)
// open_flags: fuse_open_flags = 0x0 (4 bytes)
// padding: const = 0x0 (4 bytes)
// }
// }
// }
// attr: nil
// entry: nil
// dirent: nil
// direntplus: nil
// create_open: nil
// ioctl: nil
// statx: nil
// }
// }
// ]
memcpy((void*)0x20000000e3c0, "... [truncated large byte array] ...", 8192);
*(uint64_t*)0x2000000062c0 = 0;
*(uint64_t*)0x2000000062c8 = 0;
*(uint64_t*)0x2000000062d0 = 0;
*(uint64_t*)0x2000000062d8 = 0;
*(uint64_t*)0x2000000062e0 = 0;
*(uint64_t*)0x2000000062e8 = 0;
*(uint64_t*)0x2000000062f0 = 0;
*(uint64_t*)0x2000000062f8 = 0;
*(uint64_t*)0x200000006300 = 0;
*(uint64_t*)0x200000006308 = 0x2000000001c0;
*(uint32_t*)0x2000000001c0 = 0x20;
*(uint32_t*)0x2000000001c4 = 0;
*(uint64_t*)0x2000000001c8 = 0;
*(uint64_t*)0x2000000001d0 = 0;
*(uint32_t*)0x2000000001d8 = 0;
*(uint32_t*)0x2000000001dc = 0;
*(uint64_t*)0x200000006310 = 0;
*(uint64_t*)0x200000006318 = 0;
*(uint64_t*)0x200000006320 = 0;
*(uint64_t*)0x200000006328 = 0;
*(uint64_t*)0x200000006330 = 0;
*(uint64_t*)0x200000006338 = 0;
*(uint64_t*)0x200000006340 = 0;
syz_fuse_handle_req(/*fd=*/r[0], /*buf=*/0x20000000e3c0, /*len=*/0x2000, /*res=*/0x2000000062c0);
// syz_fuse_handle_req arguments: [
// fd: fd_fuse (resource)
// buf: ptr[in, buffer] {
// buffer: {a2 80 96 c8 0a bf 35 43 ec de 75 64 ab ff 50 85 d2 22 7e bc b0 f1 64 ae 92 70 6a d0 b0 83 a3 f4 69 a3 ef d1 5b 49 21 e9 c3 06 3b 98 b3 08 20 68 e7 c3 19 50 dd e8 42 ea c5 5d f0 f9 91 45 3c ad 62 a6 95 6b 0b 6f 7b 8c f4 9b 50 6a 30 60 fe 11 27 ec a9 96 63 ad e8 ef a8 9e e1 89 ac b5 f3 b9 2f 6b c4 c4 66 21 c8 03 ee d0 d0 bb 5f 32 38 48 70 ed 08 f8 9d 4f 74 44 57 62 fb 99 71 5e 08 3c 4c 92 a8 87 8b e1 9f fa cc 30 d0 f2 da 64 f9 71 cd 40 56 31 63 ad c1 56 70 ec f2 5c d3 ad 96 13 89 67 c4 b5 3a d9 d0 4b 51 93 ab 5f b6 74 aa 00 30 a9 d7 03 d1 ba f8 10 ce 89 7f 96 91 21 f1 42 16 19 19 e5 83 c2 75 67 1b 99 9e 7f 36 38 91 df df df 35 56 d0 1b 86 ee 29 ec a8 fc cb fe af 17 71 39 51 48 70 6c c6 e6 be 7c e2 9f c9 ff ef 06 1b 54 20 95 0c 1a 52 5b f7 5a d0 6e de c5 15 38 d1 c5 bb c7 7d a7 2d c9 0f d9 99 89 36 ff fd da 24 27 e5 a6 89 66 c7 e2 20 8f 76 30 46 80 18 2e c7 30 07 e4 82 f0 34 19 57 12 af 92 2d b2 72 61 95 d9 97 70 87 34 db 9e 78 25 a8 64 be 00 b2 a4 f8 00 88 1f c0 36 3f 5e 61 83 98 45 4f 35 b1 48 b4 cc b8 8d 41 82 69 fa c8 68 a8 ba 4a 2d 5b 4f 06 a1 ac 01 b5 ad 15 8b 84 2e 05 ad ca 22 c7 37 25 85 bf 4c e9 55 60 b6 c1 e0 21 a3 ed 2f f7 bd 3b 6b 3c 77 34 c3 b6 6d 7e 4c 46 00 96 31 20 82 f8 9b 16 ba a6 e7 38 14 aa 60 92 57 80 cd 92 cd 65 08 7e 26 0e c0 46 fc 36 32 64 36 6a 9d f2 c8 49 c0 64 49 11 30 39 46 ad ad 54 45 21 ce b4 69 a3 e1 93 ec c9 a7 87 64 03 fa c4 61 a4 a7 0d 61 93 b2 45 11 89 a5 c5 12 0b 35 35 e9 ed f6 19 10 8a f7 f5 17 b5 8a bd 3f a7 fb 1a b8 32 21 34 30 d2 e6 90 10 76 fb a9 c9 e1 ac c6 c6 f4 8f f0 e4 19 bb c4 55 89 74 5a 17 6f 52 a7 40 7a d5 e3 dd 49 ac b3 1b 47 86 28 06 f4 70 77 dd a0 49 05 e4 5a 80 a1 2c bc d4 d2 dd 9f e6 6c 2d 1f 99 39 4f ed 8e c6 09 61 cd 2d c7 11 5a 96 ec e4 32 fa c8 6d 51 be bb 08 b9 5f 44 7a 83 79 2f e8 02 91 fc a7 b2 98 c9 04 3e f2 c2 6f 0f 7e 42 79 8d 3f 54 c8 4b 94 c2 4c 76 c5 55 d8 3e cc 53 b9 9b b2 2d 71 84 5e 5c f2 1a 5b a7 fb ef fe b6 30 6e 17 30 db 14 56 1b 95 0a 3f 24 bc fd 78 d4 ab 0d 97 de 80 54 bb 1a 60 77 ae 7c ca 6e 45 d8 46 d3 df 82 29 8d 07 21 29 22 74 2c b0 fa ca c3 b7 7e df ba b9 0e 9e e2 d4 f7 b0 ee 9b 17 bb 11 ec 5e 57 21 34 0d 84 cb 6b d9 34 28 16 7e 69 b4 77 59 17 25 57 ac da 31 3c 3d ec df c6 fe 93 36 bf ad e4 59 f4 3b 39 d0 f2 28 9f 91 42 db 28 0f 4e e6 68 e6 50 e1 28 58 c5 77 e1 2e 2b 9a 57 ee 66 c8 34 be 97 97 9b cb e9 47 47 fa 5d 8d 0b 7d 3a 9f 8f 21 8d f1 bf 96 0f 82 84 29 a1 ef e8 38 61 6b 18 fa f6 62 92 36 dd bd ed 43 a0 93 ef ae 16 32 28 e5 c3 8f d7 71 47 43 c2 fc ca 47 e3 38 2b cf b1 ab 89 3f d7 37 75 27 b4 ec 43 f3 fa 60 eb d3 38 16 1d 8d e7 ca d6 5b 15 57 9e 4a f2 58 f5 fe 3a 63 c2 63 7a 15 70 32 07 02 9b 08 99 b5 42 77 67 64 7b ae f1 1e 29 13 58 e6 e5 4f 6f 13 d3 d2 ca 7a 5e 79 69 e0 4d 27 33 b3 b9 ab 82 2c 69 a3 cf ac 09 73 84 de 50 71 a9 b7 4a 65 61 36 d5 5e b1 90 df 08 74 7b 50 9f d6 10 ff 62 b4 95 0e f7 1c 93 4f e2 1a 48 a4 93 1d 3d 94 58 b4 15 f1 12 ce e6 5c 66 0f 54 90 e9 82 34 1d a1 c5 86 34 b3 96 7c a6 f3 59 6d 20 cc 90 f5 08 38 21 56 e3 6f 16 53 90 93 24 0e f5 f2 aa 6a 2c 0d ff 2a 67 df 30 dc f5 0b f6 e0 b8 2a 3d 49 f2 d5 32 a8 dd e1 b3 ce ef cf 08 37 19 0b 74 18 60 90 d1 c1 8b 59 91 7d 7e fc e1 ad fb 23 8e f4 a7 b1 d2 2c 4c ef 09 32 02 21 de 88 3e 97 e6 88 24 66 50 8d e0 6f cd ab ad 3b 74 1b dc a2 cf f8 79 d5 7d dd a5 2f 42 b3 dc b8 a7 8c fc 05 82 6a f7 e4 ff 15 59 60 ff 84 91 19 4f 4d 32 1e f1 95 99 0a ba ee ef dc b8 52 d1 e1 e3 70 3f 31 73 85 a9 45 8b 6c 2d d9 db 83 0f 75 7e c2 9c 99 39 fc 73 13 e6 39 fe 48 5b c1 e4 1d da ae f3 fb f1 f7 cc 52 7c 8f ad 0d 21 b8 08 24 82 ca ad 7b ee 44 0e 50 97 66 5f 63 6c 3d fe c8 2f 8c 98 af b6 24 3b c3 94 49 39 67 5a 59 42 77 d2 78 ba 43 61 46 1f 7d a5 2e 22 4e 4c e5 de e4 a4 67 bf 6a e9 f6 7b 61 ac 6e b0 a4 40 40 6a ba c2 01 6e ec 90 7e 24 1c 57 f5 f4 4b e4 72 90 fd 0f ef 78 5f f0 4d f3 81 0c cd 63 7b 4d 97 a8 4b ae 84 86 a3 6f 75 d8 72 e6 45 fe 46 62 59 69 fc 2d 1f 03 2c 56 ed 44 bd 98 ea 27 bd 9b 6d dc 8e b2 dc 2e c9 f9 0f 2f 1c a1 bd 20 e3 7a c5 8b 03 c8 4c 87 2f 4b a4 73 10 65 49 86 64 14 60 df dd 53 1a c6 2a 76 ad 87 b8 9c 10 3a c5 c9 c2 e7 e7 0c 66 44 7b 34 12 d4 a1 e5 cb c3 0e 16 93 95 05 11 6c 04 de 33 ae 05 4e d3 66 de 8d 1f 97 1c 2d e4 39 95 7a 19 4e 22 a4 88 f5 8d 7e fd 46 43 91 77 f3 f3 c4 5a 14 75 92 7e ec d8 46 d3 d2 e6 a2 ab 5c 7f 8a dd d9 90 62 c2 fc 6b 27 2d 1f 51 bb 8f 22 f1 b6 f8 bb 3f af 8a a8 5e 5e b9 ab f7 df 5c f8 f2 62 67 32 38 08 b0 83 3a 98 79 89 cb e5 92 05 e7 ad 06 55 6e 2d 1b 8a 48 73 ca 1c bc bc 8d 43 ab c1 45 fd 4e b8 32 e7 a5 8a b2 c7 93 d0 03 ce 7b 18 50 ce 45 eb 74 80 41 7a 1e 9e b9 d3 9a 10 28 a2 a0 4a 2a a6 49 c0 98 c4 f8 ee e5 14 db 5f 60 21 17 3b b2 54 b8 e2 2b 15 0b 2c a0 1d c7 ff 23 5d b4 6e d7 8d 07 f4 3d 1a da b1 3b 84 45 d1 b3 20 69 eb 45 f9 d3 89 fc f5 a3 f7 d3 eb e2 43 c5 b1 fe 17 b1 f5 a3 d5 71 b6 5f 21 b9 e4 71 e8 18 17 25 54 dc 95 67 49 b9 9c b7 a5 f3 03 ec 48 0d 71 94 a2 ba 86 e2 04 f0 6a a1 be cd dd c8 c4 90 82 c5 27 e7 06 4a c2 ad 77 dc 05 63 9d 3d 2a 77 78 f6 94 3e d6 10 5e bf 6f 0b 9e 94 fd db e0 5c 23 6e c0 00 f4 d1 d4 e4 96 b1 00 68 21 1a b6 8a da 4c 7f 7a c6 1f 5f 5b a5 f1 81 0d 5b be 87 ff 4f 83 56 af 0d 3f 68 2b ae db 0a d8 f8 48 8b 27 74 21 f0 a0 3f c5 e3 09 5e e3 4b c4 47 2d 8f 17 e3 f7 01 3c f2 f7 9f 5f f3 ea 4b 6b ae 56 d1 36 5a 33 b0 9b fa 9a 49 63 23 f7 da 92 3b 7e 29 dc e4 be b8 10 35 f1 31 30 00 4c 96 e5 6d 7e f6 ca 6c 10 1d 20 c2 7a 21 8e 62 32 27 c3 3c 9e 48 8b 17 e7 ae 9a c2 0d a8 24 05 01 f7 b6 14 a1 73 0f 16 45 53 fe 47 9e f1 49 86 6e 4e a4 72 96 81 42 84 a3 d3 eb 7c bb 29 42 89 ff b9 96 e0 eb 05 3b 9c 16 e5 4c f2 67 83 2e 3d 36 0e b1 96 ed 51 30 56 30 22 33 09 ea 97 21 56 28 f0 1e c9 d3 ea 48 09 64 18 d5 e9 62 ca c5 06 34 60 f0 a1 87 72 ec 7c e6 6d 14 a1 cc e1 4b 52 c4 0b bb fa fc cb f1 e7 6f 09 e5 7f f0 71 80 48 e5 b9 93 15 7a 6c f4 71 88 26 b1 e0 94 30 41 3a 35 96 a1 5c 4a 62 0f a8 c8 e1 d1 66 3e 57 39 f9 f7 90 dd bb 3b e0 e0 01 87 d4 37 17 d6 59 24 24 67 d8 68 1a c1 03 03 34 61 57 f8 94 d9 03 76 41 41 70 10 e9 65 4c 6a 5b 22 26 3e 73 a5 a3 71 28 f5 00 78 a9 80 c3 09 30 32 1a a5 c5 e7 85 1d 5d 39 2d dc e3 a1 4a 96 91 6f a8 42 1a e6 72 8f 37 f5 de 7c 3e 98 fe b4 ba bd 4e 1b d2 31 5d 59 5e 20 9d 52 74 8f 70 ad c2 28 4f cd aa 6a d8 80 47 0d 2a 07 1f 34 90 aa f3 49 1f b6 4b 45 47 41 9e 8e cc dc 49 1a 89 21 15 6c b4 81 1a d1 e6 65 14 a3 2b 0b 31 b6 41 43 88 81 f2 8c 1e 64 61 b4 f4 51 93 89 99 af 67 1e 8c 6a 5c d0 c0 72 a9 fe 4c db ef e2 4c a6 16 f3 d0 a1 5a c9 7c ca 83 5b 1a 44 0e 04 fa 28 34 0c 60 44 17 6c 8e cc 8e e0 d0 33 d4 7d b8 a0 aa cf a0 ea bd fa 1c 95 09 fc 26 04 00 8f 01 cb af eb 5b d2 b5 03 b8 09 ed 67 23 40 b9 a5 76 59 3f 1e f3 88 39 1b 54 b6 05 e7 a1 5b ef 7b 13 45 62 7a 34 fc a5 77 38 b0 f8 f4 f1 9e ea 93 c9 03 49 52 74 a4 42 5a 1a 1c c6 c4 c6 e3 35 b6 31 df 51 85 c9 5b 48 5e 42 57 86 7b 53 47 a4 0e 4e 14 dc c5 60 f0 61 fd 4f d2 65 13 7d c6 8a fd 54 8a dd e7 78 f1 33 0f 76 9a cb 1c cf 5d a1 4f f6 99 2c 24 e2 10 ea 6e 61 79 42 18 81 b8 03 39 3b c6 97 4e 37 10 6c 5b 5b 3b 5d 0b 34 69 f8 96 9b ff b7 e4 ce b2 c9 8e 92 8e 74 36 64 92 d2 72 35 ae 4c 74 a2 f4 85 11 ae ea a5 3a 2b ea fa 7a 33 1b 50 e4 54 c5 07 af 1b 63 35 0a 5c ef 35 66 8a 5b 93 25 01 41 92 27 7e 50 95 61 00 8b 36 01 08 8f 79 d4 2e aa 8b 1e 4a e2 00 0b 31 74 9e 2b 80 94 31 2d db 7f 3c 1c d6 25 ef 88 5c 11 fa 22 a6 6e 37 4b 52 b3 42 5e 0b 80 16 15 4e 1f d8 47 13 39 e3 2e 73 73 d6 3a b6 46 d8 93 fb e0 9a e0 7b 06 07 4c 01 40 1e a7 6b 3c 38 2a 9d 32 f2 4f 93 c7 89 96 4e 16 bc 42 06 ec d7 5c 10 91 7a b8 4f fd 8d 6c df 4c d2 8f d9 03 75 ff 28 51 8f 8c 1a 3b ef c5 38 e1 b9 e4 27 fb 67 19 88 d2 9f 2f b2 fc d0 39 f4 d3 41 c8 4e b4 d7 cf 60 0d da ba 88 bb 09 4e 4d 87 a1 41 91 80 14 9f 49 13 68 e6 48 b6 99 85 b0 5a c3 9a 4e cd d3 c5 13 5f 3a 5c 8a d7 79 2d ac b6 47 01 44 bb 9e 67 80 5a 21 1e fb 3e c9 cc af 8e 09 01 34 5f b1 9e 4d a5 79 e1 fb e8 6a 12 07 f4 f1 3c 34 36 00 9c 2c 64 0b 7c f3 f8 b7 7c a7 bd 99 4b f9 33 08 02 73 59 c6 dd 1b 7d b1 e1 53 fc 08 21 96 8e f3 6c 00 3b 6c 73 fe 89 0f 4d e2 4f 5c 64 58 db aa f3 81 9e de aa 91 78 3c 3c fc 7e 77 36 89 23 62 48 19 5c 7b bd 60 11 3f 24 76 fa 36 87 62 1d 66 8d 17 28 ee 43 3d 2f 8f 4d b7 07 34 5d 30 f1 e5 2a b8 7a 2a 0a fd 54 7c 6b b0 65 00 f5 9f 17 fa cd e4 8f 69 34 90 e2 24 94 b7 5d 11 df 1a 14 3b 85 06 8d 14 3e f6 a9 bb 59 37 a9 df 38 0c 89 48 f1 a0 1e 96 75 e1 84 09 ed b0 f6 b9 60 5b 68 e3 46 32 fc ce 47 2d c5 0b 90 b0 f6 dc d5 79 31 f7 8e 1e 88 61 a0 fb 62 e7 2b 0b aa d6 f9 d2 3c 1c fb 0f 19 b2 50 13 c8 d9 fc d7 86 a2 f6 f7 97 68 b5 fb 39 8f 7b 2b aa 31 ce 81 56 d1 fc 4a 46 c1 c4 63 fd f3 03 60 d4 2a ee d2 ef 11 61 1d 0b 7f 65 4b b5 10 52 fd 4d c3 93 28 f8 ec 4c 58 bb da 05 e6 f1 b3 c8 f6 d8 ad ca 02 68 f2 41 0e 9a 4a 7d 63 b6 61 60 06 d0 e0 2f 6e da cc 10 e5 c5 4f d8 5f 15 a8 bd 76 48 a2 93 f2 3d 6a 69 9b d9 a6 75 25 04 75 a7 3a 96 d7 47 5e 4f ab b8 9f b5 e7 de 5d 7a 34 79 aa 48 5c 0b ef c6 0d 0a c4 fd 5a c6 db ec ce b0 6c ad 86 e2 19 fc 0c e4 72 07 58 91 78 11 a3 21 5f 8d 13 e4 13 bf b6 4f c0 65 fc 42 1a ed e0 b5 66 91 79 7d ac 42 8c 7e 46 34 79 fa 59 1b 90 72 c3 09 b7 53 3e 42 7c 5c c1 1a 1f 6c f9 a5 b9 95 d3 28 d7 96 d8 74 c5 b5 5d fc 12 a5 03 9b 41 3c e3 19 cf 5b a1 f3 55 c4 e0 71 7d 32 65 0b 43 e1 80 10 f3 7f 04 87 31 93 1c 52 c4 f3 6e b9 69 dd a7 02 af e9 6c 2a 52 41 35 0a 67 ba 2d 02 69 46 18 9c 5e 28 12 93 c9 a8 e2 cf f3 78 47 76 f1 de 78 b9 17 10 1b 54 e5 ab 00 c0 45 ea 15 f2 8a 0e 3f 50 99 62 cf 8b d3 38 5d 85 25 07 37 ea e5 c3 4e ce 86 b8 66 69 c1 3b 00 30 8a 3b 13 c0 ac 3c 83 ff 26 fb 52 a4 aa 83 c1 23 3a 94 90 cb 9c a9 17 a0 56 90 89 31 75 1b dd b8 8a 62 37 9a 71 33 95 f0 76 4e 4a 39 3f af 25 3a 40 26 d0 47 22 70 e6 03 62 87 d5 68 50 df 17 51 54 34 84 d6 5b 30 62 15 5b 63 00 e0 02 42 41 c5 9a 86 2a e7 69 c1 a9 23 2a 2d 9f b2 47 05 17 7a 09 cc eb 3e ef bf 9f 10 6f 67 e0 1b e1 4c de b4 d2 fc 7d 86 61 df 3e 75 de 5c cd 09 a7 e5 59 f0 28 fb 98 37 c6 21 ea 00 45 b4 d1 b6 79 06 7f 24 63 39 c9 74 63 1a a7 13 4d 4e 91 0e fb 28 d3 c4 89 29 ce f1 df 7e 6c 73 66 87 62 d5 50 86 b6 c5 9c 36 ac 90 15 41 35 fd 7c a4 e4 04 7d d0 aa 16 1f a9 82 d8 ed f9 c0 cb 96 66 47 7e 09 6c 55 71 8f 6e 47 42 41 5f ef d4 f6 96 d1 f1 cc d6 32 2b c1 94 96 dd eb d3 62 82 a7 c7 07 d5 b4 41 13 e3 06 78 e6 e3 3a b7 d3 4b e0 4a 59 ac 61 4d 6a 54 13 44 90 99 8b e0 26 36 fa 91 63 3d 62 94 78 1c 2b 9a 54 c6 11 c0 04 5c fc fe 81 f4 9a a2 1b 29 d8 35 cd 20 47 c8 54 48 6f d8 e6 5a 2e bf 62 9f 7c ed 60 2b 9d d1 07 bf de 48 3e 5c 9b 5c bb a4 a0 8c dc e0 99 20 bd a9 97 8b 7f c2 b4 a8 9b f1 57 3a 26 38 9e 52 09 0f df 5d cc f2 21 11 dc 8c 42 fd 3c 8c 47 70 92 89 53 98 08 6c c2 2c ca 66 52 69 e1 93 fc 65 07 42 a3 61 a4 4b 85 7d 25 84 29 f7 01 f2 2e 9b 76 15 bc 3d ab 78 c1 47 9a 41 cf 85 75 cd b1 71 69 47 0b 34 7a df c0 3e 03 da ea 3e 26 97 25 cf c7 2d f5 66 4b 9d f3 6d 2f 2b 55 01 3b 71 13 3e 0b 80 57 7a 47 18 25 11 eb b3 08 b6 24 8d 45 7b d2 af 7b 28 e7 71 82 c3 05 24 11 78 c4 12 4a b1 02 77 1f d5 a8 c3 da cb 87 75 de 88 13 01 d7 15 87 c7 6b cf 0a 97 a7 2a d2 44 d0 c4 2f d7 1a ce ec 32 dd 48 bb 5c 9a 95 b3 91 16 6c 83 2a c5 ba c8 c7 ca e4 d1 8b 3f 7d 9f 2e 47 82 fd f9 77 32 e3 d5 1f 67 bb b5 7f 98 9e e0 d7 58 9d bd 0c 2a 5c 63 84 0e 91 4b 9d 7d 72 0f a1 20 ac bf fe bf 81 6b 58 8b 2c cc 05 2e 7f a7 89 92 e0 ea 39 dd 21 a1 22 ad d4 11 95 f8 e2 e1 ac d7 77 c1 a4 e8 ef 43 62 fe f4 41 fe b4 d9 25 2c 6b fb d2 74 21 52 30 0a 32 02 77 76 e3 34 16 20 d3 c8 d9 36 5e 10 e8 1a dc ca 7d 87 a0 e5 55 c9 8a 03 53 c6 92 55 7d 90 ee 9b e3 fb aa b7 66 ab f9 3e 24 62 14 9f d9 9c 92 a5 fc 58 d8 99 ee 75 53 5c d1 fe 13 86 c5 ab 0b 15 7c 21 02 03 9d 60 15 25 8f 59 ce f3 f1 5b 95 18 93 a3 0a e8 39 f7 40 40 2a 30 b3 4e 7b e7 37 96 28 64 03 c5 be b0 85 3d 85 6d 83 f1 b0 0b 48 32 8f 56 dc b3 2e 1f aa b0 8a 34 35 b1 48 2b f1 8b 21 c9 5a ef ea af a7 fd 76 1c 7f 28 d4 16 fc de 06 bf 7a ee 5c 6e 9e b5 0e 55 87 42 53 ba 3f 1d 0c e2 50 5b 4f c7 c3 fc 99 6b fb b8 44 6b af e8 4f 5b ea 94 bf d7 ca 5a ea f2 37 fe 79 3b 66 e5 c5 21 d4 09 2e 4e 1f 9b de 1d fc fe 53 fa 55 00 5d 21 cf a8 33 a3 38 fd 97 92 61 41 29 33 60 60 e1 0d 19 11 86 20 70 76 1a a2 0c 29 02 eb 7c 5a 35 5e ff 4c f6 25 3d 71 02 a2 ca 1f ea d4 c5 3b 57 d5 76 d1 04 c0 81 31 0d 92 79 7e 4e 2e 8c 26 9d 19 91 0d 0d 4c ed f3 0f a2 8b a6 80 c0 01 37 f8 3d e9 40 62 42 29 b6 a1 25 ce 52 33 c6 cf 4a 36 40 b7 4f 58 f2 88 da d8 45 1f be 37 64 1c 55 59 a5 f3 ca f1 29 9c 8b fb 23 07 23 65 22 78 fe 37 8e fd 8e 45 9b 9d a2 6c ff eb 58 46 8a 63 01 db c0 6d 71 3b a2 d8 d4 3d 90 38 f5 f2 dc 8b 83 1b a5 8a 88 ee b5 b1 78 6b 21 e3 98 ae ee b7 c1 f3 d6 f0 1d 82 b3 94 78 62 fb 9e 7c bd 7d a5 d0 4c 5f cd 34 da 28 d5 3e 22 46 e3 ac 1e 3a 61 9a d1 74 ef a6 43 5e aa 0f c9 4d 61 07 99 ce 01 58 42 1d ce 04 63 06 eb 50 42 14 3d aa 33 6d 52 20 6b 12 61 0e a6 38 9c dd a4 9b f5 af 1d 4e e4 2a c0 90 a9 4a e7 b7 61 20 73 f3 a5 c3 6a 22 05 ed a8 87 f4 14 78 f7 d2 0f 18 66 7f 94 1f 71 ee bc fa 76 c1 ab 28 f2 a4 9a 3b d5 6b d3 f4 e6 bd 07 9a b3 fe 2d 94 78 22 36 e8 35 85 a0 3e 52 90 7a ba ef 74 56 a9 5d 5d 3f 3d 37 ef dc 03 5d bf d7 c4 1b 8b a0 af 2d f8 ad f1 cf 24 f7 ff 0b ec cd 3d 26 bc 91 ca f4 23 14 ef 7e 46 6f 74 e1 9a e0 df 2e 22 98 fc 2f 69 4a 7e c1 34 63 20 35 58 5d 53 0e 7e 19 f6 5c 25 6f 00 1d 75 38 2d 98 25 ef 74 1b c2 13 af 18 63 77 d9 ca 10 d3 72 23 54 e1 89 7c a5 c2 3a c6 a5 2c 9a d0 e6 b6 86 e1 77 6f 7e c6 5d f0 33 e8 f4 d5 db 80 c1 bc 35 40 93 b3 19 cb 70 df 93 d6 10 66 76 75 81 63 28 c9 93 22 f1 4e 63 6b 95 f0 4e 64 97 f1 39 d5 08 b4 53 f5 3d db 5c 28 9d 84 9f d5 40 7c 9b dc ef d1 64 2a bd 46 e2 8c b4 e9 43 71 bd c6 06 ee b6 7c 9f e1 77 47 c6 8f 2d 50 e8 27 11 da 4d 3e db 0e da 06 f4 1b 7f 93 fa 8f b4 d8 3c f2 1c 79 da 67 00 0b ac 22 75 50 82 17 ad e1 65 9f a8 d2 4e 5f 8e fb 9f 4b d2 10 73 eb ef 3d 06 36 8e b0 3f a3 cf 0d 63 84 48 bd 05 5e d2 0d 29 20 33 ff db a5 38 55 9c 8f f9 a2 a5 c8 f8 3b 5c 39 36 43 d6 58 5d 1d f9 94 c3 be 43 e7 2b 8f 3f 53 11 4d 2a 5f 6b ce db 57 38 42 b2 3b 6a 3e b7 fc a8 49 5b f0 3b d0 3f de 7b 19 bd 39 a1 6c ec 49 e0 1f 38 e6 71 af 33 ca e0 82 d9 78 8e 32 02 79 9b c4 66 ba be c2 08 05 28 d0 60 9c 0b 73 19 64 71 90 93 73 5b 4c 1e 73 bd 07 05 63 7c 47 51 69 22 19 7c 55 2b ae af 35 16 b5 e3 bb c2 cd 1a fa 3e f8 21 51 96 ed 58 0d 95 61 09 2f 62 0b 89 7e 98 e7 86 a0 c7 cb b0 ee dd a8 06 32 92 ba 64 82 49 7f 5f 6b b6 2f b5 ab 4c 97 cb 76 58 dc 65 79 71 8e b9 7b 54 7f cf 47 ce d1 42 65 61 af 93 a1 5f b4 dc 6d 3d 93 b8 68 64 49 43 c2 c9 4b 23 b0 57 0b bb 81 df 26 66 c2 4f 5a bc cf cd d7 1e 20 9f 3b b4 3c 01 d1 7f 9b c8 b9 af 2c 26 76 2f c6 a7 41 a1 50 b7 d1 18 6e 4f 35 17 5f 3c 31 52 43 e1 c1 1e 92 c4 3a 1f c4 92 ee f5 a1 3c 77 a8 1f cf 51 4e bf d0 f8 e6 45 da e1 5a 07 e8 6b 2f 01 fd a0 65 db 45 05 a5 ee a8 3c b6 16 f7 44 f6 be e7 31 be 19 1c 65 44 9c 02 60 35 56 d5 a5 14 22 cf 9c 2f 19 f8 d6 84 3e 0c 10 91 e0 70 8a a2 71 e9 1f 71 c8 60 2b 9f a7 21 89 e0 36 b7 cb 6a f1 56 9f 21 26 92 83 de 94 a6 d7 fe 58 49 fd 43 3d 5b 71 9c 80 41 98 73 db 05 87 fc 29 78 6c c5 98 d8 96 fb 16 36 0b dd d2 ce 12 e5 4d 05 41 8f 4f 5e 5f 2d 7a af e9 fc d6 26 8c be 2e 9e 63 29 ff b6 c6 7f ab 8f 3c e6 73 02 8c c0 6a aa 6b 85 75 56 bb a3 b4 4d 3f ab 5b 6e 87 5e 70 a2 f3 ad 4b 2f f7 6f 31 ea d3 46 2d 38 01 ba 37 3b 3c 2f 54 5e 94 f5 70 21 57 5e 29 47 f8 1f 53 28 3f c0 a5 13 7f d4 4f a3 d0 74 c9 2d e5 4a 0a 34 65 c8 58 f5 a7 ef 08 31 3f ad db c3 66 3e 4e 01 67 f3 cb a3 96 12 05 7a 75 18 fb fb 03 1f 5a d0 f9 f7 58 31 97 3e bd 73 3b 82 e5 54 bf 3f de c8 4e 51 f6 5d ab 60 28 c6 c5 13 66 d9 d4 70 0f df 25 5e 4c 7b d7 07 66 e7 f2 28 1b 3f 2a 53 63 f8 5c e4 9f 91 35 90 4d 14 bc b1 17 ad 75 4c 25 94 dc dc a2 d3 0e 40 ff 26 5b 5a cc fb 11 6f 64 ed 99 aa d5 70 c4 c5 a9 1e fd bb 98 4a c6 51 d8 72 14 05 a0 34 2c f7 7f 44 8c 17 a1 52 ea bf 29 e8 89 50 55 8a 86 d0 07 4e 1c ef ab 1e b7 c3 66 68 2f 68 6e e1 33 87 37 e6 75 ea 58 eb 8b 4c 86 b9 f2 8a 6f 6e 96 45 9f 29 e3 b4 dc 59 ff 04 4c 61 a0 dc c5 c3 1d 80 3e 6e 98 42 0e 44 62 29 cc de c3 d0 f7 05 e9 2f fe 01 6b b3 69 63 73 ea da b7 f3 5c cf 65 ab 4d 9b e0 9a 08 5c e2 1b bd 7c 05 55 37 6e 4d 7f e6 8b 5e 7a 64 f4 8b 51 27 82 5f b2 be 59 8d 99 1f 9c 1a 54 bf 52 71 34 17 dc c5 99 e8 12 d8 55 13 a5 37 e6 ea fa 73 8e dc 97 2b 67 e0 65 59 5d 11 67 84 49 bc e6 cd 3d 69 80 0a 64 9b 56 0d 0e 05 7c 50 2c a3 e7 2e 97 82 08 29 ec fe a8 01 19 2c 3f 4e 2c 87 63 c0 95 a4 3e e6 fe 45 fe 87 30 13 09 37 66 8d f1 d4 ee 57 7a da 28 23 8b e0 32 86 48 1f 2d 2a 00 4c c4 d4 88 56 e7 1f bd 64 f1 a0 04 3a 45 20 ec bb f1 b3 ab dc 96 b8 7a 27 be 84 95 a2 05 42 96 7a a4 cd 3a 44 a1 15 02 41 9a 08 3d 84 e9 7a bf de 09 01 b6 6d de 48 38 86 49 a0 ed 6d 93 b9 f2 0c 53 0e 99 0c 7c 52 37 0a 11 4d 80 0d 6a b3 f6 68 7d 6b bc 10 5b 63 73 8f e0 5f a6 ca c9 8a d6 66 39 36 bb 18 cb 92 32 64 e4 43 12 c2 4c 2c e8 e6 42 bb 73 c9 21 01 2b 68 a2 6a 70 97 74 46 b8 f1 5f 9d 62 46 7d 8b 35 65 60 c1 83 a6 bd 6c d7 6e c8 68 c3 bd 94 a5 95 cd 7b f9 96 75 5a 50 8a 81 49 80 c5 e5 88 b2 75 20 0c 45 af d9 00 c8 c2 de 32 9e c2 48 4b 0e 3e cd 7b 09 60 e5 e3 42 58 81 d1 ff 7f 8b d8 b2 0f 5c c9 8f fc 3a cb 77 f5 e8 87 75 a4 bd 3a b9 f9 eb 02 7e 27 d3 af 55 eb df 4e eb ab 48 ea 91 11 28 d6 68 d0 0f c3 f5 b5 48 0a a0 d9 a4 af 56 3b a5 77 38 44 48 e5 42 51 57 13 3d 59 e1 ce f3 c7 22 f3 37 00 bd 37 28 25 04 6b 1f a5 82 4e 40 51 54 a3 af 14 40 bc 2b 75 ac fb d0 7c f9 2e 8c 16 25 87 e7 4b 5a b6 6b 1c 6a ea b3 ad 5f a3 ee 91 da 49 00 ef 30 ad 04 ba ea 32 6d f9 12 51 7d d9 6e 16 96 b4 a9 1f aa 66 67 59 78 a3 75 e8 1f 25 46 4a 10 73 dc 67 37 af 08 d7 e2 59 56 bb 31 d4 38 54 8a 7d a3 86 62 d4 9d b8 12 a8 cf 1d 6c c6 5f 5c 63 87 9f d9 ee 7f d2 a6 6c a3 fc 1a 76 8c b2 39 aa b8 8c 87 20 64 70 b4 c6 05 92 af eb 6d 69 ed 97 a8 f9 90 15 58 62 ba 4e 22 b6 48 04 14 2c 13 1a 23 79 29 37 aa 8a 86 96 e1 65 c2 4d 76 92 a0 4b b4 47 1b 0f 0d 25 07 fe 7c 86 18 42 14 28 fc 7a 0a cc 98 4c a5 cc 6b ac b7 72 e8 a7 17 bb aa 64 6f 96 43 27 59 10 a6 03 7a fa f5 a8 06 78 d1 8e dd a1 38 a4 e1 3d 06 d0 4a 5d 06 43 1e ab 48 73 82 25 cf 15 67 e9 60 e7 65 72 8d c1 2e 91 b9 1c 6f 2b 33 df b6 e0 33 aa 68 c1 c2 33 4d 24 33 5a bc 4a 7a 1d f5 63 6d ec 29 09 1d a5 4d 5f 5a 1f ff 41 e4 a3 5a 0c 2f 04 f9 68 f7 d7 8e 2f 51 c7 35 77 e2 19 2b b2 0f 28 9a ab a5 a1 75 c2 ed 53 38 55 bd 9e d9 a8 42 ad 48 21 36 dd 5e 0c f4 5e b5 e2 d3 1f f6 2a 3b e1 cf 8a 94 a5 83 16 e7 4f 4a b9 fc 54 f3 a0 bb 83 be ef 0f 35 59 93 bd ea 2c 83 e6 1c dc 79 6b f2 56 4a e5 1f ae 61 67 99 e8 71 19 98 cd 88 d3 5c d9 82 44 52 fd d6 52 26 17 4b 46 79 2c b8 7f 4d d2 82 e4 e6 f6 7e b6 6d a4 13 ad 87 7e d6 ce 77 5f 7e 19 bc 93 f4 8b b9 e5 ec 04 00 9d e3 c0 42 ae ac f7 f4 b2 5a d6 b3 0e 01 73 03 f6 4f e0 7a c7 9e 87 44 aa b6 92 6d 11 7f 13 51 3d 04 69 ce f3 35 fe 1d 0d 78 7c 2d 0b 2c 03 1a 95 21 78 6a c1 0e 9f 8b 76 82 71 68 03 37 f2 c3 26 2a bd cc b5 d3 10 7c 63 2b f1 f7 4c 83 ee 91 f4 99 88 22 2f b0 80 cc 8f aa 9b 1a 02 52 6d 8b 60 87 e0 b2 35 41 73 d2 90 16 b3 30 95 87 c1 6f 05 7d d8 12 aa 63 c3 16 91 50 de 81 f3 af 97 d0 82 a8 f8 da 4c e4 f9 09 ff 64 98 21 d7 f9 6d 97 61 35 52 e8 cc 49 02 e0 46 ec fa 32 9b 1d 98 0f f5 ec e6 9b 8f 16 15 fd ff 52 44 f4 1c ec 0a f9 24 62 4a e1 64 1e ca e5 fa 26 c5 fb 90 06 e5 71 00 ee 71 37 7c ed 7c 25 5a e1 7a 08 45 e2 ee 02 87 c6 2c 18 52 f9 38 77 f9 f8 61 57 ca 96 75 d3 83 ff f5 cd 6f 2b 00 1e c0 13 6c 07 cf 37 f5 ac e1 85 31 22 c2 ba a1 09 2d 41 8e 2a 49 0c 4a 5c 8f 56 b8 28 ce 1b af ee f4 e7 7f 09 5d 6b 4e d9 9d 56 f6 68 12 cb 19 be 54 0e be 5d 52 e7 ef f2 d6 9c bb 84 77 e1 15 14 f7 e3 60 4b f9 99 9f 78 c2 f1 ca 6f 60 a2 21 6b 87 fa 0f 25 26 9c 42 5b 7d 50 70 9b 20 09 12 b3 b7 89 9c 95 e1 2d 6e 9c 4d ac c1 9e 32 77 21 86 0e 04 77 a5 3e 67 93 fb b7 fb 97 04 a8 48 f3 95 f4 8c 24 a6 e7 9b 9e 13 58 cc 34 97 25 1d e8 8b 8d 3a 7b 22 c6 d8 af 1a 7f ab 81 53 0d 9f 0c c9 8f 62 de bb 22 2b 54 78 0d 89 79 42 38 53 27 17 b4 47 d7 1b 46 a6 0e d4 81 c2 1d b8 5b 59 0b 31 72 00 09 69 5e cf fd 4e f0 29 96 4e 5d 51 49 62 22 33 ac 01 3e 96 0a 00 5c 92 4f 73 ea 82 c3 18 45 55 46 c5 3d 74 aa 3f 7e 2f f2 6a a0 74 c4 0a 55 ab a8 b0 80 27 fc 19 b5 96 ee c6 c4 f8 9b ae 39 e7 4b 9a ad 88 34 4f 7c c5 ad 3e ef a5 09 5f 2a b4 72 22 e9 a3 57 ec d7 1c 67 00 ac 57 60 25 20 14 90 d9 e4 46 60 3d fd 4b da 76 17 dd 50 09 81 b2 d2 ab 8c 43 88 2a 52 08 49 4c b3 f8 eb c7 20 bc a8 a7 cf 6c 80 bd 7a aa f8 95 07 bb 34 12 ea 49 0a 78 97 3f 12 cc 30 41 3e 9d f1 45 89 17 ea 3d 68 b4 38 d4 24 c1 31 4b c8 d0 19 39 c5 a5 a8 42 43 82 81 e6 2d 0c 80 0d ee 70 4b 2a 6c d3 e1 e4 b8 85 a6 b2 6b 89 4a 98 76 5f a3 30 8c 9e 4b 87 f9 36 25 fa ec db 17 c2 9a 27 cd 24 3b f6 03 0a 67 87 4e c9 f2 44 3c f8 15 42 61 ac 2a 83 4c 01 cb e1 f3 14 ee 7a a3 ca 55 2e 16 48 cf 8b 42 a6 3f 24 9e 35 38 02 6e 09 e4 4d 69 dc 25 9a db 0d 1a 0c bc cb 5a 5d d5 d0 dc cc 90 d0 23 da 79 d5 63 41 88 ff 06 0f 7e 35 a5 f9 d7 ad 99 54 68 24 d6 39 75 d4 45 2d e8 76 09 3f 4e 99 7d c4 6e ed cd 80 a9 ee bf 5e 4f 07 7f bb 10 c7 d9 e1 9a 34 19 e7 b8 45 97 2a 3b 62 61 3c 54 04 a2 09 b1 6f a8 8e 0f f4 9d 7b 4f 21 fe cc 1f 77 3c 5b 4b e6 10 21 e0 ca b8 60 2c 6e 82 57 64 93 03 aa ea fc bb 17 8e 7a 46 0f f0 7f 21 9c 46 eb 6f e5 bf 81 13 72 3e 45 40 03 bd 70 77 67 c1 07 da f4 25 57 51 da af 8d ec f3 52 62 64 00 58 92 4e b6 58 78 68 b2 c0 82 30 b3 17 e9 73 96 eb c9 28 ba 8d 27 4c a0 ee d0 bf cb 63 76 76 00 3c 64 e8 c1 e1 a0 42 0b 6c 96 a4 42 26 06 1c ed 41 b8 44 83 82 ab d2 f3 d0 c4 72 af cd e2 31 fb c9 ee 90 c2 f1 13 2f 8e 23 91 24 6f 95 ad 93 35 4c 74 60 e2 0d e9 96 ad 0f 61 b1 3b 27 64 68 87 a6 37 ce de 90 b9 4b 7d 8c 31 30 f0 fe 06 0e 8d 95 5c 71 1a 27 00 b3 02 a7 5b de b3 2a 0a 68 02 ea 79 5c b1 14 f5 f8 2a 1a 38 1a 86 bb ff 88 b2 99 e4 77 28 b7 46 df f9 64 c9 4c 52 b6 61 b9 42 93 76 b1 32 0b 46 08 14 26 b7 c3 40 20 6d c0 da 15 1b f8 4b e2 a4 9e 78 b6 b5 93 87 53 d2 b1 be 8d 9e 67 c4 3c 5d 70 e7 25 19 f5 f9 0d 05 00 e8 4e e3 8f 82 b1 91 ac 4d 96 8b 0a 37 90 1f d9 23 cb 28 9d 58 56 93 ac 3c 3f 8a 94 fc a6 df 45 e6 94 e1 99 a9 cd 0b 1b c1 fa 73 94 bc c9 6a ae 67 0d ca 66 05 a9 98 79 3b 7e 06 7a c4 10 ba 63 10 57 b8 b7 6f cb e9 52 4d f8 20 c0 2e fe f1 60 8b 74 3c d2 aa 6d 60 d3 d8 e4 76 fa 12 d3 ac c3 29 f8 27 2b 08 7d 89 47 11 77 ed 53 1f ec 1f 9c 24 a9 75 ca 2f cd 8c 24 6a 33 e2 91 a3 f0 0b 7f 23 40 52 06 7a 00 59 c8 67 62 47 52 56 bb 5e 7d ac 6f 12 1a 09 25 50 6b 18 93 3c 6e 31 49 15 d4 b3 b2 13 0a af c2 48 3e f2 2f f8 bb 7b 88 75 65 b1 bd 22 fa bc a2 20 37 d8 fc 94 37 f6 75 c5 31 35 26 26 6f 60 bb 7c 7c 47 f3 0c 7d 56 7e d1 42 ea 5e c3 67 c4 29 83 28 d2 0e 53 44 f0 1c 0c 90 cf 8a 63 02 f4 d8 4b 6b a7 49 5f ba 31 4a 05 ba 29 b6 3b b6 d4 58 fd b0 5a 44 11 13 69 58 30 9f 41 8f b1 78 e1 9a a0 9f f9 e6 2b 29 73 2f b2 98 6c 96 e7 38 f7 a6 88 cb 21 22 db b8 f2 ad 9a 5f 28 bc 49 ec 0c 46 24 13 55 2a fe e8 e4 03 25 9b 55 ad 6d c3 34 dd e7 f2 d3 06 92 9d d0 1f 2a a6 03 6c af d4 18 74 52 26 89 30 1b 81 c9 e5 0e 86 82 88 94 14 03 56 db 0a 33 17 b0 81 ed 9d 81 48 c4 1e 77 e6 bd a6 28 77 62 53 2b 86 eb 91 f5 48 09 15 68 0d eb 8a 91 fb 86 56 b7 f0 10 90 64 86 5d 2b 84 6a f0 86 1f 67 d3 f7 20 d6 e3 06 54 0c d7 b6 8f 09 5e f3 69 0b 88 ea 93 fb 6a 40 2f f5 69 75 97 cd a8 31 71 f1 59 e8 53 07 d1 a8 c0 16 11 18 9b d4 eb 4f 04 53 ab 88 d4 3a e1 81 a5 62 a7 69 02 a6 7c 68 75 14 07 9d 6f 43 04 d9 a7 c0 fa 24 b6 e8 60 74 ea 0a 9f d8 18 7c 12 03 12 07 8f 5e bf a6 74 ad c0 30 37 34 bf 8f 6b 55 85 94 37 06 59 41 92 ad 24 c9 f7 d9 79 4f b8 37 58 92 4f 86 28 55 dd d5 0b ff 58 b5 22 c4 3d 73 c0 32 89 ba ec 62 8c d6 93 ca b9 31 01 b1 e4 73 b7 65 32 51 0e 10 f0 3e 86 81 2f ea 6f 2d 6f 54 67 dc f2 9e 6d 7c f8 52 4f 38 3a 0d ed 3f 09 51 c3 ff b1 71 a6 b8 a6 d9 7b 5f a8 89 9a 19 f1 a3 d0 e9 34 a1 d4 74 10 76 e4 39 4b a2 25 15 8f 69 7b f7 d5 65 17 17 c6 95 02 29 a0 be 22 e8 12 0d 76 a4 14 ed bc d0 3d 50 52 64 b7 ed e8 27 2c cb d6 db dc eb af 11 da f6 a6 52 f6 f9 eb 74 ba 7a 3e cc 94 28 92 89 13 88 00 5a e5 d9 71 e4 e7 9d 69 65 64 90 6d ff d4 48 45 b7 04 a9 ab c2 fa 5b a1 bb 69 a5 48 42 3a 08 04 4a d6 d0 e3 65 db 7e 6b ea 0f 38 44 a4 52 75 97 16 cb 98 dc f3 26 00 1e c9 0c 1c 34 31 74 09 8c df 47 ea 2e 13 34 10 58 ca 01 4d 2a 30 e9 ba 3c 52 6d e7 2a 6e 38 71 81 bf 76 a2 78 c9 cb c5 18 d8 c3 74 a3 f1 d9 80 2a 39 46 4a 10 09 03 db ec 16 f8 f0 95 f5 d8 2d 9d 09 50 72 81 e4 f7 fe 0c e4 fb ec ed 19 39 02 a5 f6 58 af 2a 4c 1d 09 52 da bd c6 ae 58 30 b6 b5 a2 c3 f5 b8 d3 3a 73 66 59 90 82 2e 5f 4a 7c e5 36 67 55 a1 61 55 43 bd f7 82 99 c7 1e 89 0e 0b ed b6 ec 27 7b 10 a3 89 d6 a3 ba 9c 03 72 21 42 12 79 e5 1a b5 0f b1 15 de 20 76 cc 99 44 42 02 e8 8e bd 9d 0f be 4e 60 23 4b 7b 76 14 95 ac 6c 9e 61 5d da c8 17 61 64 a8 8f b6 d6 cc 2b 52 67 2c 89 49 af e3 ef c1 e8 7a 59 88 96 bc 93 e4 21 42 38 44 fc aa fe 65 af 89 8a 01 5b 3b ca f6 23 eb ee f9 a5 71 55 af 52 78 ce b5 2b 99 5f 7c a4 66 d9 e1 8b 05 e8 63 80 67 9e 02 57 cf f6 d0 c6 75 00 78 46 2f 2e e4 70 1d 6d 82 89 ed 84 8b 87 7c f5 91 86 25 b7 93 70 60 d6 67 c1 11 19 88 1c 30 80 90 56 89 23 52 c6 c5 3c 01 e3 95 af 68 66 ea 35 0e 6f 21 fa 3d b7 72 c1 17 7c 75 99 99 97 3b 51 e1 1f fc 59 08} (length 0x2000)
// }
// len: bytesize = 0x2000 (8 bytes)
// res: ptr[in, syz_fuse_req_out] {
// syz_fuse_req_out {
// init: nil
// lseek: nil
// bmap: nil
// poll: nil
// getxattr: nil
// lk: nil
// statfs: nil
// write: nil
// read: nil
// open: nil
// attr: ptr[in, fuse_out_t[int64, fuse_attr_out]] {
// fuse_out_t[int64, fuse_attr_out] {
// len: len = 0x78 (4 bytes)
// err: fuse_errors = 0x0 (4 bytes)
// unique: int64 = 0x80 (8 bytes)
// payload: fuse_attr_out {
// attr_valid: int64 = 0xc (8 bytes)
// attr_valid_nsec: int32 = 0x3 (4 bytes)
// dummy: const = 0x0 (4 bytes)
// attr: fuse_attr {
// ino: int64 = 0xfffffffffffffffd (8 bytes)
// size: int64 = 0x0 (8 bytes)
// blocks: int64 = 0xfffffffffffffffc (8 bytes)
// atime: int64 = 0x0 (8 bytes)
// mtime: int64 = 0x8 (8 bytes)
// ctime: int64 = 0xffffffff (8 bytes)
// atimensec: int32 = 0xfffffffe (4 bytes)
// mtimensec: int32 = 0x0 (4 bytes)
// ctimensec: int32 = 0x80000 (4 bytes)
// mode: fuse_mode = 0x8000 (4 bytes)
// nlink: int32 = 0x0 (4 bytes)
// uid: uid (resource)
// gid: gid (resource)
// rdev: int32 = 0x1 (4 bytes)
// blksize: int32 = 0x3 (4 bytes)
// padding: const = 0x0 (4 bytes)
// }
// }
// }
// }
// entry: nil
// dirent: nil
// direntplus: nil
// create_open: nil
// ioctl: nil
// statx: nil
// }
// }
// ]
memcpy((void*)0x200000004200, "... [truncated large byte array] ...", 8192);
*(uint64_t*)0x2000000000c0 = 0;
*(uint64_t*)0x2000000000c8 = 0;
*(uint64_t*)0x2000000000d0 = 0;
*(uint64_t*)0x2000000000d8 = 0;
*(uint64_t*)0x2000000000e0 = 0;
*(uint64_t*)0x2000000000e8 = 0;
*(uint64_t*)0x2000000000f0 = 0;
*(uint64_t*)0x2000000000f8 = 0;
*(uint64_t*)0x200000000100 = 0;
*(uint64_t*)0x200000000108 = 0;
*(uint64_t*)0x200000000110 = 0x200000000340;
*(uint32_t*)0x200000000340 = 0x78;
*(uint32_t*)0x200000000344 = 0;
*(uint64_t*)0x200000000348 = 0x80;
*(uint64_t*)0x200000000350 = 0xc;
*(uint32_t*)0x200000000358 = 3;
*(uint32_t*)0x20000000035c = 0;
*(uint64_t*)0x200000000360 = 0xfffffffffffffffd;
*(uint64_t*)0x200000000368 = 0;
*(uint64_t*)0x200000000370 = 0xfffffffffffffffc;
*(uint64_t*)0x200000000378 = 0;
*(uint64_t*)0x200000000380 = 8;
*(uint64_t*)0x200000000388 = 0xffffffff;
*(uint32_t*)0x200000000390 = 0xfffffffe;
*(uint32_t*)0x200000000394 = 0;
*(uint32_t*)0x200000000398 = 0x80000;
*(uint32_t*)0x20000000039c = 0x8000;
*(uint32_t*)0x2000000003a0 = 0;
*(uint32_t*)0x2000000003a4 = 0;
*(uint32_t*)0x2000000003a8 = r[2];
*(uint32_t*)0x2000000003ac = 1;
*(uint32_t*)0x2000000003b0 = 3;
*(uint32_t*)0x2000000003b4 = 0;
*(uint64_t*)0x200000000118 = 0;
*(uint64_t*)0x200000000120 = 0;
*(uint64_t*)0x200000000128 = 0;
*(uint64_t*)0x200000000130 = 0;
*(uint64_t*)0x200000000138 = 0;
*(uint64_t*)0x200000000140 = 0;
syz_fuse_handle_req(/*fd=*/r[0], /*buf=*/0x200000004200, /*len=*/0x2000, /*res=*/0x2000000000c0);
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// flags: open_flags = 0x20c01 (4 bytes)
// mode: open_mode = 0x0 (2 bytes)
// ]
// returns fd
memcpy((void*)0x200000000000, "./file0\000", 8);
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000000ul, /*flags=O_NONBLOCK|O_NOFOLLOW|O_APPEND|O_WRONLY*/0x20c01, /*mode=*/0);
if (res != -1)
r[3] = res;
// writev arguments: [
// fd: fd (resource)
// vec: ptr[in, array[iovec[in, array[int8]]]] {
// array[iovec[in, array[int8]]] {
// iovec[in, array[int8]] {
// addr: ptr[in, buffer] {
// buffer: {6e} (length 0x1)
// }
// len: len = 0xfdef (8 bytes)
// }
// }
// }
// vlen: len = 0x1 (8 bytes)
// ]
*(uint64_t*)0x200000000200 = 0x2000000003c0;
memset((void*)0x2000000003c0, 110, 1);
*(uint64_t*)0x200000000208 = 0xfdef;
syscall(__NR_writev, /*fd=*/r[3], /*vec=*/0x200000000200ul, /*vlen=*/1ul);
return 0;
}
Reply: **Bug Analysis:**
The reported bug is a lock order inversion (deadlock) between the `i_pages` xarray lock (`xa_lock`) and the flex_proportions sequence counter (`p->sequence`).
Here is the sequence of events that leads to the deadlock:
1. **Writer Context:** The `p->sequence` seqcount is acquired for write in `fprop_new_period()`. This function is called from the `writeout_period` timer callback, which runs in softirq context (`run_timer_softirq`). Crucially, softirqs run with hard interrupts **enabled**, meaning this writer can be interrupted by a hardware interrupt.
2. **Reader Context:** The `xa_lock` is acquired in hardirq context by block device drivers (such as the NVMe driver via `nvme_irq`) when completing a writeback request (`__folio_end_writeback`).
3. **The Deadlock:** While holding the `xa_lock` with interrupts disabled, `__folio_end_writeback` calls `__wb_writeout_add` -> `wb_domain_writeout_add` -> `__fprop_add_percpu_max`, which attempts to acquire `p->sequence` for read (`read_seqcount_begin`).
If an NVMe interrupt fires on a CPU that is currently executing `fprop_new_period()` (and thus holding `p->sequence` for write), the interrupt handler will preempt the writer, take the `xa_lock`, and then spin forever waiting for `p->sequence` to be released (waiting for the sequence number to become even). However, the writer cannot make progress because it was interrupted by this exact hardirq on the same CPU, resulting in a classic deadlock.
**Security Impact Assessment:**
* **Exploitable:** **No.** This is a pure deadlock issue. There is no memory corruption, use-after-free, or out-of-bounds access involved that could be leveraged for privilege escalation or arbitrary code execution.
* **Denial Of Service:** **Yes.** The deadlock will cause the CPU to spin indefinitely in the hardirq handler. This will quickly stall the system and eventually trigger the hard lockup detector (NMI watchdog), resulting in a kernel panic and halting the system.
* **Accessible From Unprivileged Processes & User Namespaces:** **Yes.** Any unprivileged user can trigger page writeback simply by writing data to a file on an NVMe-backed filesystem (or any block device that completes IO in hardirq context). The `writeout_period` timer and the block device interrupts will fire automatically as part of normal system operation, making the race condition reachable without any special privileges or capabilities.
* **VM Guest Trigger:** **Yes.** A guest performing heavy disk I/O can cause the host to perform disk I/O on the backing storage. If the host uses NVMe, the guest's workload can trigger the deadlock in the host kernel.
* **VM Host Trigger in The Confidential Computing Context:** **Yes.** A malicious host can precisely control and inject virtual interrupts into a confidential guest. By injecting a block completion interrupt at the exact moment the guest is executing `fprop_new_period()`, the host can deterministically trigger the deadlock in the guest kernel.
* **Network / Remote / Peripheral / Filesystem Trigger:** **No.** The bug resides in the core memory management and block layer writeback code. It is not related to parsing network packets, handling untrusted USB peripherals, or mounting malicious filesystem images.
|
| 6/2 |
2026/05/24 07:01 |
llm |
expert |
0m
Model:
Tokens:
input: 76719
output: 47
thoughts: 692
Thoughts: **Lockdep Warning Analysis: HARDIRQ-safe -> HARDIRQ-unsafe Lock Order**
Okay, so I'm looking at this lockdep warning: "HARDIRQ-safe -> HARDIRQ-unsafe lock order detected." The task, which appears to be `syz`, is holding `&xa->xa_lock#10`, which is flagged as HARDIRQ-irq-safe. Simultaneously, it's attempting to acquire `&p->sequence`, which is categorized as HARDIRQ-irq-unsafe.
The warning tells me that the xarray lock, `&xa->xa_lock#10`, is held within `__folio_end_writeback` at `mm/page-writeback.c:2990`. On the other hand, the `&p->sequence` (which I see is a `seqcount_t`) is being acquired at `__fprop_add_percpu_max` within `lib/flex_proportions.c:186`. I see that the `&xa->xa_lock#10` is an xarray lock, and `&p->sequence` is a sequence lock (seqcount) in `struct fprop_local_percpu`.
My initial thought is that sequence counts aren't traditional locks, but Lockdep clearly tracks them, so that's something to keep in mind. Lockdep is reporting that `&xa->xa_lock#10` is HARDIRQ-irq-safe, meaning it can be acquired within a hardirq context. Conversely, `&p->sequence` is HARDIRQ-irq-unsafe, which means its acquisition is done with interrupts enabled. The risk is that if a hardirq hits while `&p->sequence` is held and tries to acquire a HARDIRQ-irq-safe lock, a deadlock could occur if the order is reversed.
The key here is that `syz` is currently holding `&xa->xa_lock#10` (HARDIRQ-irq-safe) and trying to acquire `&p->sequence` (HARDIRQ-irq-unsafe). This means `&p->sequence` is being accessed (read or written) with interrupts enabled, and we're currently holding a lock that can be acquired in hardirq context. So, if an interrupt occurs while `&p->sequence` is being handled and the interrupt handler tries to acquire `&xa->xa_lock#10`, there will be a deadlock!
Okay, now let's think about this: `p->sequence` is a seqcount. Readers of seqcounts just read the counter; they don't block writers. The writer increments the counter. Lockdep appears to interpret reads as acquiring a read lock and writes as acquiring a write lock. The crux is, is `&p->sequence` being read or written here? Let's trace it back to `__fprop_add_percpu_max` within `lib/flex_proportions.c`. I'll need to check the code there to determine whether we are reading or writing the seqcount.
|
| 7/2 |
2026/05/24 07:02 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:lib/flex_proportions.c IncludeLines:true Name:__fprop_add_percpu_max]
Results: map[SourceCode: 175: /*
176: * Like __fprop_add_percpu() except that event is counted only if the given
177: * type has fraction smaller than @max_frac/FPROP_FRAC_BASE
178: */
179: void __fprop_add_percpu_max(struct fprop_global *p,
180: struct fprop_local_percpu *pl, int max_frac, long nr)
181: {
182: if (unlikely(max_frac < FPROP_FRAC_BASE)) {
183: unsigned long numerator, denominator;
184: s64 tmp;
185:
186: fprop_fraction_percpu(p, pl, &numerator, &denominator);
187: /* Adding 'nr' to fraction exceeds max_frac/FPROP_FRAC_BASE? */
188: tmp = (u64)denominator * max_frac -
189: ((u64)numerator << FPROP_FRAC_SHIFT);
190: if (tmp < 0) {
191: /* Maximum fraction already exceeded? */
192: return;
193: } else if (tmp < nr * (FPROP_FRAC_BASE - max_frac)) {
194: /* Add just enough for the fraction to saturate */
195: nr = div_u64(tmp + FPROP_FRAC_BASE - max_frac - 1,
196: FPROP_FRAC_BASE - max_frac);
197: }
198: }
199:
200: __fprop_add_percpu(p, pl, nr);
201: }
SourceFile:lib/flex_proportions.c]
|
| 8/2 |
2026/05/24 07:02 |
llm |
expert |
0m
Model:
Tokens:
input: 78628
output: 44
thoughts: 28
Thoughts: Okay, here's my interpretation of that code snippet, delivered as if it's my own thought process:
**Diving into the Seqcount Read**
Alright, so I see a call to `fprop_fraction_percpu(p, pl, &numerator, &denominator)`. My initial thought is, "Okay, we're trying to figure out a fraction, probably related to some per-CPU accounting." The function name and the parameters are the key here. `fprop_fraction_percpu` suggests this is about *forward propagation* of a fraction, potentially related to resource usage on a per-CPU basis. It has to be reading something, and the way the function is called suggests it's reading a *sequence counter*. That's where things get interesting. I know seqcounts are the classic way to implement a read-copy-update-like scheme without heavy synchronization overhead. It looks like it is reading something to calculate a fraction, with the `numerator` and `denominator` parameters. It seems to be trying to do this atomically as well. So it would be to read the `seqcount` to get some value, and then calculate a fraction using that value.
|
| 9/2 |
2026/05/24 07:02 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:lib/flex_proportions.c IncludeLines:true Name:fprop_fraction_percpu]
Results: map[SourceCode: 147: void fprop_fraction_percpu(struct fprop_global *p,
148: struct fprop_local_percpu *pl,
149: unsigned long *numerator, unsigned long *denominator)
150: {
151: unsigned int seq;
152: s64 num, den;
153:
154: do {
155: seq = read_seqcount_begin(&p->sequence);
156: fprop_reflect_period_percpu(p, pl);
157: num = percpu_counter_read_positive(&pl->events);
158: den = percpu_counter_read_positive(&p->events);
159: } while (read_seqcount_retry(&p->sequence, seq));
160:
161: /*
162: * Make fraction <= 1 and denominator > 0 even in presence of percpu
163: * counter errors
164: */
165: if (den <= num) {
166: if (num)
167: den = num;
168: else
169: den = 1;
170: }
171: *denominator = den;
172: *numerator = num;
173: }
SourceFile:lib/flex_proportions.c]
|
| 10/2 |
2026/05/24 07:02 |
llm |
expert |
0m
Model:
Tokens:
input: 79353
output: 44
thoughts: 1153
Thoughts: **Analyzing a Potential Locking Hazard**
Okay, here's what I'm thinking... I'm looking at this lockdep warning triggered by `read_seqcount_begin` on `p->sequence`. The core of the problem, as I see it, boils down to a potential lock ordering issue that can lead to deadlocks, especially in interrupt context, and it's flagged as `HARDIRQ-irq-unsafe`.
First, I see that we're acquiring a read lock on `p->sequence`, and the warning tells me `p->sequence` is *unsafe* in a HARDIRQ context. However, we're holding `xa->xa_lock#10`, which is flagged as *safe* in HARDIRQ. Immediately, I think, a *reader* should be harmless, but...
Then it hits me: the critical part isn't just the reader, it's that lockdep tracks seqcount readers to prevent deadlocks. If a writer can be interrupted by a hardirq, and that hardirq *also* takes `xa->xa_lock#10` *before* trying to read `p->sequence`, we're in trouble. The writer is interrupted, the reader in the hardirq spins forever waiting on the writer, and we get a deadlock or livelock. This can happen if `xa->xa_lock#10` is used inside a hardirq.
Okay, so the current task is holding `xa->xa_lock#10` and trying to read `p->sequence`. Lockdep flags this as a suspicious order: `xa->xa_lock#10` -> `p->sequence`. Since `xa->xa_lock#10` is HARDIRQ-irq-safe, it can be taken inside a hardirq, and because `p->sequence` is HARDIRQ-irq-unsafe, it means that writes to it might happen with hardirqs *enabled*.
The system is now creating this dependency: `xa->xa_lock#10` -> `p->sequence`. This looks dangerous. To visualize the deadlock:
CPU0 (Writer) CPU1 (Interrupt)
---------------- ----------------
lock(&p->sequence);
local_irq_disable();
lock(&xa->xa_lock#10);
lock(&p->sequence);
<Interrupt>
lock(&xa->xa_lock#10);
The interrupt handler tries to acquire `p->sequence` after it has already acquired `xa->xa_lock#10`, but it can't because the original writer is interrupted.
So, this `xa->xa_lock#10` -> `p->sequence` dependency is a problem if the interrupt handler *actually* tries to read `p->sequence`. That's where it all hinges.
Now, let's trace this back. The dependency comes from a stack: `__folio_end_writeback` -> `folio_end_writeback_no_dropbehind` -> `folio_end_writeback` -> `iomap_finish_folio_write` -> `fuse_writepage_finish` -> `fuse_send_writepage` -> `fuse_flush_writepages` -> `fuse_writepages_send` -> `fuse_iomap_writeback_range`. I need to inspect `__folio_end_writeback` in `mm/page-writeback.c` to confirm whether `p->sequence` is read within that context. I need to know where and how `p->sequence` is actually being used in that codepath!
|
| 11/2 |
2026/05/24 07:02 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:mm/page-writeback.c IncludeLines:true Name:__folio_end_writeback]
Results: map[SourceCode:2979: bool __folio_end_writeback(struct folio *folio)
2980: {
2981: long nr = folio_nr_pages(folio);
2982: struct address_space *mapping = folio_mapping(folio);
2983: bool ret;
2984:
2985: if (mapping && mapping_use_writeback_tags(mapping)) {
2986: struct inode *inode = mapping->host;
2987: struct bdi_writeback *wb;
2988: unsigned long flags;
2989:
2990: xa_lock_irqsave(&mapping->i_pages, flags);
2991: ret = folio_xor_flags_has_waiters(folio, 1 << PG_writeback);
2992: __xa_clear_mark(&mapping->i_pages, folio->index,
2993: PAGECACHE_TAG_WRITEBACK);
2994:
2995: wb = inode_to_wb(inode);
2996: wb_stat_mod(wb, WB_WRITEBACK, -nr);
2997: __wb_writeout_add(wb, nr);
2998: if (!mapping_tagged(mapping, PAGECACHE_TAG_WRITEBACK)) {
2999: wb_inode_writeback_end(wb);
3000: if (mapping->host)
3001: sb_clear_inode_writeback(mapping->host);
3002: }
3003:
3004: xa_unlock_irqrestore(&mapping->i_pages, flags);
3005: } else {
3006: ret = folio_xor_flags_has_waiters(folio, 1 << PG_writeback);
3007: }
3008:
3009: lruvec_stat_mod_folio(folio, NR_WRITEBACK, -nr);
3010: zone_stat_mod_folio(folio, NR_ZONE_WRITE_PENDING, -nr);
3011: node_stat_mod_folio(folio, NR_WRITTEN, nr);
3012:
3013: return ret;
3014: }
SourceFile:mm/page-writeback.c]
|
| 12/2 |
2026/05/24 07:02 |
llm |
expert |
0m
Model:
Tokens:
input: 81953
output: 44
thoughts: 54
Thoughts: Okay, here's my interpretation of this code snippet, filtered through the lens of my expert understanding:
**Analyzing the Writeback Process**
Alright, so I'm seeing a critical point within the writeback process, specifically around line 2990 of whatever context I'm in. The first thing that jumps out is the use of `xa_lock_irqsave(&mapping->i_pages, flags)`. This tells me we're dealing with locking the *i_pages* radix tree within a file's address space. It's a high-priority operation; the `irqsave` part indicates a need to disable interrupts temporarily while we protect the radix tree from concurrent access. This is standard practice in these types of systems to provide exclusive access to critical shared resources. It's a fundamental part of maintaining data integrity when dealing with page-level operations.
Then, just a few lines later, line 2997, we call `__wb_writeout_add(wb, nr)`. The "wb" argument strongly suggests this is linked to a `writeback_control` structure. This function call is designed to schedule a writeback operation on a specific number of pages, `nr`. It appears we're adding pages to the writeback queue after the radix tree has been locked. This looks like a tightly coordinated dance. Lock the tree, ensure no concurrent modifications can happen, and then start adding the modified pages to the writeback list for eventual flushing to disk. The use of the radix tree locking shows that this operation requires a great deal of care because we are modifying the in-memory representation of files. This is definitely a critical region for performance and correctness.
|
| 13/2 |
2026/05/24 07:02 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:mm/page-writeback.c IncludeLines:true Name:__wb_writeout_add]
Results: map[SourceCode: 577: /*
578: * Increment @wb's writeout completion count and the global writeout
579: * completion count. Called from __folio_end_writeback().
580: */
581: static inline void __wb_writeout_add(struct bdi_writeback *wb, long nr)
582: {
583: struct wb_domain *cgdom;
584:
585: wb_stat_mod(wb, WB_WRITTEN, nr);
586: wb_domain_writeout_add(&global_wb_domain, &wb->completions,
587: wb->bdi->max_prop_frac, nr);
588:
589: cgdom = mem_cgroup_wb_domain(wb);
590: if (cgdom)
591: wb_domain_writeout_add(cgdom, wb_memcg_completions(wb),
592: wb->bdi->max_prop_frac, nr);
593: }
SourceFile:mm/page-writeback.c]
|
| 14/2 |
2026/05/24 07:02 |
llm |
expert |
0m
Model:
Tokens:
input: 82728
output: 45
thoughts: 23
Thoughts: Here's a summary of my understanding:
**Deep Dive into `wb_domain_writeout_add` and Per-CPU Maxima**
Okay, so I'm looking at `wb_domain_writeout_add`, and it's calling `__fprop_add_percpu_max`. Immediately, I see that this is about adding something, presumably a value, to a per-CPU maximum. Given the function names, I'm inferring this likely relates to writeback domains, and some resource that has a per-CPU limit. I need to understand what's being written out and what the maximum actually represents. Is this about flushing dirty pages? Metadata? It has to be something that can be handled on a per-CPU basis and that has a limit or a maximum value associated with it. This `__fprop_add_percpu_max` function probably handles the atomic updates or synchronization needed for that specific per-CPU counter. This points toward a mechanism for tracking some resource within writeback and it being aggregated and limited. Now I need to know why and under what circumstances this happens. This all needs more context, but Iβm off to a good start!
|
| 15/2 |
2026/05/24 07:02 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:mm/page-writeback.c IncludeLines:true Name:wb_domain_writeout_add]
Results: map[SourceCode: 558: static void wb_domain_writeout_add(struct wb_domain *dom,
559: struct fprop_local_percpu *completions,
560: unsigned int max_prop_frac, long nr)
561: {
562: __fprop_add_percpu_max(&dom->completions, completions,
563: max_prop_frac, nr);
564: /* First event after period switching was turned off? */
565: if (unlikely(!dom->period_time)) {
566: /*
567: * We can race with other wb_domain_writeout_add calls here but
568: * it does not cause any harm since the resulting time when
569: * timer will fire and what is in writeout_period_time will be
570: * roughly the same.
571: */
572: dom->period_time = wp_next_time(jiffies);
573: mod_timer(&dom->period_timer, dom->period_time);
574: }
575: }
SourceFile:mm/page-writeback.c]
|
| 16/2 |
2026/05/24 07:02 |
llm |
expert |
0m
Model:
Tokens:
input: 83386
output: 43
thoughts: 1392
Thoughts: **Deadlock Deep Dive: A Sequence Lock Conundrum**
Okay, so I'm looking at how `__folio_end_writeback` works and I see it takes `xa_lock_irqsave` before calling `__fprop_add_percpu_max`, which reads `p->sequence`. Immediately, the `xa_lock_irqsave` call triggers a red flag β it disables interrupts! That sets the stage for a potential conflict. `__folio_end_writeback` disables interrupts, grabs the XArray lock (`xa_lock`), and *then* reads `p->sequence`.
The scenario crystallizes: CPU 1, with interrupts disabled by `xa_lock_irqsave`, takes the XArray lock, and then tries to take the sequence lock for `p->sequence`. Meanwhile, CPU 0 might be writing to `p->sequence` with the sequence lock held, and an interrupt fires. If that interrupt handler tries to acquire `xa_lock`, we've got a classic deadlock brewing.
The lockdep report is illuminating. It tells me that `__folio_end_writeback` *is* called from a hardirq, specifically `nvme_irq`. That means `nvme_irq` calls `__folio_end_writeback`, which takes `xa_lock_irqsave` (disabling interrupts) and reads `p->sequence`. So now, the sequence lock for `p->sequence` is being read within a hardirq context!
This raises the critical question: how is `p->sequence` being *written*? If the write to `p->sequence` happened with hardirqs *enabled*, then a hardirq could interrupt the writer, jump into `__folio_end_writeback`, which tries to read `p->sequence`, resulting in an endless loop.
The lockdep report indicates that `p->sequence` is becoming unsafe in `fprop_new_period`. This function is called from a timer softirq (`run_timer_softirq`). Softirqs, critically, run with hardirqs *enabled*! Therefore, `fprop_new_period` is writing to `p->sequence` while hardirqs are enabled. The implication is dire: if `nvme_irq` fires during that write, it will call `__folio_end_writeback` and try to read `p->sequence`, and we've got a definite deadlock scenario. This is a real bug!
Now, the question is why is `fprop_new_period` writing to `p->sequence` with hardirqs enabled? Time to dive into the code for `lib/flex_proportions.c` and figure out what is going on there.
|
| 17/2 |
2026/05/24 07:03 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:lib/flex_proportions.c IncludeLines:true Name:fprop_new_period]
Results: map[SourceCode: 56: /*
57: * Declare @periods new periods. It is upto the caller to make sure period
58: * transitions cannot happen in parallel.
59: *
60: * The function returns true if the proportions are still defined and false
61: * if aging zeroed out all events. This can be used to detect whether declaring
62: * further periods has any effect.
63: */
64: bool fprop_new_period(struct fprop_global *p, int periods)
65: {
66: s64 events = percpu_counter_sum(&p->events);
67:
68: /*
69: * Don't do anything if there are no events.
70: */
71: if (events <= 1)
72: return false;
73: preempt_disable_nested();
74: write_seqcount_begin(&p->sequence);
75: if (periods < 64)
76: events -= events >> periods;
77: /* Use addition to avoid losing events happening between sum and set */
78: percpu_counter_add(&p->events, -events);
79: p->period += periods;
80: write_seqcount_end(&p->sequence);
81: preempt_enable_nested();
82:
83: return true;
84: }
SourceFile:lib/flex_proportions.c]
|
| 18/2 |
2026/05/24 07:03 |
llm |
expert |
0m
Model:
Tokens:
input: 85825
output: 41
thoughts: 183
Thoughts: **Analyzing the Implications of Preemption and Interrupts in `fprop_new_period`**
Okay, so I'm focusing on this `fprop_new_period` function. My initial thought was that it only disables preemption through `preempt_disable_nested()`, which is important, but then I realized that it *doesn't* disable interrupts. That's a crucial distinction. Now, let's connect the dots.
My next line of thinking brought me to consider `write_seqcount_begin`. I realized that this function doesn't, on its own, disable interrupts either. This is where it gets interesting and potentially problematic, because the code then reads `p->sequence` in the hardirq context. This means, if `p->sequence` is read in hardirq context, then the call to `write_seqcount_begin` *must* be done with hardirqs disabled. Ideally, we should be using `write_seqcount_begin_irqsave` or similar, or at the very least using `local_irq_save` around the critical section to ensure atomicity.
Wait, I need to double-check that. Let me make sure I'm not overthinking it. Okay, `write_seqcount_begin` is just a seqcount. Is there a version of it that saves and restores interrupts? No, seqcounts are *typically* protected by a lock, which simplifies things.
Let me refresh my memory. Right, `fprop_new_period` is called from `writeout_period` in `mm/page-writeback.c`. So it's used in the page writeback path, which makes the interrupt context concern more relevant, as the writeback path can be triggered by various interrupt handlers.
|
| 19/2 |
2026/05/24 07:03 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:mm/page-writeback.c IncludeLines:true Name:writeout_period]
Results: map[SourceCode: 605: /*
606: * On idle system, we can be called long after we scheduled because we use
607: * deferred timers so count with missed periods.
608: */
609: static void writeout_period(struct timer_list *t)
610: {
611: struct wb_domain *dom = timer_container_of(dom, t, period_timer);
612: int miss_periods = (jiffies - dom->period_time) /
613: VM_COMPLETIONS_PERIOD_LEN;
614:
615: if (fprop_new_period(&dom->completions, miss_periods + 1)) {
616: dom->period_time = wp_next_time(dom->period_time +
617: miss_periods * VM_COMPLETIONS_PERIOD_LEN);
618: mod_timer(&dom->period_timer, dom->period_time);
619: } else {
620: /*
621: * Aging has zeroed all fractions. Stop wasting CPU on period
622: * updates.
623: */
624: dom->period_time = 0;
625: }
626: }
SourceFile:mm/page-writeback.c]
|
| 20/2 |
2026/05/24 07:03 |
llm |
expert |
0m
Model:
Tokens:
input: 86807
output: 45
thoughts: 405
Thoughts: **Seqcount Deadlock Investigation**
Okay, so `writeout_period` is a timer callback, and it's running in softirq context. Got it. It calls `fprop_new_period`, which handles the seqcount writing. Now, the problem arises when an NVMe interrupt hits *during* the execution of `fprop_new_period`, specifically while it's in the critical section defined by `write_seqcount_begin` and `write_seqcount_end`.
The NVMe interrupt handler, from what I can tell, calls `__folio_end_writeback`, which in turn calls `__wb_writeout_add`, and this cascades down to `wb_domain_writeout_add`, then `__fprop_add_percpu_max`, ultimately reaching `fprop_fraction_percpu`. This is where it gets interesting, as this function uses a seqcount for synchronization. And looking at the code, it uses this construct:
```c
do {
seq = read_seqcount_begin(&p->sequence);
fprop_reflect_period_percpu(p, pl);
num = percpu_counter_read_positive(&pl->events);
den = percpu_counter_read_positive(&p->events);
} while (read_seqcount_retry(&p->sequence, seq));
```
The issue is this: since the seqcount is currently *locked* for write (i.e., the sequence number is odd), `read_seqcount_begin` will spin forever, waiting for the seqcount to become even. But it *will never* become even because the writer, `fprop_new_period` is interrupted on the same CPU by this very hardirq! It's a textbook seqcount deadlock. The writer is blocked by the reader, and the reader is blocked by the writer, on the same CPU. A classic, nasty situation.
Now, I need to verify something. Is `__folio_end_writeback` actually *supposed* to be called from a hardirq context? I recall that, historically, block device completions were handled in softirq context. However, with blk-mq, and maybe especially with `IRQ_F_MULTIPLE` or something similar, completions can now occur within hardirq context. This is what I need to check. Specifically, NVMe *can* complete requests in hardirq context now, which is something I need to confirm. So, let me check `nvme_irq` in `drivers/nvme/host/pci.c`. I need to confirm that my suspicion is correct.
|
| 21/2 |
2026/05/24 07:03 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:drivers/nvme/host/pci.c IncludeLines:true Name:nvme_irq]
Results: map[SourceCode:1443: static irqreturn_t nvme_irq(int irq, void *data)
1444: {
1445: struct nvme_queue *nvmeq = data;
1446: DEFINE_IO_COMP_BATCH(iob);
1447:
1448: if (nvme_poll_cq(nvmeq, &iob)) {
1449: if (!rq_list_empty(&iob.req_list))
1450: nvme_pci_complete_batch(&iob);
1451: return IRQ_HANDLED;
1452: }
1453: return IRQ_NONE;
1454: }
SourceFile:drivers/nvme/host/pci.c]
|
| 22/2 |
2026/05/24 07:03 |
llm |
expert |
0m
Model:
Tokens:
input: 88050
output: 43
thoughts: 3409
Thoughts: **My Analysis of a Potential Deadlock in the NVMe Driver**
Okay, so I've traced this sequence, and here's what I've got. The `nvme_pci_complete_batch` function calls `nvme_complete_batch`, which eventually calls `blk_mq_end_request_batch`. This, in turn, goes through `blk_complete_request`, `bio_endio`, `end_bio_bh_io_sync`, `end_buffer_async_write`, and ultimately `folio_end_writeback`, which then triggers `__folio_end_writeback`. The crucial point is that all this happens directly within a hard interrupt handler.
Now, I understand that `__folio_end_writeback` is called within the hardirq context, but `fprop_new_period`, which is *also* involved in this flow, is called from softirq context, and notably, it doesn't disable hard interrupts. That's a huge red flag: this smells like a potential deadlock.
To see if I can reproduce this, a timer needs to fire the `writeout_period` and hit `fprop_new_period` while a writeback request is completing via an NVMe interrupt which in turn completes with `__folio_end_writeback`.
Essentially, I need a write workload that can be triggered by any user because that's what causes writeback to happen automatically. Plus, the NVMe interrupts will fire when those writes complete, which makes this race condition more likely. Even though the race window is small, it *is* triggerable by an unprivileged user.
Syzkaller, in its reproducible example, is using FUSE, which can also trigger writeback requests. It seems like the FUSE daemon and its writeback mechanisms are the key to unlocking this, because it's involved with `__folio_end_writeback` when triggered by a close operation. Lockdep is saying that the `xa_lock#10` which is the lock for the inode's xarray is taken in HARDIRQ context by the `nvme_irq` completion handler. However, `p->sequence` is also being used in softirq context by `writeout_period`, meaning this creates a dependency between the two.
So the scenario is: a timer-based softirq is running, acquiring `p->sequence`. An NVMe interrupt fires mid-execution and runs, which completes the request and calls `__folio_end_writeback`. The problem is that `__folio_end_writeback` then takes `xa_lock_irqsave` *and* then calls `__fprop_add_percpu_max`, which accesses `p->sequence`...deadlock. This is a very valid deadlock scenario.
It's a Denial of Service, not an exploit, since it will just hang the system. It is accessible to any unprivileged user because any user can cause writeback by writing to a file on an NVMe device, meaning any user can trigger the deadlock. This can even be triggered from a VM guest because the VM guest will do disk I/O, which, if it uses NVMe, is capable of triggering this deadlock. And since the deadlock can be triggered from the VM, it can be triggered by a malicious host, for example, a hostile host injecting interrupts at the right time.
|
| 23/2 |
2026/05/24 07:04 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:lib/flex_proportions.c IncludeLines:true Name:fprop_new_period]
Results: map[SourceCode: 56: /*
57: * Declare @periods new periods. It is upto the caller to make sure period
58: * transitions cannot happen in parallel.
59: *
60: * The function returns true if the proportions are still defined and false
61: * if aging zeroed out all events. This can be used to detect whether declaring
62: * further periods has any effect.
63: */
64: bool fprop_new_period(struct fprop_global *p, int periods)
65: {
66: s64 events = percpu_counter_sum(&p->events);
67:
68: /*
69: * Don't do anything if there are no events.
70: */
71: if (events <= 1)
72: return false;
73: preempt_disable_nested();
74: write_seqcount_begin(&p->sequence);
75: if (periods < 64)
76: events -= events >> periods;
77: /* Use addition to avoid losing events happening between sum and set */
78: percpu_counter_add(&p->events, -events);
79: p->period += periods;
80: write_seqcount_end(&p->sequence);
81: preempt_enable_nested();
82:
83: return true;
84: }
SourceFile:lib/flex_proportions.c]
|
| 24/2 |
2026/05/24 07:04 |
llm |
expert |
0m
Model:
Tokens:
input: 92642
output: 45
thoughts: 317
Thoughts: **Analyzing a Potential Deadlock**
Okay, so `preempt_disable_nested()`? That *only* disables preemption, right? It leaves interrupts enabled. And `write_seqcount_begin`... that's just a simple wrapper for `seqcount_begin`, so no interrupt disabling there either. Right. So, if an interrupt happens to hit between `write_seqcount_begin` and its corresponding `write_seqcount_end`, the interrupt handler will absolutely run.
Now, if that interrupt handler *happens* to call `__folio_end_writeback`... which in turn calls `__wb_writeout_add` then `wb_domain_writeout_add` then `__fprop_add_percpu_max` then `fprop_fraction_percpu`, and finally hits `read_seqcount_begin(&p->sequence)`... we've got a problem. Because `read_seqcount_begin` will spin forever if the sequence count is odd, which it *will* be because the write is in progress. Deadlock, plain and simple.
But wait a second... is `__folio_end_writeback` *always* called from a hard interrupt? In the NVMe case, yes, I think that's true. `nvme_irq` calls `blk_mq_end_request_batch`, which then calls `bio_endio`, which *then* calls `folio_end_writeback`. Ok, so the question is, does `blk_mq_end_request_batch` directly call `bio_endio` in the context of a hard interrupt? I need to double-check `blk_mq_end_request_batch` to be sure.
|
| 25/2 |
2026/05/24 07:04 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:block/blk-mq.c IncludeLines:true Name:blk_mq_end_request_batch]
Results: map[SourceCode:1188: void blk_mq_end_request_batch(struct io_comp_batch *iob)
1189: {
1190: int tags[TAG_COMP_BATCH], nr_tags = 0;
1191: struct blk_mq_hw_ctx *cur_hctx = NULL;
1192: struct request *rq;
1193: u64 now = 0;
1194:
1195: if (iob->need_ts)
1196: now = blk_time_get_ns();
1197:
1198: while ((rq = rq_list_pop(&iob->req_list)) != NULL) {
1199: prefetch(rq->bio);
1200: prefetch(rq->rq_next);
1201:
1202: blk_complete_request(rq);
1203: if (iob->need_ts)
1204: __blk_mq_end_request_acct(rq, now);
1205:
1206: blk_mq_finish_request(rq);
1207:
1208: rq_qos_done(rq->q, rq);
1209:
1210: /*
1211: * If end_io handler returns NONE, then it still has
1212: * ownership of the request.
1213: */
1214: if (rq->end_io && rq->end_io(rq, 0) == RQ_END_IO_NONE)
1215: continue;
1216:
1217: WRITE_ONCE(rq->state, MQ_RQ_IDLE);
1218: if (!req_ref_put_and_test(rq))
1219: continue;
1220:
1221: blk_crypto_free_request(rq);
1222: blk_pm_mark_last_busy(rq);
1223:
1224: if (nr_tags == TAG_COMP_BATCH || cur_hctx != rq->mq_hctx) {
1225: if (cur_hctx)
1226: blk_mq_flush_tag_batch(cur_hctx, tags, nr_tags);
1227: nr_tags = 0;
1228: cur_hctx = rq->mq_hctx;
1229: }
1230: tags[nr_tags++] = rq->tag;
1231: }
1232:
1233: if (nr_tags)
1234: blk_mq_flush_tag_batch(cur_hctx, tags, nr_tags);
1235: }
SourceFile:block/blk-mq.c]
|
| 26/2 |
2026/05/24 07:04 |
llm |
expert |
0m
Model:
Tokens:
input: 94134
output: 41
thoughts: 10
Thoughts: Okay, here's my interpretation of that thought process, assuming I'm an expert in this area and thinking about the implications of `blk_complete_request`:
**Completing the Block Request**
Alright, `blk_complete_request` is being called. That immediately tells me we're wrapping up the handling of a block I/O request. The fact that it's *being* called signals that we've reached the point where the hardware, or the backing device, has finished processing the operation. My mind instantly jumps to: what state are we in? Is this a successful completion? Was there an error? The function itself is the linchpin, the signal that the data transfer is either done as planned or there's some kind of outcome that needs to be reported back to the layers above, all the way to the application that originally initiated it.
I need to quickly assess the context: what type of request was it (read, write, discard, etc.)? What are the implications for the higher-level layers, the filesystem, and even the application? How do we handle errors? Do we need to retry? Update any statistics? Release any resources? The scheduler might be waiting for this completion to dispatch the next request. I have to make sure the right completion function is called, whether it is for a BIO, a request directly, or both. This call is critical; it's the gate that determines whether the system continues smoothly, or whether we have to handle an exception and retry.
|
| 27/2 |
2026/05/24 07:04 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:block/blk-mq.c IncludeLines:true Name:blk_complete_request]
Results: map[SourceCode: 872: /*
873: * Fully end IO on a request. Does not support partial completions, or
874: * errors.
875: */
876: static void blk_complete_request(struct request *req)
877: {
878: const bool is_flush = (req->rq_flags & RQF_FLUSH_SEQ) != 0;
879: int total_bytes = blk_rq_bytes(req);
880: struct bio *bio = req->bio;
881:
882: trace_block_rq_complete(req, BLK_STS_OK, total_bytes);
883:
884: if (!bio)
885: return;
886:
887: if (blk_integrity_rq(req) && req_op(req) == REQ_OP_READ)
888: blk_integrity_complete(req, total_bytes);
889:
890: /*
891: * Upper layers may call blk_crypto_evict_key() anytime after the last
892: * bio_endio(). Therefore, the keyslot must be released before that.
893: */
894: blk_crypto_rq_put_keyslot(req);
895:
896: blk_account_io_completion(req, total_bytes);
897:
898: do {
899: struct bio *next = bio->bi_next;
900:
901: /* Completion has already been traced */
902: bio_clear_flag(bio, BIO_TRACE_COMPLETION);
903:
904: if (blk_req_bio_is_zone_append(req, bio))
905: blk_zone_append_update_request_bio(req, bio);
906:
907: if (!is_flush)
908: bio_endio(bio);
909: bio = next;
910: } while (bio);
911:
912: /*
913: * Reset counters so that the request stacking driver
914: * can find how many bytes remain in the request
915: * later.
916: */
917: if (!req->end_io) {
918: req->bio = NULL;
919: req->__data_len = 0;
920: }
921: }
SourceFile:block/blk-mq.c]
|
| 28/2 |
2026/05/24 07:04 |
llm |
expert |
0m
Model:
Tokens:
input: 95233
output: 66
thoughts: 2687
Thoughts: **Analysis of a Kernel Deadlock Vulnerability**
Okay, so here's what I've figured out. `bio_endio` is called directly, and that triggers the `bi_end_io` callback. For writeback, this callback is something like `end_bio_bh_io_sync`, which in turn leads to `folio_end_writeback`. So, yes, `folio_end_writeback` is definitely called directly within a hardirq context. This is because `folio_end_writeback` takes `xa_lock_irqsave`, meaning `xa_lock` is HARDIRQ-irq-safe. The problem arises because `folio_end_writeback` then calls `__fprop_add_percpu_max`, which reads from `p->sequence`. If `fprop_new_period` is running on the same CPU, it has `p->sequence` locked for writing. Here's the kicker: `fprop_new_period` *doesn't* disable hardirqs, which means an NVMe interrupt can hit on that same CPU while `fprop_new_period` is accessing `p->sequence`. This creates a deadlock.
Wait, is this even a known issue?
Yep, this is a known bug. The fix is to use `write_seqcount_begin_irqsave` or `local_irq_save` in `fprop_new_period`, or to defer `folio_end_writeback` to a softirq. Currently, though, it's a real deadlock.
So, let's look at the impact:
* **Exploitable:** No. This is a deadlock, meaning a system hang, not memory corruption or privilege escalation.
* **Denial of Service:** Yes, absolutely. The system will hang.
* **Unprivileged Process Access:** Yes. A user can trigger it through writeback operations by writing to a file and `fsync`-ing it, or just writing a lot of data. The `writeout_period` timer will fire, and the NVMe interrupt can trigger the race condition.
* **User Namespace Access:** Yes.
* **VM Guest Trigger:** Yes. A guest doing disk I/O translates to host disk I/O, which can trigger the deadlock in the host.
* **VM Host Trigger (Confidential Computing):** Yes. The host can inject interrupts to cause the deadlock in the guest.
* **Network Trigger:** No. This is related to block I/O and writeback, not the network stack. It is the fact that the interrupt can happen while the seqcount is in the "write" state.
* **Remote Trigger:** No.
* **Peripheral Trigger:** No. While a peripheral could technically trigger the race, it's not a *peripheral* bug. It is a general kernel bug. A malicious USB storage device could technically control the timing of completions to trigger the deadlock, so yes, and no. But setting it to false because it is not specifically a peripheral issue.
* **Filesystem Trigger:** No. It's about writeback, not malicious filesystem images.
Now, wait, is there a network trigger involved?
Can network I/O trigger writeback?
Yes, if the network traffic is written to a file (like an NFS server). The network packet itself does not trigger the bug directly; it is the fact that a block device (like an NVMe drive) is in the dependency chain.
Okay, the issue is within `fprop_new_period` and `__folio_end_writeback` and is specifically about page writeback. Network filesystems (NFS) also use page writeback. Does NFS complete writeback in hardirq? NFS uses RPC, which completes in softirq or workqueue. So it might not take `xa_lock` in hardirq context. The dependency is created by ANY block device that completes writeback in hardirq context (like NVMe).
Once the dependency is created, lockdep will complain.
The actual deadlock requires the interrupt to hit while `fprop_new_period` is running, AND the interrupt handler must try to take `xa_lock` and read `p->sequence`. So the interrupt must be from a block device that completes writeback in hardirq context. Network interrupts don't complete block device writeback directly. They complete network packets. So network traffic cannot directly trigger the deadlock, unless the network interrupt handler somehow calls `folio_end_writeback`. Does it? No. So Network Trigger is No.
What about Peripheral Trigger?
A USB storage device (usb-storage or uas) completes I/O. Does USB complete I/O in hardirq context? USB
|
| 29/2 |
2026/05/24 07:04 |
tool |
set-results |
0m
Args: map[DenialOfService:true Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:true VMHostTrigger:true]
Results: map[DenialOfService:true Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:true VMHostTrigger:true]
|
| 30/2 |
2026/05/24 07:04 |
llm |
expert |
0m
Model:
Tokens:
input: 99075
output: 752
thoughts: 529
Thoughts: **My Analysis of the Lock Order Inversion Deadlock**
Alright, the results are in. Now it's time to craft the final explanation, breaking down this nasty bug and the logic behind it. This is a classic case of a lock order inversion, specifically a deadlock, and it's happening between two seemingly unrelated components: the `i_pages` xarray lock (`xa_lock`) and the flex_proportions sequence counter (`p->sequence`).
Here's the breakdown:
1. We have `p->sequence`, which is acquired for writing in the `fprop_new_period()` function. This function gets called from the `writeout_period` timer callback. Crucially, this all runs within a softirq context, and hard interrupts are enabled during its execution.
2. On the other hand, `xa_lock` is acquired within a hardirq context. The NVMe interrupt handler (`nvme_irq`) takes this lock when handling the completion of a writeback request, specifically during `__folio_end_writeback`.
3. The problem arises because, while holding `xa_lock`, `__folio_end_writeback` calls a sequence of functions leading to `__fprop_add_percpu_max`, which then attempts to acquire `p->sequence`, but for reading.
The deadlock occurs because if an NVMe interrupt happens on a CPU that's *already* executing `fprop_new_period()` β and therefore *already* holding `p->sequence` for writing β then the interrupt handler (now in hardirq context) will take `xa_lock` and then spin, forever waiting for `p->sequence` to be released. The thing is, the writer of `p->sequence` was interrupted by this very hardirq on the *same* CPU, leading to a spin-lock. So there's no way to ever release the lock.
As for the impact:
* **Exploitable?** No, thankfully. It's a pure deadlock, meaning there's no memory corruption, use-after-free, or out-of-bounds access. The damage is limited to halting the process in place.
* **Denial of Service?** Absolutely. The CPU will spin indefinitely within the hardirq handler. This will trigger the hard lockup detector, and the system panics. A pretty bad outcome for a subtle bug.
* **Unprivileged/User Namespace?** Yes, an unprivileged user can trigger page writeback by writing to a file on an NVMe-backed filesystem. The timer and NVMe interrupts will fire automatically, making the race condition reachable.
* **VM Guest/Host Trigger?** Yes, either a guest or a host performing disk I/O could trigger the deadlock. Even worse, a malicious host could precisely inject interrupts into a guest.
* **Network/Remote/Peripheral/Filesystem?** No. Itβs core memory management and block layer writeback code, so nothing directly related to any of the areas I usually work in.
|
| 31/1 |
2026/05/24 07:05 |
action |
format-explanation |
0m
Results: map[Explanation:**Bug Analysis:**
The reported bug is a lock order inversion (deadlock) between the `i_pages`
xarray lock (`xa_lock`) and the flex_proportions sequence counter
(`p->sequence`).
Here is the sequence of events that leads to the deadlock:
1. **Writer Context:** The `p->sequence` seqcount is acquired for write in
`fprop_new_period()`. This function is called from the `writeout_period` timer
callback, which runs in softirq context (`run_timer_softirq`). Crucially,
softirqs run with hard interrupts **enabled**, meaning this writer can be
interrupted by a hardware interrupt.
2. **Reader Context:** The `xa_lock` is acquired in hardirq context by block
device drivers (such as the NVMe driver via `nvme_irq`) when completing a
writeback request (`__folio_end_writeback`).
3. **The Deadlock:** While holding the `xa_lock` with interrupts disabled,
`__folio_end_writeback` calls `__wb_writeout_add` -> `wb_domain_writeout_add` ->
`__fprop_add_percpu_max`, which attempts to acquire `p->sequence` for read
(`read_seqcount_begin`).
If an NVMe interrupt fires on a CPU that is currently executing
`fprop_new_period()` (and thus holding `p->sequence` for write), the interrupt
handler will preempt the writer, take the `xa_lock`, and then spin forever
waiting for `p->sequence` to be released (waiting for the sequence number to
become even). However, the writer cannot make progress because it was
interrupted by this exact hardirq on the same CPU, resulting in a classic
deadlock.
**Security Impact Assessment:**
* **Exploitable:** **No.** This is a pure deadlock issue. There is no memory
corruption, use-after-free, or out-of-bounds access involved that could be
leveraged for privilege escalation or arbitrary code execution.
* **Denial Of Service:** **Yes.** The deadlock will cause the CPU to spin
indefinitely in the hardirq handler. This will quickly stall the system and
eventually trigger the hard lockup detector (NMI watchdog), resulting in a
kernel panic and halting the system.
* **Accessible From Unprivileged Processes & User Namespaces:** **Yes.** Any
unprivileged user can trigger page writeback simply by writing data to a file on
an NVMe-backed filesystem (or any block device that completes IO in hardirq
context). The `writeout_period` timer and the block device interrupts will fire
automatically as part of normal system operation, making the race condition
reachable without any special privileges or capabilities.
* **VM Guest Trigger:** **Yes.** A guest performing heavy disk I/O can cause the
host to perform disk I/O on the backing storage. If the host uses NVMe, the
guest's workload can trigger the deadlock in the host kernel.
* **VM Host Trigger in The Confidential Computing Context:** **Yes.** A
malicious host can precisely control and inject virtual interrupts into a
confidential guest. By injecting a block completion interrupt at the exact
moment the guest is executing `fprop_new_period()`, the host can
deterministically trigger the deadlock in the guest kernel.
* **Network / Remote / Peripheral / Filesystem Trigger:** **No.** The bug
resides in the core memory management and block layer writeback code. It is not
related to parsing network packets, handling untrusted USB peripherals, or
mounting malicious filesystem images.]
|