ok github.com/google/syzkaller/dashboard/app (cached) ? github.com/google/syzkaller/dashboard/dashapi [no test files] ? github.com/google/syzkaller/executor [no test files] ok github.com/google/syzkaller/pkg/ast (cached) ok github.com/google/syzkaller/pkg/bisect 17.195s ok github.com/google/syzkaller/pkg/build 6.160s ? github.com/google/syzkaller/pkg/cmdprof [no test files] ok github.com/google/syzkaller/pkg/compiler 4.927s ok github.com/google/syzkaller/pkg/config (cached) ? github.com/google/syzkaller/pkg/cover [no test files] --- FAIL: TestGenerate (1.92s) --- FAIL: TestGenerate/netbsd/amd64 (0.41s) csource_test.go:67: seed=1590071321955764654 --- FAIL: TestGenerate/netbsd/amd64/3 (0.49s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:false RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000040)=0x8) sendto(r0, &(0x7f0000000080)="8d360d8e2229aab63aef8e41582b2d02e93c2190e2fe50c1f7f3b29e853f60fb587dd78a2c404615cdf3763b9a53dba141c66b4a485450d66e0a4a281e63e3527c88cdde73010e05449a77aee1e7a35fdddea497119a92fa7fb2d108d6475f90ca55e04b82e53d6ac1138cb913b8dbb0b6f922a1a85461459190969a7d79de9164f3b4e2e9dc65817cd3908bf131ac85e8713459e5da855dd94a0feea76b05dd56d5e0b5222332210506202af0c3718596bf5549077f213886eeb0b3e38b83e237290327d0cc6d5e374a365eccda88ebf8ce4141536b085424aadb2b0c5be557bea12ea53f3fd5b7d3b48edf54f860c8a8e1941e0a56d851b2c08b8d4c9bad81ad649d1479bb60644194385d680441c674f629c50abb98ea4859798a0a3edee95e33f9c2880db8c9279f971bd597b98978bd664047c144af6c7954cc4edb914a618047a063ee7531377216a1f42404fde995936f5d7aba61bb230700ac3390d8fbc62772094fb8e543f39134132c6815d1ebf15bd0068e3b7ea86bb183465b91a431f52fe38bd0e6e077298ae8265685e46961fa82b64c5f757eaf9a7d0f63ed2849b17af0c550118c7e8e5addd917ce997796319e6bcf9bc42b8ba87c94e5a31b1cecb2fde9c571f9a87a88230f8093a7ae80a0c45c3ceec69f1e1f844296045070f3728ec4fa644cd74881db3c72352e4b8318f8834ac6306a5698ce9a5eb314f3f8647067bd6de7c90940645931c310aa55e4268ecbaf64c9d8c9ace54fc9f224746ddd681840c392f274753342ef48ac1973abf5c38d0776bd61c087d7b54b1f93eaed1a7c9f73427e38d5e3ca2cd17fa00c69873921ed8f2b8b9f89509134f723b6980831f5504a65602bd9367a151c570a705910afd9f69116737327c193a8751d9c161b5b2ef4e406055fe79c570f7c3e8334623ef02b9f47eecb78d30db147d4fc90bc91faec2d9181206e41cccde0c21483bfd0c45d8765a13d69e22479c21816dbd590ae51e49f6058449b9d3dbe94075e2e57028f43f70201a1e4875b91697c29deb8c2572a105131c87f7685cad94d1321d4ae5cc6efede11ac80a0e00a63b2ba54fcc5195475c3f1ff572693d00e491a0445c987dedcbe73b69ec13d226b193ec03fa9a27a4a434d148983366c7d8e5bc3cea9fbeffd05b8b0090765159b380ac96429655125921507f97df3e9d41c66b2f5fffd0cad4826577916f941ac7c9ec7ab625ec9390e050c5885dbd2e7131f2794ecad5709e0ac395ad0edee0182822374e701167ad2cfda07ff9e9bddee1c688d483c132e197a9481c9eb0df2cf9669ab107cc936bf2c96268a120a44fb7f178b402ecd9c512f86908f43fea11cc6902c355929b910a523acd16d5931ea41753391a0368e5bbe9e8cd926da120d8440fce2c192b1e5986854de8551320c989533771f1a71fb41ff1c927ffba9e9e25ae533db6a3c804b0b340a0409e110ac76a7b58f912db41e33b115e1c3ae9aa0399edd621a0fd4b7be2176cb49682ee82b2a219baace63b3822b98ba6f48cd34a08143321993c4390b94b138e4adcfd47dd01982e24acb8d464738f44af04ff3353f8683f352306457522e653baa8937950448eef9879dfaa42e9fcca9a968971b60c413f4aa3e0f90b41c7828ad5dbb62aae0cd2d2ef85e248bf12e4d6d75b803aca52bb9616acc37bc8bdab1a66661a5329dc936b1dbc83fd598c57b9ad80ac42c21a6318b3fb8d0d865fffb043217c42f9546c050eb8cce5e3423371a93aff46471d2008c8cd5841f849d1f0d58317353a6d7308f7962d943795bd52a4dd5a8440640273c78ef6ebbeaae9143d5e6ee90cdaa257e132e6d42d02b9567ae69b75bc60f7596a1fdd8179cff323991701062930ce23a29e30023da9d631bf61a6440acc290bdeafbaaea78365f408aea8f864da220e7a560c9ac84bb9c975814c132f97e08b64ccad47ceb08f2941a4438feb76560b1d5e6f3289f50d054e949674eb6c3294cc4a27427650c4a37f53c65c55ca410fa62ee18a829220360a8272f8c0041e2bf33f047928feb0269c438bdf399b1d8f187b2454ea5cd873e352e1d0781570234c6d810c5a16bac9ea9ffafb0c978a022276903a1c653f17d96659cbb30abc1a320c584bdfcc00125270c2d4c90950029f711575dfa828feea3b1dc83c0701dffac1f89536583a0c0995550f862c3ec786c0f8fee0fd94fae0a661313f9e753362336db3ea0296d7fb913ad490bfc9dd155307ab14e67114fcde26d032435cec7d29247deb93bcf7fa48b4ddb5fb7449c0fda083d5a63e03922d5dfb361b7eeb122a094c3b08eacbd43cecc76c29a9bbcd4808bfa6eaeb78d3453e30660d1653569841869e3d8b90f3d047388da51919cf056ce1ce1d455177c95cdb8f76637d5336e82c9e10ddfd33515f7491ef28cbe4c8a477086daeb525d097844879d140965ef0463b3e1780065da2255e68aee903f7b06b0824b151525c56063d4be22ee31b82d2029fef15f38f9008d785dcab9f1454185ec4a3d76ed3aa8d27859f66ae63eddd338ac28f64048e46a5d0731f9b7ebe52218e11e78cb6d8172aea44f2c213ce7f5edfaed81c5de95a86aba484ec2e1950f61e743f11fbd881f2b0c891aa6e94fff4e5d747971313613da54b5483aabe5b12a8e661d455cdf442b86f3cd8b6e95e2ebfba7c62001769d5d9725f1df8ff364ff45f65b16fb2a828638313dbaac9818f990e8590d54b67613430b9f1869b7f2f756e4af19a145105b7b0f7c889b3146533114d001fc2c1b6b285ded35fd0b17857da527e80658f0b717a8c98920f72289896f05a686083fa9e84ee9f0590793b484365159cd18d9290fc7b342b3926bccdc830a519b8abd07e5b885cc4a6046423d5fa976588510cf5b0cfeaa38e7d170feb401bf9b3e4284415b8e2d2b8d73a0bfda6e246d4075c16f3bf8c1d8a1969dc57fc8786b1e4afb4ec6769534debe49ef6873e76289c6442c6d690457af91df631c7b0d4d0a18a43b26803bfe374a81de3c182b4dc50683f8545157b40f4b44db5eff729645421817ff5fdd0b4ca5cc2ba9b23c33256074b0cd5938aacea39e5cb5af7ec444267f1419867e355de6700ae0a63b7a57eaabe21aee216048612ec6c6993a577ca4d7a0071f5680d89baa337a37a5d1af9dc359d9708ddab0bb96323ae8f6a48d2b8b42d47d4a051b55d14116a359899c79011f2db86e08c2fb7c7d836355cd55f33aba9cb80a10c0844011e3ffa01f5472233fbaebe45f044154220094bf7da1a4035c195978e1b97eac6c41010b27dfb5df985ab16d219f415528b0403846b326f0a00f7b73c89933e1a2daa58dd8dee2f91e2d083eb25508ad3b3e916cf7e002140ed65ebe55ed8bec0cea09a5a61f7262aaa61cbf09d16ff6aac48c511fb8220dc5e20c3d4ce6283c53442a5cf408f3e66734208cc4f13a90a9ad6f90c1db802abcff903addba309ad25dd56cf6d37f32f82eb07fce24ac33e48451e7719e323f512a459a172172ff94d41be609aba82bcb7d827dfc73b4875209aa392c6f0d24f95bb900814fbff19c8d51d421270363bc808f29e21e14f6c99a13f8000fbfbc1cae461215fbba52511c9d14aaedb16e3a3725534b5713c554f1e5ebdc2abfaa712cf0d8ff6699cf0949f89b187e58bbac15927a701432f81b61e797136789ae2e824b0a74c553d59b7a1a1d512fec36c863422f0634560064ad2c310895d6d8a1a3f9429f08a7360cd4b4f9f208bf6d210d809796276e7a900ea994d3f8a3c3be28c3384c8d822fd108e8e9a195798149beb3e4eed373edac2bbc957b3f0432bcddc9556b734b19f91d94d21a881fbc882603f7da7f8993a74d5b12670f87aa69885abea718b67a700caf9fac78122a83b282099952664e5e8446a23b4bb3c01b1b4a9dca924fe0210445dd5e8ce3bdf2429463df24de0cb74bfc162847a6177d42feb487c89e1fd76fc59e4feaab91d6fadfa65a872a8128ea56f4914fb55165598db63bd701573f8ca7b78b69fe0983f1aadb99bb0ccbf9e2409d2833f9ab80296f9795c5e5740ebebb71238c6898dbd6e043cd6031c1590edfe763446a96d3806d62ef9a7467f4545d4b958ab916939d985856d06cc9369194329b961c0b767a76624104d3cacb9119d17499d83c1e6f95f4c79de2aae011413facd8962980b5327c7e22b516c841a985646e38126fb50c8bba642076489a8a8cc21cac2e92e6d459d5666b868da0e30121e972324076476490170f513efc5dcf57ce85d81c9fffceefb19ec98278e13abb2f322af44b980f9ef522e98d909507a8eeb7a0bd927d621e0fbfa06a9ca8f2f9978aae462db2cce9240c82942957472c722a0cbc1c84e6c7cd86bf6534d05090396b70cef7c77a29f06e5360d9c5c426988ee7653d022c1b49bc99494bc661c42b97b62c0f5351b5aabcaf1e22a6cb70d348753711f9063f87b292edf6137ac524b2a4cdf8d3a8ca035fd959ea40297645253a33946687bee09f66132f2cbca0f451b82108f4e68683fcef2cb3282d38fe47f6be597a0aba1b637e24fa2ea26f890f5e8cd2e438b0c42319c3f482b21b3b36e9b66907ab9451aa2d5b0d848c958179cd2c138e7a8133d10b952745c6f9c5ad206b13ae83e21236e06a27e60f54c15fdf96c084ee9253af3ae53f1e5c79bf61eef8cd90f382da1f2c072272bf9fc89b4fc6c18a57e197a366fdb5af0ff28131f42690ec69d59fae8c8f43c8f3cf4eacbdcf3e162e492e1bd533abe70bac53f9868c1995921c79d09f67a6b724410a468129f990d150e95663e54551feb97a4304f92ab3db2a43ca841ee3b0f6b62c751f6016b8439d5a08db8d34faa4ba7a7617fe5bbf1f8fcb5a9f55f1a1db83645eb93bde600032bbac895863cc54f09a9fe1e190a08abc6c080badd8245bb9918713ddaead377afbdcbc7cf4d191f6ca2fe2defa45c3c3353c277e1130284cd441da774eb16e7bf11ad0beef302022a18cf0479285df7f64feacacaef8ca50c201cb9001087611c4cd16f1ab6782d7eafae094c93cf301477a678c9ec482baa1d1d1a405494b67b35057b691af44dc3be73e26ab2b6fbe5d2e2117e0c6d0e964b3826a6e057c80e4f0ed78ed1310c24516b95dcefcf5dfd7e79e5e24e6922ade7efdc2242934973f636e300cbe5002f8bb0413a76baee10099b1008e384b8644188932abf79d0f26c66ebd662add68e039212bf4fd801114196e105d958ade15fb451fb5d5d90fee2ecb792bb5c864125bb3e63e0a7b59ff54f5d52ec590708840bbf134e25625690b262e5493a53ef206ce25c6b4dcbf3d8ebab2806f96b6a96eedebb2930fd7230e9601ce4ab66d721e856eedd6704f0b673e0febabd1148469bdf93c890c637c542b5fd4dc21b898c8c0150a1bc2817542e211205dc70be74977c37901fdc734613e5c1f40efbdf19b983abba0ddad01d0ab654b2e34c656090351a515aca39f58b3485da7c0a696952ea618f1f79eb7c55b056eec77e22224bd79d2ad9f597f12dcdd7c7160518ccd77bb5317ac0ea66b6a80a2cc4e28ae3881c59dff4d4684779776bf9e3accc8384f2a1f05cd3cadb345a27669ea1c059e086f421346ae2cf95d19f75941eed79c775eb557e252e08d9662204006d2ba9375bd871f6b64a0633a3b271d8f1ac39d39e6a5100c99effd2a09df4b49d1a41176d4de1a4236c8190bffad251a113cc16d499ac212db31b26497a399ce1acc2b4a63ceee193bfb94bf91dc309c7ba4664b4e99c745786b7", 0x1000, 0x3, &(0x7f0000001080)=@in={0x2, 0x2}, 0xc) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000010c0)=""/205, 0xcd, 0x802, &(0x7f00000011c0)={0x2, 0x0}, 0xc) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001200)="6534640a5e7748511a23bf5623", 0xd) r1 = paccept(0xffffffffffffff9c, &(0x7f0000001240)=@in, &(0x7f0000001280)=0xc, 0x0) connect$inet6(r1, &(0x7f00000012c0)={0x18, 0x3, 0x1, 0x800}, 0xc) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000001300)=@file={0x0, ""/4096}, &(0x7f0000002340)=0x1002) pwritev(r2, &(0x7f00000024c0)=[{&(0x7f0000002380)="ce0fdad9a64a58f784d8087af805aa2bd2f9b86b22d9b2c32c5873c3f32befbc76c47e31e95cb5772009974106dd56e9b77e9ef21b64ebda31080530f8dbeb72d1925f06c0e6163c8737293d3334cdfe5de421f33504eaa8024bcb42a0ad53d6bd25e3b6650362969853803300c71d1231f73d20109fd2b805d7c0de0668001886e4a380880e169de677cb124cc60578020ffecbe8381965697296f87ca1dd26d239f00c44d28f440468978edf019a5db050913f841895d9d9a42a50fd2953af0bd6c692835f5f28b46768fc540014f8d3ee3d80175cd9bca3e52d0a15b88773f3b8110890f4dffe75433fdabac54c62298a", 0xf2}, {&(0x7f0000002480)="80242bebc81bd3dadcb992d2de24b81300a636d3a64bdfe93133e14429da14cf317eded200e371e34aef0bbaf272a4e8778908", 0x33}], 0x2, 0x51) getpeername(r2, &(0x7f0000002500)=@in, &(0x7f0000002540)=0xc) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_ethernet(0x33, &(0x7f0000000000)="48f7f190c685fad5020b2c726eadc83c0867b01c6b28ea05f4bd0544eb883ec3d8897d9aee86bcb2c90ebe68774c206570c903") syz_execute_func(&(0x7f0000000040)="c4227db74b0b458657fb66440f38dcd2c481f95bfe0f49f8660f3a0c9bb4000000fec4a2fda6fcc4a14dd516c40194596d6466410f6c23") syz_extract_tcp_res(&(0x7f0000000080), 0x6, 0x8000) syz_usb_connect(0x1e3d802a, 0xef, &(0x7f00000000c0)="53890ef7069cebf4ab2e3862d4e8f0d7cd39046611d86efa403d25558c0de4ab33f831e6f5f52956032835783bf2d0f5817f8b8dda73c7542d9f0d12a631e25a3ee4dcfb6ae2f968a825dac5812d8c6b8264e0b78c3daa0c76237a223a71f50ba36e784b03b1f38705a237cf14c437fdc2363dc773b1946be9835bd59cf8390038fb9bac191ec255eaf70ea2b563db022460b05e8d6acc51ea2dc25ff06b2add98890a727807072b47f38ee42d6367e7d3548d3f13ca5574426df294626c3ef4b8cf7aea4830b70d93122efd51fce48496a5bd03e305f2ad871969c97ceff6b6c2286c5431b9fdbd8837629298cb4e", &(0x7f00000001c0)="a185224a16ff1a062f6f9766aeb7f58408b028450e80970d9250114b2c871d5d9ec67f7990a305b4be2c41d35d3316a7f4c9b27401f8440e71a579b7f9acc606d20da088c7077bbc3c361e71c577406168bcc1bcb7f02e416e3f908403e23db0c727ea769debda4d0e524f8adf7f42184a20ba1a23f9c58d46914cc7b12c19537d55a40fcd26c68efb09dc0acc2ee7524abec0b8035ad2b1d194331e2ea4e42ebc53d3880e7c0dd6c57902c8727cefb0fd3192d662") r3 = syz_usb_connect(0xa4, 0x6f, &(0x7f0000000280)="b748b21b78ea22216c2cbfdccb03ec54d20f30f4af462b7bfd5d301b9a4fb8f9bbe630dde8d60855029447df51120e0d690ae4a73e5a06064cc06d83622a66c3cf3ccd920df4a9dec547f0c85354b2e803699f52ffc814536ce519c7c16526da56c65b4429cb224ad9c97f637ee6f2", &(0x7f0000000300)="fca1691e90fef7c0693e50161f6bf9d6be11621b96a65d5023d66e18c9dc3bb38cf479306eff4d2cf175b6f85215446b2379fdc73274566c4ca7cec4d66a481912afe23a3f61adb9467e5bf828156436ebe3d29e3073e4254b3a734acd66d14efb0736fcadff4dad73e02531870c30fae0c378c515786c88c1292736cdf0b6a2e79b47a78e33f5e1d0688a6f3ce2d9e15bd3ee2e2afe1ac5c8523a84a208755a7f822f3d211fe3a26a86507d98583d566a0591a7802cb3f9f9dc35b9110de4b2f4d3934bb20b7a") syz_usb_disconnect(r3) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bEndpointAddress; uint8_t bmAttributes; uint16_t wMaxPacketSize; uint8_t bInterval; uint8_t bRefresh; uint8_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint16_t idVendor; uint16_t idProduct; uint16_t bcdDevice; uint8_t iManufacturer; uint8_t iProduct; uint8_t iSerialNumber; uint8_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t wTotalLength; uint8_t bNumInterfaces; uint8_t bConfigurationValue; uint8_t iConfiguration; uint8_t bmAttributes; uint8_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bNumEndpoints; uint8_t bInterfaceClass; uint8_t bInterfaceSubClass; uint8_t bInterfaceProtocol; uint8_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint8_t bNumConfigurations; uint8_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void loop(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } #ifndef SYS_accept #define SYS_accept 30 #endif #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getpeername #define SYS_getpeername 31 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_pwritev #define SYS_pwritev 290 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 29 #endif #ifndef SYS_sendto #define SYS_sendto 133 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 105 #endif uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: *(uint32_t*)0x20000040 = 8; res = syscall(SYS_accept, -1, 0x20000000ul, 0x20000040ul); if (res != -1) r[0] = res; break; case 1: memcpy((void*)0x20000080, "\x8d\x36\x0d\x8e\x22\x29\xaa\xb6\x3a\xef\x8e\x41\x58\x2b\x2d\x02\xe9\x3c\x21\x90\xe2\xfe\x50\xc1\xf7\xf3\xb2\x9e\x85\x3f\x60\xfb\x58\x7d\xd7\x8a\x2c\x40\x46\x15\xcd\xf3\x76\x3b\x9a\x53\xdb\xa1\x41\xc6\x6b\x4a\x48\x54\x50\xd6\x6e\x0a\x4a\x28\x1e\x63\xe3\x52\x7c\x88\xcd\xde\x73\x01\x0e\x05\x44\x9a\x77\xae\xe1\xe7\xa3\x5f\xdd\xde\xa4\x97\x11\x9a\x92\xfa\x7f\xb2\xd1\x08\xd6\x47\x5f\x90\xca\x55\xe0\x4b\x82\xe5\x3d\x6a\xc1\x13\x8c\xb9\x13\xb8\xdb\xb0\xb6\xf9\x22\xa1\xa8\x54\x61\x45\x91\x90\x96\x9a\x7d\x79\xde\x91\x64\xf3\xb4\xe2\xe9\xdc\x65\x81\x7c\xd3\x90\x8b\xf1\x31\xac\x85\xe8\x71\x34\x59\xe5\xda\x85\x5d\xd9\x4a\x0f\xee\xa7\x6b\x05\xdd\x56\xd5\xe0\xb5\x22\x23\x32\x21\x05\x06\x20\x2a\xf0\xc3\x71\x85\x96\xbf\x55\x49\x07\x7f\x21\x38\x86\xee\xb0\xb3\xe3\x8b\x83\xe2\x37\x29\x03\x27\xd0\xcc\x6d\x5e\x37\x4a\x36\x5e\xcc\xda\x88\xeb\xf8\xce\x41\x41\x53\x6b\x08\x54\x24\xaa\xdb\x2b\x0c\x5b\xe5\x57\xbe\xa1\x2e\xa5\x3f\x3f\xd5\xb7\xd3\xb4\x8e\xdf\x54\xf8\x60\xc8\xa8\xe1\x94\x1e\x0a\x56\xd8\x51\xb2\xc0\x8b\x8d\x4c\x9b\xad\x81\xad\x64\x9d\x14\x79\xbb\x60\x64\x41\x94\x38\x5d\x68\x04\x41\xc6\x74\xf6\x29\xc5\x0a\xbb\x98\xea\x48\x59\x79\x8a\x0a\x3e\xde\xe9\x5e\x33\xf9\xc2\x88\x0d\xb8\xc9\x27\x9f\x97\x1b\xd5\x97\xb9\x89\x78\xbd\x66\x40\x47\xc1\x44\xaf\x6c\x79\x54\xcc\x4e\xdb\x91\x4a\x61\x80\x47\xa0\x63\xee\x75\x31\x37\x72\x16\xa1\xf4\x24\x04\xfd\xe9\x95\x93\x6f\x5d\x7a\xba\x61\xbb\x23\x07\x00\xac\x33\x90\xd8\xfb\xc6\x27\x72\x09\x4f\xb8\xe5\x43\xf3\x91\x34\x13\x2c\x68\x15\xd1\xeb\xf1\x5b\xd0\x06\x8e\x3b\x7e\xa8\x6b\xb1\x83\x46\x5b\x91\xa4\x31\xf5\x2f\xe3\x8b\xd0\xe6\xe0\x77\x29\x8a\xe8\x26\x56\x85\xe4\x69\x61\xfa\x82\xb6\x4c\x5f\x75\x7e\xaf\x9a\x7d\x0f\x63\xed\x28\x49\xb1\x7a\xf0\xc5\x50\x11\x8c\x7e\x8e\x5a\xdd\xd9\x17\xce\x99\x77\x96\x31\x9e\x6b\xcf\x9b\xc4\x2b\x8b\xa8\x7c\x94\xe5\xa3\x1b\x1c\xec\xb2\xfd\xe9\xc5\x71\xf9\xa8\x7a\x88\x23\x0f\x80\x93\xa7\xae\x80\xa0\xc4\x5c\x3c\xee\xc6\x9f\x1e\x1f\x84\x42\x96\x04\x50\x70\xf3\x72\x8e\xc4\xfa\x64\x4c\xd7\x48\x81\xdb\x3c\x72\x35\x2e\x4b\x83\x18\xf8\x83\x4a\xc6\x30\x6a\x56\x98\xce\x9a\x5e\xb3\x14\xf3\xf8\x64\x70\x67\xbd\x6d\xe7\xc9\x09\x40\x64\x59\x31\xc3\x10\xaa\x55\xe4\x26\x8e\xcb\xaf\x64\xc9\xd8\xc9\xac\xe5\x4f\xc9\xf2\x24\x74\x6d\xdd\x68\x18\x40\xc3\x92\xf2\x74\x75\x33\x42\xef\x48\xac\x19\x73\xab\xf5\xc3\x8d\x07\x76\xbd\x61\xc0\x87\xd7\xb5\x4b\x1f\x93\xea\xed\x1a\x7c\x9f\x73\x42\x7e\x38\xd5\xe3\xca\x2c\xd1\x7f\xa0\x0c\x69\x87\x39\x21\xed\x8f\x2b\x8b\x9f\x89\x50\x91\x34\xf7\x23\xb6\x98\x08\x31\xf5\x50\x4a\x65\x60\x2b\xd9\x36\x7a\x15\x1c\x57\x0a\x70\x59\x10\xaf\xd9\xf6\x91\x16\x73\x73\x27\xc1\x93\xa8\x75\x1d\x9c\x16\x1b\x5b\x2e\xf4\xe4\x06\x05\x5f\xe7\x9c\x57\x0f\x7c\x3e\x83\x34\x62\x3e\xf0\x2b\x9f\x47\xee\xcb\x78\xd3\x0d\xb1\x47\xd4\xfc\x90\xbc\x91\xfa\xec\x2d\x91\x81\x20\x6e\x41\xcc\xcd\xe0\xc2\x14\x83\xbf\xd0\xc4\x5d\x87\x65\xa1\x3d\x69\xe2\x24\x79\xc2\x18\x16\xdb\xd5\x90\xae\x51\xe4\x9f\x60\x58\x44\x9b\x9d\x3d\xbe\x94\x07\x5e\x2e\x57\x02\x8f\x43\xf7\x02\x01\xa1\xe4\x87\x5b\x91\x69\x7c\x29\xde\xb8\xc2\x57\x2a\x10\x51\x31\xc8\x7f\x76\x85\xca\xd9\x4d\x13\x21\xd4\xae\x5c\xc6\xef\xed\xe1\x1a\xc8\x0a\x0e\x00\xa6\x3b\x2b\xa5\x4f\xcc\x51\x95\x47\x5c\x3f\x1f\xf5\x72\x69\x3d\x00\xe4\x91\xa0\x44\x5c\x98\x7d\xed\xcb\xe7\x3b\x69\xec\x13\xd2\x26\xb1\x93\xec\x03\xfa\x9a\x27\xa4\xa4\x34\xd1\x48\x98\x33\x66\xc7\xd8\xe5\xbc\x3c\xea\x9f\xbe\xff\xd0\x5b\x8b\x00\x90\x76\x51\x59\xb3\x80\xac\x96\x42\x96\x55\x12\x59\x21\x50\x7f\x97\xdf\x3e\x9d\x41\xc6\x6b\x2f\x5f\xff\xd0\xca\xd4\x82\x65\x77\x91\x6f\x94\x1a\xc7\xc9\xec\x7a\xb6\x25\xec\x93\x90\xe0\x50\xc5\x88\x5d\xbd\x2e\x71\x31\xf2\x79\x4e\xca\xd5\x70\x9e\x0a\xc3\x95\xad\x0e\xde\xe0\x18\x28\x22\x37\x4e\x70\x11\x67\xad\x2c\xfd\xa0\x7f\xf9\xe9\xbd\xde\xe1\xc6\x88\xd4\x83\xc1\x32\xe1\x97\xa9\x48\x1c\x9e\xb0\xdf\x2c\xf9\x66\x9a\xb1\x07\xcc\x93\x6b\xf2\xc9\x62\x68\xa1\x20\xa4\x4f\xb7\xf1\x78\xb4\x02\xec\xd9\xc5\x12\xf8\x69\x08\xf4\x3f\xea\x11\xcc\x69\x02\xc3\x55\x92\x9b\x91\x0a\x52\x3a\xcd\x16\xd5\x93\x1e\xa4\x17\x53\x39\x1a\x03\x68\xe5\xbb\xe9\xe8\xcd\x92\x6d\xa1\x20\xd8\x44\x0f\xce\x2c\x19\x2b\x1e\x59\x86\x85\x4d\xe8\x55\x13\x20\xc9\x89\x53\x37\x71\xf1\xa7\x1f\xb4\x1f\xf1\xc9\x27\xff\xba\x9e\x9e\x25\xae\x53\x3d\xb6\xa3\xc8\x04\xb0\xb3\x40\xa0\x40\x9e\x11\x0a\xc7\x6a\x7b\x58\xf9\x12\xdb\x41\xe3\x3b\x11\x5e\x1c\x3a\xe9\xaa\x03\x99\xed\xd6\x21\xa0\xfd\x4b\x7b\xe2\x17\x6c\xb4\x96\x82\xee\x82\xb2\xa2\x19\xba\xac\xe6\x3b\x38\x22\xb9\x8b\xa6\xf4\x8c\xd3\x4a\x08\x14\x33\x21\x99\x3c\x43\x90\xb9\x4b\x13\x8e\x4a\xdc\xfd\x47\xdd\x01\x98\x2e\x24\xac\xb8\xd4\x64\x73\x8f\x44\xaf\x04\xff\x33\x53\xf8\x68\x3f\x35\x23\x06\x45\x75\x22\xe6\x53\xba\xa8\x93\x79\x50\x44\x8e\xef\x98\x79\xdf\xaa\x42\xe9\xfc\xca\x9a\x96\x89\x71\xb6\x0c\x41\x3f\x4a\xa3\xe0\xf9\x0b\x41\xc7\x82\x8a\xd5\xdb\xb6\x2a\xae\x0c\xd2\xd2\xef\x85\xe2\x48\xbf\x12\xe4\xd6\xd7\x5b\x80\x3a\xca\x52\xbb\x96\x16\xac\xc3\x7b\xc8\xbd\xab\x1a\x66\x66\x1a\x53\x29\xdc\x93\x6b\x1d\xbc\x83\xfd\x59\x8c\x57\xb9\xad\x80\xac\x42\xc2\x1a\x63\x18\xb3\xfb\x8d\x0d\x86\x5f\xff\xb0\x43\x21\x7c\x42\xf9\x54\x6c\x05\x0e\xb8\xcc\xe5\xe3\x42\x33\x71\xa9\x3a\xff\x46\x47\x1d\x20\x08\xc8\xcd\x58\x41\xf8\x49\xd1\xf0\xd5\x83\x17\x35\x3a\x6d\x73\x08\xf7\x96\x2d\x94\x37\x95\xbd\x52\xa4\xdd\x5a\x84\x40\x64\x02\x73\xc7\x8e\xf6\xeb\xbe\xaa\xe9\x14\x3d\x5e\x6e\xe9\x0c\xda\xa2\x57\xe1\x32\xe6\xd4\x2d\x02\xb9\x56\x7a\xe6\x9b\x75\xbc\x60\xf7\x59\x6a\x1f\xdd\x81\x79\xcf\xf3\x23\x99\x17\x01\x06\x29\x30\xce\x23\xa2\x9e\x30\x02\x3d\xa9\xd6\x31\xbf\x61\xa6\x44\x0a\xcc\x29\x0b\xde\xaf\xba\xae\xa7\x83\x65\xf4\x08\xae\xa8\xf8\x64\xda\x22\x0e\x7a\x56\x0c\x9a\xc8\x4b\xb9\xc9\x75\x81\x4c\x13\x2f\x97\xe0\x8b\x64\xcc\xad\x47\xce\xb0\x8f\x29\x41\xa4\x43\x8f\xeb\x76\x56\x0b\x1d\x5e\x6f\x32\x89\xf5\x0d\x05\x4e\x94\x96\x74\xeb\x6c\x32\x94\xcc\x4a\x27\x42\x76\x50\xc4\xa3\x7f\x53\xc6\x5c\x55\xca\x41\x0f\xa6\x2e\xe1\x8a\x82\x92\x20\x36\x0a\x82\x72\xf8\xc0\x04\x1e\x2b\xf3\x3f\x04\x79\x28\xfe\xb0\x26\x9c\x43\x8b\xdf\x39\x9b\x1d\x8f\x18\x7b\x24\x54\xea\x5c\xd8\x73\xe3\x52\xe1\xd0\x78\x15\x70\x23\x4c\x6d\x81\x0c\x5a\x16\xba\xc9\xea\x9f\xfa\xfb\x0c\x97\x8a\x02\x22\x76\x90\x3a\x1c\x65\x3f\x17\xd9\x66\x59\xcb\xb3\x0a\xbc\x1a\x32\x0c\x58\x4b\xdf\xcc\x00\x12\x52\x70\xc2\xd4\xc9\x09\x50\x02\x9f\x71\x15\x75\xdf\xa8\x28\xfe\xea\x3b\x1d\xc8\x3c\x07\x01\xdf\xfa\xc1\xf8\x95\x36\x58\x3a\x0c\x09\x95\x55\x0f\x86\x2c\x3e\xc7\x86\xc0\xf8\xfe\xe0\xfd\x94\xfa\xe0\xa6\x61\x31\x3f\x9e\x75\x33\x62\x33\x6d\xb3\xea\x02\x96\xd7\xfb\x91\x3a\xd4\x90\xbf\xc9\xdd\x15\x53\x07\xab\x14\xe6\x71\x14\xfc\xde\x26\xd0\x32\x43\x5c\xec\x7d\x29\x24\x7d\xeb\x93\xbc\xf7\xfa\x48\xb4\xdd\xb5\xfb\x74\x49\xc0\xfd\xa0\x83\xd5\xa6\x3e\x03\x92\x2d\x5d\xfb\x36\x1b\x7e\xeb\x12\x2a\x09\x4c\x3b\x08\xea\xcb\xd4\x3c\xec\xc7\x6c\x29\xa9\xbb\xcd\x48\x08\xbf\xa6\xea\xeb\x78\xd3\x45\x3e\x30\x66\x0d\x16\x53\x56\x98\x41\x86\x9e\x3d\x8b\x90\xf3\xd0\x47\x38\x8d\xa5\x19\x19\xcf\x05\x6c\xe1\xce\x1d\x45\x51\x77\xc9\x5c\xdb\x8f\x76\x63\x7d\x53\x36\xe8\x2c\x9e\x10\xdd\xfd\x33\x51\x5f\x74\x91\xef\x28\xcb\xe4\xc8\xa4\x77\x08\x6d\xae\xb5\x25\xd0\x97\x84\x48\x79\xd1\x40\x96\x5e\xf0\x46\x3b\x3e\x17\x80\x06\x5d\xa2\x25\x5e\x68\xae\xe9\x03\xf7\xb0\x6b\x08\x24\xb1\x51\x52\x5c\x56\x06\x3d\x4b\xe2\x2e\xe3\x1b\x82\xd2\x02\x9f\xef\x15\xf3\x8f\x90\x08\xd7\x85\xdc\xab\x9f\x14\x54\x18\x5e\xc4\xa3\xd7\x6e\xd3\xaa\x8d\x27\x85\x9f\x66\xae\x63\xed\xdd\x33\x8a\xc2\x8f\x64\x04\x8e\x46\xa5\xd0\x73\x1f\x9b\x7e\xbe\x52\x21\x8e\x11\xe7\x8c\xb6\xd8\x17\x2a\xea\x44\xf2\xc2\x13\xce\x7f\x5e\xdf\xae\xd8\x1c\x5d\xe9\x5a\x86\xab\xa4\x84\xec\x2e\x19\x50\xf6\x1e\x74\x3f\x11\xfb\xd8\x81\xf2\xb0\xc8\x91\xaa\x6e\x94\xff\xf4\xe5\xd7\x47\x97\x13\x13\x61\x3d\xa5\x4b\x54\x83\xaa\xbe\x5b\x12\xa8\xe6\x61\xd4\x55\xcd\xf4\x42\xb8\x6f\x3c\xd8\xb6\xe9\x5e\x2e\xbf\xba\x7c\x62\x00\x17\x69\xd5\xd9\x72\x5f\x1d\xf8\xff\x36\x4f\xf4\x5f\x65\xb1\x6f\xb2\xa8\x28\x63\x83\x13\xdb\xaa\xc9\x81\x8f\x99\x0e\x85\x90\xd5\x4b\x67\x61\x34\x30\xb9\xf1\x86\x9b\x7f\x2f\x75\x6e\x4a\xf1\x9a\x14\x51\x05\xb7\xb0\xf7\xc8\x89\xb3\x14\x65\x33\x11\x4d\x00\x1f\xc2\xc1\xb6\xb2\x85\xde\xd3\x5f\xd0\xb1\x78\x57\xda\x52\x7e\x80\x65\x8f\x0b\x71\x7a\x8c\x98\x92\x0f\x72\x28\x98\x96\xf0\x5a\x68\x60\x83\xfa\x9e\x84\xee\x9f\x05\x90\x79\x3b\x48\x43\x65\x15\x9c\xd1\x8d\x92\x90\xfc\x7b\x34\x2b\x39\x26\xbc\xcd\xc8\x30\xa5\x19\xb8\xab\xd0\x7e\x5b\x88\x5c\xc4\xa6\x04\x64\x23\xd5\xfa\x97\x65\x88\x51\x0c\xf5\xb0\xcf\xea\xa3\x8e\x7d\x17\x0f\xeb\x40\x1b\xf9\xb3\xe4\x28\x44\x15\xb8\xe2\xd2\xb8\xd7\x3a\x0b\xfd\xa6\xe2\x46\xd4\x07\x5c\x16\xf3\xbf\x8c\x1d\x8a\x19\x69\xdc\x57\xfc\x87\x86\xb1\xe4\xaf\xb4\xec\x67\x69\x53\x4d\xeb\xe4\x9e\xf6\x87\x3e\x76\x28\x9c\x64\x42\xc6\xd6\x90\x45\x7a\xf9\x1d\xf6\x31\xc7\xb0\xd4\xd0\xa1\x8a\x43\xb2\x68\x03\xbf\xe3\x74\xa8\x1d\xe3\xc1\x82\xb4\xdc\x50\x68\x3f\x85\x45\x15\x7b\x40\xf4\xb4\x4d\xb5\xef\xf7\x29\x64\x54\x21\x81\x7f\xf5\xfd\xd0\xb4\xca\x5c\xc2\xba\x9b\x23\xc3\x32\x56\x07\x4b\x0c\xd5\x93\x8a\xac\xea\x39\xe5\xcb\x5a\xf7\xec\x44\x42\x67\xf1\x41\x98\x67\xe3\x55\xde\x67\x00\xae\x0a\x63\xb7\xa5\x7e\xaa\xbe\x21\xae\xe2\x16\x04\x86\x12\xec\x6c\x69\x93\xa5\x77\xca\x4d\x7a\x00\x71\xf5\x68\x0d\x89\xba\xa3\x37\xa3\x7a\x5d\x1a\xf9\xdc\x35\x9d\x97\x08\xdd\xab\x0b\xb9\x63\x23\xae\x8f\x6a\x48\xd2\xb8\xb4\x2d\x47\xd4\xa0\x51\xb5\x5d\x14\x11\x6a\x35\x98\x99\xc7\x90\x11\xf2\xdb\x86\xe0\x8c\x2f\xb7\xc7\xd8\x36\x35\x5c\xd5\x5f\x33\xab\xa9\xcb\x80\xa1\x0c\x08\x44\x01\x1e\x3f\xfa\x01\xf5\x47\x22\x33\xfb\xae\xbe\x45\xf0\x44\x15\x42\x20\x09\x4b\xf7\xda\x1a\x40\x35\xc1\x95\x97\x8e\x1b\x97\xea\xc6\xc4\x10\x10\xb2\x7d\xfb\x5d\xf9\x85\xab\x16\xd2\x19\xf4\x15\x52\x8b\x04\x03\x84\x6b\x32\x6f\x0a\x00\xf7\xb7\x3c\x89\x93\x3e\x1a\x2d\xaa\x58\xdd\x8d\xee\x2f\x91\xe2\xd0\x83\xeb\x25\x50\x8a\xd3\xb3\xe9\x16\xcf\x7e\x00\x21\x40\xed\x65\xeb\xe5\x5e\xd8\xbe\xc0\xce\xa0\x9a\x5a\x61\xf7\x26\x2a\xaa\x61\xcb\xf0\x9d\x16\xff\x6a\xac\x48\xc5\x11\xfb\x82\x20\xdc\x5e\x20\xc3\xd4\xce\x62\x83\xc5\x34\x42\xa5\xcf\x40\x8f\x3e\x66\x73\x42\x08\xcc\x4f\x13\xa9\x0a\x9a\xd6\xf9\x0c\x1d\xb8\x02\xab\xcf\xf9\x03\xad\xdb\xa3\x09\xad\x25\xdd\x56\xcf\x6d\x37\xf3\x2f\x82\xeb\x07\xfc\xe2\x4a\xc3\x3e\x48\x45\x1e\x77\x19\xe3\x23\xf5\x12\xa4\x59\xa1\x72\x17\x2f\xf9\x4d\x41\xbe\x60\x9a\xba\x82\xbc\xb7\xd8\x27\xdf\xc7\x3b\x48\x75\x20\x9a\xa3\x92\xc6\xf0\xd2\x4f\x95\xbb\x90\x08\x14\xfb\xff\x19\xc8\xd5\x1d\x42\x12\x70\x36\x3b\xc8\x08\xf2\x9e\x21\xe1\x4f\x6c\x99\xa1\x3f\x80\x00\xfb\xfb\xc1\xca\xe4\x61\x21\x5f\xbb\xa5\x25\x11\xc9\xd1\x4a\xae\xdb\x16\xe3\xa3\x72\x55\x34\xb5\x71\x3c\x55\x4f\x1e\x5e\xbd\xc2\xab\xfa\xa7\x12\xcf\x0d\x8f\xf6\x69\x9c\xf0\x94\x9f\x89\xb1\x87\xe5\x8b\xba\xc1\x59\x27\xa7\x01\x43\x2f\x81\xb6\x1e\x79\x71\x36\x78\x9a\xe2\xe8\x24\xb0\xa7\x4c\x55\x3d\x59\xb7\xa1\xa1\xd5\x12\xfe\xc3\x6c\x86\x34\x22\xf0\x63\x45\x60\x06\x4a\xd2\xc3\x10\x89\x5d\x6d\x8a\x1a\x3f\x94\x29\xf0\x8a\x73\x60\xcd\x4b\x4f\x9f\x20\x8b\xf6\xd2\x10\xd8\x09\x79\x62\x76\xe7\xa9\x00\xea\x99\x4d\x3f\x8a\x3c\x3b\xe2\x8c\x33\x84\xc8\xd8\x22\xfd\x10\x8e\x8e\x9a\x19\x57\x98\x14\x9b\xeb\x3e\x4e\xed\x37\x3e\xda\xc2\xbb\xc9\x57\xb3\xf0\x43\x2b\xcd\xdc\x95\x56\xb7\x34\xb1\x9f\x91\xd9\x4d\x21\xa8\x81\xfb\xc8\x82\x60\x3f\x7d\xa7\xf8\x99\x3a\x74\xd5\xb1\x26\x70\xf8\x7a\xa6\x98\x85\xab\xea\x71\x8b\x67\xa7\x00\xca\xf9\xfa\xc7\x81\x22\xa8\x3b\x28\x20\x99\x95\x26\x64\xe5\xe8\x44\x6a\x23\xb4\xbb\x3c\x01\xb1\xb4\xa9\xdc\xa9\x24\xfe\x02\x10\x44\x5d\xd5\xe8\xce\x3b\xdf\x24\x29\x46\x3d\xf2\x4d\xe0\xcb\x74\xbf\xc1\x62\x84\x7a\x61\x77\xd4\x2f\xeb\x48\x7c\x89\xe1\xfd\x76\xfc\x59\xe4\xfe\xaa\xb9\x1d\x6f\xad\xfa\x65\xa8\x72\xa8\x12\x8e\xa5\x6f\x49\x14\xfb\x55\x16\x55\x98\xdb\x63\xbd\x70\x15\x73\xf8\xca\x7b\x78\xb6\x9f\xe0\x98\x3f\x1a\xad\xb9\x9b\xb0\xcc\xbf\x9e\x24\x09\xd2\x83\x3f\x9a\xb8\x02\x96\xf9\x79\x5c\x5e\x57\x40\xeb\xeb\xb7\x12\x38\xc6\x89\x8d\xbd\x6e\x04\x3c\xd6\x03\x1c\x15\x90\xed\xfe\x76\x34\x46\xa9\x6d\x38\x06\xd6\x2e\xf9\xa7\x46\x7f\x45\x45\xd4\xb9\x58\xab\x91\x69\x39\xd9\x85\x85\x6d\x06\xcc\x93\x69\x19\x43\x29\xb9\x61\xc0\xb7\x67\xa7\x66\x24\x10\x4d\x3c\xac\xb9\x11\x9d\x17\x49\x9d\x83\xc1\xe6\xf9\x5f\x4c\x79\xde\x2a\xae\x01\x14\x13\xfa\xcd\x89\x62\x98\x0b\x53\x27\xc7\xe2\x2b\x51\x6c\x84\x1a\x98\x56\x46\xe3\x81\x26\xfb\x50\xc8\xbb\xa6\x42\x07\x64\x89\xa8\xa8\xcc\x21\xca\xc2\xe9\x2e\x6d\x45\x9d\x56\x66\xb8\x68\xda\x0e\x30\x12\x1e\x97\x23\x24\x07\x64\x76\x49\x01\x70\xf5\x13\xef\xc5\xdc\xf5\x7c\xe8\x5d\x81\xc9\xff\xfc\xee\xfb\x19\xec\x98\x27\x8e\x13\xab\xb2\xf3\x22\xaf\x44\xb9\x80\xf9\xef\x52\x2e\x98\xd9\x09\x50\x7a\x8e\xeb\x7a\x0b\xd9\x27\xd6\x21\xe0\xfb\xfa\x06\xa9\xca\x8f\x2f\x99\x78\xaa\xe4\x62\xdb\x2c\xce\x92\x40\xc8\x29\x42\x95\x74\x72\xc7\x22\xa0\xcb\xc1\xc8\x4e\x6c\x7c\xd8\x6b\xf6\x53\x4d\x05\x09\x03\x96\xb7\x0c\xef\x7c\x77\xa2\x9f\x06\xe5\x36\x0d\x9c\x5c\x42\x69\x88\xee\x76\x53\xd0\x22\xc1\xb4\x9b\xc9\x94\x94\xbc\x66\x1c\x42\xb9\x7b\x62\xc0\xf5\x35\x1b\x5a\xab\xca\xf1\xe2\x2a\x6c\xb7\x0d\x34\x87\x53\x71\x1f\x90\x63\xf8\x7b\x29\x2e\xdf\x61\x37\xac\x52\x4b\x2a\x4c\xdf\x8d\x3a\x8c\xa0\x35\xfd\x95\x9e\xa4\x02\x97\x64\x52\x53\xa3\x39\x46\x68\x7b\xee\x09\xf6\x61\x32\xf2\xcb\xca\x0f\x45\x1b\x82\x10\x8f\x4e\x68\x68\x3f\xce\xf2\xcb\x32\x82\xd3\x8f\xe4\x7f\x6b\xe5\x97\xa0\xab\xa1\xb6\x37\xe2\x4f\xa2\xea\x26\xf8\x90\xf5\xe8\xcd\x2e\x43\x8b\x0c\x42\x31\x9c\x3f\x48\x2b\x21\xb3\xb3\x6e\x9b\x66\x90\x7a\xb9\x45\x1a\xa2\xd5\xb0\xd8\x48\xc9\x58\x17\x9c\xd2\xc1\x38\xe7\xa8\x13\x3d\x10\xb9\x52\x74\x5c\x6f\x9c\x5a\xd2\x06\xb1\x3a\xe8\x3e\x21\x23\x6e\x06\xa2\x7e\x60\xf5\x4c\x15\xfd\xf9\x6c\x08\x4e\xe9\x25\x3a\xf3\xae\x53\xf1\xe5\xc7\x9b\xf6\x1e\xef\x8c\xd9\x0f\x38\x2d\xa1\xf2\xc0\x72\x27\x2b\xf9\xfc\x89\xb4\xfc\x6c\x18\xa5\x7e\x19\x7a\x36\x6f\xdb\x5a\xf0\xff\x28\x13\x1f\x42\x69\x0e\xc6\x9d\x59\xfa\xe8\xc8\xf4\x3c\x8f\x3c\xf4\xea\xcb\xdc\xf3\xe1\x62\xe4\x92\xe1\xbd\x53\x3a\xbe\x70\xba\xc5\x3f\x98\x68\xc1\x99\x59\x21\xc7\x9d\x09\xf6\x7a\x6b\x72\x44\x10\xa4\x68\x12\x9f\x99\x0d\x15\x0e\x95\x66\x3e\x54\x55\x1f\xeb\x97\xa4\x30\x4f\x92\xab\x3d\xb2\xa4\x3c\xa8\x41\xee\x3b\x0f\x6b\x62\xc7\x51\xf6\x01\x6b\x84\x39\xd5\xa0\x8d\xb8\xd3\x4f\xaa\x4b\xa7\xa7\x61\x7f\xe5\xbb\xf1\xf8\xfc\xb5\xa9\xf5\x5f\x1a\x1d\xb8\x36\x45\xeb\x93\xbd\xe6\x00\x03\x2b\xba\xc8\x95\x86\x3c\xc5\x4f\x09\xa9\xfe\x1e\x19\x0a\x08\xab\xc6\xc0\x80\xba\xdd\x82\x45\xbb\x99\x18\x71\x3d\xda\xea\xd3\x77\xaf\xbd\xcb\xc7\xcf\x4d\x19\x1f\x6c\xa2\xfe\x2d\xef\xa4\x5c\x3c\x33\x53\xc2\x77\xe1\x13\x02\x84\xcd\x44\x1d\xa7\x74\xeb\x16\xe7\xbf\x11\xad\x0b\xee\xf3\x02\x02\x2a\x18\xcf\x04\x79\x28\x5d\xf7\xf6\x4f\xea\xca\xca\xef\x8c\xa5\x0c\x20\x1c\xb9\x00\x10\x87\x61\x1c\x4c\xd1\x6f\x1a\xb6\x78\x2d\x7e\xaf\xae\x09\x4c\x93\xcf\x30\x14\x77\xa6\x78\xc9\xec\x48\x2b\xaa\x1d\x1d\x1a\x40\x54\x94\xb6\x7b\x35\x05\x7b\x69\x1a\xf4\x4d\xc3\xbe\x73\xe2\x6a\xb2\xb6\xfb\xe5\xd2\xe2\x11\x7e\x0c\x6d\x0e\x96\x4b\x38\x26\xa6\xe0\x57\xc8\x0e\x4f\x0e\xd7\x8e\xd1\x31\x0c\x24\x51\x6b\x95\xdc\xef\xcf\x5d\xfd\x7e\x79\xe5\xe2\x4e\x69\x22\xad\xe7\xef\xdc\x22\x42\x93\x49\x73\xf6\x36\xe3\x00\xcb\xe5\x00\x2f\x8b\xb0\x41\x3a\x76\xba\xee\x10\x09\x9b\x10\x08\xe3\x84\xb8\x64\x41\x88\x93\x2a\xbf\x79\xd0\xf2\x6c\x66\xeb\xd6\x62\xad\xd6\x8e\x03\x92\x12\xbf\x4f\xd8\x01\x11\x41\x96\xe1\x05\xd9\x58\xad\xe1\x5f\xb4\x51\xfb\x5d\x5d\x90\xfe\xe2\xec\xb7\x92\xbb\x5c\x86\x41\x25\xbb\x3e\x63\xe0\xa7\xb5\x9f\xf5\x4f\x5d\x52\xec\x59\x07\x08\x84\x0b\xbf\x13\x4e\x25\x62\x56\x90\xb2\x62\xe5\x49\x3a\x53\xef\x20\x6c\xe2\x5c\x6b\x4d\xcb\xf3\xd8\xeb\xab\x28\x06\xf9\x6b\x6a\x96\xee\xde\xbb\x29\x30\xfd\x72\x30\xe9\x60\x1c\xe4\xab\x66\xd7\x21\xe8\x56\xee\xdd\x67\x04\xf0\xb6\x73\xe0\xfe\xba\xbd\x11\x48\x46\x9b\xdf\x93\xc8\x90\xc6\x37\xc5\x42\xb5\xfd\x4d\xc2\x1b\x89\x8c\x8c\x01\x50\xa1\xbc\x28\x17\x54\x2e\x21\x12\x05\xdc\x70\xbe\x74\x97\x7c\x37\x90\x1f\xdc\x73\x46\x13\xe5\xc1\xf4\x0e\xfb\xdf\x19\xb9\x83\xab\xba\x0d\xda\xd0\x1d\x0a\xb6\x54\xb2\xe3\x4c\x65\x60\x90\x35\x1a\x51\x5a\xca\x39\xf5\x8b\x34\x85\xda\x7c\x0a\x69\x69\x52\xea\x61\x8f\x1f\x79\xeb\x7c\x55\xb0\x56\xee\xc7\x7e\x22\x22\x4b\xd7\x9d\x2a\xd9\xf5\x97\xf1\x2d\xcd\xd7\xc7\x16\x05\x18\xcc\xd7\x7b\xb5\x31\x7a\xc0\xea\x66\xb6\xa8\x0a\x2c\xc4\xe2\x8a\xe3\x88\x1c\x59\xdf\xf4\xd4\x68\x47\x79\x77\x6b\xf9\xe3\xac\xcc\x83\x84\xf2\xa1\xf0\x5c\xd3\xca\xdb\x34\x5a\x27\x66\x9e\xa1\xc0\x59\xe0\x86\xf4\x21\x34\x6a\xe2\xcf\x95\xd1\x9f\x75\x94\x1e\xed\x79\xc7\x75\xeb\x55\x7e\x25\x2e\x08\xd9\x66\x22\x04\x00\x6d\x2b\xa9\x37\x5b\xd8\x71\xf6\xb6\x4a\x06\x33\xa3\xb2\x71\xd8\xf1\xac\x39\xd3\x9e\x6a\x51\x00\xc9\x9e\xff\xd2\xa0\x9d\xf4\xb4\x9d\x1a\x41\x17\x6d\x4d\xe1\xa4\x23\x6c\x81\x90\xbf\xfa\xd2\x51\xa1\x13\xcc\x16\xd4\x99\xac\x21\x2d\xb3\x1b\x26\x49\x7a\x39\x9c\xe1\xac\xc2\xb4\xa6\x3c\xee\xe1\x93\xbf\xb9\x4b\xf9\x1d\xc3\x09\xc7\xba\x46\x64\xb4\xe9\x9c\x74\x57\x86\xb7", 4096); *(uint16_t*)0x20001080 = 2; *(uint16_t*)0x20001082 = htobe16(0x4e22); *(uint8_t*)0x20001084 = 0; *(uint8_t*)0x20001085 = 0; *(uint8_t*)0x20001086 = 0; *(uint8_t*)0x20001087 = 0; *(uint8_t*)0x20001088 = 0; *(uint8_t*)0x20001089 = 0; *(uint8_t*)0x2000108a = 0; *(uint8_t*)0x2000108b = 0; syscall(SYS_sendto, r[0], 0x20000080ul, 0x1000ul, 3ul, 0x20001080ul, 0xcul); break; case 2: *(uint16_t*)0x200011c0 = 2; *(uint16_t*)0x200011c2 = htobe16(0x4e20); *(uint8_t*)0x200011c4 = 0; *(uint8_t*)0x200011c5 = 0; *(uint8_t*)0x200011c6 = 0; *(uint8_t*)0x200011c7 = 0; *(uint8_t*)0x200011c8 = 0; *(uint8_t*)0x200011c9 = 0; *(uint8_t*)0x200011ca = 0; *(uint8_t*)0x200011cb = 0; syscall(SYS_recvfrom, 0xffffff9c, 0x200010c0ul, 0xcdul, 0x802ul, 0x200011c0ul, 0xcul); break; case 3: memcpy((void*)0x20001200, "\x65\x34\x64\x0a\x5e\x77\x48\x51\x1a\x23\xbf\x56\x23", 13); syscall(SYS_setsockopt, -1, 0, 1, 0x20001200ul, 0xdul); break; case 4: *(uint32_t*)0x20001280 = 0xc; res = syscall(SYS_paccept, 0xffffff9c, 0x20001240ul, 0x20001280ul, 0ul); if (res != -1) r[1] = res; break; case 5: *(uint16_t*)0x200012c0 = 0x18; *(uint16_t*)0x200012c2 = htobe16(0x4e23); *(uint32_t*)0x200012c4 = 1; *(uint32_t*)0x200012c8 = 0x800; syscall(SYS_connect, r[1], 0x200012c0ul, 0xcul); break; case 6: *(uint32_t*)0x20002340 = 0x1002; res = syscall(SYS_accept, -1, 0x20001300ul, 0x20002340ul); if (res != -1) r[2] = res; break; case 7: *(uint64_t*)0x200024c0 = 0x20002380; memcpy((void*)0x20002380, "\xce\x0f\xda\xd9\xa6\x4a\x58\xf7\x84\xd8\x08\x7a\xf8\x05\xaa\x2b\xd2\xf9\xb8\x6b\x22\xd9\xb2\xc3\x2c\x58\x73\xc3\xf3\x2b\xef\xbc\x76\xc4\x7e\x31\xe9\x5c\xb5\x77\x20\x09\x97\x41\x06\xdd\x56\xe9\xb7\x7e\x9e\xf2\x1b\x64\xeb\xda\x31\x08\x05\x30\xf8\xdb\xeb\x72\xd1\x92\x5f\x06\xc0\xe6\x16\x3c\x87\x37\x29\x3d\x33\x34\xcd\xfe\x5d\xe4\x21\xf3\x35\x04\xea\xa8\x02\x4b\xcb\x42\xa0\xad\x53\xd6\xbd\x25\xe3\xb6\x65\x03\x62\x96\x98\x53\x80\x33\x00\xc7\x1d\x12\x31\xf7\x3d\x20\x10\x9f\xd2\xb8\x05\xd7\xc0\xde\x06\x68\x00\x18\x86\xe4\xa3\x80\x88\x0e\x16\x9d\xe6\x77\xcb\x12\x4c\xc6\x05\x78\x02\x0f\xfe\xcb\xe8\x38\x19\x65\x69\x72\x96\xf8\x7c\xa1\xdd\x26\xd2\x39\xf0\x0c\x44\xd2\x8f\x44\x04\x68\x97\x8e\xdf\x01\x9a\x5d\xb0\x50\x91\x3f\x84\x18\x95\xd9\xd9\xa4\x2a\x50\xfd\x29\x53\xaf\x0b\xd6\xc6\x92\x83\x5f\x5f\x28\xb4\x67\x68\xfc\x54\x00\x14\xf8\xd3\xee\x3d\x80\x17\x5c\xd9\xbc\xa3\xe5\x2d\x0a\x15\xb8\x87\x73\xf3\xb8\x11\x08\x90\xf4\xdf\xfe\x75\x43\x3f\xda\xba\xc5\x4c\x62\x29\x8a", 242); *(uint64_t*)0x200024c8 = 0xf2; *(uint64_t*)0x200024d0 = 0x20002480; memcpy((void*)0x20002480, "\x80\x24\x2b\xeb\xc8\x1b\xd3\xda\xdc\xb9\x92\xd2\xde\x24\xb8\x13\x00\xa6\x36\xd3\xa6\x4b\xdf\xe9\x31\x33\xe1\x44\x29\xda\x14\xcf\x31\x7e\xde\xd2\x00\xe3\x71\xe3\x4a\xef\x0b\xba\xf2\x72\xa4\xe8\x77\x89\x08", 51); *(uint64_t*)0x200024d8 = 0x33; syscall(SYS_pwritev, r[2], 0x200024c0ul, 2ul, 0x51ul); break; case 8: *(uint32_t*)0x20002540 = 0xc; syscall(SYS_getpeername, r[2], 0x20002500ul, 0x20002540ul); break; case 9: syscall(SYS_dup2, -1, -1); break; case 10: memcpy((void*)0x20000000, "\x48\xf7\xf1\x90\xc6\x85\xfa\xd5\x02\x0b\x2c\x72\x6e\xad\xc8\x3c\x08\x67\xb0\x1c\x6b\x28\xea\x05\xf4\xbd\x05\x44\xeb\x88\x3e\xc3\xd8\x89\x7d\x9a\xee\x86\xbc\xb2\xc9\x0e\xbe\x68\x77\x4c\x20\x65\x70\xc9\x03", 51); break; case 11: memcpy((void*)0x20000040, "\xc4\x22\x7d\xb7\x4b\x0b\x45\x86\x57\xfb\x66\x44\x0f\x38\xdc\xd2\xc4\x81\xf9\x5b\xfe\x0f\x49\xf8\x66\x0f\x3a\x0c\x9b\xb4\x00\x00\x00\xfe\xc4\xa2\xfd\xa6\xfc\xc4\xa1\x4d\xd5\x16\xc4\x01\x94\x59\x6d\x64\x66\x41\x0f\x6c\x23", 55); syz_execute_func(0x20000040); break; case 12: break; case 13: memcpy((void*)0x200000c0, "\x53\x89\x0e\xf7\x06\x9c\xeb\xf4\xab\x2e\x38\x62\xd4\xe8\xf0\xd7\xcd\x39\x04\x66\x11\xd8\x6e\xfa\x40\x3d\x25\x55\x8c\x0d\xe4\xab\x33\xf8\x31\xe6\xf5\xf5\x29\x56\x03\x28\x35\x78\x3b\xf2\xd0\xf5\x81\x7f\x8b\x8d\xda\x73\xc7\x54\x2d\x9f\x0d\x12\xa6\x31\xe2\x5a\x3e\xe4\xdc\xfb\x6a\xe2\xf9\x68\xa8\x25\xda\xc5\x81\x2d\x8c\x6b\x82\x64\xe0\xb7\x8c\x3d\xaa\x0c\x76\x23\x7a\x22\x3a\x71\xf5\x0b\xa3\x6e\x78\x4b\x03\xb1\xf3\x87\x05\xa2\x37\xcf\x14\xc4\x37\xfd\xc2\x36\x3d\xc7\x73\xb1\x94\x6b\xe9\x83\x5b\xd5\x9c\xf8\x39\x00\x38\xfb\x9b\xac\x19\x1e\xc2\x55\xea\xf7\x0e\xa2\xb5\x63\xdb\x02\x24\x60\xb0\x5e\x8d\x6a\xcc\x51\xea\x2d\xc2\x5f\xf0\x6b\x2a\xdd\x98\x89\x0a\x72\x78\x07\x07\x2b\x47\xf3\x8e\xe4\x2d\x63\x67\xe7\xd3\x54\x8d\x3f\x13\xca\x55\x74\x42\x6d\xf2\x94\x62\x6c\x3e\xf4\xb8\xcf\x7a\xea\x48\x30\xb7\x0d\x93\x12\x2e\xfd\x51\xfc\xe4\x84\x96\xa5\xbd\x03\xe3\x05\xf2\xad\x87\x19\x69\xc9\x7c\xef\xf6\xb6\xc2\x28\x6c\x54\x31\xb9\xfd\xbd\x88\x37\x62\x92\x98\xcb\x4e", 239); memcpy((void*)0x200001c0, "\xa1\x85\x22\x4a\x16\xff\x1a\x06\x2f\x6f\x97\x66\xae\xb7\xf5\x84\x08\xb0\x28\x45\x0e\x80\x97\x0d\x92\x50\x11\x4b\x2c\x87\x1d\x5d\x9e\xc6\x7f\x79\x90\xa3\x05\xb4\xbe\x2c\x41\xd3\x5d\x33\x16\xa7\xf4\xc9\xb2\x74\x01\xf8\x44\x0e\x71\xa5\x79\xb7\xf9\xac\xc6\x06\xd2\x0d\xa0\x88\xc7\x07\x7b\xbc\x3c\x36\x1e\x71\xc5\x77\x40\x61\x68\xbc\xc1\xbc\xb7\xf0\x2e\x41\x6e\x3f\x90\x84\x03\xe2\x3d\xb0\xc7\x27\xea\x76\x9d\xeb\xda\x4d\x0e\x52\x4f\x8a\xdf\x7f\x42\x18\x4a\x20\xba\x1a\x23\xf9\xc5\x8d\x46\x91\x4c\xc7\xb1\x2c\x19\x53\x7d\x55\xa4\x0f\xcd\x26\xc6\x8e\xfb\x09\xdc\x0a\xcc\x2e\xe7\x52\x4a\xbe\xc0\xb8\x03\x5a\xd2\xb1\xd1\x94\x33\x1e\x2e\xa4\xe4\x2e\xbc\x53\xd3\x88\x0e\x7c\x0d\xd6\xc5\x79\x02\xc8\x72\x7c\xef\xb0\xfd\x31\x92\xd6\x62", 181); syz_usb_connect(0x1e3d802a, 0xef, 0x200000c0, 0x200001c0); break; case 14: memcpy((void*)0x20000280, "\xb7\x48\xb2\x1b\x78\xea\x22\x21\x6c\x2c\xbf\xdc\xcb\x03\xec\x54\xd2\x0f\x30\xf4\xaf\x46\x2b\x7b\xfd\x5d\x30\x1b\x9a\x4f\xb8\xf9\xbb\xe6\x30\xdd\xe8\xd6\x08\x55\x02\x94\x47\xdf\x51\x12\x0e\x0d\x69\x0a\xe4\xa7\x3e\x5a\x06\x06\x4c\xc0\x6d\x83\x62\x2a\x66\xc3\xcf\x3c\xcd\x92\x0d\xf4\xa9\xde\xc5\x47\xf0\xc8\x53\x54\xb2\xe8\x03\x69\x9f\x52\xff\xc8\x14\x53\x6c\xe5\x19\xc7\xc1\x65\x26\xda\x56\xc6\x5b\x44\x29\xcb\x22\x4a\xd9\xc9\x7f\x63\x7e\xe6\xf2", 111); memcpy((void*)0x20000300, "\xfc\xa1\x69\x1e\x90\xfe\xf7\xc0\x69\x3e\x50\x16\x1f\x6b\xf9\xd6\xbe\x11\x62\x1b\x96\xa6\x5d\x50\x23\xd6\x6e\x18\xc9\xdc\x3b\xb3\x8c\xf4\x79\x30\x6e\xff\x4d\x2c\xf1\x75\xb6\xf8\x52\x15\x44\x6b\x23\x79\xfd\xc7\x32\x74\x56\x6c\x4c\xa7\xce\xc4\xd6\x6a\x48\x19\x12\xaf\xe2\x3a\x3f\x61\xad\xb9\x46\x7e\x5b\xf8\x28\x15\x64\x36\xeb\xe3\xd2\x9e\x30\x73\xe4\x25\x4b\x3a\x73\x4a\xcd\x66\xd1\x4e\xfb\x07\x36\xfc\xad\xff\x4d\xad\x73\xe0\x25\x31\x87\x0c\x30\xfa\xe0\xc3\x78\xc5\x15\x78\x6c\x88\xc1\x29\x27\x36\xcd\xf0\xb6\xa2\xe7\x9b\x47\xa7\x8e\x33\xf5\xe1\xd0\x68\x8a\x6f\x3c\xe2\xd9\xe1\x5b\xd3\xee\x2e\x2a\xfe\x1a\xc5\xc8\x52\x3a\x84\xa2\x08\x75\x5a\x7f\x82\x2f\x3d\x21\x1f\xe3\xa2\x6a\x86\x50\x7d\x98\x58\x3d\x56\x6a\x05\x91\xa7\x80\x2c\xb3\xf9\xf9\xdc\x35\xb9\x11\x0d\xe4\xb2\xf4\xd3\x93\x4b\xb2\x0b\x7a", 199); res = syz_usb_connect(0xa4, 0x6f, 0x20000280, 0x20000300); if (res != -1) r[3] = res; break; case 15: syz_usb_disconnect(r[3]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } : In function 'syz_usb_connect_impl': :599:63: error: unknown type name 'usb_ctrlrequest' :604:55: error: unknown type name 'usb_ctrlrequest' compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor222869677 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/5 (0.56s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:1 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000040)=0x8) sendto(r0, &(0x7f0000000080)="8d360d8e2229aab63aef8e41582b2d02e93c2190e2fe50c1f7f3b29e853f60fb587dd78a2c404615cdf3763b9a53dba141c66b4a485450d66e0a4a281e63e3527c88cdde73010e05449a77aee1e7a35fdddea497119a92fa7fb2d108d6475f90ca55e04b82e53d6ac1138cb913b8dbb0b6f922a1a85461459190969a7d79de9164f3b4e2e9dc65817cd3908bf131ac85e8713459e5da855dd94a0feea76b05dd56d5e0b5222332210506202af0c3718596bf5549077f213886eeb0b3e38b83e237290327d0cc6d5e374a365eccda88ebf8ce4141536b085424aadb2b0c5be557bea12ea53f3fd5b7d3b48edf54f860c8a8e1941e0a56d851b2c08b8d4c9bad81ad649d1479bb60644194385d680441c674f629c50abb98ea4859798a0a3edee95e33f9c2880db8c9279f971bd597b98978bd664047c144af6c7954cc4edb914a618047a063ee7531377216a1f42404fde995936f5d7aba61bb230700ac3390d8fbc62772094fb8e543f39134132c6815d1ebf15bd0068e3b7ea86bb183465b91a431f52fe38bd0e6e077298ae8265685e46961fa82b64c5f757eaf9a7d0f63ed2849b17af0c550118c7e8e5addd917ce997796319e6bcf9bc42b8ba87c94e5a31b1cecb2fde9c571f9a87a88230f8093a7ae80a0c45c3ceec69f1e1f844296045070f3728ec4fa644cd74881db3c72352e4b8318f8834ac6306a5698ce9a5eb314f3f8647067bd6de7c90940645931c310aa55e4268ecbaf64c9d8c9ace54fc9f224746ddd681840c392f274753342ef48ac1973abf5c38d0776bd61c087d7b54b1f93eaed1a7c9f73427e38d5e3ca2cd17fa00c69873921ed8f2b8b9f89509134f723b6980831f5504a65602bd9367a151c570a705910afd9f69116737327c193a8751d9c161b5b2ef4e406055fe79c570f7c3e8334623ef02b9f47eecb78d30db147d4fc90bc91faec2d9181206e41cccde0c21483bfd0c45d8765a13d69e22479c21816dbd590ae51e49f6058449b9d3dbe94075e2e57028f43f70201a1e4875b91697c29deb8c2572a105131c87f7685cad94d1321d4ae5cc6efede11ac80a0e00a63b2ba54fcc5195475c3f1ff572693d00e491a0445c987dedcbe73b69ec13d226b193ec03fa9a27a4a434d148983366c7d8e5bc3cea9fbeffd05b8b0090765159b380ac96429655125921507f97df3e9d41c66b2f5fffd0cad4826577916f941ac7c9ec7ab625ec9390e050c5885dbd2e7131f2794ecad5709e0ac395ad0edee0182822374e701167ad2cfda07ff9e9bddee1c688d483c132e197a9481c9eb0df2cf9669ab107cc936bf2c96268a120a44fb7f178b402ecd9c512f86908f43fea11cc6902c355929b910a523acd16d5931ea41753391a0368e5bbe9e8cd926da120d8440fce2c192b1e5986854de8551320c989533771f1a71fb41ff1c927ffba9e9e25ae533db6a3c804b0b340a0409e110ac76a7b58f912db41e33b115e1c3ae9aa0399edd621a0fd4b7be2176cb49682ee82b2a219baace63b3822b98ba6f48cd34a08143321993c4390b94b138e4adcfd47dd01982e24acb8d464738f44af04ff3353f8683f352306457522e653baa8937950448eef9879dfaa42e9fcca9a968971b60c413f4aa3e0f90b41c7828ad5dbb62aae0cd2d2ef85e248bf12e4d6d75b803aca52bb9616acc37bc8bdab1a66661a5329dc936b1dbc83fd598c57b9ad80ac42c21a6318b3fb8d0d865fffb043217c42f9546c050eb8cce5e3423371a93aff46471d2008c8cd5841f849d1f0d58317353a6d7308f7962d943795bd52a4dd5a8440640273c78ef6ebbeaae9143d5e6ee90cdaa257e132e6d42d02b9567ae69b75bc60f7596a1fdd8179cff323991701062930ce23a29e30023da9d631bf61a6440acc290bdeafbaaea78365f408aea8f864da220e7a560c9ac84bb9c975814c132f97e08b64ccad47ceb08f2941a4438feb76560b1d5e6f3289f50d054e949674eb6c3294cc4a27427650c4a37f53c65c55ca410fa62ee18a829220360a8272f8c0041e2bf33f047928feb0269c438bdf399b1d8f187b2454ea5cd873e352e1d0781570234c6d810c5a16bac9ea9ffafb0c978a022276903a1c653f17d96659cbb30abc1a320c584bdfcc00125270c2d4c90950029f711575dfa828feea3b1dc83c0701dffac1f89536583a0c0995550f862c3ec786c0f8fee0fd94fae0a661313f9e753362336db3ea0296d7fb913ad490bfc9dd155307ab14e67114fcde26d032435cec7d29247deb93bcf7fa48b4ddb5fb7449c0fda083d5a63e03922d5dfb361b7eeb122a094c3b08eacbd43cecc76c29a9bbcd4808bfa6eaeb78d3453e30660d1653569841869e3d8b90f3d047388da51919cf056ce1ce1d455177c95cdb8f76637d5336e82c9e10ddfd33515f7491ef28cbe4c8a477086daeb525d097844879d140965ef0463b3e1780065da2255e68aee903f7b06b0824b151525c56063d4be22ee31b82d2029fef15f38f9008d785dcab9f1454185ec4a3d76ed3aa8d27859f66ae63eddd338ac28f64048e46a5d0731f9b7ebe52218e11e78cb6d8172aea44f2c213ce7f5edfaed81c5de95a86aba484ec2e1950f61e743f11fbd881f2b0c891aa6e94fff4e5d747971313613da54b5483aabe5b12a8e661d455cdf442b86f3cd8b6e95e2ebfba7c62001769d5d9725f1df8ff364ff45f65b16fb2a828638313dbaac9818f990e8590d54b67613430b9f1869b7f2f756e4af19a145105b7b0f7c889b3146533114d001fc2c1b6b285ded35fd0b17857da527e80658f0b717a8c98920f72289896f05a686083fa9e84ee9f0590793b484365159cd18d9290fc7b342b3926bccdc830a519b8abd07e5b885cc4a6046423d5fa976588510cf5b0cfeaa38e7d170feb401bf9b3e4284415b8e2d2b8d73a0bfda6e246d4075c16f3bf8c1d8a1969dc57fc8786b1e4afb4ec6769534debe49ef6873e76289c6442c6d690457af91df631c7b0d4d0a18a43b26803bfe374a81de3c182b4dc50683f8545157b40f4b44db5eff729645421817ff5fdd0b4ca5cc2ba9b23c33256074b0cd5938aacea39e5cb5af7ec444267f1419867e355de6700ae0a63b7a57eaabe21aee216048612ec6c6993a577ca4d7a0071f5680d89baa337a37a5d1af9dc359d9708ddab0bb96323ae8f6a48d2b8b42d47d4a051b55d14116a359899c79011f2db86e08c2fb7c7d836355cd55f33aba9cb80a10c0844011e3ffa01f5472233fbaebe45f044154220094bf7da1a4035c195978e1b97eac6c41010b27dfb5df985ab16d219f415528b0403846b326f0a00f7b73c89933e1a2daa58dd8dee2f91e2d083eb25508ad3b3e916cf7e002140ed65ebe55ed8bec0cea09a5a61f7262aaa61cbf09d16ff6aac48c511fb8220dc5e20c3d4ce6283c53442a5cf408f3e66734208cc4f13a90a9ad6f90c1db802abcff903addba309ad25dd56cf6d37f32f82eb07fce24ac33e48451e7719e323f512a459a172172ff94d41be609aba82bcb7d827dfc73b4875209aa392c6f0d24f95bb900814fbff19c8d51d421270363bc808f29e21e14f6c99a13f8000fbfbc1cae461215fbba52511c9d14aaedb16e3a3725534b5713c554f1e5ebdc2abfaa712cf0d8ff6699cf0949f89b187e58bbac15927a701432f81b61e797136789ae2e824b0a74c553d59b7a1a1d512fec36c863422f0634560064ad2c310895d6d8a1a3f9429f08a7360cd4b4f9f208bf6d210d809796276e7a900ea994d3f8a3c3be28c3384c8d822fd108e8e9a195798149beb3e4eed373edac2bbc957b3f0432bcddc9556b734b19f91d94d21a881fbc882603f7da7f8993a74d5b12670f87aa69885abea718b67a700caf9fac78122a83b282099952664e5e8446a23b4bb3c01b1b4a9dca924fe0210445dd5e8ce3bdf2429463df24de0cb74bfc162847a6177d42feb487c89e1fd76fc59e4feaab91d6fadfa65a872a8128ea56f4914fb55165598db63bd701573f8ca7b78b69fe0983f1aadb99bb0ccbf9e2409d2833f9ab80296f9795c5e5740ebebb71238c6898dbd6e043cd6031c1590edfe763446a96d3806d62ef9a7467f4545d4b958ab916939d985856d06cc9369194329b961c0b767a76624104d3cacb9119d17499d83c1e6f95f4c79de2aae011413facd8962980b5327c7e22b516c841a985646e38126fb50c8bba642076489a8a8cc21cac2e92e6d459d5666b868da0e30121e972324076476490170f513efc5dcf57ce85d81c9fffceefb19ec98278e13abb2f322af44b980f9ef522e98d909507a8eeb7a0bd927d621e0fbfa06a9ca8f2f9978aae462db2cce9240c82942957472c722a0cbc1c84e6c7cd86bf6534d05090396b70cef7c77a29f06e5360d9c5c426988ee7653d022c1b49bc99494bc661c42b97b62c0f5351b5aabcaf1e22a6cb70d348753711f9063f87b292edf6137ac524b2a4cdf8d3a8ca035fd959ea40297645253a33946687bee09f66132f2cbca0f451b82108f4e68683fcef2cb3282d38fe47f6be597a0aba1b637e24fa2ea26f890f5e8cd2e438b0c42319c3f482b21b3b36e9b66907ab9451aa2d5b0d848c958179cd2c138e7a8133d10b952745c6f9c5ad206b13ae83e21236e06a27e60f54c15fdf96c084ee9253af3ae53f1e5c79bf61eef8cd90f382da1f2c072272bf9fc89b4fc6c18a57e197a366fdb5af0ff28131f42690ec69d59fae8c8f43c8f3cf4eacbdcf3e162e492e1bd533abe70bac53f9868c1995921c79d09f67a6b724410a468129f990d150e95663e54551feb97a4304f92ab3db2a43ca841ee3b0f6b62c751f6016b8439d5a08db8d34faa4ba7a7617fe5bbf1f8fcb5a9f55f1a1db83645eb93bde600032bbac895863cc54f09a9fe1e190a08abc6c080badd8245bb9918713ddaead377afbdcbc7cf4d191f6ca2fe2defa45c3c3353c277e1130284cd441da774eb16e7bf11ad0beef302022a18cf0479285df7f64feacacaef8ca50c201cb9001087611c4cd16f1ab6782d7eafae094c93cf301477a678c9ec482baa1d1d1a405494b67b35057b691af44dc3be73e26ab2b6fbe5d2e2117e0c6d0e964b3826a6e057c80e4f0ed78ed1310c24516b95dcefcf5dfd7e79e5e24e6922ade7efdc2242934973f636e300cbe5002f8bb0413a76baee10099b1008e384b8644188932abf79d0f26c66ebd662add68e039212bf4fd801114196e105d958ade15fb451fb5d5d90fee2ecb792bb5c864125bb3e63e0a7b59ff54f5d52ec590708840bbf134e25625690b262e5493a53ef206ce25c6b4dcbf3d8ebab2806f96b6a96eedebb2930fd7230e9601ce4ab66d721e856eedd6704f0b673e0febabd1148469bdf93c890c637c542b5fd4dc21b898c8c0150a1bc2817542e211205dc70be74977c37901fdc734613e5c1f40efbdf19b983abba0ddad01d0ab654b2e34c656090351a515aca39f58b3485da7c0a696952ea618f1f79eb7c55b056eec77e22224bd79d2ad9f597f12dcdd7c7160518ccd77bb5317ac0ea66b6a80a2cc4e28ae3881c59dff4d4684779776bf9e3accc8384f2a1f05cd3cadb345a27669ea1c059e086f421346ae2cf95d19f75941eed79c775eb557e252e08d9662204006d2ba9375bd871f6b64a0633a3b271d8f1ac39d39e6a5100c99effd2a09df4b49d1a41176d4de1a4236c8190bffad251a113cc16d499ac212db31b26497a399ce1acc2b4a63ceee193bfb94bf91dc309c7ba4664b4e99c745786b7", 0x1000, 0x3, &(0x7f0000001080)=@in={0x2, 0x2}, 0xc) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000010c0)=""/205, 0xcd, 0x802, &(0x7f00000011c0)={0x2, 0x0}, 0xc) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001200)="6534640a5e7748511a23bf5623", 0xd) r1 = paccept(0xffffffffffffff9c, &(0x7f0000001240)=@in, &(0x7f0000001280)=0xc, 0x0) connect$inet6(r1, &(0x7f00000012c0)={0x18, 0x3, 0x1, 0x800}, 0xc) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000001300)=@file={0x0, ""/4096}, &(0x7f0000002340)=0x1002) pwritev(r2, &(0x7f00000024c0)=[{&(0x7f0000002380)="ce0fdad9a64a58f784d8087af805aa2bd2f9b86b22d9b2c32c5873c3f32befbc76c47e31e95cb5772009974106dd56e9b77e9ef21b64ebda31080530f8dbeb72d1925f06c0e6163c8737293d3334cdfe5de421f33504eaa8024bcb42a0ad53d6bd25e3b6650362969853803300c71d1231f73d20109fd2b805d7c0de0668001886e4a380880e169de677cb124cc60578020ffecbe8381965697296f87ca1dd26d239f00c44d28f440468978edf019a5db050913f841895d9d9a42a50fd2953af0bd6c692835f5f28b46768fc540014f8d3ee3d80175cd9bca3e52d0a15b88773f3b8110890f4dffe75433fdabac54c62298a", 0xf2}, {&(0x7f0000002480)="80242bebc81bd3dadcb992d2de24b81300a636d3a64bdfe93133e14429da14cf317eded200e371e34aef0bbaf272a4e8778908", 0x33}], 0x2, 0x51) getpeername(r2, &(0x7f0000002500)=@in, &(0x7f0000002540)=0xc) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_ethernet(0x33, &(0x7f0000000000)="48f7f190c685fad5020b2c726eadc83c0867b01c6b28ea05f4bd0544eb883ec3d8897d9aee86bcb2c90ebe68774c206570c903") syz_execute_func(&(0x7f0000000040)="c4227db74b0b458657fb66440f38dcd2c481f95bfe0f49f8660f3a0c9bb4000000fec4a2fda6fcc4a14dd516c40194596d6466410f6c23") syz_extract_tcp_res(&(0x7f0000000080), 0x6, 0x8000) syz_usb_connect(0x1e3d802a, 0xef, &(0x7f00000000c0)="53890ef7069cebf4ab2e3862d4e8f0d7cd39046611d86efa403d25558c0de4ab33f831e6f5f52956032835783bf2d0f5817f8b8dda73c7542d9f0d12a631e25a3ee4dcfb6ae2f968a825dac5812d8c6b8264e0b78c3daa0c76237a223a71f50ba36e784b03b1f38705a237cf14c437fdc2363dc773b1946be9835bd59cf8390038fb9bac191ec255eaf70ea2b563db022460b05e8d6acc51ea2dc25ff06b2add98890a727807072b47f38ee42d6367e7d3548d3f13ca5574426df294626c3ef4b8cf7aea4830b70d93122efd51fce48496a5bd03e305f2ad871969c97ceff6b6c2286c5431b9fdbd8837629298cb4e", &(0x7f00000001c0)="a185224a16ff1a062f6f9766aeb7f58408b028450e80970d9250114b2c871d5d9ec67f7990a305b4be2c41d35d3316a7f4c9b27401f8440e71a579b7f9acc606d20da088c7077bbc3c361e71c577406168bcc1bcb7f02e416e3f908403e23db0c727ea769debda4d0e524f8adf7f42184a20ba1a23f9c58d46914cc7b12c19537d55a40fcd26c68efb09dc0acc2ee7524abec0b8035ad2b1d194331e2ea4e42ebc53d3880e7c0dd6c57902c8727cefb0fd3192d662") r3 = syz_usb_connect(0xa4, 0x6f, &(0x7f0000000280)="b748b21b78ea22216c2cbfdccb03ec54d20f30f4af462b7bfd5d301b9a4fb8f9bbe630dde8d60855029447df51120e0d690ae4a73e5a06064cc06d83622a66c3cf3ccd920df4a9dec547f0c85354b2e803699f52ffc814536ce519c7c16526da56c65b4429cb224ad9c97f637ee6f2", &(0x7f0000000300)="fca1691e90fef7c0693e50161f6bf9d6be11621b96a65d5023d66e18c9dc3bb38cf479306eff4d2cf175b6f85215446b2379fdc73274566c4ca7cec4d66a481912afe23a3f61adb9467e5bf828156436ebe3d29e3073e4254b3a734acd66d14efb0736fcadff4dad73e02531870c30fae0c378c515786c88c1292736cdf0b6a2e79b47a78e33f5e1d0688a6f3ce2d9e15bd3ee2e2afe1ac5c8523a84a208755a7f822f3d211fe3a26a86507d98583d566a0591a7802cb3f9f9dc35b9110de4b2f4d3934bb20b7a") syz_usb_disconnect(r3) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bEndpointAddress; uint8_t bmAttributes; uint16_t wMaxPacketSize; uint8_t bInterval; uint8_t bRefresh; uint8_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint16_t idVendor; uint16_t idProduct; uint16_t bcdDevice; uint8_t iManufacturer; uint8_t iProduct; uint8_t iSerialNumber; uint8_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t wTotalLength; uint8_t bNumInterfaces; uint8_t bConfigurationValue; uint8_t iConfiguration; uint8_t bmAttributes; uint8_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bNumEndpoints; uint8_t bInterfaceClass; uint8_t bInterfaceSubClass; uint8_t bInterfaceProtocol; uint8_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint8_t bNumConfigurations; uint8_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_accept #define SYS_accept 30 #endif #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getpeername #define SYS_getpeername 31 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_pwritev #define SYS_pwritev 290 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 29 #endif #ifndef SYS_sendto #define SYS_sendto 133 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 105 #endif uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: *(uint32_t*)0x20000040 = 8; res = syscall(SYS_accept, -1, 0x20000000ul, 0x20000040ul); if (res != -1) r[0] = res; break; case 1: memcpy((void*)0x20000080, "\x8d\x36\x0d\x8e\x22\x29\xaa\xb6\x3a\xef\x8e\x41\x58\x2b\x2d\x02\xe9\x3c\x21\x90\xe2\xfe\x50\xc1\xf7\xf3\xb2\x9e\x85\x3f\x60\xfb\x58\x7d\xd7\x8a\x2c\x40\x46\x15\xcd\xf3\x76\x3b\x9a\x53\xdb\xa1\x41\xc6\x6b\x4a\x48\x54\x50\xd6\x6e\x0a\x4a\x28\x1e\x63\xe3\x52\x7c\x88\xcd\xde\x73\x01\x0e\x05\x44\x9a\x77\xae\xe1\xe7\xa3\x5f\xdd\xde\xa4\x97\x11\x9a\x92\xfa\x7f\xb2\xd1\x08\xd6\x47\x5f\x90\xca\x55\xe0\x4b\x82\xe5\x3d\x6a\xc1\x13\x8c\xb9\x13\xb8\xdb\xb0\xb6\xf9\x22\xa1\xa8\x54\x61\x45\x91\x90\x96\x9a\x7d\x79\xde\x91\x64\xf3\xb4\xe2\xe9\xdc\x65\x81\x7c\xd3\x90\x8b\xf1\x31\xac\x85\xe8\x71\x34\x59\xe5\xda\x85\x5d\xd9\x4a\x0f\xee\xa7\x6b\x05\xdd\x56\xd5\xe0\xb5\x22\x23\x32\x21\x05\x06\x20\x2a\xf0\xc3\x71\x85\x96\xbf\x55\x49\x07\x7f\x21\x38\x86\xee\xb0\xb3\xe3\x8b\x83\xe2\x37\x29\x03\x27\xd0\xcc\x6d\x5e\x37\x4a\x36\x5e\xcc\xda\x88\xeb\xf8\xce\x41\x41\x53\x6b\x08\x54\x24\xaa\xdb\x2b\x0c\x5b\xe5\x57\xbe\xa1\x2e\xa5\x3f\x3f\xd5\xb7\xd3\xb4\x8e\xdf\x54\xf8\x60\xc8\xa8\xe1\x94\x1e\x0a\x56\xd8\x51\xb2\xc0\x8b\x8d\x4c\x9b\xad\x81\xad\x64\x9d\x14\x79\xbb\x60\x64\x41\x94\x38\x5d\x68\x04\x41\xc6\x74\xf6\x29\xc5\x0a\xbb\x98\xea\x48\x59\x79\x8a\x0a\x3e\xde\xe9\x5e\x33\xf9\xc2\x88\x0d\xb8\xc9\x27\x9f\x97\x1b\xd5\x97\xb9\x89\x78\xbd\x66\x40\x47\xc1\x44\xaf\x6c\x79\x54\xcc\x4e\xdb\x91\x4a\x61\x80\x47\xa0\x63\xee\x75\x31\x37\x72\x16\xa1\xf4\x24\x04\xfd\xe9\x95\x93\x6f\x5d\x7a\xba\x61\xbb\x23\x07\x00\xac\x33\x90\xd8\xfb\xc6\x27\x72\x09\x4f\xb8\xe5\x43\xf3\x91\x34\x13\x2c\x68\x15\xd1\xeb\xf1\x5b\xd0\x06\x8e\x3b\x7e\xa8\x6b\xb1\x83\x46\x5b\x91\xa4\x31\xf5\x2f\xe3\x8b\xd0\xe6\xe0\x77\x29\x8a\xe8\x26\x56\x85\xe4\x69\x61\xfa\x82\xb6\x4c\x5f\x75\x7e\xaf\x9a\x7d\x0f\x63\xed\x28\x49\xb1\x7a\xf0\xc5\x50\x11\x8c\x7e\x8e\x5a\xdd\xd9\x17\xce\x99\x77\x96\x31\x9e\x6b\xcf\x9b\xc4\x2b\x8b\xa8\x7c\x94\xe5\xa3\x1b\x1c\xec\xb2\xfd\xe9\xc5\x71\xf9\xa8\x7a\x88\x23\x0f\x80\x93\xa7\xae\x80\xa0\xc4\x5c\x3c\xee\xc6\x9f\x1e\x1f\x84\x42\x96\x04\x50\x70\xf3\x72\x8e\xc4\xfa\x64\x4c\xd7\x48\x81\xdb\x3c\x72\x35\x2e\x4b\x83\x18\xf8\x83\x4a\xc6\x30\x6a\x56\x98\xce\x9a\x5e\xb3\x14\xf3\xf8\x64\x70\x67\xbd\x6d\xe7\xc9\x09\x40\x64\x59\x31\xc3\x10\xaa\x55\xe4\x26\x8e\xcb\xaf\x64\xc9\xd8\xc9\xac\xe5\x4f\xc9\xf2\x24\x74\x6d\xdd\x68\x18\x40\xc3\x92\xf2\x74\x75\x33\x42\xef\x48\xac\x19\x73\xab\xf5\xc3\x8d\x07\x76\xbd\x61\xc0\x87\xd7\xb5\x4b\x1f\x93\xea\xed\x1a\x7c\x9f\x73\x42\x7e\x38\xd5\xe3\xca\x2c\xd1\x7f\xa0\x0c\x69\x87\x39\x21\xed\x8f\x2b\x8b\x9f\x89\x50\x91\x34\xf7\x23\xb6\x98\x08\x31\xf5\x50\x4a\x65\x60\x2b\xd9\x36\x7a\x15\x1c\x57\x0a\x70\x59\x10\xaf\xd9\xf6\x91\x16\x73\x73\x27\xc1\x93\xa8\x75\x1d\x9c\x16\x1b\x5b\x2e\xf4\xe4\x06\x05\x5f\xe7\x9c\x57\x0f\x7c\x3e\x83\x34\x62\x3e\xf0\x2b\x9f\x47\xee\xcb\x78\xd3\x0d\xb1\x47\xd4\xfc\x90\xbc\x91\xfa\xec\x2d\x91\x81\x20\x6e\x41\xcc\xcd\xe0\xc2\x14\x83\xbf\xd0\xc4\x5d\x87\x65\xa1\x3d\x69\xe2\x24\x79\xc2\x18\x16\xdb\xd5\x90\xae\x51\xe4\x9f\x60\x58\x44\x9b\x9d\x3d\xbe\x94\x07\x5e\x2e\x57\x02\x8f\x43\xf7\x02\x01\xa1\xe4\x87\x5b\x91\x69\x7c\x29\xde\xb8\xc2\x57\x2a\x10\x51\x31\xc8\x7f\x76\x85\xca\xd9\x4d\x13\x21\xd4\xae\x5c\xc6\xef\xed\xe1\x1a\xc8\x0a\x0e\x00\xa6\x3b\x2b\xa5\x4f\xcc\x51\x95\x47\x5c\x3f\x1f\xf5\x72\x69\x3d\x00\xe4\x91\xa0\x44\x5c\x98\x7d\xed\xcb\xe7\x3b\x69\xec\x13\xd2\x26\xb1\x93\xec\x03\xfa\x9a\x27\xa4\xa4\x34\xd1\x48\x98\x33\x66\xc7\xd8\xe5\xbc\x3c\xea\x9f\xbe\xff\xd0\x5b\x8b\x00\x90\x76\x51\x59\xb3\x80\xac\x96\x42\x96\x55\x12\x59\x21\x50\x7f\x97\xdf\x3e\x9d\x41\xc6\x6b\x2f\x5f\xff\xd0\xca\xd4\x82\x65\x77\x91\x6f\x94\x1a\xc7\xc9\xec\x7a\xb6\x25\xec\x93\x90\xe0\x50\xc5\x88\x5d\xbd\x2e\x71\x31\xf2\x79\x4e\xca\xd5\x70\x9e\x0a\xc3\x95\xad\x0e\xde\xe0\x18\x28\x22\x37\x4e\x70\x11\x67\xad\x2c\xfd\xa0\x7f\xf9\xe9\xbd\xde\xe1\xc6\x88\xd4\x83\xc1\x32\xe1\x97\xa9\x48\x1c\x9e\xb0\xdf\x2c\xf9\x66\x9a\xb1\x07\xcc\x93\x6b\xf2\xc9\x62\x68\xa1\x20\xa4\x4f\xb7\xf1\x78\xb4\x02\xec\xd9\xc5\x12\xf8\x69\x08\xf4\x3f\xea\x11\xcc\x69\x02\xc3\x55\x92\x9b\x91\x0a\x52\x3a\xcd\x16\xd5\x93\x1e\xa4\x17\x53\x39\x1a\x03\x68\xe5\xbb\xe9\xe8\xcd\x92\x6d\xa1\x20\xd8\x44\x0f\xce\x2c\x19\x2b\x1e\x59\x86\x85\x4d\xe8\x55\x13\x20\xc9\x89\x53\x37\x71\xf1\xa7\x1f\xb4\x1f\xf1\xc9\x27\xff\xba\x9e\x9e\x25\xae\x53\x3d\xb6\xa3\xc8\x04\xb0\xb3\x40\xa0\x40\x9e\x11\x0a\xc7\x6a\x7b\x58\xf9\x12\xdb\x41\xe3\x3b\x11\x5e\x1c\x3a\xe9\xaa\x03\x99\xed\xd6\x21\xa0\xfd\x4b\x7b\xe2\x17\x6c\xb4\x96\x82\xee\x82\xb2\xa2\x19\xba\xac\xe6\x3b\x38\x22\xb9\x8b\xa6\xf4\x8c\xd3\x4a\x08\x14\x33\x21\x99\x3c\x43\x90\xb9\x4b\x13\x8e\x4a\xdc\xfd\x47\xdd\x01\x98\x2e\x24\xac\xb8\xd4\x64\x73\x8f\x44\xaf\x04\xff\x33\x53\xf8\x68\x3f\x35\x23\x06\x45\x75\x22\xe6\x53\xba\xa8\x93\x79\x50\x44\x8e\xef\x98\x79\xdf\xaa\x42\xe9\xfc\xca\x9a\x96\x89\x71\xb6\x0c\x41\x3f\x4a\xa3\xe0\xf9\x0b\x41\xc7\x82\x8a\xd5\xdb\xb6\x2a\xae\x0c\xd2\xd2\xef\x85\xe2\x48\xbf\x12\xe4\xd6\xd7\x5b\x80\x3a\xca\x52\xbb\x96\x16\xac\xc3\x7b\xc8\xbd\xab\x1a\x66\x66\x1a\x53\x29\xdc\x93\x6b\x1d\xbc\x83\xfd\x59\x8c\x57\xb9\xad\x80\xac\x42\xc2\x1a\x63\x18\xb3\xfb\x8d\x0d\x86\x5f\xff\xb0\x43\x21\x7c\x42\xf9\x54\x6c\x05\x0e\xb8\xcc\xe5\xe3\x42\x33\x71\xa9\x3a\xff\x46\x47\x1d\x20\x08\xc8\xcd\x58\x41\xf8\x49\xd1\xf0\xd5\x83\x17\x35\x3a\x6d\x73\x08\xf7\x96\x2d\x94\x37\x95\xbd\x52\xa4\xdd\x5a\x84\x40\x64\x02\x73\xc7\x8e\xf6\xeb\xbe\xaa\xe9\x14\x3d\x5e\x6e\xe9\x0c\xda\xa2\x57\xe1\x32\xe6\xd4\x2d\x02\xb9\x56\x7a\xe6\x9b\x75\xbc\x60\xf7\x59\x6a\x1f\xdd\x81\x79\xcf\xf3\x23\x99\x17\x01\x06\x29\x30\xce\x23\xa2\x9e\x30\x02\x3d\xa9\xd6\x31\xbf\x61\xa6\x44\x0a\xcc\x29\x0b\xde\xaf\xba\xae\xa7\x83\x65\xf4\x08\xae\xa8\xf8\x64\xda\x22\x0e\x7a\x56\x0c\x9a\xc8\x4b\xb9\xc9\x75\x81\x4c\x13\x2f\x97\xe0\x8b\x64\xcc\xad\x47\xce\xb0\x8f\x29\x41\xa4\x43\x8f\xeb\x76\x56\x0b\x1d\x5e\x6f\x32\x89\xf5\x0d\x05\x4e\x94\x96\x74\xeb\x6c\x32\x94\xcc\x4a\x27\x42\x76\x50\xc4\xa3\x7f\x53\xc6\x5c\x55\xca\x41\x0f\xa6\x2e\xe1\x8a\x82\x92\x20\x36\x0a\x82\x72\xf8\xc0\x04\x1e\x2b\xf3\x3f\x04\x79\x28\xfe\xb0\x26\x9c\x43\x8b\xdf\x39\x9b\x1d\x8f\x18\x7b\x24\x54\xea\x5c\xd8\x73\xe3\x52\xe1\xd0\x78\x15\x70\x23\x4c\x6d\x81\x0c\x5a\x16\xba\xc9\xea\x9f\xfa\xfb\x0c\x97\x8a\x02\x22\x76\x90\x3a\x1c\x65\x3f\x17\xd9\x66\x59\xcb\xb3\x0a\xbc\x1a\x32\x0c\x58\x4b\xdf\xcc\x00\x12\x52\x70\xc2\xd4\xc9\x09\x50\x02\x9f\x71\x15\x75\xdf\xa8\x28\xfe\xea\x3b\x1d\xc8\x3c\x07\x01\xdf\xfa\xc1\xf8\x95\x36\x58\x3a\x0c\x09\x95\x55\x0f\x86\x2c\x3e\xc7\x86\xc0\xf8\xfe\xe0\xfd\x94\xfa\xe0\xa6\x61\x31\x3f\x9e\x75\x33\x62\x33\x6d\xb3\xea\x02\x96\xd7\xfb\x91\x3a\xd4\x90\xbf\xc9\xdd\x15\x53\x07\xab\x14\xe6\x71\x14\xfc\xde\x26\xd0\x32\x43\x5c\xec\x7d\x29\x24\x7d\xeb\x93\xbc\xf7\xfa\x48\xb4\xdd\xb5\xfb\x74\x49\xc0\xfd\xa0\x83\xd5\xa6\x3e\x03\x92\x2d\x5d\xfb\x36\x1b\x7e\xeb\x12\x2a\x09\x4c\x3b\x08\xea\xcb\xd4\x3c\xec\xc7\x6c\x29\xa9\xbb\xcd\x48\x08\xbf\xa6\xea\xeb\x78\xd3\x45\x3e\x30\x66\x0d\x16\x53\x56\x98\x41\x86\x9e\x3d\x8b\x90\xf3\xd0\x47\x38\x8d\xa5\x19\x19\xcf\x05\x6c\xe1\xce\x1d\x45\x51\x77\xc9\x5c\xdb\x8f\x76\x63\x7d\x53\x36\xe8\x2c\x9e\x10\xdd\xfd\x33\x51\x5f\x74\x91\xef\x28\xcb\xe4\xc8\xa4\x77\x08\x6d\xae\xb5\x25\xd0\x97\x84\x48\x79\xd1\x40\x96\x5e\xf0\x46\x3b\x3e\x17\x80\x06\x5d\xa2\x25\x5e\x68\xae\xe9\x03\xf7\xb0\x6b\x08\x24\xb1\x51\x52\x5c\x56\x06\x3d\x4b\xe2\x2e\xe3\x1b\x82\xd2\x02\x9f\xef\x15\xf3\x8f\x90\x08\xd7\x85\xdc\xab\x9f\x14\x54\x18\x5e\xc4\xa3\xd7\x6e\xd3\xaa\x8d\x27\x85\x9f\x66\xae\x63\xed\xdd\x33\x8a\xc2\x8f\x64\x04\x8e\x46\xa5\xd0\x73\x1f\x9b\x7e\xbe\x52\x21\x8e\x11\xe7\x8c\xb6\xd8\x17\x2a\xea\x44\xf2\xc2\x13\xce\x7f\x5e\xdf\xae\xd8\x1c\x5d\xe9\x5a\x86\xab\xa4\x84\xec\x2e\x19\x50\xf6\x1e\x74\x3f\x11\xfb\xd8\x81\xf2\xb0\xc8\x91\xaa\x6e\x94\xff\xf4\xe5\xd7\x47\x97\x13\x13\x61\x3d\xa5\x4b\x54\x83\xaa\xbe\x5b\x12\xa8\xe6\x61\xd4\x55\xcd\xf4\x42\xb8\x6f\x3c\xd8\xb6\xe9\x5e\x2e\xbf\xba\x7c\x62\x00\x17\x69\xd5\xd9\x72\x5f\x1d\xf8\xff\x36\x4f\xf4\x5f\x65\xb1\x6f\xb2\xa8\x28\x63\x83\x13\xdb\xaa\xc9\x81\x8f\x99\x0e\x85\x90\xd5\x4b\x67\x61\x34\x30\xb9\xf1\x86\x9b\x7f\x2f\x75\x6e\x4a\xf1\x9a\x14\x51\x05\xb7\xb0\xf7\xc8\x89\xb3\x14\x65\x33\x11\x4d\x00\x1f\xc2\xc1\xb6\xb2\x85\xde\xd3\x5f\xd0\xb1\x78\x57\xda\x52\x7e\x80\x65\x8f\x0b\x71\x7a\x8c\x98\x92\x0f\x72\x28\x98\x96\xf0\x5a\x68\x60\x83\xfa\x9e\x84\xee\x9f\x05\x90\x79\x3b\x48\x43\x65\x15\x9c\xd1\x8d\x92\x90\xfc\x7b\x34\x2b\x39\x26\xbc\xcd\xc8\x30\xa5\x19\xb8\xab\xd0\x7e\x5b\x88\x5c\xc4\xa6\x04\x64\x23\xd5\xfa\x97\x65\x88\x51\x0c\xf5\xb0\xcf\xea\xa3\x8e\x7d\x17\x0f\xeb\x40\x1b\xf9\xb3\xe4\x28\x44\x15\xb8\xe2\xd2\xb8\xd7\x3a\x0b\xfd\xa6\xe2\x46\xd4\x07\x5c\x16\xf3\xbf\x8c\x1d\x8a\x19\x69\xdc\x57\xfc\x87\x86\xb1\xe4\xaf\xb4\xec\x67\x69\x53\x4d\xeb\xe4\x9e\xf6\x87\x3e\x76\x28\x9c\x64\x42\xc6\xd6\x90\x45\x7a\xf9\x1d\xf6\x31\xc7\xb0\xd4\xd0\xa1\x8a\x43\xb2\x68\x03\xbf\xe3\x74\xa8\x1d\xe3\xc1\x82\xb4\xdc\x50\x68\x3f\x85\x45\x15\x7b\x40\xf4\xb4\x4d\xb5\xef\xf7\x29\x64\x54\x21\x81\x7f\xf5\xfd\xd0\xb4\xca\x5c\xc2\xba\x9b\x23\xc3\x32\x56\x07\x4b\x0c\xd5\x93\x8a\xac\xea\x39\xe5\xcb\x5a\xf7\xec\x44\x42\x67\xf1\x41\x98\x67\xe3\x55\xde\x67\x00\xae\x0a\x63\xb7\xa5\x7e\xaa\xbe\x21\xae\xe2\x16\x04\x86\x12\xec\x6c\x69\x93\xa5\x77\xca\x4d\x7a\x00\x71\xf5\x68\x0d\x89\xba\xa3\x37\xa3\x7a\x5d\x1a\xf9\xdc\x35\x9d\x97\x08\xdd\xab\x0b\xb9\x63\x23\xae\x8f\x6a\x48\xd2\xb8\xb4\x2d\x47\xd4\xa0\x51\xb5\x5d\x14\x11\x6a\x35\x98\x99\xc7\x90\x11\xf2\xdb\x86\xe0\x8c\x2f\xb7\xc7\xd8\x36\x35\x5c\xd5\x5f\x33\xab\xa9\xcb\x80\xa1\x0c\x08\x44\x01\x1e\x3f\xfa\x01\xf5\x47\x22\x33\xfb\xae\xbe\x45\xf0\x44\x15\x42\x20\x09\x4b\xf7\xda\x1a\x40\x35\xc1\x95\x97\x8e\x1b\x97\xea\xc6\xc4\x10\x10\xb2\x7d\xfb\x5d\xf9\x85\xab\x16\xd2\x19\xf4\x15\x52\x8b\x04\x03\x84\x6b\x32\x6f\x0a\x00\xf7\xb7\x3c\x89\x93\x3e\x1a\x2d\xaa\x58\xdd\x8d\xee\x2f\x91\xe2\xd0\x83\xeb\x25\x50\x8a\xd3\xb3\xe9\x16\xcf\x7e\x00\x21\x40\xed\x65\xeb\xe5\x5e\xd8\xbe\xc0\xce\xa0\x9a\x5a\x61\xf7\x26\x2a\xaa\x61\xcb\xf0\x9d\x16\xff\x6a\xac\x48\xc5\x11\xfb\x82\x20\xdc\x5e\x20\xc3\xd4\xce\x62\x83\xc5\x34\x42\xa5\xcf\x40\x8f\x3e\x66\x73\x42\x08\xcc\x4f\x13\xa9\x0a\x9a\xd6\xf9\x0c\x1d\xb8\x02\xab\xcf\xf9\x03\xad\xdb\xa3\x09\xad\x25\xdd\x56\xcf\x6d\x37\xf3\x2f\x82\xeb\x07\xfc\xe2\x4a\xc3\x3e\x48\x45\x1e\x77\x19\xe3\x23\xf5\x12\xa4\x59\xa1\x72\x17\x2f\xf9\x4d\x41\xbe\x60\x9a\xba\x82\xbc\xb7\xd8\x27\xdf\xc7\x3b\x48\x75\x20\x9a\xa3\x92\xc6\xf0\xd2\x4f\x95\xbb\x90\x08\x14\xfb\xff\x19\xc8\xd5\x1d\x42\x12\x70\x36\x3b\xc8\x08\xf2\x9e\x21\xe1\x4f\x6c\x99\xa1\x3f\x80\x00\xfb\xfb\xc1\xca\xe4\x61\x21\x5f\xbb\xa5\x25\x11\xc9\xd1\x4a\xae\xdb\x16\xe3\xa3\x72\x55\x34\xb5\x71\x3c\x55\x4f\x1e\x5e\xbd\xc2\xab\xfa\xa7\x12\xcf\x0d\x8f\xf6\x69\x9c\xf0\x94\x9f\x89\xb1\x87\xe5\x8b\xba\xc1\x59\x27\xa7\x01\x43\x2f\x81\xb6\x1e\x79\x71\x36\x78\x9a\xe2\xe8\x24\xb0\xa7\x4c\x55\x3d\x59\xb7\xa1\xa1\xd5\x12\xfe\xc3\x6c\x86\x34\x22\xf0\x63\x45\x60\x06\x4a\xd2\xc3\x10\x89\x5d\x6d\x8a\x1a\x3f\x94\x29\xf0\x8a\x73\x60\xcd\x4b\x4f\x9f\x20\x8b\xf6\xd2\x10\xd8\x09\x79\x62\x76\xe7\xa9\x00\xea\x99\x4d\x3f\x8a\x3c\x3b\xe2\x8c\x33\x84\xc8\xd8\x22\xfd\x10\x8e\x8e\x9a\x19\x57\x98\x14\x9b\xeb\x3e\x4e\xed\x37\x3e\xda\xc2\xbb\xc9\x57\xb3\xf0\x43\x2b\xcd\xdc\x95\x56\xb7\x34\xb1\x9f\x91\xd9\x4d\x21\xa8\x81\xfb\xc8\x82\x60\x3f\x7d\xa7\xf8\x99\x3a\x74\xd5\xb1\x26\x70\xf8\x7a\xa6\x98\x85\xab\xea\x71\x8b\x67\xa7\x00\xca\xf9\xfa\xc7\x81\x22\xa8\x3b\x28\x20\x99\x95\x26\x64\xe5\xe8\x44\x6a\x23\xb4\xbb\x3c\x01\xb1\xb4\xa9\xdc\xa9\x24\xfe\x02\x10\x44\x5d\xd5\xe8\xce\x3b\xdf\x24\x29\x46\x3d\xf2\x4d\xe0\xcb\x74\xbf\xc1\x62\x84\x7a\x61\x77\xd4\x2f\xeb\x48\x7c\x89\xe1\xfd\x76\xfc\x59\xe4\xfe\xaa\xb9\x1d\x6f\xad\xfa\x65\xa8\x72\xa8\x12\x8e\xa5\x6f\x49\x14\xfb\x55\x16\x55\x98\xdb\x63\xbd\x70\x15\x73\xf8\xca\x7b\x78\xb6\x9f\xe0\x98\x3f\x1a\xad\xb9\x9b\xb0\xcc\xbf\x9e\x24\x09\xd2\x83\x3f\x9a\xb8\x02\x96\xf9\x79\x5c\x5e\x57\x40\xeb\xeb\xb7\x12\x38\xc6\x89\x8d\xbd\x6e\x04\x3c\xd6\x03\x1c\x15\x90\xed\xfe\x76\x34\x46\xa9\x6d\x38\x06\xd6\x2e\xf9\xa7\x46\x7f\x45\x45\xd4\xb9\x58\xab\x91\x69\x39\xd9\x85\x85\x6d\x06\xcc\x93\x69\x19\x43\x29\xb9\x61\xc0\xb7\x67\xa7\x66\x24\x10\x4d\x3c\xac\xb9\x11\x9d\x17\x49\x9d\x83\xc1\xe6\xf9\x5f\x4c\x79\xde\x2a\xae\x01\x14\x13\xfa\xcd\x89\x62\x98\x0b\x53\x27\xc7\xe2\x2b\x51\x6c\x84\x1a\x98\x56\x46\xe3\x81\x26\xfb\x50\xc8\xbb\xa6\x42\x07\x64\x89\xa8\xa8\xcc\x21\xca\xc2\xe9\x2e\x6d\x45\x9d\x56\x66\xb8\x68\xda\x0e\x30\x12\x1e\x97\x23\x24\x07\x64\x76\x49\x01\x70\xf5\x13\xef\xc5\xdc\xf5\x7c\xe8\x5d\x81\xc9\xff\xfc\xee\xfb\x19\xec\x98\x27\x8e\x13\xab\xb2\xf3\x22\xaf\x44\xb9\x80\xf9\xef\x52\x2e\x98\xd9\x09\x50\x7a\x8e\xeb\x7a\x0b\xd9\x27\xd6\x21\xe0\xfb\xfa\x06\xa9\xca\x8f\x2f\x99\x78\xaa\xe4\x62\xdb\x2c\xce\x92\x40\xc8\x29\x42\x95\x74\x72\xc7\x22\xa0\xcb\xc1\xc8\x4e\x6c\x7c\xd8\x6b\xf6\x53\x4d\x05\x09\x03\x96\xb7\x0c\xef\x7c\x77\xa2\x9f\x06\xe5\x36\x0d\x9c\x5c\x42\x69\x88\xee\x76\x53\xd0\x22\xc1\xb4\x9b\xc9\x94\x94\xbc\x66\x1c\x42\xb9\x7b\x62\xc0\xf5\x35\x1b\x5a\xab\xca\xf1\xe2\x2a\x6c\xb7\x0d\x34\x87\x53\x71\x1f\x90\x63\xf8\x7b\x29\x2e\xdf\x61\x37\xac\x52\x4b\x2a\x4c\xdf\x8d\x3a\x8c\xa0\x35\xfd\x95\x9e\xa4\x02\x97\x64\x52\x53\xa3\x39\x46\x68\x7b\xee\x09\xf6\x61\x32\xf2\xcb\xca\x0f\x45\x1b\x82\x10\x8f\x4e\x68\x68\x3f\xce\xf2\xcb\x32\x82\xd3\x8f\xe4\x7f\x6b\xe5\x97\xa0\xab\xa1\xb6\x37\xe2\x4f\xa2\xea\x26\xf8\x90\xf5\xe8\xcd\x2e\x43\x8b\x0c\x42\x31\x9c\x3f\x48\x2b\x21\xb3\xb3\x6e\x9b\x66\x90\x7a\xb9\x45\x1a\xa2\xd5\xb0\xd8\x48\xc9\x58\x17\x9c\xd2\xc1\x38\xe7\xa8\x13\x3d\x10\xb9\x52\x74\x5c\x6f\x9c\x5a\xd2\x06\xb1\x3a\xe8\x3e\x21\x23\x6e\x06\xa2\x7e\x60\xf5\x4c\x15\xfd\xf9\x6c\x08\x4e\xe9\x25\x3a\xf3\xae\x53\xf1\xe5\xc7\x9b\xf6\x1e\xef\x8c\xd9\x0f\x38\x2d\xa1\xf2\xc0\x72\x27\x2b\xf9\xfc\x89\xb4\xfc\x6c\x18\xa5\x7e\x19\x7a\x36\x6f\xdb\x5a\xf0\xff\x28\x13\x1f\x42\x69\x0e\xc6\x9d\x59\xfa\xe8\xc8\xf4\x3c\x8f\x3c\xf4\xea\xcb\xdc\xf3\xe1\x62\xe4\x92\xe1\xbd\x53\x3a\xbe\x70\xba\xc5\x3f\x98\x68\xc1\x99\x59\x21\xc7\x9d\x09\xf6\x7a\x6b\x72\x44\x10\xa4\x68\x12\x9f\x99\x0d\x15\x0e\x95\x66\x3e\x54\x55\x1f\xeb\x97\xa4\x30\x4f\x92\xab\x3d\xb2\xa4\x3c\xa8\x41\xee\x3b\x0f\x6b\x62\xc7\x51\xf6\x01\x6b\x84\x39\xd5\xa0\x8d\xb8\xd3\x4f\xaa\x4b\xa7\xa7\x61\x7f\xe5\xbb\xf1\xf8\xfc\xb5\xa9\xf5\x5f\x1a\x1d\xb8\x36\x45\xeb\x93\xbd\xe6\x00\x03\x2b\xba\xc8\x95\x86\x3c\xc5\x4f\x09\xa9\xfe\x1e\x19\x0a\x08\xab\xc6\xc0\x80\xba\xdd\x82\x45\xbb\x99\x18\x71\x3d\xda\xea\xd3\x77\xaf\xbd\xcb\xc7\xcf\x4d\x19\x1f\x6c\xa2\xfe\x2d\xef\xa4\x5c\x3c\x33\x53\xc2\x77\xe1\x13\x02\x84\xcd\x44\x1d\xa7\x74\xeb\x16\xe7\xbf\x11\xad\x0b\xee\xf3\x02\x02\x2a\x18\xcf\x04\x79\x28\x5d\xf7\xf6\x4f\xea\xca\xca\xef\x8c\xa5\x0c\x20\x1c\xb9\x00\x10\x87\x61\x1c\x4c\xd1\x6f\x1a\xb6\x78\x2d\x7e\xaf\xae\x09\x4c\x93\xcf\x30\x14\x77\xa6\x78\xc9\xec\x48\x2b\xaa\x1d\x1d\x1a\x40\x54\x94\xb6\x7b\x35\x05\x7b\x69\x1a\xf4\x4d\xc3\xbe\x73\xe2\x6a\xb2\xb6\xfb\xe5\xd2\xe2\x11\x7e\x0c\x6d\x0e\x96\x4b\x38\x26\xa6\xe0\x57\xc8\x0e\x4f\x0e\xd7\x8e\xd1\x31\x0c\x24\x51\x6b\x95\xdc\xef\xcf\x5d\xfd\x7e\x79\xe5\xe2\x4e\x69\x22\xad\xe7\xef\xdc\x22\x42\x93\x49\x73\xf6\x36\xe3\x00\xcb\xe5\x00\x2f\x8b\xb0\x41\x3a\x76\xba\xee\x10\x09\x9b\x10\x08\xe3\x84\xb8\x64\x41\x88\x93\x2a\xbf\x79\xd0\xf2\x6c\x66\xeb\xd6\x62\xad\xd6\x8e\x03\x92\x12\xbf\x4f\xd8\x01\x11\x41\x96\xe1\x05\xd9\x58\xad\xe1\x5f\xb4\x51\xfb\x5d\x5d\x90\xfe\xe2\xec\xb7\x92\xbb\x5c\x86\x41\x25\xbb\x3e\x63\xe0\xa7\xb5\x9f\xf5\x4f\x5d\x52\xec\x59\x07\x08\x84\x0b\xbf\x13\x4e\x25\x62\x56\x90\xb2\x62\xe5\x49\x3a\x53\xef\x20\x6c\xe2\x5c\x6b\x4d\xcb\xf3\xd8\xeb\xab\x28\x06\xf9\x6b\x6a\x96\xee\xde\xbb\x29\x30\xfd\x72\x30\xe9\x60\x1c\xe4\xab\x66\xd7\x21\xe8\x56\xee\xdd\x67\x04\xf0\xb6\x73\xe0\xfe\xba\xbd\x11\x48\x46\x9b\xdf\x93\xc8\x90\xc6\x37\xc5\x42\xb5\xfd\x4d\xc2\x1b\x89\x8c\x8c\x01\x50\xa1\xbc\x28\x17\x54\x2e\x21\x12\x05\xdc\x70\xbe\x74\x97\x7c\x37\x90\x1f\xdc\x73\x46\x13\xe5\xc1\xf4\x0e\xfb\xdf\x19\xb9\x83\xab\xba\x0d\xda\xd0\x1d\x0a\xb6\x54\xb2\xe3\x4c\x65\x60\x90\x35\x1a\x51\x5a\xca\x39\xf5\x8b\x34\x85\xda\x7c\x0a\x69\x69\x52\xea\x61\x8f\x1f\x79\xeb\x7c\x55\xb0\x56\xee\xc7\x7e\x22\x22\x4b\xd7\x9d\x2a\xd9\xf5\x97\xf1\x2d\xcd\xd7\xc7\x16\x05\x18\xcc\xd7\x7b\xb5\x31\x7a\xc0\xea\x66\xb6\xa8\x0a\x2c\xc4\xe2\x8a\xe3\x88\x1c\x59\xdf\xf4\xd4\x68\x47\x79\x77\x6b\xf9\xe3\xac\xcc\x83\x84\xf2\xa1\xf0\x5c\xd3\xca\xdb\x34\x5a\x27\x66\x9e\xa1\xc0\x59\xe0\x86\xf4\x21\x34\x6a\xe2\xcf\x95\xd1\x9f\x75\x94\x1e\xed\x79\xc7\x75\xeb\x55\x7e\x25\x2e\x08\xd9\x66\x22\x04\x00\x6d\x2b\xa9\x37\x5b\xd8\x71\xf6\xb6\x4a\x06\x33\xa3\xb2\x71\xd8\xf1\xac\x39\xd3\x9e\x6a\x51\x00\xc9\x9e\xff\xd2\xa0\x9d\xf4\xb4\x9d\x1a\x41\x17\x6d\x4d\xe1\xa4\x23\x6c\x81\x90\xbf\xfa\xd2\x51\xa1\x13\xcc\x16\xd4\x99\xac\x21\x2d\xb3\x1b\x26\x49\x7a\x39\x9c\xe1\xac\xc2\xb4\xa6\x3c\xee\xe1\x93\xbf\xb9\x4b\xf9\x1d\xc3\x09\xc7\xba\x46\x64\xb4\xe9\x9c\x74\x57\x86\xb7", 4096); *(uint16_t*)0x20001080 = 2; *(uint16_t*)0x20001082 = htobe16(0x4e22); *(uint8_t*)0x20001084 = 0; *(uint8_t*)0x20001085 = 0; *(uint8_t*)0x20001086 = 0; *(uint8_t*)0x20001087 = 0; *(uint8_t*)0x20001088 = 0; *(uint8_t*)0x20001089 = 0; *(uint8_t*)0x2000108a = 0; *(uint8_t*)0x2000108b = 0; syscall(SYS_sendto, r[0], 0x20000080ul, 0x1000ul, 3ul, 0x20001080ul, 0xcul); break; case 2: *(uint16_t*)0x200011c0 = 2; *(uint16_t*)0x200011c2 = htobe16(0x4e20); *(uint8_t*)0x200011c4 = 0; *(uint8_t*)0x200011c5 = 0; *(uint8_t*)0x200011c6 = 0; *(uint8_t*)0x200011c7 = 0; *(uint8_t*)0x200011c8 = 0; *(uint8_t*)0x200011c9 = 0; *(uint8_t*)0x200011ca = 0; *(uint8_t*)0x200011cb = 0; syscall(SYS_recvfrom, 0xffffff9c, 0x200010c0ul, 0xcdul, 0x802ul, 0x200011c0ul, 0xcul); break; case 3: memcpy((void*)0x20001200, "\x65\x34\x64\x0a\x5e\x77\x48\x51\x1a\x23\xbf\x56\x23", 13); syscall(SYS_setsockopt, -1, 0, 1, 0x20001200ul, 0xdul); break; case 4: *(uint32_t*)0x20001280 = 0xc; res = syscall(SYS_paccept, 0xffffff9c, 0x20001240ul, 0x20001280ul, 0ul); if (res != -1) r[1] = res; break; case 5: *(uint16_t*)0x200012c0 = 0x18; *(uint16_t*)0x200012c2 = htobe16(0x4e23); *(uint32_t*)0x200012c4 = 1; *(uint32_t*)0x200012c8 = 0x800; syscall(SYS_connect, r[1], 0x200012c0ul, 0xcul); break; case 6: *(uint32_t*)0x20002340 = 0x1002; res = syscall(SYS_accept, -1, 0x20001300ul, 0x20002340ul); if (res != -1) r[2] = res; break; case 7: *(uint64_t*)0x200024c0 = 0x20002380; memcpy((void*)0x20002380, "\xce\x0f\xda\xd9\xa6\x4a\x58\xf7\x84\xd8\x08\x7a\xf8\x05\xaa\x2b\xd2\xf9\xb8\x6b\x22\xd9\xb2\xc3\x2c\x58\x73\xc3\xf3\x2b\xef\xbc\x76\xc4\x7e\x31\xe9\x5c\xb5\x77\x20\x09\x97\x41\x06\xdd\x56\xe9\xb7\x7e\x9e\xf2\x1b\x64\xeb\xda\x31\x08\x05\x30\xf8\xdb\xeb\x72\xd1\x92\x5f\x06\xc0\xe6\x16\x3c\x87\x37\x29\x3d\x33\x34\xcd\xfe\x5d\xe4\x21\xf3\x35\x04\xea\xa8\x02\x4b\xcb\x42\xa0\xad\x53\xd6\xbd\x25\xe3\xb6\x65\x03\x62\x96\x98\x53\x80\x33\x00\xc7\x1d\x12\x31\xf7\x3d\x20\x10\x9f\xd2\xb8\x05\xd7\xc0\xde\x06\x68\x00\x18\x86\xe4\xa3\x80\x88\x0e\x16\x9d\xe6\x77\xcb\x12\x4c\xc6\x05\x78\x02\x0f\xfe\xcb\xe8\x38\x19\x65\x69\x72\x96\xf8\x7c\xa1\xdd\x26\xd2\x39\xf0\x0c\x44\xd2\x8f\x44\x04\x68\x97\x8e\xdf\x01\x9a\x5d\xb0\x50\x91\x3f\x84\x18\x95\xd9\xd9\xa4\x2a\x50\xfd\x29\x53\xaf\x0b\xd6\xc6\x92\x83\x5f\x5f\x28\xb4\x67\x68\xfc\x54\x00\x14\xf8\xd3\xee\x3d\x80\x17\x5c\xd9\xbc\xa3\xe5\x2d\x0a\x15\xb8\x87\x73\xf3\xb8\x11\x08\x90\xf4\xdf\xfe\x75\x43\x3f\xda\xba\xc5\x4c\x62\x29\x8a", 242); *(uint64_t*)0x200024c8 = 0xf2; *(uint64_t*)0x200024d0 = 0x20002480; memcpy((void*)0x20002480, "\x80\x24\x2b\xeb\xc8\x1b\xd3\xda\xdc\xb9\x92\xd2\xde\x24\xb8\x13\x00\xa6\x36\xd3\xa6\x4b\xdf\xe9\x31\x33\xe1\x44\x29\xda\x14\xcf\x31\x7e\xde\xd2\x00\xe3\x71\xe3\x4a\xef\x0b\xba\xf2\x72\xa4\xe8\x77\x89\x08", 51); *(uint64_t*)0x200024d8 = 0x33; syscall(SYS_pwritev, r[2], 0x200024c0ul, 2ul, 0x51ul); break; case 8: *(uint32_t*)0x20002540 = 0xc; syscall(SYS_getpeername, r[2], 0x20002500ul, 0x20002540ul); break; case 9: syscall(SYS_dup2, -1, -1); break; case 10: memcpy((void*)0x20000000, "\x48\xf7\xf1\x90\xc6\x85\xfa\xd5\x02\x0b\x2c\x72\x6e\xad\xc8\x3c\x08\x67\xb0\x1c\x6b\x28\xea\x05\xf4\xbd\x05\x44\xeb\x88\x3e\xc3\xd8\x89\x7d\x9a\xee\x86\xbc\xb2\xc9\x0e\xbe\x68\x77\x4c\x20\x65\x70\xc9\x03", 51); break; case 11: memcpy((void*)0x20000040, "\xc4\x22\x7d\xb7\x4b\x0b\x45\x86\x57\xfb\x66\x44\x0f\x38\xdc\xd2\xc4\x81\xf9\x5b\xfe\x0f\x49\xf8\x66\x0f\x3a\x0c\x9b\xb4\x00\x00\x00\xfe\xc4\xa2\xfd\xa6\xfc\xc4\xa1\x4d\xd5\x16\xc4\x01\x94\x59\x6d\x64\x66\x41\x0f\x6c\x23", 55); syz_execute_func(0x20000040); break; case 12: break; case 13: memcpy((void*)0x200000c0, "\x53\x89\x0e\xf7\x06\x9c\xeb\xf4\xab\x2e\x38\x62\xd4\xe8\xf0\xd7\xcd\x39\x04\x66\x11\xd8\x6e\xfa\x40\x3d\x25\x55\x8c\x0d\xe4\xab\x33\xf8\x31\xe6\xf5\xf5\x29\x56\x03\x28\x35\x78\x3b\xf2\xd0\xf5\x81\x7f\x8b\x8d\xda\x73\xc7\x54\x2d\x9f\x0d\x12\xa6\x31\xe2\x5a\x3e\xe4\xdc\xfb\x6a\xe2\xf9\x68\xa8\x25\xda\xc5\x81\x2d\x8c\x6b\x82\x64\xe0\xb7\x8c\x3d\xaa\x0c\x76\x23\x7a\x22\x3a\x71\xf5\x0b\xa3\x6e\x78\x4b\x03\xb1\xf3\x87\x05\xa2\x37\xcf\x14\xc4\x37\xfd\xc2\x36\x3d\xc7\x73\xb1\x94\x6b\xe9\x83\x5b\xd5\x9c\xf8\x39\x00\x38\xfb\x9b\xac\x19\x1e\xc2\x55\xea\xf7\x0e\xa2\xb5\x63\xdb\x02\x24\x60\xb0\x5e\x8d\x6a\xcc\x51\xea\x2d\xc2\x5f\xf0\x6b\x2a\xdd\x98\x89\x0a\x72\x78\x07\x07\x2b\x47\xf3\x8e\xe4\x2d\x63\x67\xe7\xd3\x54\x8d\x3f\x13\xca\x55\x74\x42\x6d\xf2\x94\x62\x6c\x3e\xf4\xb8\xcf\x7a\xea\x48\x30\xb7\x0d\x93\x12\x2e\xfd\x51\xfc\xe4\x84\x96\xa5\xbd\x03\xe3\x05\xf2\xad\x87\x19\x69\xc9\x7c\xef\xf6\xb6\xc2\x28\x6c\x54\x31\xb9\xfd\xbd\x88\x37\x62\x92\x98\xcb\x4e", 239); memcpy((void*)0x200001c0, "\xa1\x85\x22\x4a\x16\xff\x1a\x06\x2f\x6f\x97\x66\xae\xb7\xf5\x84\x08\xb0\x28\x45\x0e\x80\x97\x0d\x92\x50\x11\x4b\x2c\x87\x1d\x5d\x9e\xc6\x7f\x79\x90\xa3\x05\xb4\xbe\x2c\x41\xd3\x5d\x33\x16\xa7\xf4\xc9\xb2\x74\x01\xf8\x44\x0e\x71\xa5\x79\xb7\xf9\xac\xc6\x06\xd2\x0d\xa0\x88\xc7\x07\x7b\xbc\x3c\x36\x1e\x71\xc5\x77\x40\x61\x68\xbc\xc1\xbc\xb7\xf0\x2e\x41\x6e\x3f\x90\x84\x03\xe2\x3d\xb0\xc7\x27\xea\x76\x9d\xeb\xda\x4d\x0e\x52\x4f\x8a\xdf\x7f\x42\x18\x4a\x20\xba\x1a\x23\xf9\xc5\x8d\x46\x91\x4c\xc7\xb1\x2c\x19\x53\x7d\x55\xa4\x0f\xcd\x26\xc6\x8e\xfb\x09\xdc\x0a\xcc\x2e\xe7\x52\x4a\xbe\xc0\xb8\x03\x5a\xd2\xb1\xd1\x94\x33\x1e\x2e\xa4\xe4\x2e\xbc\x53\xd3\x88\x0e\x7c\x0d\xd6\xc5\x79\x02\xc8\x72\x7c\xef\xb0\xfd\x31\x92\xd6\x62", 181); syz_usb_connect(0x1e3d802a, 0xef, 0x200000c0, 0x200001c0); break; case 14: memcpy((void*)0x20000280, "\xb7\x48\xb2\x1b\x78\xea\x22\x21\x6c\x2c\xbf\xdc\xcb\x03\xec\x54\xd2\x0f\x30\xf4\xaf\x46\x2b\x7b\xfd\x5d\x30\x1b\x9a\x4f\xb8\xf9\xbb\xe6\x30\xdd\xe8\xd6\x08\x55\x02\x94\x47\xdf\x51\x12\x0e\x0d\x69\x0a\xe4\xa7\x3e\x5a\x06\x06\x4c\xc0\x6d\x83\x62\x2a\x66\xc3\xcf\x3c\xcd\x92\x0d\xf4\xa9\xde\xc5\x47\xf0\xc8\x53\x54\xb2\xe8\x03\x69\x9f\x52\xff\xc8\x14\x53\x6c\xe5\x19\xc7\xc1\x65\x26\xda\x56\xc6\x5b\x44\x29\xcb\x22\x4a\xd9\xc9\x7f\x63\x7e\xe6\xf2", 111); memcpy((void*)0x20000300, "\xfc\xa1\x69\x1e\x90\xfe\xf7\xc0\x69\x3e\x50\x16\x1f\x6b\xf9\xd6\xbe\x11\x62\x1b\x96\xa6\x5d\x50\x23\xd6\x6e\x18\xc9\xdc\x3b\xb3\x8c\xf4\x79\x30\x6e\xff\x4d\x2c\xf1\x75\xb6\xf8\x52\x15\x44\x6b\x23\x79\xfd\xc7\x32\x74\x56\x6c\x4c\xa7\xce\xc4\xd6\x6a\x48\x19\x12\xaf\xe2\x3a\x3f\x61\xad\xb9\x46\x7e\x5b\xf8\x28\x15\x64\x36\xeb\xe3\xd2\x9e\x30\x73\xe4\x25\x4b\x3a\x73\x4a\xcd\x66\xd1\x4e\xfb\x07\x36\xfc\xad\xff\x4d\xad\x73\xe0\x25\x31\x87\x0c\x30\xfa\xe0\xc3\x78\xc5\x15\x78\x6c\x88\xc1\x29\x27\x36\xcd\xf0\xb6\xa2\xe7\x9b\x47\xa7\x8e\x33\xf5\xe1\xd0\x68\x8a\x6f\x3c\xe2\xd9\xe1\x5b\xd3\xee\x2e\x2a\xfe\x1a\xc5\xc8\x52\x3a\x84\xa2\x08\x75\x5a\x7f\x82\x2f\x3d\x21\x1f\xe3\xa2\x6a\x86\x50\x7d\x98\x58\x3d\x56\x6a\x05\x91\xa7\x80\x2c\xb3\xf9\xf9\xdc\x35\xb9\x11\x0d\xe4\xb2\xf4\xd3\x93\x4b\xb2\x0b\x7a", 199); res = syz_usb_connect(0xa4, 0x6f, 0x20000280, 0x20000300); if (res != -1) r[3] = res; break; case 15: syz_usb_disconnect(r[3]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor781387825 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/4 (0.67s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:10 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000040)=0x8) sendto(r0, &(0x7f0000000080)="8d360d8e2229aab63aef8e41582b2d02e93c2190e2fe50c1f7f3b29e853f60fb587dd78a2c404615cdf3763b9a53dba141c66b4a485450d66e0a4a281e63e3527c88cdde73010e05449a77aee1e7a35fdddea497119a92fa7fb2d108d6475f90ca55e04b82e53d6ac1138cb913b8dbb0b6f922a1a85461459190969a7d79de9164f3b4e2e9dc65817cd3908bf131ac85e8713459e5da855dd94a0feea76b05dd56d5e0b5222332210506202af0c3718596bf5549077f213886eeb0b3e38b83e237290327d0cc6d5e374a365eccda88ebf8ce4141536b085424aadb2b0c5be557bea12ea53f3fd5b7d3b48edf54f860c8a8e1941e0a56d851b2c08b8d4c9bad81ad649d1479bb60644194385d680441c674f629c50abb98ea4859798a0a3edee95e33f9c2880db8c9279f971bd597b98978bd664047c144af6c7954cc4edb914a618047a063ee7531377216a1f42404fde995936f5d7aba61bb230700ac3390d8fbc62772094fb8e543f39134132c6815d1ebf15bd0068e3b7ea86bb183465b91a431f52fe38bd0e6e077298ae8265685e46961fa82b64c5f757eaf9a7d0f63ed2849b17af0c550118c7e8e5addd917ce997796319e6bcf9bc42b8ba87c94e5a31b1cecb2fde9c571f9a87a88230f8093a7ae80a0c45c3ceec69f1e1f844296045070f3728ec4fa644cd74881db3c72352e4b8318f8834ac6306a5698ce9a5eb314f3f8647067bd6de7c90940645931c310aa55e4268ecbaf64c9d8c9ace54fc9f224746ddd681840c392f274753342ef48ac1973abf5c38d0776bd61c087d7b54b1f93eaed1a7c9f73427e38d5e3ca2cd17fa00c69873921ed8f2b8b9f89509134f723b6980831f5504a65602bd9367a151c570a705910afd9f69116737327c193a8751d9c161b5b2ef4e406055fe79c570f7c3e8334623ef02b9f47eecb78d30db147d4fc90bc91faec2d9181206e41cccde0c21483bfd0c45d8765a13d69e22479c21816dbd590ae51e49f6058449b9d3dbe94075e2e57028f43f70201a1e4875b91697c29deb8c2572a105131c87f7685cad94d1321d4ae5cc6efede11ac80a0e00a63b2ba54fcc5195475c3f1ff572693d00e491a0445c987dedcbe73b69ec13d226b193ec03fa9a27a4a434d148983366c7d8e5bc3cea9fbeffd05b8b0090765159b380ac96429655125921507f97df3e9d41c66b2f5fffd0cad4826577916f941ac7c9ec7ab625ec9390e050c5885dbd2e7131f2794ecad5709e0ac395ad0edee0182822374e701167ad2cfda07ff9e9bddee1c688d483c132e197a9481c9eb0df2cf9669ab107cc936bf2c96268a120a44fb7f178b402ecd9c512f86908f43fea11cc6902c355929b910a523acd16d5931ea41753391a0368e5bbe9e8cd926da120d8440fce2c192b1e5986854de8551320c989533771f1a71fb41ff1c927ffba9e9e25ae533db6a3c804b0b340a0409e110ac76a7b58f912db41e33b115e1c3ae9aa0399edd621a0fd4b7be2176cb49682ee82b2a219baace63b3822b98ba6f48cd34a08143321993c4390b94b138e4adcfd47dd01982e24acb8d464738f44af04ff3353f8683f352306457522e653baa8937950448eef9879dfaa42e9fcca9a968971b60c413f4aa3e0f90b41c7828ad5dbb62aae0cd2d2ef85e248bf12e4d6d75b803aca52bb9616acc37bc8bdab1a66661a5329dc936b1dbc83fd598c57b9ad80ac42c21a6318b3fb8d0d865fffb043217c42f9546c050eb8cce5e3423371a93aff46471d2008c8cd5841f849d1f0d58317353a6d7308f7962d943795bd52a4dd5a8440640273c78ef6ebbeaae9143d5e6ee90cdaa257e132e6d42d02b9567ae69b75bc60f7596a1fdd8179cff323991701062930ce23a29e30023da9d631bf61a6440acc290bdeafbaaea78365f408aea8f864da220e7a560c9ac84bb9c975814c132f97e08b64ccad47ceb08f2941a4438feb76560b1d5e6f3289f50d054e949674eb6c3294cc4a27427650c4a37f53c65c55ca410fa62ee18a829220360a8272f8c0041e2bf33f047928feb0269c438bdf399b1d8f187b2454ea5cd873e352e1d0781570234c6d810c5a16bac9ea9ffafb0c978a022276903a1c653f17d96659cbb30abc1a320c584bdfcc00125270c2d4c90950029f711575dfa828feea3b1dc83c0701dffac1f89536583a0c0995550f862c3ec786c0f8fee0fd94fae0a661313f9e753362336db3ea0296d7fb913ad490bfc9dd155307ab14e67114fcde26d032435cec7d29247deb93bcf7fa48b4ddb5fb7449c0fda083d5a63e03922d5dfb361b7eeb122a094c3b08eacbd43cecc76c29a9bbcd4808bfa6eaeb78d3453e30660d1653569841869e3d8b90f3d047388da51919cf056ce1ce1d455177c95cdb8f76637d5336e82c9e10ddfd33515f7491ef28cbe4c8a477086daeb525d097844879d140965ef0463b3e1780065da2255e68aee903f7b06b0824b151525c56063d4be22ee31b82d2029fef15f38f9008d785dcab9f1454185ec4a3d76ed3aa8d27859f66ae63eddd338ac28f64048e46a5d0731f9b7ebe52218e11e78cb6d8172aea44f2c213ce7f5edfaed81c5de95a86aba484ec2e1950f61e743f11fbd881f2b0c891aa6e94fff4e5d747971313613da54b5483aabe5b12a8e661d455cdf442b86f3cd8b6e95e2ebfba7c62001769d5d9725f1df8ff364ff45f65b16fb2a828638313dbaac9818f990e8590d54b67613430b9f1869b7f2f756e4af19a145105b7b0f7c889b3146533114d001fc2c1b6b285ded35fd0b17857da527e80658f0b717a8c98920f72289896f05a686083fa9e84ee9f0590793b484365159cd18d9290fc7b342b3926bccdc830a519b8abd07e5b885cc4a6046423d5fa976588510cf5b0cfeaa38e7d170feb401bf9b3e4284415b8e2d2b8d73a0bfda6e246d4075c16f3bf8c1d8a1969dc57fc8786b1e4afb4ec6769534debe49ef6873e76289c6442c6d690457af91df631c7b0d4d0a18a43b26803bfe374a81de3c182b4dc50683f8545157b40f4b44db5eff729645421817ff5fdd0b4ca5cc2ba9b23c33256074b0cd5938aacea39e5cb5af7ec444267f1419867e355de6700ae0a63b7a57eaabe21aee216048612ec6c6993a577ca4d7a0071f5680d89baa337a37a5d1af9dc359d9708ddab0bb96323ae8f6a48d2b8b42d47d4a051b55d14116a359899c79011f2db86e08c2fb7c7d836355cd55f33aba9cb80a10c0844011e3ffa01f5472233fbaebe45f044154220094bf7da1a4035c195978e1b97eac6c41010b27dfb5df985ab16d219f415528b0403846b326f0a00f7b73c89933e1a2daa58dd8dee2f91e2d083eb25508ad3b3e916cf7e002140ed65ebe55ed8bec0cea09a5a61f7262aaa61cbf09d16ff6aac48c511fb8220dc5e20c3d4ce6283c53442a5cf408f3e66734208cc4f13a90a9ad6f90c1db802abcff903addba309ad25dd56cf6d37f32f82eb07fce24ac33e48451e7719e323f512a459a172172ff94d41be609aba82bcb7d827dfc73b4875209aa392c6f0d24f95bb900814fbff19c8d51d421270363bc808f29e21e14f6c99a13f8000fbfbc1cae461215fbba52511c9d14aaedb16e3a3725534b5713c554f1e5ebdc2abfaa712cf0d8ff6699cf0949f89b187e58bbac15927a701432f81b61e797136789ae2e824b0a74c553d59b7a1a1d512fec36c863422f0634560064ad2c310895d6d8a1a3f9429f08a7360cd4b4f9f208bf6d210d809796276e7a900ea994d3f8a3c3be28c3384c8d822fd108e8e9a195798149beb3e4eed373edac2bbc957b3f0432bcddc9556b734b19f91d94d21a881fbc882603f7da7f8993a74d5b12670f87aa69885abea718b67a700caf9fac78122a83b282099952664e5e8446a23b4bb3c01b1b4a9dca924fe0210445dd5e8ce3bdf2429463df24de0cb74bfc162847a6177d42feb487c89e1fd76fc59e4feaab91d6fadfa65a872a8128ea56f4914fb55165598db63bd701573f8ca7b78b69fe0983f1aadb99bb0ccbf9e2409d2833f9ab80296f9795c5e5740ebebb71238c6898dbd6e043cd6031c1590edfe763446a96d3806d62ef9a7467f4545d4b958ab916939d985856d06cc9369194329b961c0b767a76624104d3cacb9119d17499d83c1e6f95f4c79de2aae011413facd8962980b5327c7e22b516c841a985646e38126fb50c8bba642076489a8a8cc21cac2e92e6d459d5666b868da0e30121e972324076476490170f513efc5dcf57ce85d81c9fffceefb19ec98278e13abb2f322af44b980f9ef522e98d909507a8eeb7a0bd927d621e0fbfa06a9ca8f2f9978aae462db2cce9240c82942957472c722a0cbc1c84e6c7cd86bf6534d05090396b70cef7c77a29f06e5360d9c5c426988ee7653d022c1b49bc99494bc661c42b97b62c0f5351b5aabcaf1e22a6cb70d348753711f9063f87b292edf6137ac524b2a4cdf8d3a8ca035fd959ea40297645253a33946687bee09f66132f2cbca0f451b82108f4e68683fcef2cb3282d38fe47f6be597a0aba1b637e24fa2ea26f890f5e8cd2e438b0c42319c3f482b21b3b36e9b66907ab9451aa2d5b0d848c958179cd2c138e7a8133d10b952745c6f9c5ad206b13ae83e21236e06a27e60f54c15fdf96c084ee9253af3ae53f1e5c79bf61eef8cd90f382da1f2c072272bf9fc89b4fc6c18a57e197a366fdb5af0ff28131f42690ec69d59fae8c8f43c8f3cf4eacbdcf3e162e492e1bd533abe70bac53f9868c1995921c79d09f67a6b724410a468129f990d150e95663e54551feb97a4304f92ab3db2a43ca841ee3b0f6b62c751f6016b8439d5a08db8d34faa4ba7a7617fe5bbf1f8fcb5a9f55f1a1db83645eb93bde600032bbac895863cc54f09a9fe1e190a08abc6c080badd8245bb9918713ddaead377afbdcbc7cf4d191f6ca2fe2defa45c3c3353c277e1130284cd441da774eb16e7bf11ad0beef302022a18cf0479285df7f64feacacaef8ca50c201cb9001087611c4cd16f1ab6782d7eafae094c93cf301477a678c9ec482baa1d1d1a405494b67b35057b691af44dc3be73e26ab2b6fbe5d2e2117e0c6d0e964b3826a6e057c80e4f0ed78ed1310c24516b95dcefcf5dfd7e79e5e24e6922ade7efdc2242934973f636e300cbe5002f8bb0413a76baee10099b1008e384b8644188932abf79d0f26c66ebd662add68e039212bf4fd801114196e105d958ade15fb451fb5d5d90fee2ecb792bb5c864125bb3e63e0a7b59ff54f5d52ec590708840bbf134e25625690b262e5493a53ef206ce25c6b4dcbf3d8ebab2806f96b6a96eedebb2930fd7230e9601ce4ab66d721e856eedd6704f0b673e0febabd1148469bdf93c890c637c542b5fd4dc21b898c8c0150a1bc2817542e211205dc70be74977c37901fdc734613e5c1f40efbdf19b983abba0ddad01d0ab654b2e34c656090351a515aca39f58b3485da7c0a696952ea618f1f79eb7c55b056eec77e22224bd79d2ad9f597f12dcdd7c7160518ccd77bb5317ac0ea66b6a80a2cc4e28ae3881c59dff4d4684779776bf9e3accc8384f2a1f05cd3cadb345a27669ea1c059e086f421346ae2cf95d19f75941eed79c775eb557e252e08d9662204006d2ba9375bd871f6b64a0633a3b271d8f1ac39d39e6a5100c99effd2a09df4b49d1a41176d4de1a4236c8190bffad251a113cc16d499ac212db31b26497a399ce1acc2b4a63ceee193bfb94bf91dc309c7ba4664b4e99c745786b7", 0x1000, 0x3, &(0x7f0000001080)=@in={0x2, 0x2}, 0xc) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000010c0)=""/205, 0xcd, 0x802, &(0x7f00000011c0)={0x2, 0x0}, 0xc) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001200)="6534640a5e7748511a23bf5623", 0xd) r1 = paccept(0xffffffffffffff9c, &(0x7f0000001240)=@in, &(0x7f0000001280)=0xc, 0x0) connect$inet6(r1, &(0x7f00000012c0)={0x18, 0x3, 0x1, 0x800}, 0xc) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000001300)=@file={0x0, ""/4096}, &(0x7f0000002340)=0x1002) pwritev(r2, &(0x7f00000024c0)=[{&(0x7f0000002380)="ce0fdad9a64a58f784d8087af805aa2bd2f9b86b22d9b2c32c5873c3f32befbc76c47e31e95cb5772009974106dd56e9b77e9ef21b64ebda31080530f8dbeb72d1925f06c0e6163c8737293d3334cdfe5de421f33504eaa8024bcb42a0ad53d6bd25e3b6650362969853803300c71d1231f73d20109fd2b805d7c0de0668001886e4a380880e169de677cb124cc60578020ffecbe8381965697296f87ca1dd26d239f00c44d28f440468978edf019a5db050913f841895d9d9a42a50fd2953af0bd6c692835f5f28b46768fc540014f8d3ee3d80175cd9bca3e52d0a15b88773f3b8110890f4dffe75433fdabac54c62298a", 0xf2}, {&(0x7f0000002480)="80242bebc81bd3dadcb992d2de24b81300a636d3a64bdfe93133e14429da14cf317eded200e371e34aef0bbaf272a4e8778908", 0x33}], 0x2, 0x51) getpeername(r2, &(0x7f0000002500)=@in, &(0x7f0000002540)=0xc) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_ethernet(0x33, &(0x7f0000000000)="48f7f190c685fad5020b2c726eadc83c0867b01c6b28ea05f4bd0544eb883ec3d8897d9aee86bcb2c90ebe68774c206570c903") syz_execute_func(&(0x7f0000000040)="c4227db74b0b458657fb66440f38dcd2c481f95bfe0f49f8660f3a0c9bb4000000fec4a2fda6fcc4a14dd516c40194596d6466410f6c23") syz_extract_tcp_res(&(0x7f0000000080), 0x6, 0x8000) syz_usb_connect(0x1e3d802a, 0xef, &(0x7f00000000c0)="53890ef7069cebf4ab2e3862d4e8f0d7cd39046611d86efa403d25558c0de4ab33f831e6f5f52956032835783bf2d0f5817f8b8dda73c7542d9f0d12a631e25a3ee4dcfb6ae2f968a825dac5812d8c6b8264e0b78c3daa0c76237a223a71f50ba36e784b03b1f38705a237cf14c437fdc2363dc773b1946be9835bd59cf8390038fb9bac191ec255eaf70ea2b563db022460b05e8d6acc51ea2dc25ff06b2add98890a727807072b47f38ee42d6367e7d3548d3f13ca5574426df294626c3ef4b8cf7aea4830b70d93122efd51fce48496a5bd03e305f2ad871969c97ceff6b6c2286c5431b9fdbd8837629298cb4e", &(0x7f00000001c0)="a185224a16ff1a062f6f9766aeb7f58408b028450e80970d9250114b2c871d5d9ec67f7990a305b4be2c41d35d3316a7f4c9b27401f8440e71a579b7f9acc606d20da088c7077bbc3c361e71c577406168bcc1bcb7f02e416e3f908403e23db0c727ea769debda4d0e524f8adf7f42184a20ba1a23f9c58d46914cc7b12c19537d55a40fcd26c68efb09dc0acc2ee7524abec0b8035ad2b1d194331e2ea4e42ebc53d3880e7c0dd6c57902c8727cefb0fd3192d662") r3 = syz_usb_connect(0xa4, 0x6f, &(0x7f0000000280)="b748b21b78ea22216c2cbfdccb03ec54d20f30f4af462b7bfd5d301b9a4fb8f9bbe630dde8d60855029447df51120e0d690ae4a73e5a06064cc06d83622a66c3cf3ccd920df4a9dec547f0c85354b2e803699f52ffc814536ce519c7c16526da56c65b4429cb224ad9c97f637ee6f2", &(0x7f0000000300)="fca1691e90fef7c0693e50161f6bf9d6be11621b96a65d5023d66e18c9dc3bb38cf479306eff4d2cf175b6f85215446b2379fdc73274566c4ca7cec4d66a481912afe23a3f61adb9467e5bf828156436ebe3d29e3073e4254b3a734acd66d14efb0736fcadff4dad73e02531870c30fae0c378c515786c88c1292736cdf0b6a2e79b47a78e33f5e1d0688a6f3ce2d9e15bd3ee2e2afe1ac5c8523a84a208755a7f822f3d211fe3a26a86507d98583d566a0591a7802cb3f9f9dc35b9110de4b2f4d3934bb20b7a") syz_usb_disconnect(r3) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bEndpointAddress; uint8_t bmAttributes; uint16_t wMaxPacketSize; uint8_t bInterval; uint8_t bRefresh; uint8_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint16_t idVendor; uint16_t idProduct; uint16_t bcdDevice; uint8_t iManufacturer; uint8_t iProduct; uint8_t iSerialNumber; uint8_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t wTotalLength; uint8_t bNumInterfaces; uint8_t bConfigurationValue; uint8_t iConfiguration; uint8_t bmAttributes; uint8_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bNumEndpoints; uint8_t bInterfaceClass; uint8_t bInterfaceSubClass; uint8_t bInterfaceProtocol; uint8_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint8_t bNumConfigurations; uint8_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0; iter < 10; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_accept #define SYS_accept 30 #endif #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getpeername #define SYS_getpeername 31 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_pwritev #define SYS_pwritev 290 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 29 #endif #ifndef SYS_sendto #define SYS_sendto 133 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 105 #endif uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: *(uint32_t*)0x20000040 = 8; res = syscall(SYS_accept, -1, 0x20000000ul, 0x20000040ul); if (res != -1) r[0] = res; break; case 1: memcpy((void*)0x20000080, "\x8d\x36\x0d\x8e\x22\x29\xaa\xb6\x3a\xef\x8e\x41\x58\x2b\x2d\x02\xe9\x3c\x21\x90\xe2\xfe\x50\xc1\xf7\xf3\xb2\x9e\x85\x3f\x60\xfb\x58\x7d\xd7\x8a\x2c\x40\x46\x15\xcd\xf3\x76\x3b\x9a\x53\xdb\xa1\x41\xc6\x6b\x4a\x48\x54\x50\xd6\x6e\x0a\x4a\x28\x1e\x63\xe3\x52\x7c\x88\xcd\xde\x73\x01\x0e\x05\x44\x9a\x77\xae\xe1\xe7\xa3\x5f\xdd\xde\xa4\x97\x11\x9a\x92\xfa\x7f\xb2\xd1\x08\xd6\x47\x5f\x90\xca\x55\xe0\x4b\x82\xe5\x3d\x6a\xc1\x13\x8c\xb9\x13\xb8\xdb\xb0\xb6\xf9\x22\xa1\xa8\x54\x61\x45\x91\x90\x96\x9a\x7d\x79\xde\x91\x64\xf3\xb4\xe2\xe9\xdc\x65\x81\x7c\xd3\x90\x8b\xf1\x31\xac\x85\xe8\x71\x34\x59\xe5\xda\x85\x5d\xd9\x4a\x0f\xee\xa7\x6b\x05\xdd\x56\xd5\xe0\xb5\x22\x23\x32\x21\x05\x06\x20\x2a\xf0\xc3\x71\x85\x96\xbf\x55\x49\x07\x7f\x21\x38\x86\xee\xb0\xb3\xe3\x8b\x83\xe2\x37\x29\x03\x27\xd0\xcc\x6d\x5e\x37\x4a\x36\x5e\xcc\xda\x88\xeb\xf8\xce\x41\x41\x53\x6b\x08\x54\x24\xaa\xdb\x2b\x0c\x5b\xe5\x57\xbe\xa1\x2e\xa5\x3f\x3f\xd5\xb7\xd3\xb4\x8e\xdf\x54\xf8\x60\xc8\xa8\xe1\x94\x1e\x0a\x56\xd8\x51\xb2\xc0\x8b\x8d\x4c\x9b\xad\x81\xad\x64\x9d\x14\x79\xbb\x60\x64\x41\x94\x38\x5d\x68\x04\x41\xc6\x74\xf6\x29\xc5\x0a\xbb\x98\xea\x48\x59\x79\x8a\x0a\x3e\xde\xe9\x5e\x33\xf9\xc2\x88\x0d\xb8\xc9\x27\x9f\x97\x1b\xd5\x97\xb9\x89\x78\xbd\x66\x40\x47\xc1\x44\xaf\x6c\x79\x54\xcc\x4e\xdb\x91\x4a\x61\x80\x47\xa0\x63\xee\x75\x31\x37\x72\x16\xa1\xf4\x24\x04\xfd\xe9\x95\x93\x6f\x5d\x7a\xba\x61\xbb\x23\x07\x00\xac\x33\x90\xd8\xfb\xc6\x27\x72\x09\x4f\xb8\xe5\x43\xf3\x91\x34\x13\x2c\x68\x15\xd1\xeb\xf1\x5b\xd0\x06\x8e\x3b\x7e\xa8\x6b\xb1\x83\x46\x5b\x91\xa4\x31\xf5\x2f\xe3\x8b\xd0\xe6\xe0\x77\x29\x8a\xe8\x26\x56\x85\xe4\x69\x61\xfa\x82\xb6\x4c\x5f\x75\x7e\xaf\x9a\x7d\x0f\x63\xed\x28\x49\xb1\x7a\xf0\xc5\x50\x11\x8c\x7e\x8e\x5a\xdd\xd9\x17\xce\x99\x77\x96\x31\x9e\x6b\xcf\x9b\xc4\x2b\x8b\xa8\x7c\x94\xe5\xa3\x1b\x1c\xec\xb2\xfd\xe9\xc5\x71\xf9\xa8\x7a\x88\x23\x0f\x80\x93\xa7\xae\x80\xa0\xc4\x5c\x3c\xee\xc6\x9f\x1e\x1f\x84\x42\x96\x04\x50\x70\xf3\x72\x8e\xc4\xfa\x64\x4c\xd7\x48\x81\xdb\x3c\x72\x35\x2e\x4b\x83\x18\xf8\x83\x4a\xc6\x30\x6a\x56\x98\xce\x9a\x5e\xb3\x14\xf3\xf8\x64\x70\x67\xbd\x6d\xe7\xc9\x09\x40\x64\x59\x31\xc3\x10\xaa\x55\xe4\x26\x8e\xcb\xaf\x64\xc9\xd8\xc9\xac\xe5\x4f\xc9\xf2\x24\x74\x6d\xdd\x68\x18\x40\xc3\x92\xf2\x74\x75\x33\x42\xef\x48\xac\x19\x73\xab\xf5\xc3\x8d\x07\x76\xbd\x61\xc0\x87\xd7\xb5\x4b\x1f\x93\xea\xed\x1a\x7c\x9f\x73\x42\x7e\x38\xd5\xe3\xca\x2c\xd1\x7f\xa0\x0c\x69\x87\x39\x21\xed\x8f\x2b\x8b\x9f\x89\x50\x91\x34\xf7\x23\xb6\x98\x08\x31\xf5\x50\x4a\x65\x60\x2b\xd9\x36\x7a\x15\x1c\x57\x0a\x70\x59\x10\xaf\xd9\xf6\x91\x16\x73\x73\x27\xc1\x93\xa8\x75\x1d\x9c\x16\x1b\x5b\x2e\xf4\xe4\x06\x05\x5f\xe7\x9c\x57\x0f\x7c\x3e\x83\x34\x62\x3e\xf0\x2b\x9f\x47\xee\xcb\x78\xd3\x0d\xb1\x47\xd4\xfc\x90\xbc\x91\xfa\xec\x2d\x91\x81\x20\x6e\x41\xcc\xcd\xe0\xc2\x14\x83\xbf\xd0\xc4\x5d\x87\x65\xa1\x3d\x69\xe2\x24\x79\xc2\x18\x16\xdb\xd5\x90\xae\x51\xe4\x9f\x60\x58\x44\x9b\x9d\x3d\xbe\x94\x07\x5e\x2e\x57\x02\x8f\x43\xf7\x02\x01\xa1\xe4\x87\x5b\x91\x69\x7c\x29\xde\xb8\xc2\x57\x2a\x10\x51\x31\xc8\x7f\x76\x85\xca\xd9\x4d\x13\x21\xd4\xae\x5c\xc6\xef\xed\xe1\x1a\xc8\x0a\x0e\x00\xa6\x3b\x2b\xa5\x4f\xcc\x51\x95\x47\x5c\x3f\x1f\xf5\x72\x69\x3d\x00\xe4\x91\xa0\x44\x5c\x98\x7d\xed\xcb\xe7\x3b\x69\xec\x13\xd2\x26\xb1\x93\xec\x03\xfa\x9a\x27\xa4\xa4\x34\xd1\x48\x98\x33\x66\xc7\xd8\xe5\xbc\x3c\xea\x9f\xbe\xff\xd0\x5b\x8b\x00\x90\x76\x51\x59\xb3\x80\xac\x96\x42\x96\x55\x12\x59\x21\x50\x7f\x97\xdf\x3e\x9d\x41\xc6\x6b\x2f\x5f\xff\xd0\xca\xd4\x82\x65\x77\x91\x6f\x94\x1a\xc7\xc9\xec\x7a\xb6\x25\xec\x93\x90\xe0\x50\xc5\x88\x5d\xbd\x2e\x71\x31\xf2\x79\x4e\xca\xd5\x70\x9e\x0a\xc3\x95\xad\x0e\xde\xe0\x18\x28\x22\x37\x4e\x70\x11\x67\xad\x2c\xfd\xa0\x7f\xf9\xe9\xbd\xde\xe1\xc6\x88\xd4\x83\xc1\x32\xe1\x97\xa9\x48\x1c\x9e\xb0\xdf\x2c\xf9\x66\x9a\xb1\x07\xcc\x93\x6b\xf2\xc9\x62\x68\xa1\x20\xa4\x4f\xb7\xf1\x78\xb4\x02\xec\xd9\xc5\x12\xf8\x69\x08\xf4\x3f\xea\x11\xcc\x69\x02\xc3\x55\x92\x9b\x91\x0a\x52\x3a\xcd\x16\xd5\x93\x1e\xa4\x17\x53\x39\x1a\x03\x68\xe5\xbb\xe9\xe8\xcd\x92\x6d\xa1\x20\xd8\x44\x0f\xce\x2c\x19\x2b\x1e\x59\x86\x85\x4d\xe8\x55\x13\x20\xc9\x89\x53\x37\x71\xf1\xa7\x1f\xb4\x1f\xf1\xc9\x27\xff\xba\x9e\x9e\x25\xae\x53\x3d\xb6\xa3\xc8\x04\xb0\xb3\x40\xa0\x40\x9e\x11\x0a\xc7\x6a\x7b\x58\xf9\x12\xdb\x41\xe3\x3b\x11\x5e\x1c\x3a\xe9\xaa\x03\x99\xed\xd6\x21\xa0\xfd\x4b\x7b\xe2\x17\x6c\xb4\x96\x82\xee\x82\xb2\xa2\x19\xba\xac\xe6\x3b\x38\x22\xb9\x8b\xa6\xf4\x8c\xd3\x4a\x08\x14\x33\x21\x99\x3c\x43\x90\xb9\x4b\x13\x8e\x4a\xdc\xfd\x47\xdd\x01\x98\x2e\x24\xac\xb8\xd4\x64\x73\x8f\x44\xaf\x04\xff\x33\x53\xf8\x68\x3f\x35\x23\x06\x45\x75\x22\xe6\x53\xba\xa8\x93\x79\x50\x44\x8e\xef\x98\x79\xdf\xaa\x42\xe9\xfc\xca\x9a\x96\x89\x71\xb6\x0c\x41\x3f\x4a\xa3\xe0\xf9\x0b\x41\xc7\x82\x8a\xd5\xdb\xb6\x2a\xae\x0c\xd2\xd2\xef\x85\xe2\x48\xbf\x12\xe4\xd6\xd7\x5b\x80\x3a\xca\x52\xbb\x96\x16\xac\xc3\x7b\xc8\xbd\xab\x1a\x66\x66\x1a\x53\x29\xdc\x93\x6b\x1d\xbc\x83\xfd\x59\x8c\x57\xb9\xad\x80\xac\x42\xc2\x1a\x63\x18\xb3\xfb\x8d\x0d\x86\x5f\xff\xb0\x43\x21\x7c\x42\xf9\x54\x6c\x05\x0e\xb8\xcc\xe5\xe3\x42\x33\x71\xa9\x3a\xff\x46\x47\x1d\x20\x08\xc8\xcd\x58\x41\xf8\x49\xd1\xf0\xd5\x83\x17\x35\x3a\x6d\x73\x08\xf7\x96\x2d\x94\x37\x95\xbd\x52\xa4\xdd\x5a\x84\x40\x64\x02\x73\xc7\x8e\xf6\xeb\xbe\xaa\xe9\x14\x3d\x5e\x6e\xe9\x0c\xda\xa2\x57\xe1\x32\xe6\xd4\x2d\x02\xb9\x56\x7a\xe6\x9b\x75\xbc\x60\xf7\x59\x6a\x1f\xdd\x81\x79\xcf\xf3\x23\x99\x17\x01\x06\x29\x30\xce\x23\xa2\x9e\x30\x02\x3d\xa9\xd6\x31\xbf\x61\xa6\x44\x0a\xcc\x29\x0b\xde\xaf\xba\xae\xa7\x83\x65\xf4\x08\xae\xa8\xf8\x64\xda\x22\x0e\x7a\x56\x0c\x9a\xc8\x4b\xb9\xc9\x75\x81\x4c\x13\x2f\x97\xe0\x8b\x64\xcc\xad\x47\xce\xb0\x8f\x29\x41\xa4\x43\x8f\xeb\x76\x56\x0b\x1d\x5e\x6f\x32\x89\xf5\x0d\x05\x4e\x94\x96\x74\xeb\x6c\x32\x94\xcc\x4a\x27\x42\x76\x50\xc4\xa3\x7f\x53\xc6\x5c\x55\xca\x41\x0f\xa6\x2e\xe1\x8a\x82\x92\x20\x36\x0a\x82\x72\xf8\xc0\x04\x1e\x2b\xf3\x3f\x04\x79\x28\xfe\xb0\x26\x9c\x43\x8b\xdf\x39\x9b\x1d\x8f\x18\x7b\x24\x54\xea\x5c\xd8\x73\xe3\x52\xe1\xd0\x78\x15\x70\x23\x4c\x6d\x81\x0c\x5a\x16\xba\xc9\xea\x9f\xfa\xfb\x0c\x97\x8a\x02\x22\x76\x90\x3a\x1c\x65\x3f\x17\xd9\x66\x59\xcb\xb3\x0a\xbc\x1a\x32\x0c\x58\x4b\xdf\xcc\x00\x12\x52\x70\xc2\xd4\xc9\x09\x50\x02\x9f\x71\x15\x75\xdf\xa8\x28\xfe\xea\x3b\x1d\xc8\x3c\x07\x01\xdf\xfa\xc1\xf8\x95\x36\x58\x3a\x0c\x09\x95\x55\x0f\x86\x2c\x3e\xc7\x86\xc0\xf8\xfe\xe0\xfd\x94\xfa\xe0\xa6\x61\x31\x3f\x9e\x75\x33\x62\x33\x6d\xb3\xea\x02\x96\xd7\xfb\x91\x3a\xd4\x90\xbf\xc9\xdd\x15\x53\x07\xab\x14\xe6\x71\x14\xfc\xde\x26\xd0\x32\x43\x5c\xec\x7d\x29\x24\x7d\xeb\x93\xbc\xf7\xfa\x48\xb4\xdd\xb5\xfb\x74\x49\xc0\xfd\xa0\x83\xd5\xa6\x3e\x03\x92\x2d\x5d\xfb\x36\x1b\x7e\xeb\x12\x2a\x09\x4c\x3b\x08\xea\xcb\xd4\x3c\xec\xc7\x6c\x29\xa9\xbb\xcd\x48\x08\xbf\xa6\xea\xeb\x78\xd3\x45\x3e\x30\x66\x0d\x16\x53\x56\x98\x41\x86\x9e\x3d\x8b\x90\xf3\xd0\x47\x38\x8d\xa5\x19\x19\xcf\x05\x6c\xe1\xce\x1d\x45\x51\x77\xc9\x5c\xdb\x8f\x76\x63\x7d\x53\x36\xe8\x2c\x9e\x10\xdd\xfd\x33\x51\x5f\x74\x91\xef\x28\xcb\xe4\xc8\xa4\x77\x08\x6d\xae\xb5\x25\xd0\x97\x84\x48\x79\xd1\x40\x96\x5e\xf0\x46\x3b\x3e\x17\x80\x06\x5d\xa2\x25\x5e\x68\xae\xe9\x03\xf7\xb0\x6b\x08\x24\xb1\x51\x52\x5c\x56\x06\x3d\x4b\xe2\x2e\xe3\x1b\x82\xd2\x02\x9f\xef\x15\xf3\x8f\x90\x08\xd7\x85\xdc\xab\x9f\x14\x54\x18\x5e\xc4\xa3\xd7\x6e\xd3\xaa\x8d\x27\x85\x9f\x66\xae\x63\xed\xdd\x33\x8a\xc2\x8f\x64\x04\x8e\x46\xa5\xd0\x73\x1f\x9b\x7e\xbe\x52\x21\x8e\x11\xe7\x8c\xb6\xd8\x17\x2a\xea\x44\xf2\xc2\x13\xce\x7f\x5e\xdf\xae\xd8\x1c\x5d\xe9\x5a\x86\xab\xa4\x84\xec\x2e\x19\x50\xf6\x1e\x74\x3f\x11\xfb\xd8\x81\xf2\xb0\xc8\x91\xaa\x6e\x94\xff\xf4\xe5\xd7\x47\x97\x13\x13\x61\x3d\xa5\x4b\x54\x83\xaa\xbe\x5b\x12\xa8\xe6\x61\xd4\x55\xcd\xf4\x42\xb8\x6f\x3c\xd8\xb6\xe9\x5e\x2e\xbf\xba\x7c\x62\x00\x17\x69\xd5\xd9\x72\x5f\x1d\xf8\xff\x36\x4f\xf4\x5f\x65\xb1\x6f\xb2\xa8\x28\x63\x83\x13\xdb\xaa\xc9\x81\x8f\x99\x0e\x85\x90\xd5\x4b\x67\x61\x34\x30\xb9\xf1\x86\x9b\x7f\x2f\x75\x6e\x4a\xf1\x9a\x14\x51\x05\xb7\xb0\xf7\xc8\x89\xb3\x14\x65\x33\x11\x4d\x00\x1f\xc2\xc1\xb6\xb2\x85\xde\xd3\x5f\xd0\xb1\x78\x57\xda\x52\x7e\x80\x65\x8f\x0b\x71\x7a\x8c\x98\x92\x0f\x72\x28\x98\x96\xf0\x5a\x68\x60\x83\xfa\x9e\x84\xee\x9f\x05\x90\x79\x3b\x48\x43\x65\x15\x9c\xd1\x8d\x92\x90\xfc\x7b\x34\x2b\x39\x26\xbc\xcd\xc8\x30\xa5\x19\xb8\xab\xd0\x7e\x5b\x88\x5c\xc4\xa6\x04\x64\x23\xd5\xfa\x97\x65\x88\x51\x0c\xf5\xb0\xcf\xea\xa3\x8e\x7d\x17\x0f\xeb\x40\x1b\xf9\xb3\xe4\x28\x44\x15\xb8\xe2\xd2\xb8\xd7\x3a\x0b\xfd\xa6\xe2\x46\xd4\x07\x5c\x16\xf3\xbf\x8c\x1d\x8a\x19\x69\xdc\x57\xfc\x87\x86\xb1\xe4\xaf\xb4\xec\x67\x69\x53\x4d\xeb\xe4\x9e\xf6\x87\x3e\x76\x28\x9c\x64\x42\xc6\xd6\x90\x45\x7a\xf9\x1d\xf6\x31\xc7\xb0\xd4\xd0\xa1\x8a\x43\xb2\x68\x03\xbf\xe3\x74\xa8\x1d\xe3\xc1\x82\xb4\xdc\x50\x68\x3f\x85\x45\x15\x7b\x40\xf4\xb4\x4d\xb5\xef\xf7\x29\x64\x54\x21\x81\x7f\xf5\xfd\xd0\xb4\xca\x5c\xc2\xba\x9b\x23\xc3\x32\x56\x07\x4b\x0c\xd5\x93\x8a\xac\xea\x39\xe5\xcb\x5a\xf7\xec\x44\x42\x67\xf1\x41\x98\x67\xe3\x55\xde\x67\x00\xae\x0a\x63\xb7\xa5\x7e\xaa\xbe\x21\xae\xe2\x16\x04\x86\x12\xec\x6c\x69\x93\xa5\x77\xca\x4d\x7a\x00\x71\xf5\x68\x0d\x89\xba\xa3\x37\xa3\x7a\x5d\x1a\xf9\xdc\x35\x9d\x97\x08\xdd\xab\x0b\xb9\x63\x23\xae\x8f\x6a\x48\xd2\xb8\xb4\x2d\x47\xd4\xa0\x51\xb5\x5d\x14\x11\x6a\x35\x98\x99\xc7\x90\x11\xf2\xdb\x86\xe0\x8c\x2f\xb7\xc7\xd8\x36\x35\x5c\xd5\x5f\x33\xab\xa9\xcb\x80\xa1\x0c\x08\x44\x01\x1e\x3f\xfa\x01\xf5\x47\x22\x33\xfb\xae\xbe\x45\xf0\x44\x15\x42\x20\x09\x4b\xf7\xda\x1a\x40\x35\xc1\x95\x97\x8e\x1b\x97\xea\xc6\xc4\x10\x10\xb2\x7d\xfb\x5d\xf9\x85\xab\x16\xd2\x19\xf4\x15\x52\x8b\x04\x03\x84\x6b\x32\x6f\x0a\x00\xf7\xb7\x3c\x89\x93\x3e\x1a\x2d\xaa\x58\xdd\x8d\xee\x2f\x91\xe2\xd0\x83\xeb\x25\x50\x8a\xd3\xb3\xe9\x16\xcf\x7e\x00\x21\x40\xed\x65\xeb\xe5\x5e\xd8\xbe\xc0\xce\xa0\x9a\x5a\x61\xf7\x26\x2a\xaa\x61\xcb\xf0\x9d\x16\xff\x6a\xac\x48\xc5\x11\xfb\x82\x20\xdc\x5e\x20\xc3\xd4\xce\x62\x83\xc5\x34\x42\xa5\xcf\x40\x8f\x3e\x66\x73\x42\x08\xcc\x4f\x13\xa9\x0a\x9a\xd6\xf9\x0c\x1d\xb8\x02\xab\xcf\xf9\x03\xad\xdb\xa3\x09\xad\x25\xdd\x56\xcf\x6d\x37\xf3\x2f\x82\xeb\x07\xfc\xe2\x4a\xc3\x3e\x48\x45\x1e\x77\x19\xe3\x23\xf5\x12\xa4\x59\xa1\x72\x17\x2f\xf9\x4d\x41\xbe\x60\x9a\xba\x82\xbc\xb7\xd8\x27\xdf\xc7\x3b\x48\x75\x20\x9a\xa3\x92\xc6\xf0\xd2\x4f\x95\xbb\x90\x08\x14\xfb\xff\x19\xc8\xd5\x1d\x42\x12\x70\x36\x3b\xc8\x08\xf2\x9e\x21\xe1\x4f\x6c\x99\xa1\x3f\x80\x00\xfb\xfb\xc1\xca\xe4\x61\x21\x5f\xbb\xa5\x25\x11\xc9\xd1\x4a\xae\xdb\x16\xe3\xa3\x72\x55\x34\xb5\x71\x3c\x55\x4f\x1e\x5e\xbd\xc2\xab\xfa\xa7\x12\xcf\x0d\x8f\xf6\x69\x9c\xf0\x94\x9f\x89\xb1\x87\xe5\x8b\xba\xc1\x59\x27\xa7\x01\x43\x2f\x81\xb6\x1e\x79\x71\x36\x78\x9a\xe2\xe8\x24\xb0\xa7\x4c\x55\x3d\x59\xb7\xa1\xa1\xd5\x12\xfe\xc3\x6c\x86\x34\x22\xf0\x63\x45\x60\x06\x4a\xd2\xc3\x10\x89\x5d\x6d\x8a\x1a\x3f\x94\x29\xf0\x8a\x73\x60\xcd\x4b\x4f\x9f\x20\x8b\xf6\xd2\x10\xd8\x09\x79\x62\x76\xe7\xa9\x00\xea\x99\x4d\x3f\x8a\x3c\x3b\xe2\x8c\x33\x84\xc8\xd8\x22\xfd\x10\x8e\x8e\x9a\x19\x57\x98\x14\x9b\xeb\x3e\x4e\xed\x37\x3e\xda\xc2\xbb\xc9\x57\xb3\xf0\x43\x2b\xcd\xdc\x95\x56\xb7\x34\xb1\x9f\x91\xd9\x4d\x21\xa8\x81\xfb\xc8\x82\x60\x3f\x7d\xa7\xf8\x99\x3a\x74\xd5\xb1\x26\x70\xf8\x7a\xa6\x98\x85\xab\xea\x71\x8b\x67\xa7\x00\xca\xf9\xfa\xc7\x81\x22\xa8\x3b\x28\x20\x99\x95\x26\x64\xe5\xe8\x44\x6a\x23\xb4\xbb\x3c\x01\xb1\xb4\xa9\xdc\xa9\x24\xfe\x02\x10\x44\x5d\xd5\xe8\xce\x3b\xdf\x24\x29\x46\x3d\xf2\x4d\xe0\xcb\x74\xbf\xc1\x62\x84\x7a\x61\x77\xd4\x2f\xeb\x48\x7c\x89\xe1\xfd\x76\xfc\x59\xe4\xfe\xaa\xb9\x1d\x6f\xad\xfa\x65\xa8\x72\xa8\x12\x8e\xa5\x6f\x49\x14\xfb\x55\x16\x55\x98\xdb\x63\xbd\x70\x15\x73\xf8\xca\x7b\x78\xb6\x9f\xe0\x98\x3f\x1a\xad\xb9\x9b\xb0\xcc\xbf\x9e\x24\x09\xd2\x83\x3f\x9a\xb8\x02\x96\xf9\x79\x5c\x5e\x57\x40\xeb\xeb\xb7\x12\x38\xc6\x89\x8d\xbd\x6e\x04\x3c\xd6\x03\x1c\x15\x90\xed\xfe\x76\x34\x46\xa9\x6d\x38\x06\xd6\x2e\xf9\xa7\x46\x7f\x45\x45\xd4\xb9\x58\xab\x91\x69\x39\xd9\x85\x85\x6d\x06\xcc\x93\x69\x19\x43\x29\xb9\x61\xc0\xb7\x67\xa7\x66\x24\x10\x4d\x3c\xac\xb9\x11\x9d\x17\x49\x9d\x83\xc1\xe6\xf9\x5f\x4c\x79\xde\x2a\xae\x01\x14\x13\xfa\xcd\x89\x62\x98\x0b\x53\x27\xc7\xe2\x2b\x51\x6c\x84\x1a\x98\x56\x46\xe3\x81\x26\xfb\x50\xc8\xbb\xa6\x42\x07\x64\x89\xa8\xa8\xcc\x21\xca\xc2\xe9\x2e\x6d\x45\x9d\x56\x66\xb8\x68\xda\x0e\x30\x12\x1e\x97\x23\x24\x07\x64\x76\x49\x01\x70\xf5\x13\xef\xc5\xdc\xf5\x7c\xe8\x5d\x81\xc9\xff\xfc\xee\xfb\x19\xec\x98\x27\x8e\x13\xab\xb2\xf3\x22\xaf\x44\xb9\x80\xf9\xef\x52\x2e\x98\xd9\x09\x50\x7a\x8e\xeb\x7a\x0b\xd9\x27\xd6\x21\xe0\xfb\xfa\x06\xa9\xca\x8f\x2f\x99\x78\xaa\xe4\x62\xdb\x2c\xce\x92\x40\xc8\x29\x42\x95\x74\x72\xc7\x22\xa0\xcb\xc1\xc8\x4e\x6c\x7c\xd8\x6b\xf6\x53\x4d\x05\x09\x03\x96\xb7\x0c\xef\x7c\x77\xa2\x9f\x06\xe5\x36\x0d\x9c\x5c\x42\x69\x88\xee\x76\x53\xd0\x22\xc1\xb4\x9b\xc9\x94\x94\xbc\x66\x1c\x42\xb9\x7b\x62\xc0\xf5\x35\x1b\x5a\xab\xca\xf1\xe2\x2a\x6c\xb7\x0d\x34\x87\x53\x71\x1f\x90\x63\xf8\x7b\x29\x2e\xdf\x61\x37\xac\x52\x4b\x2a\x4c\xdf\x8d\x3a\x8c\xa0\x35\xfd\x95\x9e\xa4\x02\x97\x64\x52\x53\xa3\x39\x46\x68\x7b\xee\x09\xf6\x61\x32\xf2\xcb\xca\x0f\x45\x1b\x82\x10\x8f\x4e\x68\x68\x3f\xce\xf2\xcb\x32\x82\xd3\x8f\xe4\x7f\x6b\xe5\x97\xa0\xab\xa1\xb6\x37\xe2\x4f\xa2\xea\x26\xf8\x90\xf5\xe8\xcd\x2e\x43\x8b\x0c\x42\x31\x9c\x3f\x48\x2b\x21\xb3\xb3\x6e\x9b\x66\x90\x7a\xb9\x45\x1a\xa2\xd5\xb0\xd8\x48\xc9\x58\x17\x9c\xd2\xc1\x38\xe7\xa8\x13\x3d\x10\xb9\x52\x74\x5c\x6f\x9c\x5a\xd2\x06\xb1\x3a\xe8\x3e\x21\x23\x6e\x06\xa2\x7e\x60\xf5\x4c\x15\xfd\xf9\x6c\x08\x4e\xe9\x25\x3a\xf3\xae\x53\xf1\xe5\xc7\x9b\xf6\x1e\xef\x8c\xd9\x0f\x38\x2d\xa1\xf2\xc0\x72\x27\x2b\xf9\xfc\x89\xb4\xfc\x6c\x18\xa5\x7e\x19\x7a\x36\x6f\xdb\x5a\xf0\xff\x28\x13\x1f\x42\x69\x0e\xc6\x9d\x59\xfa\xe8\xc8\xf4\x3c\x8f\x3c\xf4\xea\xcb\xdc\xf3\xe1\x62\xe4\x92\xe1\xbd\x53\x3a\xbe\x70\xba\xc5\x3f\x98\x68\xc1\x99\x59\x21\xc7\x9d\x09\xf6\x7a\x6b\x72\x44\x10\xa4\x68\x12\x9f\x99\x0d\x15\x0e\x95\x66\x3e\x54\x55\x1f\xeb\x97\xa4\x30\x4f\x92\xab\x3d\xb2\xa4\x3c\xa8\x41\xee\x3b\x0f\x6b\x62\xc7\x51\xf6\x01\x6b\x84\x39\xd5\xa0\x8d\xb8\xd3\x4f\xaa\x4b\xa7\xa7\x61\x7f\xe5\xbb\xf1\xf8\xfc\xb5\xa9\xf5\x5f\x1a\x1d\xb8\x36\x45\xeb\x93\xbd\xe6\x00\x03\x2b\xba\xc8\x95\x86\x3c\xc5\x4f\x09\xa9\xfe\x1e\x19\x0a\x08\xab\xc6\xc0\x80\xba\xdd\x82\x45\xbb\x99\x18\x71\x3d\xda\xea\xd3\x77\xaf\xbd\xcb\xc7\xcf\x4d\x19\x1f\x6c\xa2\xfe\x2d\xef\xa4\x5c\x3c\x33\x53\xc2\x77\xe1\x13\x02\x84\xcd\x44\x1d\xa7\x74\xeb\x16\xe7\xbf\x11\xad\x0b\xee\xf3\x02\x02\x2a\x18\xcf\x04\x79\x28\x5d\xf7\xf6\x4f\xea\xca\xca\xef\x8c\xa5\x0c\x20\x1c\xb9\x00\x10\x87\x61\x1c\x4c\xd1\x6f\x1a\xb6\x78\x2d\x7e\xaf\xae\x09\x4c\x93\xcf\x30\x14\x77\xa6\x78\xc9\xec\x48\x2b\xaa\x1d\x1d\x1a\x40\x54\x94\xb6\x7b\x35\x05\x7b\x69\x1a\xf4\x4d\xc3\xbe\x73\xe2\x6a\xb2\xb6\xfb\xe5\xd2\xe2\x11\x7e\x0c\x6d\x0e\x96\x4b\x38\x26\xa6\xe0\x57\xc8\x0e\x4f\x0e\xd7\x8e\xd1\x31\x0c\x24\x51\x6b\x95\xdc\xef\xcf\x5d\xfd\x7e\x79\xe5\xe2\x4e\x69\x22\xad\xe7\xef\xdc\x22\x42\x93\x49\x73\xf6\x36\xe3\x00\xcb\xe5\x00\x2f\x8b\xb0\x41\x3a\x76\xba\xee\x10\x09\x9b\x10\x08\xe3\x84\xb8\x64\x41\x88\x93\x2a\xbf\x79\xd0\xf2\x6c\x66\xeb\xd6\x62\xad\xd6\x8e\x03\x92\x12\xbf\x4f\xd8\x01\x11\x41\x96\xe1\x05\xd9\x58\xad\xe1\x5f\xb4\x51\xfb\x5d\x5d\x90\xfe\xe2\xec\xb7\x92\xbb\x5c\x86\x41\x25\xbb\x3e\x63\xe0\xa7\xb5\x9f\xf5\x4f\x5d\x52\xec\x59\x07\x08\x84\x0b\xbf\x13\x4e\x25\x62\x56\x90\xb2\x62\xe5\x49\x3a\x53\xef\x20\x6c\xe2\x5c\x6b\x4d\xcb\xf3\xd8\xeb\xab\x28\x06\xf9\x6b\x6a\x96\xee\xde\xbb\x29\x30\xfd\x72\x30\xe9\x60\x1c\xe4\xab\x66\xd7\x21\xe8\x56\xee\xdd\x67\x04\xf0\xb6\x73\xe0\xfe\xba\xbd\x11\x48\x46\x9b\xdf\x93\xc8\x90\xc6\x37\xc5\x42\xb5\xfd\x4d\xc2\x1b\x89\x8c\x8c\x01\x50\xa1\xbc\x28\x17\x54\x2e\x21\x12\x05\xdc\x70\xbe\x74\x97\x7c\x37\x90\x1f\xdc\x73\x46\x13\xe5\xc1\xf4\x0e\xfb\xdf\x19\xb9\x83\xab\xba\x0d\xda\xd0\x1d\x0a\xb6\x54\xb2\xe3\x4c\x65\x60\x90\x35\x1a\x51\x5a\xca\x39\xf5\x8b\x34\x85\xda\x7c\x0a\x69\x69\x52\xea\x61\x8f\x1f\x79\xeb\x7c\x55\xb0\x56\xee\xc7\x7e\x22\x22\x4b\xd7\x9d\x2a\xd9\xf5\x97\xf1\x2d\xcd\xd7\xc7\x16\x05\x18\xcc\xd7\x7b\xb5\x31\x7a\xc0\xea\x66\xb6\xa8\x0a\x2c\xc4\xe2\x8a\xe3\x88\x1c\x59\xdf\xf4\xd4\x68\x47\x79\x77\x6b\xf9\xe3\xac\xcc\x83\x84\xf2\xa1\xf0\x5c\xd3\xca\xdb\x34\x5a\x27\x66\x9e\xa1\xc0\x59\xe0\x86\xf4\x21\x34\x6a\xe2\xcf\x95\xd1\x9f\x75\x94\x1e\xed\x79\xc7\x75\xeb\x55\x7e\x25\x2e\x08\xd9\x66\x22\x04\x00\x6d\x2b\xa9\x37\x5b\xd8\x71\xf6\xb6\x4a\x06\x33\xa3\xb2\x71\xd8\xf1\xac\x39\xd3\x9e\x6a\x51\x00\xc9\x9e\xff\xd2\xa0\x9d\xf4\xb4\x9d\x1a\x41\x17\x6d\x4d\xe1\xa4\x23\x6c\x81\x90\xbf\xfa\xd2\x51\xa1\x13\xcc\x16\xd4\x99\xac\x21\x2d\xb3\x1b\x26\x49\x7a\x39\x9c\xe1\xac\xc2\xb4\xa6\x3c\xee\xe1\x93\xbf\xb9\x4b\xf9\x1d\xc3\x09\xc7\xba\x46\x64\xb4\xe9\x9c\x74\x57\x86\xb7", 4096); *(uint16_t*)0x20001080 = 2; *(uint16_t*)0x20001082 = htobe16(0x4e22); *(uint8_t*)0x20001084 = 0; *(uint8_t*)0x20001085 = 0; *(uint8_t*)0x20001086 = 0; *(uint8_t*)0x20001087 = 0; *(uint8_t*)0x20001088 = 0; *(uint8_t*)0x20001089 = 0; *(uint8_t*)0x2000108a = 0; *(uint8_t*)0x2000108b = 0; syscall(SYS_sendto, r[0], 0x20000080ul, 0x1000ul, 3ul, 0x20001080ul, 0xcul); break; case 2: *(uint16_t*)0x200011c0 = 2; *(uint16_t*)0x200011c2 = htobe16(0x4e20); *(uint8_t*)0x200011c4 = 0; *(uint8_t*)0x200011c5 = 0; *(uint8_t*)0x200011c6 = 0; *(uint8_t*)0x200011c7 = 0; *(uint8_t*)0x200011c8 = 0; *(uint8_t*)0x200011c9 = 0; *(uint8_t*)0x200011ca = 0; *(uint8_t*)0x200011cb = 0; syscall(SYS_recvfrom, 0xffffff9c, 0x200010c0ul, 0xcdul, 0x802ul, 0x200011c0ul, 0xcul); break; case 3: memcpy((void*)0x20001200, "\x65\x34\x64\x0a\x5e\x77\x48\x51\x1a\x23\xbf\x56\x23", 13); syscall(SYS_setsockopt, -1, 0, 1, 0x20001200ul, 0xdul); break; case 4: *(uint32_t*)0x20001280 = 0xc; res = syscall(SYS_paccept, 0xffffff9c, 0x20001240ul, 0x20001280ul, 0ul); if (res != -1) r[1] = res; break; case 5: *(uint16_t*)0x200012c0 = 0x18; *(uint16_t*)0x200012c2 = htobe16(0x4e23); *(uint32_t*)0x200012c4 = 1; *(uint32_t*)0x200012c8 = 0x800; syscall(SYS_connect, r[1], 0x200012c0ul, 0xcul); break; case 6: *(uint32_t*)0x20002340 = 0x1002; res = syscall(SYS_accept, -1, 0x20001300ul, 0x20002340ul); if (res != -1) r[2] = res; break; case 7: *(uint64_t*)0x200024c0 = 0x20002380; memcpy((void*)0x20002380, "\xce\x0f\xda\xd9\xa6\x4a\x58\xf7\x84\xd8\x08\x7a\xf8\x05\xaa\x2b\xd2\xf9\xb8\x6b\x22\xd9\xb2\xc3\x2c\x58\x73\xc3\xf3\x2b\xef\xbc\x76\xc4\x7e\x31\xe9\x5c\xb5\x77\x20\x09\x97\x41\x06\xdd\x56\xe9\xb7\x7e\x9e\xf2\x1b\x64\xeb\xda\x31\x08\x05\x30\xf8\xdb\xeb\x72\xd1\x92\x5f\x06\xc0\xe6\x16\x3c\x87\x37\x29\x3d\x33\x34\xcd\xfe\x5d\xe4\x21\xf3\x35\x04\xea\xa8\x02\x4b\xcb\x42\xa0\xad\x53\xd6\xbd\x25\xe3\xb6\x65\x03\x62\x96\x98\x53\x80\x33\x00\xc7\x1d\x12\x31\xf7\x3d\x20\x10\x9f\xd2\xb8\x05\xd7\xc0\xde\x06\x68\x00\x18\x86\xe4\xa3\x80\x88\x0e\x16\x9d\xe6\x77\xcb\x12\x4c\xc6\x05\x78\x02\x0f\xfe\xcb\xe8\x38\x19\x65\x69\x72\x96\xf8\x7c\xa1\xdd\x26\xd2\x39\xf0\x0c\x44\xd2\x8f\x44\x04\x68\x97\x8e\xdf\x01\x9a\x5d\xb0\x50\x91\x3f\x84\x18\x95\xd9\xd9\xa4\x2a\x50\xfd\x29\x53\xaf\x0b\xd6\xc6\x92\x83\x5f\x5f\x28\xb4\x67\x68\xfc\x54\x00\x14\xf8\xd3\xee\x3d\x80\x17\x5c\xd9\xbc\xa3\xe5\x2d\x0a\x15\xb8\x87\x73\xf3\xb8\x11\x08\x90\xf4\xdf\xfe\x75\x43\x3f\xda\xba\xc5\x4c\x62\x29\x8a", 242); *(uint64_t*)0x200024c8 = 0xf2; *(uint64_t*)0x200024d0 = 0x20002480; memcpy((void*)0x20002480, "\x80\x24\x2b\xeb\xc8\x1b\xd3\xda\xdc\xb9\x92\xd2\xde\x24\xb8\x13\x00\xa6\x36\xd3\xa6\x4b\xdf\xe9\x31\x33\xe1\x44\x29\xda\x14\xcf\x31\x7e\xde\xd2\x00\xe3\x71\xe3\x4a\xef\x0b\xba\xf2\x72\xa4\xe8\x77\x89\x08", 51); *(uint64_t*)0x200024d8 = 0x33; syscall(SYS_pwritev, r[2], 0x200024c0ul, 2ul, 0x51ul); break; case 8: *(uint32_t*)0x20002540 = 0xc; syscall(SYS_getpeername, r[2], 0x20002500ul, 0x20002540ul); break; case 9: syscall(SYS_dup2, -1, -1); break; case 10: memcpy((void*)0x20000000, "\x48\xf7\xf1\x90\xc6\x85\xfa\xd5\x02\x0b\x2c\x72\x6e\xad\xc8\x3c\x08\x67\xb0\x1c\x6b\x28\xea\x05\xf4\xbd\x05\x44\xeb\x88\x3e\xc3\xd8\x89\x7d\x9a\xee\x86\xbc\xb2\xc9\x0e\xbe\x68\x77\x4c\x20\x65\x70\xc9\x03", 51); break; case 11: memcpy((void*)0x20000040, "\xc4\x22\x7d\xb7\x4b\x0b\x45\x86\x57\xfb\x66\x44\x0f\x38\xdc\xd2\xc4\x81\xf9\x5b\xfe\x0f\x49\xf8\x66\x0f\x3a\x0c\x9b\xb4\x00\x00\x00\xfe\xc4\xa2\xfd\xa6\xfc\xc4\xa1\x4d\xd5\x16\xc4\x01\x94\x59\x6d\x64\x66\x41\x0f\x6c\x23", 55); syz_execute_func(0x20000040); break; case 12: break; case 13: memcpy((void*)0x200000c0, "\x53\x89\x0e\xf7\x06\x9c\xeb\xf4\xab\x2e\x38\x62\xd4\xe8\xf0\xd7\xcd\x39\x04\x66\x11\xd8\x6e\xfa\x40\x3d\x25\x55\x8c\x0d\xe4\xab\x33\xf8\x31\xe6\xf5\xf5\x29\x56\x03\x28\x35\x78\x3b\xf2\xd0\xf5\x81\x7f\x8b\x8d\xda\x73\xc7\x54\x2d\x9f\x0d\x12\xa6\x31\xe2\x5a\x3e\xe4\xdc\xfb\x6a\xe2\xf9\x68\xa8\x25\xda\xc5\x81\x2d\x8c\x6b\x82\x64\xe0\xb7\x8c\x3d\xaa\x0c\x76\x23\x7a\x22\x3a\x71\xf5\x0b\xa3\x6e\x78\x4b\x03\xb1\xf3\x87\x05\xa2\x37\xcf\x14\xc4\x37\xfd\xc2\x36\x3d\xc7\x73\xb1\x94\x6b\xe9\x83\x5b\xd5\x9c\xf8\x39\x00\x38\xfb\x9b\xac\x19\x1e\xc2\x55\xea\xf7\x0e\xa2\xb5\x63\xdb\x02\x24\x60\xb0\x5e\x8d\x6a\xcc\x51\xea\x2d\xc2\x5f\xf0\x6b\x2a\xdd\x98\x89\x0a\x72\x78\x07\x07\x2b\x47\xf3\x8e\xe4\x2d\x63\x67\xe7\xd3\x54\x8d\x3f\x13\xca\x55\x74\x42\x6d\xf2\x94\x62\x6c\x3e\xf4\xb8\xcf\x7a\xea\x48\x30\xb7\x0d\x93\x12\x2e\xfd\x51\xfc\xe4\x84\x96\xa5\xbd\x03\xe3\x05\xf2\xad\x87\x19\x69\xc9\x7c\xef\xf6\xb6\xc2\x28\x6c\x54\x31\xb9\xfd\xbd\x88\x37\x62\x92\x98\xcb\x4e", 239); memcpy((void*)0x200001c0, "\xa1\x85\x22\x4a\x16\xff\x1a\x06\x2f\x6f\x97\x66\xae\xb7\xf5\x84\x08\xb0\x28\x45\x0e\x80\x97\x0d\x92\x50\x11\x4b\x2c\x87\x1d\x5d\x9e\xc6\x7f\x79\x90\xa3\x05\xb4\xbe\x2c\x41\xd3\x5d\x33\x16\xa7\xf4\xc9\xb2\x74\x01\xf8\x44\x0e\x71\xa5\x79\xb7\xf9\xac\xc6\x06\xd2\x0d\xa0\x88\xc7\x07\x7b\xbc\x3c\x36\x1e\x71\xc5\x77\x40\x61\x68\xbc\xc1\xbc\xb7\xf0\x2e\x41\x6e\x3f\x90\x84\x03\xe2\x3d\xb0\xc7\x27\xea\x76\x9d\xeb\xda\x4d\x0e\x52\x4f\x8a\xdf\x7f\x42\x18\x4a\x20\xba\x1a\x23\xf9\xc5\x8d\x46\x91\x4c\xc7\xb1\x2c\x19\x53\x7d\x55\xa4\x0f\xcd\x26\xc6\x8e\xfb\x09\xdc\x0a\xcc\x2e\xe7\x52\x4a\xbe\xc0\xb8\x03\x5a\xd2\xb1\xd1\x94\x33\x1e\x2e\xa4\xe4\x2e\xbc\x53\xd3\x88\x0e\x7c\x0d\xd6\xc5\x79\x02\xc8\x72\x7c\xef\xb0\xfd\x31\x92\xd6\x62", 181); syz_usb_connect(0x1e3d802a, 0xef, 0x200000c0, 0x200001c0); break; case 14: memcpy((void*)0x20000280, "\xb7\x48\xb2\x1b\x78\xea\x22\x21\x6c\x2c\xbf\xdc\xcb\x03\xec\x54\xd2\x0f\x30\xf4\xaf\x46\x2b\x7b\xfd\x5d\x30\x1b\x9a\x4f\xb8\xf9\xbb\xe6\x30\xdd\xe8\xd6\x08\x55\x02\x94\x47\xdf\x51\x12\x0e\x0d\x69\x0a\xe4\xa7\x3e\x5a\x06\x06\x4c\xc0\x6d\x83\x62\x2a\x66\xc3\xcf\x3c\xcd\x92\x0d\xf4\xa9\xde\xc5\x47\xf0\xc8\x53\x54\xb2\xe8\x03\x69\x9f\x52\xff\xc8\x14\x53\x6c\xe5\x19\xc7\xc1\x65\x26\xda\x56\xc6\x5b\x44\x29\xcb\x22\x4a\xd9\xc9\x7f\x63\x7e\xe6\xf2", 111); memcpy((void*)0x20000300, "\xfc\xa1\x69\x1e\x90\xfe\xf7\xc0\x69\x3e\x50\x16\x1f\x6b\xf9\xd6\xbe\x11\x62\x1b\x96\xa6\x5d\x50\x23\xd6\x6e\x18\xc9\xdc\x3b\xb3\x8c\xf4\x79\x30\x6e\xff\x4d\x2c\xf1\x75\xb6\xf8\x52\x15\x44\x6b\x23\x79\xfd\xc7\x32\x74\x56\x6c\x4c\xa7\xce\xc4\xd6\x6a\x48\x19\x12\xaf\xe2\x3a\x3f\x61\xad\xb9\x46\x7e\x5b\xf8\x28\x15\x64\x36\xeb\xe3\xd2\x9e\x30\x73\xe4\x25\x4b\x3a\x73\x4a\xcd\x66\xd1\x4e\xfb\x07\x36\xfc\xad\xff\x4d\xad\x73\xe0\x25\x31\x87\x0c\x30\xfa\xe0\xc3\x78\xc5\x15\x78\x6c\x88\xc1\x29\x27\x36\xcd\xf0\xb6\xa2\xe7\x9b\x47\xa7\x8e\x33\xf5\xe1\xd0\x68\x8a\x6f\x3c\xe2\xd9\xe1\x5b\xd3\xee\x2e\x2a\xfe\x1a\xc5\xc8\x52\x3a\x84\xa2\x08\x75\x5a\x7f\x82\x2f\x3d\x21\x1f\xe3\xa2\x6a\x86\x50\x7d\x98\x58\x3d\x56\x6a\x05\x91\xa7\x80\x2c\xb3\xf9\xf9\xdc\x35\xb9\x11\x0d\xe4\xb2\xf4\xd3\x93\x4b\xb2\x0b\x7a", 199); res = syz_usb_connect(0xa4, 0x6f, 0x20000280, 0x20000300); if (res != -1) r[3] = res; break; case 15: syz_usb_disconnect(r[3]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor158732654 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/0 (0.69s) csource_test.go:123: opts: {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000040)=0x8) sendto(r0, &(0x7f0000000080)="8d360d8e2229aab63aef8e41582b2d02e93c2190e2fe50c1f7f3b29e853f60fb587dd78a2c404615cdf3763b9a53dba141c66b4a485450d66e0a4a281e63e3527c88cdde73010e05449a77aee1e7a35fdddea497119a92fa7fb2d108d6475f90ca55e04b82e53d6ac1138cb913b8dbb0b6f922a1a85461459190969a7d79de9164f3b4e2e9dc65817cd3908bf131ac85e8713459e5da855dd94a0feea76b05dd56d5e0b5222332210506202af0c3718596bf5549077f213886eeb0b3e38b83e237290327d0cc6d5e374a365eccda88ebf8ce4141536b085424aadb2b0c5be557bea12ea53f3fd5b7d3b48edf54f860c8a8e1941e0a56d851b2c08b8d4c9bad81ad649d1479bb60644194385d680441c674f629c50abb98ea4859798a0a3edee95e33f9c2880db8c9279f971bd597b98978bd664047c144af6c7954cc4edb914a618047a063ee7531377216a1f42404fde995936f5d7aba61bb230700ac3390d8fbc62772094fb8e543f39134132c6815d1ebf15bd0068e3b7ea86bb183465b91a431f52fe38bd0e6e077298ae8265685e46961fa82b64c5f757eaf9a7d0f63ed2849b17af0c550118c7e8e5addd917ce997796319e6bcf9bc42b8ba87c94e5a31b1cecb2fde9c571f9a87a88230f8093a7ae80a0c45c3ceec69f1e1f844296045070f3728ec4fa644cd74881db3c72352e4b8318f8834ac6306a5698ce9a5eb314f3f8647067bd6de7c90940645931c310aa55e4268ecbaf64c9d8c9ace54fc9f224746ddd681840c392f274753342ef48ac1973abf5c38d0776bd61c087d7b54b1f93eaed1a7c9f73427e38d5e3ca2cd17fa00c69873921ed8f2b8b9f89509134f723b6980831f5504a65602bd9367a151c570a705910afd9f69116737327c193a8751d9c161b5b2ef4e406055fe79c570f7c3e8334623ef02b9f47eecb78d30db147d4fc90bc91faec2d9181206e41cccde0c21483bfd0c45d8765a13d69e22479c21816dbd590ae51e49f6058449b9d3dbe94075e2e57028f43f70201a1e4875b91697c29deb8c2572a105131c87f7685cad94d1321d4ae5cc6efede11ac80a0e00a63b2ba54fcc5195475c3f1ff572693d00e491a0445c987dedcbe73b69ec13d226b193ec03fa9a27a4a434d148983366c7d8e5bc3cea9fbeffd05b8b0090765159b380ac96429655125921507f97df3e9d41c66b2f5fffd0cad4826577916f941ac7c9ec7ab625ec9390e050c5885dbd2e7131f2794ecad5709e0ac395ad0edee0182822374e701167ad2cfda07ff9e9bddee1c688d483c132e197a9481c9eb0df2cf9669ab107cc936bf2c96268a120a44fb7f178b402ecd9c512f86908f43fea11cc6902c355929b910a523acd16d5931ea41753391a0368e5bbe9e8cd926da120d8440fce2c192b1e5986854de8551320c989533771f1a71fb41ff1c927ffba9e9e25ae533db6a3c804b0b340a0409e110ac76a7b58f912db41e33b115e1c3ae9aa0399edd621a0fd4b7be2176cb49682ee82b2a219baace63b3822b98ba6f48cd34a08143321993c4390b94b138e4adcfd47dd01982e24acb8d464738f44af04ff3353f8683f352306457522e653baa8937950448eef9879dfaa42e9fcca9a968971b60c413f4aa3e0f90b41c7828ad5dbb62aae0cd2d2ef85e248bf12e4d6d75b803aca52bb9616acc37bc8bdab1a66661a5329dc936b1dbc83fd598c57b9ad80ac42c21a6318b3fb8d0d865fffb043217c42f9546c050eb8cce5e3423371a93aff46471d2008c8cd5841f849d1f0d58317353a6d7308f7962d943795bd52a4dd5a8440640273c78ef6ebbeaae9143d5e6ee90cdaa257e132e6d42d02b9567ae69b75bc60f7596a1fdd8179cff323991701062930ce23a29e30023da9d631bf61a6440acc290bdeafbaaea78365f408aea8f864da220e7a560c9ac84bb9c975814c132f97e08b64ccad47ceb08f2941a4438feb76560b1d5e6f3289f50d054e949674eb6c3294cc4a27427650c4a37f53c65c55ca410fa62ee18a829220360a8272f8c0041e2bf33f047928feb0269c438bdf399b1d8f187b2454ea5cd873e352e1d0781570234c6d810c5a16bac9ea9ffafb0c978a022276903a1c653f17d96659cbb30abc1a320c584bdfcc00125270c2d4c90950029f711575dfa828feea3b1dc83c0701dffac1f89536583a0c0995550f862c3ec786c0f8fee0fd94fae0a661313f9e753362336db3ea0296d7fb913ad490bfc9dd155307ab14e67114fcde26d032435cec7d29247deb93bcf7fa48b4ddb5fb7449c0fda083d5a63e03922d5dfb361b7eeb122a094c3b08eacbd43cecc76c29a9bbcd4808bfa6eaeb78d3453e30660d1653569841869e3d8b90f3d047388da51919cf056ce1ce1d455177c95cdb8f76637d5336e82c9e10ddfd33515f7491ef28cbe4c8a477086daeb525d097844879d140965ef0463b3e1780065da2255e68aee903f7b06b0824b151525c56063d4be22ee31b82d2029fef15f38f9008d785dcab9f1454185ec4a3d76ed3aa8d27859f66ae63eddd338ac28f64048e46a5d0731f9b7ebe52218e11e78cb6d8172aea44f2c213ce7f5edfaed81c5de95a86aba484ec2e1950f61e743f11fbd881f2b0c891aa6e94fff4e5d747971313613da54b5483aabe5b12a8e661d455cdf442b86f3cd8b6e95e2ebfba7c62001769d5d9725f1df8ff364ff45f65b16fb2a828638313dbaac9818f990e8590d54b67613430b9f1869b7f2f756e4af19a145105b7b0f7c889b3146533114d001fc2c1b6b285ded35fd0b17857da527e80658f0b717a8c98920f72289896f05a686083fa9e84ee9f0590793b484365159cd18d9290fc7b342b3926bccdc830a519b8abd07e5b885cc4a6046423d5fa976588510cf5b0cfeaa38e7d170feb401bf9b3e4284415b8e2d2b8d73a0bfda6e246d4075c16f3bf8c1d8a1969dc57fc8786b1e4afb4ec6769534debe49ef6873e76289c6442c6d690457af91df631c7b0d4d0a18a43b26803bfe374a81de3c182b4dc50683f8545157b40f4b44db5eff729645421817ff5fdd0b4ca5cc2ba9b23c33256074b0cd5938aacea39e5cb5af7ec444267f1419867e355de6700ae0a63b7a57eaabe21aee216048612ec6c6993a577ca4d7a0071f5680d89baa337a37a5d1af9dc359d9708ddab0bb96323ae8f6a48d2b8b42d47d4a051b55d14116a359899c79011f2db86e08c2fb7c7d836355cd55f33aba9cb80a10c0844011e3ffa01f5472233fbaebe45f044154220094bf7da1a4035c195978e1b97eac6c41010b27dfb5df985ab16d219f415528b0403846b326f0a00f7b73c89933e1a2daa58dd8dee2f91e2d083eb25508ad3b3e916cf7e002140ed65ebe55ed8bec0cea09a5a61f7262aaa61cbf09d16ff6aac48c511fb8220dc5e20c3d4ce6283c53442a5cf408f3e66734208cc4f13a90a9ad6f90c1db802abcff903addba309ad25dd56cf6d37f32f82eb07fce24ac33e48451e7719e323f512a459a172172ff94d41be609aba82bcb7d827dfc73b4875209aa392c6f0d24f95bb900814fbff19c8d51d421270363bc808f29e21e14f6c99a13f8000fbfbc1cae461215fbba52511c9d14aaedb16e3a3725534b5713c554f1e5ebdc2abfaa712cf0d8ff6699cf0949f89b187e58bbac15927a701432f81b61e797136789ae2e824b0a74c553d59b7a1a1d512fec36c863422f0634560064ad2c310895d6d8a1a3f9429f08a7360cd4b4f9f208bf6d210d809796276e7a900ea994d3f8a3c3be28c3384c8d822fd108e8e9a195798149beb3e4eed373edac2bbc957b3f0432bcddc9556b734b19f91d94d21a881fbc882603f7da7f8993a74d5b12670f87aa69885abea718b67a700caf9fac78122a83b282099952664e5e8446a23b4bb3c01b1b4a9dca924fe0210445dd5e8ce3bdf2429463df24de0cb74bfc162847a6177d42feb487c89e1fd76fc59e4feaab91d6fadfa65a872a8128ea56f4914fb55165598db63bd701573f8ca7b78b69fe0983f1aadb99bb0ccbf9e2409d2833f9ab80296f9795c5e5740ebebb71238c6898dbd6e043cd6031c1590edfe763446a96d3806d62ef9a7467f4545d4b958ab916939d985856d06cc9369194329b961c0b767a76624104d3cacb9119d17499d83c1e6f95f4c79de2aae011413facd8962980b5327c7e22b516c841a985646e38126fb50c8bba642076489a8a8cc21cac2e92e6d459d5666b868da0e30121e972324076476490170f513efc5dcf57ce85d81c9fffceefb19ec98278e13abb2f322af44b980f9ef522e98d909507a8eeb7a0bd927d621e0fbfa06a9ca8f2f9978aae462db2cce9240c82942957472c722a0cbc1c84e6c7cd86bf6534d05090396b70cef7c77a29f06e5360d9c5c426988ee7653d022c1b49bc99494bc661c42b97b62c0f5351b5aabcaf1e22a6cb70d348753711f9063f87b292edf6137ac524b2a4cdf8d3a8ca035fd959ea40297645253a33946687bee09f66132f2cbca0f451b82108f4e68683fcef2cb3282d38fe47f6be597a0aba1b637e24fa2ea26f890f5e8cd2e438b0c42319c3f482b21b3b36e9b66907ab9451aa2d5b0d848c958179cd2c138e7a8133d10b952745c6f9c5ad206b13ae83e21236e06a27e60f54c15fdf96c084ee9253af3ae53f1e5c79bf61eef8cd90f382da1f2c072272bf9fc89b4fc6c18a57e197a366fdb5af0ff28131f42690ec69d59fae8c8f43c8f3cf4eacbdcf3e162e492e1bd533abe70bac53f9868c1995921c79d09f67a6b724410a468129f990d150e95663e54551feb97a4304f92ab3db2a43ca841ee3b0f6b62c751f6016b8439d5a08db8d34faa4ba7a7617fe5bbf1f8fcb5a9f55f1a1db83645eb93bde600032bbac895863cc54f09a9fe1e190a08abc6c080badd8245bb9918713ddaead377afbdcbc7cf4d191f6ca2fe2defa45c3c3353c277e1130284cd441da774eb16e7bf11ad0beef302022a18cf0479285df7f64feacacaef8ca50c201cb9001087611c4cd16f1ab6782d7eafae094c93cf301477a678c9ec482baa1d1d1a405494b67b35057b691af44dc3be73e26ab2b6fbe5d2e2117e0c6d0e964b3826a6e057c80e4f0ed78ed1310c24516b95dcefcf5dfd7e79e5e24e6922ade7efdc2242934973f636e300cbe5002f8bb0413a76baee10099b1008e384b8644188932abf79d0f26c66ebd662add68e039212bf4fd801114196e105d958ade15fb451fb5d5d90fee2ecb792bb5c864125bb3e63e0a7b59ff54f5d52ec590708840bbf134e25625690b262e5493a53ef206ce25c6b4dcbf3d8ebab2806f96b6a96eedebb2930fd7230e9601ce4ab66d721e856eedd6704f0b673e0febabd1148469bdf93c890c637c542b5fd4dc21b898c8c0150a1bc2817542e211205dc70be74977c37901fdc734613e5c1f40efbdf19b983abba0ddad01d0ab654b2e34c656090351a515aca39f58b3485da7c0a696952ea618f1f79eb7c55b056eec77e22224bd79d2ad9f597f12dcdd7c7160518ccd77bb5317ac0ea66b6a80a2cc4e28ae3881c59dff4d4684779776bf9e3accc8384f2a1f05cd3cadb345a27669ea1c059e086f421346ae2cf95d19f75941eed79c775eb557e252e08d9662204006d2ba9375bd871f6b64a0633a3b271d8f1ac39d39e6a5100c99effd2a09df4b49d1a41176d4de1a4236c8190bffad251a113cc16d499ac212db31b26497a399ce1acc2b4a63ceee193bfb94bf91dc309c7ba4664b4e99c745786b7", 0x1000, 0x3, &(0x7f0000001080)=@in={0x2, 0x2}, 0xc) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000010c0)=""/205, 0xcd, 0x802, &(0x7f00000011c0)={0x2, 0x0}, 0xc) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001200)="6534640a5e7748511a23bf5623", 0xd) r1 = paccept(0xffffffffffffff9c, &(0x7f0000001240)=@in, &(0x7f0000001280)=0xc, 0x0) connect$inet6(r1, &(0x7f00000012c0)={0x18, 0x3, 0x1, 0x800}, 0xc) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000001300)=@file={0x0, ""/4096}, &(0x7f0000002340)=0x1002) pwritev(r2, &(0x7f00000024c0)=[{&(0x7f0000002380)="ce0fdad9a64a58f784d8087af805aa2bd2f9b86b22d9b2c32c5873c3f32befbc76c47e31e95cb5772009974106dd56e9b77e9ef21b64ebda31080530f8dbeb72d1925f06c0e6163c8737293d3334cdfe5de421f33504eaa8024bcb42a0ad53d6bd25e3b6650362969853803300c71d1231f73d20109fd2b805d7c0de0668001886e4a380880e169de677cb124cc60578020ffecbe8381965697296f87ca1dd26d239f00c44d28f440468978edf019a5db050913f841895d9d9a42a50fd2953af0bd6c692835f5f28b46768fc540014f8d3ee3d80175cd9bca3e52d0a15b88773f3b8110890f4dffe75433fdabac54c62298a", 0xf2}, {&(0x7f0000002480)="80242bebc81bd3dadcb992d2de24b81300a636d3a64bdfe93133e14429da14cf317eded200e371e34aef0bbaf272a4e8778908", 0x33}], 0x2, 0x51) getpeername(r2, &(0x7f0000002500)=@in, &(0x7f0000002540)=0xc) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_ethernet(0x33, &(0x7f0000000000)="48f7f190c685fad5020b2c726eadc83c0867b01c6b28ea05f4bd0544eb883ec3d8897d9aee86bcb2c90ebe68774c206570c903") syz_execute_func(&(0x7f0000000040)="c4227db74b0b458657fb66440f38dcd2c481f95bfe0f49f8660f3a0c9bb4000000fec4a2fda6fcc4a14dd516c40194596d6466410f6c23") syz_extract_tcp_res(&(0x7f0000000080), 0x6, 0x8000) syz_usb_connect(0x1e3d802a, 0xef, &(0x7f00000000c0)="53890ef7069cebf4ab2e3862d4e8f0d7cd39046611d86efa403d25558c0de4ab33f831e6f5f52956032835783bf2d0f5817f8b8dda73c7542d9f0d12a631e25a3ee4dcfb6ae2f968a825dac5812d8c6b8264e0b78c3daa0c76237a223a71f50ba36e784b03b1f38705a237cf14c437fdc2363dc773b1946be9835bd59cf8390038fb9bac191ec255eaf70ea2b563db022460b05e8d6acc51ea2dc25ff06b2add98890a727807072b47f38ee42d6367e7d3548d3f13ca5574426df294626c3ef4b8cf7aea4830b70d93122efd51fce48496a5bd03e305f2ad871969c97ceff6b6c2286c5431b9fdbd8837629298cb4e", &(0x7f00000001c0)="a185224a16ff1a062f6f9766aeb7f58408b028450e80970d9250114b2c871d5d9ec67f7990a305b4be2c41d35d3316a7f4c9b27401f8440e71a579b7f9acc606d20da088c7077bbc3c361e71c577406168bcc1bcb7f02e416e3f908403e23db0c727ea769debda4d0e524f8adf7f42184a20ba1a23f9c58d46914cc7b12c19537d55a40fcd26c68efb09dc0acc2ee7524abec0b8035ad2b1d194331e2ea4e42ebc53d3880e7c0dd6c57902c8727cefb0fd3192d662") r3 = syz_usb_connect(0xa4, 0x6f, &(0x7f0000000280)="b748b21b78ea22216c2cbfdccb03ec54d20f30f4af462b7bfd5d301b9a4fb8f9bbe630dde8d60855029447df51120e0d690ae4a73e5a06064cc06d83622a66c3cf3ccd920df4a9dec547f0c85354b2e803699f52ffc814536ce519c7c16526da56c65b4429cb224ad9c97f637ee6f2", &(0x7f0000000300)="fca1691e90fef7c0693e50161f6bf9d6be11621b96a65d5023d66e18c9dc3bb38cf479306eff4d2cf175b6f85215446b2379fdc73274566c4ca7cec4d66a481912afe23a3f61adb9467e5bf828156436ebe3d29e3073e4254b3a734acd66d14efb0736fcadff4dad73e02531870c30fae0c378c515786c88c1292736cdf0b6a2e79b47a78e33f5e1d0688a6f3ce2d9e15bd3ee2e2afe1ac5c8523a84a208755a7f822f3d211fe3a26a86507d98583d566a0591a7802cb3f9f9dc35b9110de4b2f4d3934bb20b7a") syz_usb_disconnect(r3) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bEndpointAddress; uint8_t bmAttributes; uint16_t wMaxPacketSize; uint8_t bInterval; uint8_t bRefresh; uint8_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint16_t idVendor; uint16_t idProduct; uint16_t bcdDevice; uint8_t iManufacturer; uint8_t iProduct; uint8_t iSerialNumber; uint8_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t wTotalLength; uint8_t bNumInterfaces; uint8_t bConfigurationValue; uint8_t iConfiguration; uint8_t bmAttributes; uint8_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bNumEndpoints; uint8_t bInterfaceClass; uint8_t bInterfaceSubClass; uint8_t bInterfaceProtocol; uint8_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint8_t bNumConfigurations; uint8_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_accept #define SYS_accept 30 #endif #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getpeername #define SYS_getpeername 31 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_pwritev #define SYS_pwritev 290 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 29 #endif #ifndef SYS_sendto #define SYS_sendto 133 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 105 #endif uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; *(uint32_t*)0x20000040 = 8; res = syscall(SYS_accept, -1, 0x20000000ul, 0x20000040ul); if (res != -1) r[0] = res; memcpy((void*)0x20000080, "\x8d\x36\x0d\x8e\x22\x29\xaa\xb6\x3a\xef\x8e\x41\x58\x2b\x2d\x02\xe9\x3c\x21\x90\xe2\xfe\x50\xc1\xf7\xf3\xb2\x9e\x85\x3f\x60\xfb\x58\x7d\xd7\x8a\x2c\x40\x46\x15\xcd\xf3\x76\x3b\x9a\x53\xdb\xa1\x41\xc6\x6b\x4a\x48\x54\x50\xd6\x6e\x0a\x4a\x28\x1e\x63\xe3\x52\x7c\x88\xcd\xde\x73\x01\x0e\x05\x44\x9a\x77\xae\xe1\xe7\xa3\x5f\xdd\xde\xa4\x97\x11\x9a\x92\xfa\x7f\xb2\xd1\x08\xd6\x47\x5f\x90\xca\x55\xe0\x4b\x82\xe5\x3d\x6a\xc1\x13\x8c\xb9\x13\xb8\xdb\xb0\xb6\xf9\x22\xa1\xa8\x54\x61\x45\x91\x90\x96\x9a\x7d\x79\xde\x91\x64\xf3\xb4\xe2\xe9\xdc\x65\x81\x7c\xd3\x90\x8b\xf1\x31\xac\x85\xe8\x71\x34\x59\xe5\xda\x85\x5d\xd9\x4a\x0f\xee\xa7\x6b\x05\xdd\x56\xd5\xe0\xb5\x22\x23\x32\x21\x05\x06\x20\x2a\xf0\xc3\x71\x85\x96\xbf\x55\x49\x07\x7f\x21\x38\x86\xee\xb0\xb3\xe3\x8b\x83\xe2\x37\x29\x03\x27\xd0\xcc\x6d\x5e\x37\x4a\x36\x5e\xcc\xda\x88\xeb\xf8\xce\x41\x41\x53\x6b\x08\x54\x24\xaa\xdb\x2b\x0c\x5b\xe5\x57\xbe\xa1\x2e\xa5\x3f\x3f\xd5\xb7\xd3\xb4\x8e\xdf\x54\xf8\x60\xc8\xa8\xe1\x94\x1e\x0a\x56\xd8\x51\xb2\xc0\x8b\x8d\x4c\x9b\xad\x81\xad\x64\x9d\x14\x79\xbb\x60\x64\x41\x94\x38\x5d\x68\x04\x41\xc6\x74\xf6\x29\xc5\x0a\xbb\x98\xea\x48\x59\x79\x8a\x0a\x3e\xde\xe9\x5e\x33\xf9\xc2\x88\x0d\xb8\xc9\x27\x9f\x97\x1b\xd5\x97\xb9\x89\x78\xbd\x66\x40\x47\xc1\x44\xaf\x6c\x79\x54\xcc\x4e\xdb\x91\x4a\x61\x80\x47\xa0\x63\xee\x75\x31\x37\x72\x16\xa1\xf4\x24\x04\xfd\xe9\x95\x93\x6f\x5d\x7a\xba\x61\xbb\x23\x07\x00\xac\x33\x90\xd8\xfb\xc6\x27\x72\x09\x4f\xb8\xe5\x43\xf3\x91\x34\x13\x2c\x68\x15\xd1\xeb\xf1\x5b\xd0\x06\x8e\x3b\x7e\xa8\x6b\xb1\x83\x46\x5b\x91\xa4\x31\xf5\x2f\xe3\x8b\xd0\xe6\xe0\x77\x29\x8a\xe8\x26\x56\x85\xe4\x69\x61\xfa\x82\xb6\x4c\x5f\x75\x7e\xaf\x9a\x7d\x0f\x63\xed\x28\x49\xb1\x7a\xf0\xc5\x50\x11\x8c\x7e\x8e\x5a\xdd\xd9\x17\xce\x99\x77\x96\x31\x9e\x6b\xcf\x9b\xc4\x2b\x8b\xa8\x7c\x94\xe5\xa3\x1b\x1c\xec\xb2\xfd\xe9\xc5\x71\xf9\xa8\x7a\x88\x23\x0f\x80\x93\xa7\xae\x80\xa0\xc4\x5c\x3c\xee\xc6\x9f\x1e\x1f\x84\x42\x96\x04\x50\x70\xf3\x72\x8e\xc4\xfa\x64\x4c\xd7\x48\x81\xdb\x3c\x72\x35\x2e\x4b\x83\x18\xf8\x83\x4a\xc6\x30\x6a\x56\x98\xce\x9a\x5e\xb3\x14\xf3\xf8\x64\x70\x67\xbd\x6d\xe7\xc9\x09\x40\x64\x59\x31\xc3\x10\xaa\x55\xe4\x26\x8e\xcb\xaf\x64\xc9\xd8\xc9\xac\xe5\x4f\xc9\xf2\x24\x74\x6d\xdd\x68\x18\x40\xc3\x92\xf2\x74\x75\x33\x42\xef\x48\xac\x19\x73\xab\xf5\xc3\x8d\x07\x76\xbd\x61\xc0\x87\xd7\xb5\x4b\x1f\x93\xea\xed\x1a\x7c\x9f\x73\x42\x7e\x38\xd5\xe3\xca\x2c\xd1\x7f\xa0\x0c\x69\x87\x39\x21\xed\x8f\x2b\x8b\x9f\x89\x50\x91\x34\xf7\x23\xb6\x98\x08\x31\xf5\x50\x4a\x65\x60\x2b\xd9\x36\x7a\x15\x1c\x57\x0a\x70\x59\x10\xaf\xd9\xf6\x91\x16\x73\x73\x27\xc1\x93\xa8\x75\x1d\x9c\x16\x1b\x5b\x2e\xf4\xe4\x06\x05\x5f\xe7\x9c\x57\x0f\x7c\x3e\x83\x34\x62\x3e\xf0\x2b\x9f\x47\xee\xcb\x78\xd3\x0d\xb1\x47\xd4\xfc\x90\xbc\x91\xfa\xec\x2d\x91\x81\x20\x6e\x41\xcc\xcd\xe0\xc2\x14\x83\xbf\xd0\xc4\x5d\x87\x65\xa1\x3d\x69\xe2\x24\x79\xc2\x18\x16\xdb\xd5\x90\xae\x51\xe4\x9f\x60\x58\x44\x9b\x9d\x3d\xbe\x94\x07\x5e\x2e\x57\x02\x8f\x43\xf7\x02\x01\xa1\xe4\x87\x5b\x91\x69\x7c\x29\xde\xb8\xc2\x57\x2a\x10\x51\x31\xc8\x7f\x76\x85\xca\xd9\x4d\x13\x21\xd4\xae\x5c\xc6\xef\xed\xe1\x1a\xc8\x0a\x0e\x00\xa6\x3b\x2b\xa5\x4f\xcc\x51\x95\x47\x5c\x3f\x1f\xf5\x72\x69\x3d\x00\xe4\x91\xa0\x44\x5c\x98\x7d\xed\xcb\xe7\x3b\x69\xec\x13\xd2\x26\xb1\x93\xec\x03\xfa\x9a\x27\xa4\xa4\x34\xd1\x48\x98\x33\x66\xc7\xd8\xe5\xbc\x3c\xea\x9f\xbe\xff\xd0\x5b\x8b\x00\x90\x76\x51\x59\xb3\x80\xac\x96\x42\x96\x55\x12\x59\x21\x50\x7f\x97\xdf\x3e\x9d\x41\xc6\x6b\x2f\x5f\xff\xd0\xca\xd4\x82\x65\x77\x91\x6f\x94\x1a\xc7\xc9\xec\x7a\xb6\x25\xec\x93\x90\xe0\x50\xc5\x88\x5d\xbd\x2e\x71\x31\xf2\x79\x4e\xca\xd5\x70\x9e\x0a\xc3\x95\xad\x0e\xde\xe0\x18\x28\x22\x37\x4e\x70\x11\x67\xad\x2c\xfd\xa0\x7f\xf9\xe9\xbd\xde\xe1\xc6\x88\xd4\x83\xc1\x32\xe1\x97\xa9\x48\x1c\x9e\xb0\xdf\x2c\xf9\x66\x9a\xb1\x07\xcc\x93\x6b\xf2\xc9\x62\x68\xa1\x20\xa4\x4f\xb7\xf1\x78\xb4\x02\xec\xd9\xc5\x12\xf8\x69\x08\xf4\x3f\xea\x11\xcc\x69\x02\xc3\x55\x92\x9b\x91\x0a\x52\x3a\xcd\x16\xd5\x93\x1e\xa4\x17\x53\x39\x1a\x03\x68\xe5\xbb\xe9\xe8\xcd\x92\x6d\xa1\x20\xd8\x44\x0f\xce\x2c\x19\x2b\x1e\x59\x86\x85\x4d\xe8\x55\x13\x20\xc9\x89\x53\x37\x71\xf1\xa7\x1f\xb4\x1f\xf1\xc9\x27\xff\xba\x9e\x9e\x25\xae\x53\x3d\xb6\xa3\xc8\x04\xb0\xb3\x40\xa0\x40\x9e\x11\x0a\xc7\x6a\x7b\x58\xf9\x12\xdb\x41\xe3\x3b\x11\x5e\x1c\x3a\xe9\xaa\x03\x99\xed\xd6\x21\xa0\xfd\x4b\x7b\xe2\x17\x6c\xb4\x96\x82\xee\x82\xb2\xa2\x19\xba\xac\xe6\x3b\x38\x22\xb9\x8b\xa6\xf4\x8c\xd3\x4a\x08\x14\x33\x21\x99\x3c\x43\x90\xb9\x4b\x13\x8e\x4a\xdc\xfd\x47\xdd\x01\x98\x2e\x24\xac\xb8\xd4\x64\x73\x8f\x44\xaf\x04\xff\x33\x53\xf8\x68\x3f\x35\x23\x06\x45\x75\x22\xe6\x53\xba\xa8\x93\x79\x50\x44\x8e\xef\x98\x79\xdf\xaa\x42\xe9\xfc\xca\x9a\x96\x89\x71\xb6\x0c\x41\x3f\x4a\xa3\xe0\xf9\x0b\x41\xc7\x82\x8a\xd5\xdb\xb6\x2a\xae\x0c\xd2\xd2\xef\x85\xe2\x48\xbf\x12\xe4\xd6\xd7\x5b\x80\x3a\xca\x52\xbb\x96\x16\xac\xc3\x7b\xc8\xbd\xab\x1a\x66\x66\x1a\x53\x29\xdc\x93\x6b\x1d\xbc\x83\xfd\x59\x8c\x57\xb9\xad\x80\xac\x42\xc2\x1a\x63\x18\xb3\xfb\x8d\x0d\x86\x5f\xff\xb0\x43\x21\x7c\x42\xf9\x54\x6c\x05\x0e\xb8\xcc\xe5\xe3\x42\x33\x71\xa9\x3a\xff\x46\x47\x1d\x20\x08\xc8\xcd\x58\x41\xf8\x49\xd1\xf0\xd5\x83\x17\x35\x3a\x6d\x73\x08\xf7\x96\x2d\x94\x37\x95\xbd\x52\xa4\xdd\x5a\x84\x40\x64\x02\x73\xc7\x8e\xf6\xeb\xbe\xaa\xe9\x14\x3d\x5e\x6e\xe9\x0c\xda\xa2\x57\xe1\x32\xe6\xd4\x2d\x02\xb9\x56\x7a\xe6\x9b\x75\xbc\x60\xf7\x59\x6a\x1f\xdd\x81\x79\xcf\xf3\x23\x99\x17\x01\x06\x29\x30\xce\x23\xa2\x9e\x30\x02\x3d\xa9\xd6\x31\xbf\x61\xa6\x44\x0a\xcc\x29\x0b\xde\xaf\xba\xae\xa7\x83\x65\xf4\x08\xae\xa8\xf8\x64\xda\x22\x0e\x7a\x56\x0c\x9a\xc8\x4b\xb9\xc9\x75\x81\x4c\x13\x2f\x97\xe0\x8b\x64\xcc\xad\x47\xce\xb0\x8f\x29\x41\xa4\x43\x8f\xeb\x76\x56\x0b\x1d\x5e\x6f\x32\x89\xf5\x0d\x05\x4e\x94\x96\x74\xeb\x6c\x32\x94\xcc\x4a\x27\x42\x76\x50\xc4\xa3\x7f\x53\xc6\x5c\x55\xca\x41\x0f\xa6\x2e\xe1\x8a\x82\x92\x20\x36\x0a\x82\x72\xf8\xc0\x04\x1e\x2b\xf3\x3f\x04\x79\x28\xfe\xb0\x26\x9c\x43\x8b\xdf\x39\x9b\x1d\x8f\x18\x7b\x24\x54\xea\x5c\xd8\x73\xe3\x52\xe1\xd0\x78\x15\x70\x23\x4c\x6d\x81\x0c\x5a\x16\xba\xc9\xea\x9f\xfa\xfb\x0c\x97\x8a\x02\x22\x76\x90\x3a\x1c\x65\x3f\x17\xd9\x66\x59\xcb\xb3\x0a\xbc\x1a\x32\x0c\x58\x4b\xdf\xcc\x00\x12\x52\x70\xc2\xd4\xc9\x09\x50\x02\x9f\x71\x15\x75\xdf\xa8\x28\xfe\xea\x3b\x1d\xc8\x3c\x07\x01\xdf\xfa\xc1\xf8\x95\x36\x58\x3a\x0c\x09\x95\x55\x0f\x86\x2c\x3e\xc7\x86\xc0\xf8\xfe\xe0\xfd\x94\xfa\xe0\xa6\x61\x31\x3f\x9e\x75\x33\x62\x33\x6d\xb3\xea\x02\x96\xd7\xfb\x91\x3a\xd4\x90\xbf\xc9\xdd\x15\x53\x07\xab\x14\xe6\x71\x14\xfc\xde\x26\xd0\x32\x43\x5c\xec\x7d\x29\x24\x7d\xeb\x93\xbc\xf7\xfa\x48\xb4\xdd\xb5\xfb\x74\x49\xc0\xfd\xa0\x83\xd5\xa6\x3e\x03\x92\x2d\x5d\xfb\x36\x1b\x7e\xeb\x12\x2a\x09\x4c\x3b\x08\xea\xcb\xd4\x3c\xec\xc7\x6c\x29\xa9\xbb\xcd\x48\x08\xbf\xa6\xea\xeb\x78\xd3\x45\x3e\x30\x66\x0d\x16\x53\x56\x98\x41\x86\x9e\x3d\x8b\x90\xf3\xd0\x47\x38\x8d\xa5\x19\x19\xcf\x05\x6c\xe1\xce\x1d\x45\x51\x77\xc9\x5c\xdb\x8f\x76\x63\x7d\x53\x36\xe8\x2c\x9e\x10\xdd\xfd\x33\x51\x5f\x74\x91\xef\x28\xcb\xe4\xc8\xa4\x77\x08\x6d\xae\xb5\x25\xd0\x97\x84\x48\x79\xd1\x40\x96\x5e\xf0\x46\x3b\x3e\x17\x80\x06\x5d\xa2\x25\x5e\x68\xae\xe9\x03\xf7\xb0\x6b\x08\x24\xb1\x51\x52\x5c\x56\x06\x3d\x4b\xe2\x2e\xe3\x1b\x82\xd2\x02\x9f\xef\x15\xf3\x8f\x90\x08\xd7\x85\xdc\xab\x9f\x14\x54\x18\x5e\xc4\xa3\xd7\x6e\xd3\xaa\x8d\x27\x85\x9f\x66\xae\x63\xed\xdd\x33\x8a\xc2\x8f\x64\x04\x8e\x46\xa5\xd0\x73\x1f\x9b\x7e\xbe\x52\x21\x8e\x11\xe7\x8c\xb6\xd8\x17\x2a\xea\x44\xf2\xc2\x13\xce\x7f\x5e\xdf\xae\xd8\x1c\x5d\xe9\x5a\x86\xab\xa4\x84\xec\x2e\x19\x50\xf6\x1e\x74\x3f\x11\xfb\xd8\x81\xf2\xb0\xc8\x91\xaa\x6e\x94\xff\xf4\xe5\xd7\x47\x97\x13\x13\x61\x3d\xa5\x4b\x54\x83\xaa\xbe\x5b\x12\xa8\xe6\x61\xd4\x55\xcd\xf4\x42\xb8\x6f\x3c\xd8\xb6\xe9\x5e\x2e\xbf\xba\x7c\x62\x00\x17\x69\xd5\xd9\x72\x5f\x1d\xf8\xff\x36\x4f\xf4\x5f\x65\xb1\x6f\xb2\xa8\x28\x63\x83\x13\xdb\xaa\xc9\x81\x8f\x99\x0e\x85\x90\xd5\x4b\x67\x61\x34\x30\xb9\xf1\x86\x9b\x7f\x2f\x75\x6e\x4a\xf1\x9a\x14\x51\x05\xb7\xb0\xf7\xc8\x89\xb3\x14\x65\x33\x11\x4d\x00\x1f\xc2\xc1\xb6\xb2\x85\xde\xd3\x5f\xd0\xb1\x78\x57\xda\x52\x7e\x80\x65\x8f\x0b\x71\x7a\x8c\x98\x92\x0f\x72\x28\x98\x96\xf0\x5a\x68\x60\x83\xfa\x9e\x84\xee\x9f\x05\x90\x79\x3b\x48\x43\x65\x15\x9c\xd1\x8d\x92\x90\xfc\x7b\x34\x2b\x39\x26\xbc\xcd\xc8\x30\xa5\x19\xb8\xab\xd0\x7e\x5b\x88\x5c\xc4\xa6\x04\x64\x23\xd5\xfa\x97\x65\x88\x51\x0c\xf5\xb0\xcf\xea\xa3\x8e\x7d\x17\x0f\xeb\x40\x1b\xf9\xb3\xe4\x28\x44\x15\xb8\xe2\xd2\xb8\xd7\x3a\x0b\xfd\xa6\xe2\x46\xd4\x07\x5c\x16\xf3\xbf\x8c\x1d\x8a\x19\x69\xdc\x57\xfc\x87\x86\xb1\xe4\xaf\xb4\xec\x67\x69\x53\x4d\xeb\xe4\x9e\xf6\x87\x3e\x76\x28\x9c\x64\x42\xc6\xd6\x90\x45\x7a\xf9\x1d\xf6\x31\xc7\xb0\xd4\xd0\xa1\x8a\x43\xb2\x68\x03\xbf\xe3\x74\xa8\x1d\xe3\xc1\x82\xb4\xdc\x50\x68\x3f\x85\x45\x15\x7b\x40\xf4\xb4\x4d\xb5\xef\xf7\x29\x64\x54\x21\x81\x7f\xf5\xfd\xd0\xb4\xca\x5c\xc2\xba\x9b\x23\xc3\x32\x56\x07\x4b\x0c\xd5\x93\x8a\xac\xea\x39\xe5\xcb\x5a\xf7\xec\x44\x42\x67\xf1\x41\x98\x67\xe3\x55\xde\x67\x00\xae\x0a\x63\xb7\xa5\x7e\xaa\xbe\x21\xae\xe2\x16\x04\x86\x12\xec\x6c\x69\x93\xa5\x77\xca\x4d\x7a\x00\x71\xf5\x68\x0d\x89\xba\xa3\x37\xa3\x7a\x5d\x1a\xf9\xdc\x35\x9d\x97\x08\xdd\xab\x0b\xb9\x63\x23\xae\x8f\x6a\x48\xd2\xb8\xb4\x2d\x47\xd4\xa0\x51\xb5\x5d\x14\x11\x6a\x35\x98\x99\xc7\x90\x11\xf2\xdb\x86\xe0\x8c\x2f\xb7\xc7\xd8\x36\x35\x5c\xd5\x5f\x33\xab\xa9\xcb\x80\xa1\x0c\x08\x44\x01\x1e\x3f\xfa\x01\xf5\x47\x22\x33\xfb\xae\xbe\x45\xf0\x44\x15\x42\x20\x09\x4b\xf7\xda\x1a\x40\x35\xc1\x95\x97\x8e\x1b\x97\xea\xc6\xc4\x10\x10\xb2\x7d\xfb\x5d\xf9\x85\xab\x16\xd2\x19\xf4\x15\x52\x8b\x04\x03\x84\x6b\x32\x6f\x0a\x00\xf7\xb7\x3c\x89\x93\x3e\x1a\x2d\xaa\x58\xdd\x8d\xee\x2f\x91\xe2\xd0\x83\xeb\x25\x50\x8a\xd3\xb3\xe9\x16\xcf\x7e\x00\x21\x40\xed\x65\xeb\xe5\x5e\xd8\xbe\xc0\xce\xa0\x9a\x5a\x61\xf7\x26\x2a\xaa\x61\xcb\xf0\x9d\x16\xff\x6a\xac\x48\xc5\x11\xfb\x82\x20\xdc\x5e\x20\xc3\xd4\xce\x62\x83\xc5\x34\x42\xa5\xcf\x40\x8f\x3e\x66\x73\x42\x08\xcc\x4f\x13\xa9\x0a\x9a\xd6\xf9\x0c\x1d\xb8\x02\xab\xcf\xf9\x03\xad\xdb\xa3\x09\xad\x25\xdd\x56\xcf\x6d\x37\xf3\x2f\x82\xeb\x07\xfc\xe2\x4a\xc3\x3e\x48\x45\x1e\x77\x19\xe3\x23\xf5\x12\xa4\x59\xa1\x72\x17\x2f\xf9\x4d\x41\xbe\x60\x9a\xba\x82\xbc\xb7\xd8\x27\xdf\xc7\x3b\x48\x75\x20\x9a\xa3\x92\xc6\xf0\xd2\x4f\x95\xbb\x90\x08\x14\xfb\xff\x19\xc8\xd5\x1d\x42\x12\x70\x36\x3b\xc8\x08\xf2\x9e\x21\xe1\x4f\x6c\x99\xa1\x3f\x80\x00\xfb\xfb\xc1\xca\xe4\x61\x21\x5f\xbb\xa5\x25\x11\xc9\xd1\x4a\xae\xdb\x16\xe3\xa3\x72\x55\x34\xb5\x71\x3c\x55\x4f\x1e\x5e\xbd\xc2\xab\xfa\xa7\x12\xcf\x0d\x8f\xf6\x69\x9c\xf0\x94\x9f\x89\xb1\x87\xe5\x8b\xba\xc1\x59\x27\xa7\x01\x43\x2f\x81\xb6\x1e\x79\x71\x36\x78\x9a\xe2\xe8\x24\xb0\xa7\x4c\x55\x3d\x59\xb7\xa1\xa1\xd5\x12\xfe\xc3\x6c\x86\x34\x22\xf0\x63\x45\x60\x06\x4a\xd2\xc3\x10\x89\x5d\x6d\x8a\x1a\x3f\x94\x29\xf0\x8a\x73\x60\xcd\x4b\x4f\x9f\x20\x8b\xf6\xd2\x10\xd8\x09\x79\x62\x76\xe7\xa9\x00\xea\x99\x4d\x3f\x8a\x3c\x3b\xe2\x8c\x33\x84\xc8\xd8\x22\xfd\x10\x8e\x8e\x9a\x19\x57\x98\x14\x9b\xeb\x3e\x4e\xed\x37\x3e\xda\xc2\xbb\xc9\x57\xb3\xf0\x43\x2b\xcd\xdc\x95\x56\xb7\x34\xb1\x9f\x91\xd9\x4d\x21\xa8\x81\xfb\xc8\x82\x60\x3f\x7d\xa7\xf8\x99\x3a\x74\xd5\xb1\x26\x70\xf8\x7a\xa6\x98\x85\xab\xea\x71\x8b\x67\xa7\x00\xca\xf9\xfa\xc7\x81\x22\xa8\x3b\x28\x20\x99\x95\x26\x64\xe5\xe8\x44\x6a\x23\xb4\xbb\x3c\x01\xb1\xb4\xa9\xdc\xa9\x24\xfe\x02\x10\x44\x5d\xd5\xe8\xce\x3b\xdf\x24\x29\x46\x3d\xf2\x4d\xe0\xcb\x74\xbf\xc1\x62\x84\x7a\x61\x77\xd4\x2f\xeb\x48\x7c\x89\xe1\xfd\x76\xfc\x59\xe4\xfe\xaa\xb9\x1d\x6f\xad\xfa\x65\xa8\x72\xa8\x12\x8e\xa5\x6f\x49\x14\xfb\x55\x16\x55\x98\xdb\x63\xbd\x70\x15\x73\xf8\xca\x7b\x78\xb6\x9f\xe0\x98\x3f\x1a\xad\xb9\x9b\xb0\xcc\xbf\x9e\x24\x09\xd2\x83\x3f\x9a\xb8\x02\x96\xf9\x79\x5c\x5e\x57\x40\xeb\xeb\xb7\x12\x38\xc6\x89\x8d\xbd\x6e\x04\x3c\xd6\x03\x1c\x15\x90\xed\xfe\x76\x34\x46\xa9\x6d\x38\x06\xd6\x2e\xf9\xa7\x46\x7f\x45\x45\xd4\xb9\x58\xab\x91\x69\x39\xd9\x85\x85\x6d\x06\xcc\x93\x69\x19\x43\x29\xb9\x61\xc0\xb7\x67\xa7\x66\x24\x10\x4d\x3c\xac\xb9\x11\x9d\x17\x49\x9d\x83\xc1\xe6\xf9\x5f\x4c\x79\xde\x2a\xae\x01\x14\x13\xfa\xcd\x89\x62\x98\x0b\x53\x27\xc7\xe2\x2b\x51\x6c\x84\x1a\x98\x56\x46\xe3\x81\x26\xfb\x50\xc8\xbb\xa6\x42\x07\x64\x89\xa8\xa8\xcc\x21\xca\xc2\xe9\x2e\x6d\x45\x9d\x56\x66\xb8\x68\xda\x0e\x30\x12\x1e\x97\x23\x24\x07\x64\x76\x49\x01\x70\xf5\x13\xef\xc5\xdc\xf5\x7c\xe8\x5d\x81\xc9\xff\xfc\xee\xfb\x19\xec\x98\x27\x8e\x13\xab\xb2\xf3\x22\xaf\x44\xb9\x80\xf9\xef\x52\x2e\x98\xd9\x09\x50\x7a\x8e\xeb\x7a\x0b\xd9\x27\xd6\x21\xe0\xfb\xfa\x06\xa9\xca\x8f\x2f\x99\x78\xaa\xe4\x62\xdb\x2c\xce\x92\x40\xc8\x29\x42\x95\x74\x72\xc7\x22\xa0\xcb\xc1\xc8\x4e\x6c\x7c\xd8\x6b\xf6\x53\x4d\x05\x09\x03\x96\xb7\x0c\xef\x7c\x77\xa2\x9f\x06\xe5\x36\x0d\x9c\x5c\x42\x69\x88\xee\x76\x53\xd0\x22\xc1\xb4\x9b\xc9\x94\x94\xbc\x66\x1c\x42\xb9\x7b\x62\xc0\xf5\x35\x1b\x5a\xab\xca\xf1\xe2\x2a\x6c\xb7\x0d\x34\x87\x53\x71\x1f\x90\x63\xf8\x7b\x29\x2e\xdf\x61\x37\xac\x52\x4b\x2a\x4c\xdf\x8d\x3a\x8c\xa0\x35\xfd\x95\x9e\xa4\x02\x97\x64\x52\x53\xa3\x39\x46\x68\x7b\xee\x09\xf6\x61\x32\xf2\xcb\xca\x0f\x45\x1b\x82\x10\x8f\x4e\x68\x68\x3f\xce\xf2\xcb\x32\x82\xd3\x8f\xe4\x7f\x6b\xe5\x97\xa0\xab\xa1\xb6\x37\xe2\x4f\xa2\xea\x26\xf8\x90\xf5\xe8\xcd\x2e\x43\x8b\x0c\x42\x31\x9c\x3f\x48\x2b\x21\xb3\xb3\x6e\x9b\x66\x90\x7a\xb9\x45\x1a\xa2\xd5\xb0\xd8\x48\xc9\x58\x17\x9c\xd2\xc1\x38\xe7\xa8\x13\x3d\x10\xb9\x52\x74\x5c\x6f\x9c\x5a\xd2\x06\xb1\x3a\xe8\x3e\x21\x23\x6e\x06\xa2\x7e\x60\xf5\x4c\x15\xfd\xf9\x6c\x08\x4e\xe9\x25\x3a\xf3\xae\x53\xf1\xe5\xc7\x9b\xf6\x1e\xef\x8c\xd9\x0f\x38\x2d\xa1\xf2\xc0\x72\x27\x2b\xf9\xfc\x89\xb4\xfc\x6c\x18\xa5\x7e\x19\x7a\x36\x6f\xdb\x5a\xf0\xff\x28\x13\x1f\x42\x69\x0e\xc6\x9d\x59\xfa\xe8\xc8\xf4\x3c\x8f\x3c\xf4\xea\xcb\xdc\xf3\xe1\x62\xe4\x92\xe1\xbd\x53\x3a\xbe\x70\xba\xc5\x3f\x98\x68\xc1\x99\x59\x21\xc7\x9d\x09\xf6\x7a\x6b\x72\x44\x10\xa4\x68\x12\x9f\x99\x0d\x15\x0e\x95\x66\x3e\x54\x55\x1f\xeb\x97\xa4\x30\x4f\x92\xab\x3d\xb2\xa4\x3c\xa8\x41\xee\x3b\x0f\x6b\x62\xc7\x51\xf6\x01\x6b\x84\x39\xd5\xa0\x8d\xb8\xd3\x4f\xaa\x4b\xa7\xa7\x61\x7f\xe5\xbb\xf1\xf8\xfc\xb5\xa9\xf5\x5f\x1a\x1d\xb8\x36\x45\xeb\x93\xbd\xe6\x00\x03\x2b\xba\xc8\x95\x86\x3c\xc5\x4f\x09\xa9\xfe\x1e\x19\x0a\x08\xab\xc6\xc0\x80\xba\xdd\x82\x45\xbb\x99\x18\x71\x3d\xda\xea\xd3\x77\xaf\xbd\xcb\xc7\xcf\x4d\x19\x1f\x6c\xa2\xfe\x2d\xef\xa4\x5c\x3c\x33\x53\xc2\x77\xe1\x13\x02\x84\xcd\x44\x1d\xa7\x74\xeb\x16\xe7\xbf\x11\xad\x0b\xee\xf3\x02\x02\x2a\x18\xcf\x04\x79\x28\x5d\xf7\xf6\x4f\xea\xca\xca\xef\x8c\xa5\x0c\x20\x1c\xb9\x00\x10\x87\x61\x1c\x4c\xd1\x6f\x1a\xb6\x78\x2d\x7e\xaf\xae\x09\x4c\x93\xcf\x30\x14\x77\xa6\x78\xc9\xec\x48\x2b\xaa\x1d\x1d\x1a\x40\x54\x94\xb6\x7b\x35\x05\x7b\x69\x1a\xf4\x4d\xc3\xbe\x73\xe2\x6a\xb2\xb6\xfb\xe5\xd2\xe2\x11\x7e\x0c\x6d\x0e\x96\x4b\x38\x26\xa6\xe0\x57\xc8\x0e\x4f\x0e\xd7\x8e\xd1\x31\x0c\x24\x51\x6b\x95\xdc\xef\xcf\x5d\xfd\x7e\x79\xe5\xe2\x4e\x69\x22\xad\xe7\xef\xdc\x22\x42\x93\x49\x73\xf6\x36\xe3\x00\xcb\xe5\x00\x2f\x8b\xb0\x41\x3a\x76\xba\xee\x10\x09\x9b\x10\x08\xe3\x84\xb8\x64\x41\x88\x93\x2a\xbf\x79\xd0\xf2\x6c\x66\xeb\xd6\x62\xad\xd6\x8e\x03\x92\x12\xbf\x4f\xd8\x01\x11\x41\x96\xe1\x05\xd9\x58\xad\xe1\x5f\xb4\x51\xfb\x5d\x5d\x90\xfe\xe2\xec\xb7\x92\xbb\x5c\x86\x41\x25\xbb\x3e\x63\xe0\xa7\xb5\x9f\xf5\x4f\x5d\x52\xec\x59\x07\x08\x84\x0b\xbf\x13\x4e\x25\x62\x56\x90\xb2\x62\xe5\x49\x3a\x53\xef\x20\x6c\xe2\x5c\x6b\x4d\xcb\xf3\xd8\xeb\xab\x28\x06\xf9\x6b\x6a\x96\xee\xde\xbb\x29\x30\xfd\x72\x30\xe9\x60\x1c\xe4\xab\x66\xd7\x21\xe8\x56\xee\xdd\x67\x04\xf0\xb6\x73\xe0\xfe\xba\xbd\x11\x48\x46\x9b\xdf\x93\xc8\x90\xc6\x37\xc5\x42\xb5\xfd\x4d\xc2\x1b\x89\x8c\x8c\x01\x50\xa1\xbc\x28\x17\x54\x2e\x21\x12\x05\xdc\x70\xbe\x74\x97\x7c\x37\x90\x1f\xdc\x73\x46\x13\xe5\xc1\xf4\x0e\xfb\xdf\x19\xb9\x83\xab\xba\x0d\xda\xd0\x1d\x0a\xb6\x54\xb2\xe3\x4c\x65\x60\x90\x35\x1a\x51\x5a\xca\x39\xf5\x8b\x34\x85\xda\x7c\x0a\x69\x69\x52\xea\x61\x8f\x1f\x79\xeb\x7c\x55\xb0\x56\xee\xc7\x7e\x22\x22\x4b\xd7\x9d\x2a\xd9\xf5\x97\xf1\x2d\xcd\xd7\xc7\x16\x05\x18\xcc\xd7\x7b\xb5\x31\x7a\xc0\xea\x66\xb6\xa8\x0a\x2c\xc4\xe2\x8a\xe3\x88\x1c\x59\xdf\xf4\xd4\x68\x47\x79\x77\x6b\xf9\xe3\xac\xcc\x83\x84\xf2\xa1\xf0\x5c\xd3\xca\xdb\x34\x5a\x27\x66\x9e\xa1\xc0\x59\xe0\x86\xf4\x21\x34\x6a\xe2\xcf\x95\xd1\x9f\x75\x94\x1e\xed\x79\xc7\x75\xeb\x55\x7e\x25\x2e\x08\xd9\x66\x22\x04\x00\x6d\x2b\xa9\x37\x5b\xd8\x71\xf6\xb6\x4a\x06\x33\xa3\xb2\x71\xd8\xf1\xac\x39\xd3\x9e\x6a\x51\x00\xc9\x9e\xff\xd2\xa0\x9d\xf4\xb4\x9d\x1a\x41\x17\x6d\x4d\xe1\xa4\x23\x6c\x81\x90\xbf\xfa\xd2\x51\xa1\x13\xcc\x16\xd4\x99\xac\x21\x2d\xb3\x1b\x26\x49\x7a\x39\x9c\xe1\xac\xc2\xb4\xa6\x3c\xee\xe1\x93\xbf\xb9\x4b\xf9\x1d\xc3\x09\xc7\xba\x46\x64\xb4\xe9\x9c\x74\x57\x86\xb7", 4096); *(uint16_t*)0x20001080 = 2; *(uint16_t*)0x20001082 = htobe16(0x4e22); *(uint8_t*)0x20001084 = 0; *(uint8_t*)0x20001085 = 0; *(uint8_t*)0x20001086 = 0; *(uint8_t*)0x20001087 = 0; *(uint8_t*)0x20001088 = 0; *(uint8_t*)0x20001089 = 0; *(uint8_t*)0x2000108a = 0; *(uint8_t*)0x2000108b = 0; syscall(SYS_sendto, r[0], 0x20000080ul, 0x1000ul, 3ul, 0x20001080ul, 0xcul); *(uint16_t*)0x200011c0 = 2; *(uint16_t*)0x200011c2 = htobe16(0x4e20); *(uint8_t*)0x200011c4 = 0; *(uint8_t*)0x200011c5 = 0; *(uint8_t*)0x200011c6 = 0; *(uint8_t*)0x200011c7 = 0; *(uint8_t*)0x200011c8 = 0; *(uint8_t*)0x200011c9 = 0; *(uint8_t*)0x200011ca = 0; *(uint8_t*)0x200011cb = 0; syscall(SYS_recvfrom, 0xffffff9c, 0x200010c0ul, 0xcdul, 0x802ul, 0x200011c0ul, 0xcul); memcpy((void*)0x20001200, "\x65\x34\x64\x0a\x5e\x77\x48\x51\x1a\x23\xbf\x56\x23", 13); syscall(SYS_setsockopt, -1, 0, 1, 0x20001200ul, 0xdul); *(uint32_t*)0x20001280 = 0xc; res = syscall(SYS_paccept, 0xffffff9c, 0x20001240ul, 0x20001280ul, 0ul); if (res != -1) r[1] = res; *(uint16_t*)0x200012c0 = 0x18; *(uint16_t*)0x200012c2 = htobe16(0x4e23); *(uint32_t*)0x200012c4 = 1; *(uint32_t*)0x200012c8 = 0x800; syscall(SYS_connect, r[1], 0x200012c0ul, 0xcul); *(uint32_t*)0x20002340 = 0x1002; res = syscall(SYS_accept, -1, 0x20001300ul, 0x20002340ul); if (res != -1) r[2] = res; *(uint64_t*)0x200024c0 = 0x20002380; memcpy((void*)0x20002380, "\xce\x0f\xda\xd9\xa6\x4a\x58\xf7\x84\xd8\x08\x7a\xf8\x05\xaa\x2b\xd2\xf9\xb8\x6b\x22\xd9\xb2\xc3\x2c\x58\x73\xc3\xf3\x2b\xef\xbc\x76\xc4\x7e\x31\xe9\x5c\xb5\x77\x20\x09\x97\x41\x06\xdd\x56\xe9\xb7\x7e\x9e\xf2\x1b\x64\xeb\xda\x31\x08\x05\x30\xf8\xdb\xeb\x72\xd1\x92\x5f\x06\xc0\xe6\x16\x3c\x87\x37\x29\x3d\x33\x34\xcd\xfe\x5d\xe4\x21\xf3\x35\x04\xea\xa8\x02\x4b\xcb\x42\xa0\xad\x53\xd6\xbd\x25\xe3\xb6\x65\x03\x62\x96\x98\x53\x80\x33\x00\xc7\x1d\x12\x31\xf7\x3d\x20\x10\x9f\xd2\xb8\x05\xd7\xc0\xde\x06\x68\x00\x18\x86\xe4\xa3\x80\x88\x0e\x16\x9d\xe6\x77\xcb\x12\x4c\xc6\x05\x78\x02\x0f\xfe\xcb\xe8\x38\x19\x65\x69\x72\x96\xf8\x7c\xa1\xdd\x26\xd2\x39\xf0\x0c\x44\xd2\x8f\x44\x04\x68\x97\x8e\xdf\x01\x9a\x5d\xb0\x50\x91\x3f\x84\x18\x95\xd9\xd9\xa4\x2a\x50\xfd\x29\x53\xaf\x0b\xd6\xc6\x92\x83\x5f\x5f\x28\xb4\x67\x68\xfc\x54\x00\x14\xf8\xd3\xee\x3d\x80\x17\x5c\xd9\xbc\xa3\xe5\x2d\x0a\x15\xb8\x87\x73\xf3\xb8\x11\x08\x90\xf4\xdf\xfe\x75\x43\x3f\xda\xba\xc5\x4c\x62\x29\x8a", 242); *(uint64_t*)0x200024c8 = 0xf2; *(uint64_t*)0x200024d0 = 0x20002480; memcpy((void*)0x20002480, "\x80\x24\x2b\xeb\xc8\x1b\xd3\xda\xdc\xb9\x92\xd2\xde\x24\xb8\x13\x00\xa6\x36\xd3\xa6\x4b\xdf\xe9\x31\x33\xe1\x44\x29\xda\x14\xcf\x31\x7e\xde\xd2\x00\xe3\x71\xe3\x4a\xef\x0b\xba\xf2\x72\xa4\xe8\x77\x89\x08", 51); *(uint64_t*)0x200024d8 = 0x33; syscall(SYS_pwritev, r[2], 0x200024c0ul, 2ul, 0x51ul); *(uint32_t*)0x20002540 = 0xc; syscall(SYS_getpeername, r[2], 0x20002500ul, 0x20002540ul); syscall(SYS_dup2, -1, -1); memcpy((void*)0x20000000, "\x48\xf7\xf1\x90\xc6\x85\xfa\xd5\x02\x0b\x2c\x72\x6e\xad\xc8\x3c\x08\x67\xb0\x1c\x6b\x28\xea\x05\xf4\xbd\x05\x44\xeb\x88\x3e\xc3\xd8\x89\x7d\x9a\xee\x86\xbc\xb2\xc9\x0e\xbe\x68\x77\x4c\x20\x65\x70\xc9\x03", 51); memcpy((void*)0x20000040, "\xc4\x22\x7d\xb7\x4b\x0b\x45\x86\x57\xfb\x66\x44\x0f\x38\xdc\xd2\xc4\x81\xf9\x5b\xfe\x0f\x49\xf8\x66\x0f\x3a\x0c\x9b\xb4\x00\x00\x00\xfe\xc4\xa2\xfd\xa6\xfc\xc4\xa1\x4d\xd5\x16\xc4\x01\x94\x59\x6d\x64\x66\x41\x0f\x6c\x23", 55); syz_execute_func(0x20000040); memcpy((void*)0x200000c0, "\x53\x89\x0e\xf7\x06\x9c\xeb\xf4\xab\x2e\x38\x62\xd4\xe8\xf0\xd7\xcd\x39\x04\x66\x11\xd8\x6e\xfa\x40\x3d\x25\x55\x8c\x0d\xe4\xab\x33\xf8\x31\xe6\xf5\xf5\x29\x56\x03\x28\x35\x78\x3b\xf2\xd0\xf5\x81\x7f\x8b\x8d\xda\x73\xc7\x54\x2d\x9f\x0d\x12\xa6\x31\xe2\x5a\x3e\xe4\xdc\xfb\x6a\xe2\xf9\x68\xa8\x25\xda\xc5\x81\x2d\x8c\x6b\x82\x64\xe0\xb7\x8c\x3d\xaa\x0c\x76\x23\x7a\x22\x3a\x71\xf5\x0b\xa3\x6e\x78\x4b\x03\xb1\xf3\x87\x05\xa2\x37\xcf\x14\xc4\x37\xfd\xc2\x36\x3d\xc7\x73\xb1\x94\x6b\xe9\x83\x5b\xd5\x9c\xf8\x39\x00\x38\xfb\x9b\xac\x19\x1e\xc2\x55\xea\xf7\x0e\xa2\xb5\x63\xdb\x02\x24\x60\xb0\x5e\x8d\x6a\xcc\x51\xea\x2d\xc2\x5f\xf0\x6b\x2a\xdd\x98\x89\x0a\x72\x78\x07\x07\x2b\x47\xf3\x8e\xe4\x2d\x63\x67\xe7\xd3\x54\x8d\x3f\x13\xca\x55\x74\x42\x6d\xf2\x94\x62\x6c\x3e\xf4\xb8\xcf\x7a\xea\x48\x30\xb7\x0d\x93\x12\x2e\xfd\x51\xfc\xe4\x84\x96\xa5\xbd\x03\xe3\x05\xf2\xad\x87\x19\x69\xc9\x7c\xef\xf6\xb6\xc2\x28\x6c\x54\x31\xb9\xfd\xbd\x88\x37\x62\x92\x98\xcb\x4e", 239); memcpy((void*)0x200001c0, "\xa1\x85\x22\x4a\x16\xff\x1a\x06\x2f\x6f\x97\x66\xae\xb7\xf5\x84\x08\xb0\x28\x45\x0e\x80\x97\x0d\x92\x50\x11\x4b\x2c\x87\x1d\x5d\x9e\xc6\x7f\x79\x90\xa3\x05\xb4\xbe\x2c\x41\xd3\x5d\x33\x16\xa7\xf4\xc9\xb2\x74\x01\xf8\x44\x0e\x71\xa5\x79\xb7\xf9\xac\xc6\x06\xd2\x0d\xa0\x88\xc7\x07\x7b\xbc\x3c\x36\x1e\x71\xc5\x77\x40\x61\x68\xbc\xc1\xbc\xb7\xf0\x2e\x41\x6e\x3f\x90\x84\x03\xe2\x3d\xb0\xc7\x27\xea\x76\x9d\xeb\xda\x4d\x0e\x52\x4f\x8a\xdf\x7f\x42\x18\x4a\x20\xba\x1a\x23\xf9\xc5\x8d\x46\x91\x4c\xc7\xb1\x2c\x19\x53\x7d\x55\xa4\x0f\xcd\x26\xc6\x8e\xfb\x09\xdc\x0a\xcc\x2e\xe7\x52\x4a\xbe\xc0\xb8\x03\x5a\xd2\xb1\xd1\x94\x33\x1e\x2e\xa4\xe4\x2e\xbc\x53\xd3\x88\x0e\x7c\x0d\xd6\xc5\x79\x02\xc8\x72\x7c\xef\xb0\xfd\x31\x92\xd6\x62", 181); syz_usb_connect(0x1e3d802a, 0xef, 0x200000c0, 0x200001c0); memcpy((void*)0x20000280, "\xb7\x48\xb2\x1b\x78\xea\x22\x21\x6c\x2c\xbf\xdc\xcb\x03\xec\x54\xd2\x0f\x30\xf4\xaf\x46\x2b\x7b\xfd\x5d\x30\x1b\x9a\x4f\xb8\xf9\xbb\xe6\x30\xdd\xe8\xd6\x08\x55\x02\x94\x47\xdf\x51\x12\x0e\x0d\x69\x0a\xe4\xa7\x3e\x5a\x06\x06\x4c\xc0\x6d\x83\x62\x2a\x66\xc3\xcf\x3c\xcd\x92\x0d\xf4\xa9\xde\xc5\x47\xf0\xc8\x53\x54\xb2\xe8\x03\x69\x9f\x52\xff\xc8\x14\x53\x6c\xe5\x19\xc7\xc1\x65\x26\xda\x56\xc6\x5b\x44\x29\xcb\x22\x4a\xd9\xc9\x7f\x63\x7e\xe6\xf2", 111); memcpy((void*)0x20000300, "\xfc\xa1\x69\x1e\x90\xfe\xf7\xc0\x69\x3e\x50\x16\x1f\x6b\xf9\xd6\xbe\x11\x62\x1b\x96\xa6\x5d\x50\x23\xd6\x6e\x18\xc9\xdc\x3b\xb3\x8c\xf4\x79\x30\x6e\xff\x4d\x2c\xf1\x75\xb6\xf8\x52\x15\x44\x6b\x23\x79\xfd\xc7\x32\x74\x56\x6c\x4c\xa7\xce\xc4\xd6\x6a\x48\x19\x12\xaf\xe2\x3a\x3f\x61\xad\xb9\x46\x7e\x5b\xf8\x28\x15\x64\x36\xeb\xe3\xd2\x9e\x30\x73\xe4\x25\x4b\x3a\x73\x4a\xcd\x66\xd1\x4e\xfb\x07\x36\xfc\xad\xff\x4d\xad\x73\xe0\x25\x31\x87\x0c\x30\xfa\xe0\xc3\x78\xc5\x15\x78\x6c\x88\xc1\x29\x27\x36\xcd\xf0\xb6\xa2\xe7\x9b\x47\xa7\x8e\x33\xf5\xe1\xd0\x68\x8a\x6f\x3c\xe2\xd9\xe1\x5b\xd3\xee\x2e\x2a\xfe\x1a\xc5\xc8\x52\x3a\x84\xa2\x08\x75\x5a\x7f\x82\x2f\x3d\x21\x1f\xe3\xa2\x6a\x86\x50\x7d\x98\x58\x3d\x56\x6a\x05\x91\xa7\x80\x2c\xb3\xf9\xf9\xdc\x35\xb9\x11\x0d\xe4\xb2\xf4\xd3\x93\x4b\xb2\x0b\x7a", 199); res = syz_usb_connect(0xa4, 0x6f, 0x20000280, 0x20000300); if (res != -1) r[3] = res; syz_usb_disconnect(r[3]); } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } : In function 'syz_usb_connect_impl': :546:63: error: unknown type name 'usb_ctrlrequest' :551:55: error: unknown type name 'usb_ctrlrequest' compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor196656848 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/9 (0.75s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000040)=0x8) sendto(r0, &(0x7f0000000080)="8d360d8e2229aab63aef8e41582b2d02e93c2190e2fe50c1f7f3b29e853f60fb587dd78a2c404615cdf3763b9a53dba141c66b4a485450d66e0a4a281e63e3527c88cdde73010e05449a77aee1e7a35fdddea497119a92fa7fb2d108d6475f90ca55e04b82e53d6ac1138cb913b8dbb0b6f922a1a85461459190969a7d79de9164f3b4e2e9dc65817cd3908bf131ac85e8713459e5da855dd94a0feea76b05dd56d5e0b5222332210506202af0c3718596bf5549077f213886eeb0b3e38b83e237290327d0cc6d5e374a365eccda88ebf8ce4141536b085424aadb2b0c5be557bea12ea53f3fd5b7d3b48edf54f860c8a8e1941e0a56d851b2c08b8d4c9bad81ad649d1479bb60644194385d680441c674f629c50abb98ea4859798a0a3edee95e33f9c2880db8c9279f971bd597b98978bd664047c144af6c7954cc4edb914a618047a063ee7531377216a1f42404fde995936f5d7aba61bb230700ac3390d8fbc62772094fb8e543f39134132c6815d1ebf15bd0068e3b7ea86bb183465b91a431f52fe38bd0e6e077298ae8265685e46961fa82b64c5f757eaf9a7d0f63ed2849b17af0c550118c7e8e5addd917ce997796319e6bcf9bc42b8ba87c94e5a31b1cecb2fde9c571f9a87a88230f8093a7ae80a0c45c3ceec69f1e1f844296045070f3728ec4fa644cd74881db3c72352e4b8318f8834ac6306a5698ce9a5eb314f3f8647067bd6de7c90940645931c310aa55e4268ecbaf64c9d8c9ace54fc9f224746ddd681840c392f274753342ef48ac1973abf5c38d0776bd61c087d7b54b1f93eaed1a7c9f73427e38d5e3ca2cd17fa00c69873921ed8f2b8b9f89509134f723b6980831f5504a65602bd9367a151c570a705910afd9f69116737327c193a8751d9c161b5b2ef4e406055fe79c570f7c3e8334623ef02b9f47eecb78d30db147d4fc90bc91faec2d9181206e41cccde0c21483bfd0c45d8765a13d69e22479c21816dbd590ae51e49f6058449b9d3dbe94075e2e57028f43f70201a1e4875b91697c29deb8c2572a105131c87f7685cad94d1321d4ae5cc6efede11ac80a0e00a63b2ba54fcc5195475c3f1ff572693d00e491a0445c987dedcbe73b69ec13d226b193ec03fa9a27a4a434d148983366c7d8e5bc3cea9fbeffd05b8b0090765159b380ac96429655125921507f97df3e9d41c66b2f5fffd0cad4826577916f941ac7c9ec7ab625ec9390e050c5885dbd2e7131f2794ecad5709e0ac395ad0edee0182822374e701167ad2cfda07ff9e9bddee1c688d483c132e197a9481c9eb0df2cf9669ab107cc936bf2c96268a120a44fb7f178b402ecd9c512f86908f43fea11cc6902c355929b910a523acd16d5931ea41753391a0368e5bbe9e8cd926da120d8440fce2c192b1e5986854de8551320c989533771f1a71fb41ff1c927ffba9e9e25ae533db6a3c804b0b340a0409e110ac76a7b58f912db41e33b115e1c3ae9aa0399edd621a0fd4b7be2176cb49682ee82b2a219baace63b3822b98ba6f48cd34a08143321993c4390b94b138e4adcfd47dd01982e24acb8d464738f44af04ff3353f8683f352306457522e653baa8937950448eef9879dfaa42e9fcca9a968971b60c413f4aa3e0f90b41c7828ad5dbb62aae0cd2d2ef85e248bf12e4d6d75b803aca52bb9616acc37bc8bdab1a66661a5329dc936b1dbc83fd598c57b9ad80ac42c21a6318b3fb8d0d865fffb043217c42f9546c050eb8cce5e3423371a93aff46471d2008c8cd5841f849d1f0d58317353a6d7308f7962d943795bd52a4dd5a8440640273c78ef6ebbeaae9143d5e6ee90cdaa257e132e6d42d02b9567ae69b75bc60f7596a1fdd8179cff323991701062930ce23a29e30023da9d631bf61a6440acc290bdeafbaaea78365f408aea8f864da220e7a560c9ac84bb9c975814c132f97e08b64ccad47ceb08f2941a4438feb76560b1d5e6f3289f50d054e949674eb6c3294cc4a27427650c4a37f53c65c55ca410fa62ee18a829220360a8272f8c0041e2bf33f047928feb0269c438bdf399b1d8f187b2454ea5cd873e352e1d0781570234c6d810c5a16bac9ea9ffafb0c978a022276903a1c653f17d96659cbb30abc1a320c584bdfcc00125270c2d4c90950029f711575dfa828feea3b1dc83c0701dffac1f89536583a0c0995550f862c3ec786c0f8fee0fd94fae0a661313f9e753362336db3ea0296d7fb913ad490bfc9dd155307ab14e67114fcde26d032435cec7d29247deb93bcf7fa48b4ddb5fb7449c0fda083d5a63e03922d5dfb361b7eeb122a094c3b08eacbd43cecc76c29a9bbcd4808bfa6eaeb78d3453e30660d1653569841869e3d8b90f3d047388da51919cf056ce1ce1d455177c95cdb8f76637d5336e82c9e10ddfd33515f7491ef28cbe4c8a477086daeb525d097844879d140965ef0463b3e1780065da2255e68aee903f7b06b0824b151525c56063d4be22ee31b82d2029fef15f38f9008d785dcab9f1454185ec4a3d76ed3aa8d27859f66ae63eddd338ac28f64048e46a5d0731f9b7ebe52218e11e78cb6d8172aea44f2c213ce7f5edfaed81c5de95a86aba484ec2e1950f61e743f11fbd881f2b0c891aa6e94fff4e5d747971313613da54b5483aabe5b12a8e661d455cdf442b86f3cd8b6e95e2ebfba7c62001769d5d9725f1df8ff364ff45f65b16fb2a828638313dbaac9818f990e8590d54b67613430b9f1869b7f2f756e4af19a145105b7b0f7c889b3146533114d001fc2c1b6b285ded35fd0b17857da527e80658f0b717a8c98920f72289896f05a686083fa9e84ee9f0590793b484365159cd18d9290fc7b342b3926bccdc830a519b8abd07e5b885cc4a6046423d5fa976588510cf5b0cfeaa38e7d170feb401bf9b3e4284415b8e2d2b8d73a0bfda6e246d4075c16f3bf8c1d8a1969dc57fc8786b1e4afb4ec6769534debe49ef6873e76289c6442c6d690457af91df631c7b0d4d0a18a43b26803bfe374a81de3c182b4dc50683f8545157b40f4b44db5eff729645421817ff5fdd0b4ca5cc2ba9b23c33256074b0cd5938aacea39e5cb5af7ec444267f1419867e355de6700ae0a63b7a57eaabe21aee216048612ec6c6993a577ca4d7a0071f5680d89baa337a37a5d1af9dc359d9708ddab0bb96323ae8f6a48d2b8b42d47d4a051b55d14116a359899c79011f2db86e08c2fb7c7d836355cd55f33aba9cb80a10c0844011e3ffa01f5472233fbaebe45f044154220094bf7da1a4035c195978e1b97eac6c41010b27dfb5df985ab16d219f415528b0403846b326f0a00f7b73c89933e1a2daa58dd8dee2f91e2d083eb25508ad3b3e916cf7e002140ed65ebe55ed8bec0cea09a5a61f7262aaa61cbf09d16ff6aac48c511fb8220dc5e20c3d4ce6283c53442a5cf408f3e66734208cc4f13a90a9ad6f90c1db802abcff903addba309ad25dd56cf6d37f32f82eb07fce24ac33e48451e7719e323f512a459a172172ff94d41be609aba82bcb7d827dfc73b4875209aa392c6f0d24f95bb900814fbff19c8d51d421270363bc808f29e21e14f6c99a13f8000fbfbc1cae461215fbba52511c9d14aaedb16e3a3725534b5713c554f1e5ebdc2abfaa712cf0d8ff6699cf0949f89b187e58bbac15927a701432f81b61e797136789ae2e824b0a74c553d59b7a1a1d512fec36c863422f0634560064ad2c310895d6d8a1a3f9429f08a7360cd4b4f9f208bf6d210d809796276e7a900ea994d3f8a3c3be28c3384c8d822fd108e8e9a195798149beb3e4eed373edac2bbc957b3f0432bcddc9556b734b19f91d94d21a881fbc882603f7da7f8993a74d5b12670f87aa69885abea718b67a700caf9fac78122a83b282099952664e5e8446a23b4bb3c01b1b4a9dca924fe0210445dd5e8ce3bdf2429463df24de0cb74bfc162847a6177d42feb487c89e1fd76fc59e4feaab91d6fadfa65a872a8128ea56f4914fb55165598db63bd701573f8ca7b78b69fe0983f1aadb99bb0ccbf9e2409d2833f9ab80296f9795c5e5740ebebb71238c6898dbd6e043cd6031c1590edfe763446a96d3806d62ef9a7467f4545d4b958ab916939d985856d06cc9369194329b961c0b767a76624104d3cacb9119d17499d83c1e6f95f4c79de2aae011413facd8962980b5327c7e22b516c841a985646e38126fb50c8bba642076489a8a8cc21cac2e92e6d459d5666b868da0e30121e972324076476490170f513efc5dcf57ce85d81c9fffceefb19ec98278e13abb2f322af44b980f9ef522e98d909507a8eeb7a0bd927d621e0fbfa06a9ca8f2f9978aae462db2cce9240c82942957472c722a0cbc1c84e6c7cd86bf6534d05090396b70cef7c77a29f06e5360d9c5c426988ee7653d022c1b49bc99494bc661c42b97b62c0f5351b5aabcaf1e22a6cb70d348753711f9063f87b292edf6137ac524b2a4cdf8d3a8ca035fd959ea40297645253a33946687bee09f66132f2cbca0f451b82108f4e68683fcef2cb3282d38fe47f6be597a0aba1b637e24fa2ea26f890f5e8cd2e438b0c42319c3f482b21b3b36e9b66907ab9451aa2d5b0d848c958179cd2c138e7a8133d10b952745c6f9c5ad206b13ae83e21236e06a27e60f54c15fdf96c084ee9253af3ae53f1e5c79bf61eef8cd90f382da1f2c072272bf9fc89b4fc6c18a57e197a366fdb5af0ff28131f42690ec69d59fae8c8f43c8f3cf4eacbdcf3e162e492e1bd533abe70bac53f9868c1995921c79d09f67a6b724410a468129f990d150e95663e54551feb97a4304f92ab3db2a43ca841ee3b0f6b62c751f6016b8439d5a08db8d34faa4ba7a7617fe5bbf1f8fcb5a9f55f1a1db83645eb93bde600032bbac895863cc54f09a9fe1e190a08abc6c080badd8245bb9918713ddaead377afbdcbc7cf4d191f6ca2fe2defa45c3c3353c277e1130284cd441da774eb16e7bf11ad0beef302022a18cf0479285df7f64feacacaef8ca50c201cb9001087611c4cd16f1ab6782d7eafae094c93cf301477a678c9ec482baa1d1d1a405494b67b35057b691af44dc3be73e26ab2b6fbe5d2e2117e0c6d0e964b3826a6e057c80e4f0ed78ed1310c24516b95dcefcf5dfd7e79e5e24e6922ade7efdc2242934973f636e300cbe5002f8bb0413a76baee10099b1008e384b8644188932abf79d0f26c66ebd662add68e039212bf4fd801114196e105d958ade15fb451fb5d5d90fee2ecb792bb5c864125bb3e63e0a7b59ff54f5d52ec590708840bbf134e25625690b262e5493a53ef206ce25c6b4dcbf3d8ebab2806f96b6a96eedebb2930fd7230e9601ce4ab66d721e856eedd6704f0b673e0febabd1148469bdf93c890c637c542b5fd4dc21b898c8c0150a1bc2817542e211205dc70be74977c37901fdc734613e5c1f40efbdf19b983abba0ddad01d0ab654b2e34c656090351a515aca39f58b3485da7c0a696952ea618f1f79eb7c55b056eec77e22224bd79d2ad9f597f12dcdd7c7160518ccd77bb5317ac0ea66b6a80a2cc4e28ae3881c59dff4d4684779776bf9e3accc8384f2a1f05cd3cadb345a27669ea1c059e086f421346ae2cf95d19f75941eed79c775eb557e252e08d9662204006d2ba9375bd871f6b64a0633a3b271d8f1ac39d39e6a5100c99effd2a09df4b49d1a41176d4de1a4236c8190bffad251a113cc16d499ac212db31b26497a399ce1acc2b4a63ceee193bfb94bf91dc309c7ba4664b4e99c745786b7", 0x1000, 0x3, &(0x7f0000001080)=@in={0x2, 0x2}, 0xc) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000010c0)=""/205, 0xcd, 0x802, &(0x7f00000011c0)={0x2, 0x0}, 0xc) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001200)="6534640a5e7748511a23bf5623", 0xd) r1 = paccept(0xffffffffffffff9c, &(0x7f0000001240)=@in, &(0x7f0000001280)=0xc, 0x0) connect$inet6(r1, &(0x7f00000012c0)={0x18, 0x3, 0x1, 0x800}, 0xc) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000001300)=@file={0x0, ""/4096}, &(0x7f0000002340)=0x1002) pwritev(r2, &(0x7f00000024c0)=[{&(0x7f0000002380)="ce0fdad9a64a58f784d8087af805aa2bd2f9b86b22d9b2c32c5873c3f32befbc76c47e31e95cb5772009974106dd56e9b77e9ef21b64ebda31080530f8dbeb72d1925f06c0e6163c8737293d3334cdfe5de421f33504eaa8024bcb42a0ad53d6bd25e3b6650362969853803300c71d1231f73d20109fd2b805d7c0de0668001886e4a380880e169de677cb124cc60578020ffecbe8381965697296f87ca1dd26d239f00c44d28f440468978edf019a5db050913f841895d9d9a42a50fd2953af0bd6c692835f5f28b46768fc540014f8d3ee3d80175cd9bca3e52d0a15b88773f3b8110890f4dffe75433fdabac54c62298a", 0xf2}, {&(0x7f0000002480)="80242bebc81bd3dadcb992d2de24b81300a636d3a64bdfe93133e14429da14cf317eded200e371e34aef0bbaf272a4e8778908", 0x33}], 0x2, 0x51) getpeername(r2, &(0x7f0000002500)=@in, &(0x7f0000002540)=0xc) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_ethernet(0x33, &(0x7f0000000000)="48f7f190c685fad5020b2c726eadc83c0867b01c6b28ea05f4bd0544eb883ec3d8897d9aee86bcb2c90ebe68774c206570c903") syz_execute_func(&(0x7f0000000040)="c4227db74b0b458657fb66440f38dcd2c481f95bfe0f49f8660f3a0c9bb4000000fec4a2fda6fcc4a14dd516c40194596d6466410f6c23") syz_extract_tcp_res(&(0x7f0000000080), 0x6, 0x8000) syz_usb_connect(0x1e3d802a, 0xef, &(0x7f00000000c0)="53890ef7069cebf4ab2e3862d4e8f0d7cd39046611d86efa403d25558c0de4ab33f831e6f5f52956032835783bf2d0f5817f8b8dda73c7542d9f0d12a631e25a3ee4dcfb6ae2f968a825dac5812d8c6b8264e0b78c3daa0c76237a223a71f50ba36e784b03b1f38705a237cf14c437fdc2363dc773b1946be9835bd59cf8390038fb9bac191ec255eaf70ea2b563db022460b05e8d6acc51ea2dc25ff06b2add98890a727807072b47f38ee42d6367e7d3548d3f13ca5574426df294626c3ef4b8cf7aea4830b70d93122efd51fce48496a5bd03e305f2ad871969c97ceff6b6c2286c5431b9fdbd8837629298cb4e", &(0x7f00000001c0)="a185224a16ff1a062f6f9766aeb7f58408b028450e80970d9250114b2c871d5d9ec67f7990a305b4be2c41d35d3316a7f4c9b27401f8440e71a579b7f9acc606d20da088c7077bbc3c361e71c577406168bcc1bcb7f02e416e3f908403e23db0c727ea769debda4d0e524f8adf7f42184a20ba1a23f9c58d46914cc7b12c19537d55a40fcd26c68efb09dc0acc2ee7524abec0b8035ad2b1d194331e2ea4e42ebc53d3880e7c0dd6c57902c8727cefb0fd3192d662") r3 = syz_usb_connect(0xa4, 0x6f, &(0x7f0000000280)="b748b21b78ea22216c2cbfdccb03ec54d20f30f4af462b7bfd5d301b9a4fb8f9bbe630dde8d60855029447df51120e0d690ae4a73e5a06064cc06d83622a66c3cf3ccd920df4a9dec547f0c85354b2e803699f52ffc814536ce519c7c16526da56c65b4429cb224ad9c97f637ee6f2", &(0x7f0000000300)="fca1691e90fef7c0693e50161f6bf9d6be11621b96a65d5023d66e18c9dc3bb38cf479306eff4d2cf175b6f85215446b2379fdc73274566c4ca7cec4d66a481912afe23a3f61adb9467e5bf828156436ebe3d29e3073e4254b3a734acd66d14efb0736fcadff4dad73e02531870c30fae0c378c515786c88c1292736cdf0b6a2e79b47a78e33f5e1d0688a6f3ce2d9e15bd3ee2e2afe1ac5c8523a84a208755a7f822f3d211fe3a26a86507d98583d566a0591a7802cb3f9f9dc35b9110de4b2f4d3934bb20b7a") syz_usb_disconnect(r3) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bEndpointAddress; uint8_t bmAttributes; uint16_t wMaxPacketSize; uint8_t bInterval; uint8_t bRefresh; uint8_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint16_t idVendor; uint16_t idProduct; uint16_t bcdDevice; uint8_t iManufacturer; uint8_t iProduct; uint8_t iSerialNumber; uint8_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t wTotalLength; uint8_t bNumInterfaces; uint8_t bConfigurationValue; uint8_t iConfiguration; uint8_t bmAttributes; uint8_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bNumEndpoints; uint8_t bInterfaceClass; uint8_t bInterfaceSubClass; uint8_t bInterfaceProtocol; uint8_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint8_t bNumConfigurations; uint8_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static int tunfd = -1; #define MAX_TUN 64 #define TUN_IFACE "tap%d" #define TUN_DEVICE "/dev/tap%d" #define LOCAL_MAC "aa:aa:aa:aa:aa:aa" #define REMOTE_MAC "aa:aa:aa:aa:aa:bb" #define LOCAL_IPV4 "172.20.%d.170" #define REMOTE_IPV4 "172.20.%d.187" #define LOCAL_IPV6 "fe80::%02hxaa" #define REMOTE_IPV6 "fe80::%02hxbb" static void vsnprintf_check(char* str, size_t size, const char* format, va_list args) { int rv; rv = vsnprintf(str, size, format, args); if (rv < 0) exit(1); if ((size_t)rv >= size) exit(1); } static void snprintf_check(char* str, size_t size, const char* format, ...) { va_list args; va_start(args, format); vsnprintf_check(str, size, format, args); va_end(args); } #define COMMAND_MAX_LEN 128 #define PATH_PREFIX "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin " #define PATH_PREFIX_LEN (sizeof(PATH_PREFIX) - 1) static void execute_command(bool panic, const char* format, ...) { va_list args; char command[PATH_PREFIX_LEN + COMMAND_MAX_LEN]; int rv; va_start(args, format); memcpy(command, PATH_PREFIX, PATH_PREFIX_LEN); vsnprintf_check(command + PATH_PREFIX_LEN, COMMAND_MAX_LEN, format, args); va_end(args); rv = system(command); if (rv) { if (panic) exit(1); } } static void initialize_tun(int tun_id) { if (tun_id < 0 || tun_id >= MAX_TUN) { exit(1); } char tun_device[sizeof(TUN_DEVICE)]; snprintf_check(tun_device, sizeof(tun_device), TUN_DEVICE, tun_id); char tun_iface[sizeof(TUN_IFACE)]; snprintf_check(tun_iface, sizeof(tun_iface), TUN_IFACE, tun_id); execute_command(0, "ifconfig %s destroy", tun_iface); execute_command(0, "ifconfig %s create", tun_iface); tunfd = open(tun_device, O_RDWR | O_NONBLOCK); if (tunfd == -1) { printf("tun: can't open %s: errno=%d\n", tun_device, errno); return; } const int kTunFd = 240; if (dup2(tunfd, kTunFd) < 0) exit(1); close(tunfd); tunfd = kTunFd; char local_mac[sizeof(LOCAL_MAC)]; snprintf_check(local_mac, sizeof(local_mac), LOCAL_MAC); execute_command(1, "ifconfig %s link %s", tun_iface, local_mac); char local_ipv4[sizeof(LOCAL_IPV4)]; snprintf_check(local_ipv4, sizeof(local_ipv4), LOCAL_IPV4, tun_id); execute_command(1, "ifconfig %s inet %s netmask 255.255.255.0", tun_iface, local_ipv4); char remote_mac[sizeof(REMOTE_MAC)]; char remote_ipv4[sizeof(REMOTE_IPV4)]; snprintf_check(remote_mac, sizeof(remote_mac), REMOTE_MAC); snprintf_check(remote_ipv4, sizeof(remote_ipv4), REMOTE_IPV4, tun_id); execute_command(0, "arp -s %s %s", remote_ipv4, remote_mac); char local_ipv6[sizeof(LOCAL_IPV6)]; snprintf_check(local_ipv6, sizeof(local_ipv6), LOCAL_IPV6, tun_id); execute_command(1, "ifconfig %s inet6 %s", tun_iface, local_ipv6); char remote_ipv6[sizeof(REMOTE_IPV6)]; snprintf_check(remote_ipv6, sizeof(remote_ipv6), REMOTE_IPV6, tun_id); execute_command(0, "ndp -s %s%%%s %s", remote_ipv6, tun_iface, remote_mac); } static long syz_emit_ethernet(volatile long a0, volatile long a1) { if (tunfd < 0) return (uintptr_t)-1; size_t length = a0; const char* data = (char*)a1; return write(tunfd, data, length); } static int read_tun(char* data, int size) { if (tunfd < 0) return -1; int rv = read(tunfd, data, size); if (rv < 0) { if (errno == EAGAIN) return -1; exit(1); } return rv; } struct tcp_resources { uint32_t seq; uint32_t ack; }; static long syz_extract_tcp_res(volatile long a0, volatile long a1, volatile long a2) { if (tunfd < 0) return (uintptr_t)-1; char data[1000]; int rv = read_tun(&data[0], sizeof(data)); if (rv == -1) return (uintptr_t)-1; size_t length = rv; struct tcphdr* tcphdr; if (length < sizeof(struct ether_header)) return (uintptr_t)-1; struct ether_header* ethhdr = (struct ether_header*)&data[0]; if (ethhdr->ether_type == htons(ETHERTYPE_IP)) { if (length < sizeof(struct ether_header) + sizeof(struct ip)) return (uintptr_t)-1; struct ip* iphdr = (struct ip*)&data[sizeof(struct ether_header)]; if (iphdr->ip_p != IPPROTO_TCP) return (uintptr_t)-1; if (length < sizeof(struct ether_header) + iphdr->ip_hl * 4 + sizeof(struct tcphdr)) return (uintptr_t)-1; tcphdr = (struct tcphdr*)&data[sizeof(struct ether_header) + iphdr->ip_hl * 4]; } else { if (length < sizeof(struct ether_header) + sizeof(struct ip6_hdr)) return (uintptr_t)-1; struct ip6_hdr* ipv6hdr = (struct ip6_hdr*)&data[sizeof(struct ether_header)]; if (ipv6hdr->ip6_nxt != IPPROTO_TCP) return (uintptr_t)-1; if (length < sizeof(struct ether_header) + sizeof(struct ip6_hdr) + sizeof(struct tcphdr)) return (uintptr_t)-1; tcphdr = (struct tcphdr*)&data[sizeof(struct ether_header) + sizeof(struct ip6_hdr)]; } struct tcp_resources* res = (struct tcp_resources*)a0; res->seq = htonl((ntohl(tcphdr->th_seq) + (uint32_t)a1)); res->ack = htonl((ntohl(tcphdr->th_ack) + (uint32_t)a2)); return 0; } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); initialize_tun(procid); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_accept #define SYS_accept 30 #endif #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getpeername #define SYS_getpeername 31 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_pwritev #define SYS_pwritev 290 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 29 #endif #ifndef SYS_sendto #define SYS_sendto 133 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 105 #endif uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: *(uint32_t*)0x20000040 = 8; res = syscall(SYS_accept, -1, 0x20000000ul, 0x20000040ul); if (res != -1) r[0] = res; break; case 1: memcpy((void*)0x20000080, "\x8d\x36\x0d\x8e\x22\x29\xaa\xb6\x3a\xef\x8e\x41\x58\x2b\x2d\x02\xe9\x3c\x21\x90\xe2\xfe\x50\xc1\xf7\xf3\xb2\x9e\x85\x3f\x60\xfb\x58\x7d\xd7\x8a\x2c\x40\x46\x15\xcd\xf3\x76\x3b\x9a\x53\xdb\xa1\x41\xc6\x6b\x4a\x48\x54\x50\xd6\x6e\x0a\x4a\x28\x1e\x63\xe3\x52\x7c\x88\xcd\xde\x73\x01\x0e\x05\x44\x9a\x77\xae\xe1\xe7\xa3\x5f\xdd\xde\xa4\x97\x11\x9a\x92\xfa\x7f\xb2\xd1\x08\xd6\x47\x5f\x90\xca\x55\xe0\x4b\x82\xe5\x3d\x6a\xc1\x13\x8c\xb9\x13\xb8\xdb\xb0\xb6\xf9\x22\xa1\xa8\x54\x61\x45\x91\x90\x96\x9a\x7d\x79\xde\x91\x64\xf3\xb4\xe2\xe9\xdc\x65\x81\x7c\xd3\x90\x8b\xf1\x31\xac\x85\xe8\x71\x34\x59\xe5\xda\x85\x5d\xd9\x4a\x0f\xee\xa7\x6b\x05\xdd\x56\xd5\xe0\xb5\x22\x23\x32\x21\x05\x06\x20\x2a\xf0\xc3\x71\x85\x96\xbf\x55\x49\x07\x7f\x21\x38\x86\xee\xb0\xb3\xe3\x8b\x83\xe2\x37\x29\x03\x27\xd0\xcc\x6d\x5e\x37\x4a\x36\x5e\xcc\xda\x88\xeb\xf8\xce\x41\x41\x53\x6b\x08\x54\x24\xaa\xdb\x2b\x0c\x5b\xe5\x57\xbe\xa1\x2e\xa5\x3f\x3f\xd5\xb7\xd3\xb4\x8e\xdf\x54\xf8\x60\xc8\xa8\xe1\x94\x1e\x0a\x56\xd8\x51\xb2\xc0\x8b\x8d\x4c\x9b\xad\x81\xad\x64\x9d\x14\x79\xbb\x60\x64\x41\x94\x38\x5d\x68\x04\x41\xc6\x74\xf6\x29\xc5\x0a\xbb\x98\xea\x48\x59\x79\x8a\x0a\x3e\xde\xe9\x5e\x33\xf9\xc2\x88\x0d\xb8\xc9\x27\x9f\x97\x1b\xd5\x97\xb9\x89\x78\xbd\x66\x40\x47\xc1\x44\xaf\x6c\x79\x54\xcc\x4e\xdb\x91\x4a\x61\x80\x47\xa0\x63\xee\x75\x31\x37\x72\x16\xa1\xf4\x24\x04\xfd\xe9\x95\x93\x6f\x5d\x7a\xba\x61\xbb\x23\x07\x00\xac\x33\x90\xd8\xfb\xc6\x27\x72\x09\x4f\xb8\xe5\x43\xf3\x91\x34\x13\x2c\x68\x15\xd1\xeb\xf1\x5b\xd0\x06\x8e\x3b\x7e\xa8\x6b\xb1\x83\x46\x5b\x91\xa4\x31\xf5\x2f\xe3\x8b\xd0\xe6\xe0\x77\x29\x8a\xe8\x26\x56\x85\xe4\x69\x61\xfa\x82\xb6\x4c\x5f\x75\x7e\xaf\x9a\x7d\x0f\x63\xed\x28\x49\xb1\x7a\xf0\xc5\x50\x11\x8c\x7e\x8e\x5a\xdd\xd9\x17\xce\x99\x77\x96\x31\x9e\x6b\xcf\x9b\xc4\x2b\x8b\xa8\x7c\x94\xe5\xa3\x1b\x1c\xec\xb2\xfd\xe9\xc5\x71\xf9\xa8\x7a\x88\x23\x0f\x80\x93\xa7\xae\x80\xa0\xc4\x5c\x3c\xee\xc6\x9f\x1e\x1f\x84\x42\x96\x04\x50\x70\xf3\x72\x8e\xc4\xfa\x64\x4c\xd7\x48\x81\xdb\x3c\x72\x35\x2e\x4b\x83\x18\xf8\x83\x4a\xc6\x30\x6a\x56\x98\xce\x9a\x5e\xb3\x14\xf3\xf8\x64\x70\x67\xbd\x6d\xe7\xc9\x09\x40\x64\x59\x31\xc3\x10\xaa\x55\xe4\x26\x8e\xcb\xaf\x64\xc9\xd8\xc9\xac\xe5\x4f\xc9\xf2\x24\x74\x6d\xdd\x68\x18\x40\xc3\x92\xf2\x74\x75\x33\x42\xef\x48\xac\x19\x73\xab\xf5\xc3\x8d\x07\x76\xbd\x61\xc0\x87\xd7\xb5\x4b\x1f\x93\xea\xed\x1a\x7c\x9f\x73\x42\x7e\x38\xd5\xe3\xca\x2c\xd1\x7f\xa0\x0c\x69\x87\x39\x21\xed\x8f\x2b\x8b\x9f\x89\x50\x91\x34\xf7\x23\xb6\x98\x08\x31\xf5\x50\x4a\x65\x60\x2b\xd9\x36\x7a\x15\x1c\x57\x0a\x70\x59\x10\xaf\xd9\xf6\x91\x16\x73\x73\x27\xc1\x93\xa8\x75\x1d\x9c\x16\x1b\x5b\x2e\xf4\xe4\x06\x05\x5f\xe7\x9c\x57\x0f\x7c\x3e\x83\x34\x62\x3e\xf0\x2b\x9f\x47\xee\xcb\x78\xd3\x0d\xb1\x47\xd4\xfc\x90\xbc\x91\xfa\xec\x2d\x91\x81\x20\x6e\x41\xcc\xcd\xe0\xc2\x14\x83\xbf\xd0\xc4\x5d\x87\x65\xa1\x3d\x69\xe2\x24\x79\xc2\x18\x16\xdb\xd5\x90\xae\x51\xe4\x9f\x60\x58\x44\x9b\x9d\x3d\xbe\x94\x07\x5e\x2e\x57\x02\x8f\x43\xf7\x02\x01\xa1\xe4\x87\x5b\x91\x69\x7c\x29\xde\xb8\xc2\x57\x2a\x10\x51\x31\xc8\x7f\x76\x85\xca\xd9\x4d\x13\x21\xd4\xae\x5c\xc6\xef\xed\xe1\x1a\xc8\x0a\x0e\x00\xa6\x3b\x2b\xa5\x4f\xcc\x51\x95\x47\x5c\x3f\x1f\xf5\x72\x69\x3d\x00\xe4\x91\xa0\x44\x5c\x98\x7d\xed\xcb\xe7\x3b\x69\xec\x13\xd2\x26\xb1\x93\xec\x03\xfa\x9a\x27\xa4\xa4\x34\xd1\x48\x98\x33\x66\xc7\xd8\xe5\xbc\x3c\xea\x9f\xbe\xff\xd0\x5b\x8b\x00\x90\x76\x51\x59\xb3\x80\xac\x96\x42\x96\x55\x12\x59\x21\x50\x7f\x97\xdf\x3e\x9d\x41\xc6\x6b\x2f\x5f\xff\xd0\xca\xd4\x82\x65\x77\x91\x6f\x94\x1a\xc7\xc9\xec\x7a\xb6\x25\xec\x93\x90\xe0\x50\xc5\x88\x5d\xbd\x2e\x71\x31\xf2\x79\x4e\xca\xd5\x70\x9e\x0a\xc3\x95\xad\x0e\xde\xe0\x18\x28\x22\x37\x4e\x70\x11\x67\xad\x2c\xfd\xa0\x7f\xf9\xe9\xbd\xde\xe1\xc6\x88\xd4\x83\xc1\x32\xe1\x97\xa9\x48\x1c\x9e\xb0\xdf\x2c\xf9\x66\x9a\xb1\x07\xcc\x93\x6b\xf2\xc9\x62\x68\xa1\x20\xa4\x4f\xb7\xf1\x78\xb4\x02\xec\xd9\xc5\x12\xf8\x69\x08\xf4\x3f\xea\x11\xcc\x69\x02\xc3\x55\x92\x9b\x91\x0a\x52\x3a\xcd\x16\xd5\x93\x1e\xa4\x17\x53\x39\x1a\x03\x68\xe5\xbb\xe9\xe8\xcd\x92\x6d\xa1\x20\xd8\x44\x0f\xce\x2c\x19\x2b\x1e\x59\x86\x85\x4d\xe8\x55\x13\x20\xc9\x89\x53\x37\x71\xf1\xa7\x1f\xb4\x1f\xf1\xc9\x27\xff\xba\x9e\x9e\x25\xae\x53\x3d\xb6\xa3\xc8\x04\xb0\xb3\x40\xa0\x40\x9e\x11\x0a\xc7\x6a\x7b\x58\xf9\x12\xdb\x41\xe3\x3b\x11\x5e\x1c\x3a\xe9\xaa\x03\x99\xed\xd6\x21\xa0\xfd\x4b\x7b\xe2\x17\x6c\xb4\x96\x82\xee\x82\xb2\xa2\x19\xba\xac\xe6\x3b\x38\x22\xb9\x8b\xa6\xf4\x8c\xd3\x4a\x08\x14\x33\x21\x99\x3c\x43\x90\xb9\x4b\x13\x8e\x4a\xdc\xfd\x47\xdd\x01\x98\x2e\x24\xac\xb8\xd4\x64\x73\x8f\x44\xaf\x04\xff\x33\x53\xf8\x68\x3f\x35\x23\x06\x45\x75\x22\xe6\x53\xba\xa8\x93\x79\x50\x44\x8e\xef\x98\x79\xdf\xaa\x42\xe9\xfc\xca\x9a\x96\x89\x71\xb6\x0c\x41\x3f\x4a\xa3\xe0\xf9\x0b\x41\xc7\x82\x8a\xd5\xdb\xb6\x2a\xae\x0c\xd2\xd2\xef\x85\xe2\x48\xbf\x12\xe4\xd6\xd7\x5b\x80\x3a\xca\x52\xbb\x96\x16\xac\xc3\x7b\xc8\xbd\xab\x1a\x66\x66\x1a\x53\x29\xdc\x93\x6b\x1d\xbc\x83\xfd\x59\x8c\x57\xb9\xad\x80\xac\x42\xc2\x1a\x63\x18\xb3\xfb\x8d\x0d\x86\x5f\xff\xb0\x43\x21\x7c\x42\xf9\x54\x6c\x05\x0e\xb8\xcc\xe5\xe3\x42\x33\x71\xa9\x3a\xff\x46\x47\x1d\x20\x08\xc8\xcd\x58\x41\xf8\x49\xd1\xf0\xd5\x83\x17\x35\x3a\x6d\x73\x08\xf7\x96\x2d\x94\x37\x95\xbd\x52\xa4\xdd\x5a\x84\x40\x64\x02\x73\xc7\x8e\xf6\xeb\xbe\xaa\xe9\x14\x3d\x5e\x6e\xe9\x0c\xda\xa2\x57\xe1\x32\xe6\xd4\x2d\x02\xb9\x56\x7a\xe6\x9b\x75\xbc\x60\xf7\x59\x6a\x1f\xdd\x81\x79\xcf\xf3\x23\x99\x17\x01\x06\x29\x30\xce\x23\xa2\x9e\x30\x02\x3d\xa9\xd6\x31\xbf\x61\xa6\x44\x0a\xcc\x29\x0b\xde\xaf\xba\xae\xa7\x83\x65\xf4\x08\xae\xa8\xf8\x64\xda\x22\x0e\x7a\x56\x0c\x9a\xc8\x4b\xb9\xc9\x75\x81\x4c\x13\x2f\x97\xe0\x8b\x64\xcc\xad\x47\xce\xb0\x8f\x29\x41\xa4\x43\x8f\xeb\x76\x56\x0b\x1d\x5e\x6f\x32\x89\xf5\x0d\x05\x4e\x94\x96\x74\xeb\x6c\x32\x94\xcc\x4a\x27\x42\x76\x50\xc4\xa3\x7f\x53\xc6\x5c\x55\xca\x41\x0f\xa6\x2e\xe1\x8a\x82\x92\x20\x36\x0a\x82\x72\xf8\xc0\x04\x1e\x2b\xf3\x3f\x04\x79\x28\xfe\xb0\x26\x9c\x43\x8b\xdf\x39\x9b\x1d\x8f\x18\x7b\x24\x54\xea\x5c\xd8\x73\xe3\x52\xe1\xd0\x78\x15\x70\x23\x4c\x6d\x81\x0c\x5a\x16\xba\xc9\xea\x9f\xfa\xfb\x0c\x97\x8a\x02\x22\x76\x90\x3a\x1c\x65\x3f\x17\xd9\x66\x59\xcb\xb3\x0a\xbc\x1a\x32\x0c\x58\x4b\xdf\xcc\x00\x12\x52\x70\xc2\xd4\xc9\x09\x50\x02\x9f\x71\x15\x75\xdf\xa8\x28\xfe\xea\x3b\x1d\xc8\x3c\x07\x01\xdf\xfa\xc1\xf8\x95\x36\x58\x3a\x0c\x09\x95\x55\x0f\x86\x2c\x3e\xc7\x86\xc0\xf8\xfe\xe0\xfd\x94\xfa\xe0\xa6\x61\x31\x3f\x9e\x75\x33\x62\x33\x6d\xb3\xea\x02\x96\xd7\xfb\x91\x3a\xd4\x90\xbf\xc9\xdd\x15\x53\x07\xab\x14\xe6\x71\x14\xfc\xde\x26\xd0\x32\x43\x5c\xec\x7d\x29\x24\x7d\xeb\x93\xbc\xf7\xfa\x48\xb4\xdd\xb5\xfb\x74\x49\xc0\xfd\xa0\x83\xd5\xa6\x3e\x03\x92\x2d\x5d\xfb\x36\x1b\x7e\xeb\x12\x2a\x09\x4c\x3b\x08\xea\xcb\xd4\x3c\xec\xc7\x6c\x29\xa9\xbb\xcd\x48\x08\xbf\xa6\xea\xeb\x78\xd3\x45\x3e\x30\x66\x0d\x16\x53\x56\x98\x41\x86\x9e\x3d\x8b\x90\xf3\xd0\x47\x38\x8d\xa5\x19\x19\xcf\x05\x6c\xe1\xce\x1d\x45\x51\x77\xc9\x5c\xdb\x8f\x76\x63\x7d\x53\x36\xe8\x2c\x9e\x10\xdd\xfd\x33\x51\x5f\x74\x91\xef\x28\xcb\xe4\xc8\xa4\x77\x08\x6d\xae\xb5\x25\xd0\x97\x84\x48\x79\xd1\x40\x96\x5e\xf0\x46\x3b\x3e\x17\x80\x06\x5d\xa2\x25\x5e\x68\xae\xe9\x03\xf7\xb0\x6b\x08\x24\xb1\x51\x52\x5c\x56\x06\x3d\x4b\xe2\x2e\xe3\x1b\x82\xd2\x02\x9f\xef\x15\xf3\x8f\x90\x08\xd7\x85\xdc\xab\x9f\x14\x54\x18\x5e\xc4\xa3\xd7\x6e\xd3\xaa\x8d\x27\x85\x9f\x66\xae\x63\xed\xdd\x33\x8a\xc2\x8f\x64\x04\x8e\x46\xa5\xd0\x73\x1f\x9b\x7e\xbe\x52\x21\x8e\x11\xe7\x8c\xb6\xd8\x17\x2a\xea\x44\xf2\xc2\x13\xce\x7f\x5e\xdf\xae\xd8\x1c\x5d\xe9\x5a\x86\xab\xa4\x84\xec\x2e\x19\x50\xf6\x1e\x74\x3f\x11\xfb\xd8\x81\xf2\xb0\xc8\x91\xaa\x6e\x94\xff\xf4\xe5\xd7\x47\x97\x13\x13\x61\x3d\xa5\x4b\x54\x83\xaa\xbe\x5b\x12\xa8\xe6\x61\xd4\x55\xcd\xf4\x42\xb8\x6f\x3c\xd8\xb6\xe9\x5e\x2e\xbf\xba\x7c\x62\x00\x17\x69\xd5\xd9\x72\x5f\x1d\xf8\xff\x36\x4f\xf4\x5f\x65\xb1\x6f\xb2\xa8\x28\x63\x83\x13\xdb\xaa\xc9\x81\x8f\x99\x0e\x85\x90\xd5\x4b\x67\x61\x34\x30\xb9\xf1\x86\x9b\x7f\x2f\x75\x6e\x4a\xf1\x9a\x14\x51\x05\xb7\xb0\xf7\xc8\x89\xb3\x14\x65\x33\x11\x4d\x00\x1f\xc2\xc1\xb6\xb2\x85\xde\xd3\x5f\xd0\xb1\x78\x57\xda\x52\x7e\x80\x65\x8f\x0b\x71\x7a\x8c\x98\x92\x0f\x72\x28\x98\x96\xf0\x5a\x68\x60\x83\xfa\x9e\x84\xee\x9f\x05\x90\x79\x3b\x48\x43\x65\x15\x9c\xd1\x8d\x92\x90\xfc\x7b\x34\x2b\x39\x26\xbc\xcd\xc8\x30\xa5\x19\xb8\xab\xd0\x7e\x5b\x88\x5c\xc4\xa6\x04\x64\x23\xd5\xfa\x97\x65\x88\x51\x0c\xf5\xb0\xcf\xea\xa3\x8e\x7d\x17\x0f\xeb\x40\x1b\xf9\xb3\xe4\x28\x44\x15\xb8\xe2\xd2\xb8\xd7\x3a\x0b\xfd\xa6\xe2\x46\xd4\x07\x5c\x16\xf3\xbf\x8c\x1d\x8a\x19\x69\xdc\x57\xfc\x87\x86\xb1\xe4\xaf\xb4\xec\x67\x69\x53\x4d\xeb\xe4\x9e\xf6\x87\x3e\x76\x28\x9c\x64\x42\xc6\xd6\x90\x45\x7a\xf9\x1d\xf6\x31\xc7\xb0\xd4\xd0\xa1\x8a\x43\xb2\x68\x03\xbf\xe3\x74\xa8\x1d\xe3\xc1\x82\xb4\xdc\x50\x68\x3f\x85\x45\x15\x7b\x40\xf4\xb4\x4d\xb5\xef\xf7\x29\x64\x54\x21\x81\x7f\xf5\xfd\xd0\xb4\xca\x5c\xc2\xba\x9b\x23\xc3\x32\x56\x07\x4b\x0c\xd5\x93\x8a\xac\xea\x39\xe5\xcb\x5a\xf7\xec\x44\x42\x67\xf1\x41\x98\x67\xe3\x55\xde\x67\x00\xae\x0a\x63\xb7\xa5\x7e\xaa\xbe\x21\xae\xe2\x16\x04\x86\x12\xec\x6c\x69\x93\xa5\x77\xca\x4d\x7a\x00\x71\xf5\x68\x0d\x89\xba\xa3\x37\xa3\x7a\x5d\x1a\xf9\xdc\x35\x9d\x97\x08\xdd\xab\x0b\xb9\x63\x23\xae\x8f\x6a\x48\xd2\xb8\xb4\x2d\x47\xd4\xa0\x51\xb5\x5d\x14\x11\x6a\x35\x98\x99\xc7\x90\x11\xf2\xdb\x86\xe0\x8c\x2f\xb7\xc7\xd8\x36\x35\x5c\xd5\x5f\x33\xab\xa9\xcb\x80\xa1\x0c\x08\x44\x01\x1e\x3f\xfa\x01\xf5\x47\x22\x33\xfb\xae\xbe\x45\xf0\x44\x15\x42\x20\x09\x4b\xf7\xda\x1a\x40\x35\xc1\x95\x97\x8e\x1b\x97\xea\xc6\xc4\x10\x10\xb2\x7d\xfb\x5d\xf9\x85\xab\x16\xd2\x19\xf4\x15\x52\x8b\x04\x03\x84\x6b\x32\x6f\x0a\x00\xf7\xb7\x3c\x89\x93\x3e\x1a\x2d\xaa\x58\xdd\x8d\xee\x2f\x91\xe2\xd0\x83\xeb\x25\x50\x8a\xd3\xb3\xe9\x16\xcf\x7e\x00\x21\x40\xed\x65\xeb\xe5\x5e\xd8\xbe\xc0\xce\xa0\x9a\x5a\x61\xf7\x26\x2a\xaa\x61\xcb\xf0\x9d\x16\xff\x6a\xac\x48\xc5\x11\xfb\x82\x20\xdc\x5e\x20\xc3\xd4\xce\x62\x83\xc5\x34\x42\xa5\xcf\x40\x8f\x3e\x66\x73\x42\x08\xcc\x4f\x13\xa9\x0a\x9a\xd6\xf9\x0c\x1d\xb8\x02\xab\xcf\xf9\x03\xad\xdb\xa3\x09\xad\x25\xdd\x56\xcf\x6d\x37\xf3\x2f\x82\xeb\x07\xfc\xe2\x4a\xc3\x3e\x48\x45\x1e\x77\x19\xe3\x23\xf5\x12\xa4\x59\xa1\x72\x17\x2f\xf9\x4d\x41\xbe\x60\x9a\xba\x82\xbc\xb7\xd8\x27\xdf\xc7\x3b\x48\x75\x20\x9a\xa3\x92\xc6\xf0\xd2\x4f\x95\xbb\x90\x08\x14\xfb\xff\x19\xc8\xd5\x1d\x42\x12\x70\x36\x3b\xc8\x08\xf2\x9e\x21\xe1\x4f\x6c\x99\xa1\x3f\x80\x00\xfb\xfb\xc1\xca\xe4\x61\x21\x5f\xbb\xa5\x25\x11\xc9\xd1\x4a\xae\xdb\x16\xe3\xa3\x72\x55\x34\xb5\x71\x3c\x55\x4f\x1e\x5e\xbd\xc2\xab\xfa\xa7\x12\xcf\x0d\x8f\xf6\x69\x9c\xf0\x94\x9f\x89\xb1\x87\xe5\x8b\xba\xc1\x59\x27\xa7\x01\x43\x2f\x81\xb6\x1e\x79\x71\x36\x78\x9a\xe2\xe8\x24\xb0\xa7\x4c\x55\x3d\x59\xb7\xa1\xa1\xd5\x12\xfe\xc3\x6c\x86\x34\x22\xf0\x63\x45\x60\x06\x4a\xd2\xc3\x10\x89\x5d\x6d\x8a\x1a\x3f\x94\x29\xf0\x8a\x73\x60\xcd\x4b\x4f\x9f\x20\x8b\xf6\xd2\x10\xd8\x09\x79\x62\x76\xe7\xa9\x00\xea\x99\x4d\x3f\x8a\x3c\x3b\xe2\x8c\x33\x84\xc8\xd8\x22\xfd\x10\x8e\x8e\x9a\x19\x57\x98\x14\x9b\xeb\x3e\x4e\xed\x37\x3e\xda\xc2\xbb\xc9\x57\xb3\xf0\x43\x2b\xcd\xdc\x95\x56\xb7\x34\xb1\x9f\x91\xd9\x4d\x21\xa8\x81\xfb\xc8\x82\x60\x3f\x7d\xa7\xf8\x99\x3a\x74\xd5\xb1\x26\x70\xf8\x7a\xa6\x98\x85\xab\xea\x71\x8b\x67\xa7\x00\xca\xf9\xfa\xc7\x81\x22\xa8\x3b\x28\x20\x99\x95\x26\x64\xe5\xe8\x44\x6a\x23\xb4\xbb\x3c\x01\xb1\xb4\xa9\xdc\xa9\x24\xfe\x02\x10\x44\x5d\xd5\xe8\xce\x3b\xdf\x24\x29\x46\x3d\xf2\x4d\xe0\xcb\x74\xbf\xc1\x62\x84\x7a\x61\x77\xd4\x2f\xeb\x48\x7c\x89\xe1\xfd\x76\xfc\x59\xe4\xfe\xaa\xb9\x1d\x6f\xad\xfa\x65\xa8\x72\xa8\x12\x8e\xa5\x6f\x49\x14\xfb\x55\x16\x55\x98\xdb\x63\xbd\x70\x15\x73\xf8\xca\x7b\x78\xb6\x9f\xe0\x98\x3f\x1a\xad\xb9\x9b\xb0\xcc\xbf\x9e\x24\x09\xd2\x83\x3f\x9a\xb8\x02\x96\xf9\x79\x5c\x5e\x57\x40\xeb\xeb\xb7\x12\x38\xc6\x89\x8d\xbd\x6e\x04\x3c\xd6\x03\x1c\x15\x90\xed\xfe\x76\x34\x46\xa9\x6d\x38\x06\xd6\x2e\xf9\xa7\x46\x7f\x45\x45\xd4\xb9\x58\xab\x91\x69\x39\xd9\x85\x85\x6d\x06\xcc\x93\x69\x19\x43\x29\xb9\x61\xc0\xb7\x67\xa7\x66\x24\x10\x4d\x3c\xac\xb9\x11\x9d\x17\x49\x9d\x83\xc1\xe6\xf9\x5f\x4c\x79\xde\x2a\xae\x01\x14\x13\xfa\xcd\x89\x62\x98\x0b\x53\x27\xc7\xe2\x2b\x51\x6c\x84\x1a\x98\x56\x46\xe3\x81\x26\xfb\x50\xc8\xbb\xa6\x42\x07\x64\x89\xa8\xa8\xcc\x21\xca\xc2\xe9\x2e\x6d\x45\x9d\x56\x66\xb8\x68\xda\x0e\x30\x12\x1e\x97\x23\x24\x07\x64\x76\x49\x01\x70\xf5\x13\xef\xc5\xdc\xf5\x7c\xe8\x5d\x81\xc9\xff\xfc\xee\xfb\x19\xec\x98\x27\x8e\x13\xab\xb2\xf3\x22\xaf\x44\xb9\x80\xf9\xef\x52\x2e\x98\xd9\x09\x50\x7a\x8e\xeb\x7a\x0b\xd9\x27\xd6\x21\xe0\xfb\xfa\x06\xa9\xca\x8f\x2f\x99\x78\xaa\xe4\x62\xdb\x2c\xce\x92\x40\xc8\x29\x42\x95\x74\x72\xc7\x22\xa0\xcb\xc1\xc8\x4e\x6c\x7c\xd8\x6b\xf6\x53\x4d\x05\x09\x03\x96\xb7\x0c\xef\x7c\x77\xa2\x9f\x06\xe5\x36\x0d\x9c\x5c\x42\x69\x88\xee\x76\x53\xd0\x22\xc1\xb4\x9b\xc9\x94\x94\xbc\x66\x1c\x42\xb9\x7b\x62\xc0\xf5\x35\x1b\x5a\xab\xca\xf1\xe2\x2a\x6c\xb7\x0d\x34\x87\x53\x71\x1f\x90\x63\xf8\x7b\x29\x2e\xdf\x61\x37\xac\x52\x4b\x2a\x4c\xdf\x8d\x3a\x8c\xa0\x35\xfd\x95\x9e\xa4\x02\x97\x64\x52\x53\xa3\x39\x46\x68\x7b\xee\x09\xf6\x61\x32\xf2\xcb\xca\x0f\x45\x1b\x82\x10\x8f\x4e\x68\x68\x3f\xce\xf2\xcb\x32\x82\xd3\x8f\xe4\x7f\x6b\xe5\x97\xa0\xab\xa1\xb6\x37\xe2\x4f\xa2\xea\x26\xf8\x90\xf5\xe8\xcd\x2e\x43\x8b\x0c\x42\x31\x9c\x3f\x48\x2b\x21\xb3\xb3\x6e\x9b\x66\x90\x7a\xb9\x45\x1a\xa2\xd5\xb0\xd8\x48\xc9\x58\x17\x9c\xd2\xc1\x38\xe7\xa8\x13\x3d\x10\xb9\x52\x74\x5c\x6f\x9c\x5a\xd2\x06\xb1\x3a\xe8\x3e\x21\x23\x6e\x06\xa2\x7e\x60\xf5\x4c\x15\xfd\xf9\x6c\x08\x4e\xe9\x25\x3a\xf3\xae\x53\xf1\xe5\xc7\x9b\xf6\x1e\xef\x8c\xd9\x0f\x38\x2d\xa1\xf2\xc0\x72\x27\x2b\xf9\xfc\x89\xb4\xfc\x6c\x18\xa5\x7e\x19\x7a\x36\x6f\xdb\x5a\xf0\xff\x28\x13\x1f\x42\x69\x0e\xc6\x9d\x59\xfa\xe8\xc8\xf4\x3c\x8f\x3c\xf4\xea\xcb\xdc\xf3\xe1\x62\xe4\x92\xe1\xbd\x53\x3a\xbe\x70\xba\xc5\x3f\x98\x68\xc1\x99\x59\x21\xc7\x9d\x09\xf6\x7a\x6b\x72\x44\x10\xa4\x68\x12\x9f\x99\x0d\x15\x0e\x95\x66\x3e\x54\x55\x1f\xeb\x97\xa4\x30\x4f\x92\xab\x3d\xb2\xa4\x3c\xa8\x41\xee\x3b\x0f\x6b\x62\xc7\x51\xf6\x01\x6b\x84\x39\xd5\xa0\x8d\xb8\xd3\x4f\xaa\x4b\xa7\xa7\x61\x7f\xe5\xbb\xf1\xf8\xfc\xb5\xa9\xf5\x5f\x1a\x1d\xb8\x36\x45\xeb\x93\xbd\xe6\x00\x03\x2b\xba\xc8\x95\x86\x3c\xc5\x4f\x09\xa9\xfe\x1e\x19\x0a\x08\xab\xc6\xc0\x80\xba\xdd\x82\x45\xbb\x99\x18\x71\x3d\xda\xea\xd3\x77\xaf\xbd\xcb\xc7\xcf\x4d\x19\x1f\x6c\xa2\xfe\x2d\xef\xa4\x5c\x3c\x33\x53\xc2\x77\xe1\x13\x02\x84\xcd\x44\x1d\xa7\x74\xeb\x16\xe7\xbf\x11\xad\x0b\xee\xf3\x02\x02\x2a\x18\xcf\x04\x79\x28\x5d\xf7\xf6\x4f\xea\xca\xca\xef\x8c\xa5\x0c\x20\x1c\xb9\x00\x10\x87\x61\x1c\x4c\xd1\x6f\x1a\xb6\x78\x2d\x7e\xaf\xae\x09\x4c\x93\xcf\x30\x14\x77\xa6\x78\xc9\xec\x48\x2b\xaa\x1d\x1d\x1a\x40\x54\x94\xb6\x7b\x35\x05\x7b\x69\x1a\xf4\x4d\xc3\xbe\x73\xe2\x6a\xb2\xb6\xfb\xe5\xd2\xe2\x11\x7e\x0c\x6d\x0e\x96\x4b\x38\x26\xa6\xe0\x57\xc8\x0e\x4f\x0e\xd7\x8e\xd1\x31\x0c\x24\x51\x6b\x95\xdc\xef\xcf\x5d\xfd\x7e\x79\xe5\xe2\x4e\x69\x22\xad\xe7\xef\xdc\x22\x42\x93\x49\x73\xf6\x36\xe3\x00\xcb\xe5\x00\x2f\x8b\xb0\x41\x3a\x76\xba\xee\x10\x09\x9b\x10\x08\xe3\x84\xb8\x64\x41\x88\x93\x2a\xbf\x79\xd0\xf2\x6c\x66\xeb\xd6\x62\xad\xd6\x8e\x03\x92\x12\xbf\x4f\xd8\x01\x11\x41\x96\xe1\x05\xd9\x58\xad\xe1\x5f\xb4\x51\xfb\x5d\x5d\x90\xfe\xe2\xec\xb7\x92\xbb\x5c\x86\x41\x25\xbb\x3e\x63\xe0\xa7\xb5\x9f\xf5\x4f\x5d\x52\xec\x59\x07\x08\x84\x0b\xbf\x13\x4e\x25\x62\x56\x90\xb2\x62\xe5\x49\x3a\x53\xef\x20\x6c\xe2\x5c\x6b\x4d\xcb\xf3\xd8\xeb\xab\x28\x06\xf9\x6b\x6a\x96\xee\xde\xbb\x29\x30\xfd\x72\x30\xe9\x60\x1c\xe4\xab\x66\xd7\x21\xe8\x56\xee\xdd\x67\x04\xf0\xb6\x73\xe0\xfe\xba\xbd\x11\x48\x46\x9b\xdf\x93\xc8\x90\xc6\x37\xc5\x42\xb5\xfd\x4d\xc2\x1b\x89\x8c\x8c\x01\x50\xa1\xbc\x28\x17\x54\x2e\x21\x12\x05\xdc\x70\xbe\x74\x97\x7c\x37\x90\x1f\xdc\x73\x46\x13\xe5\xc1\xf4\x0e\xfb\xdf\x19\xb9\x83\xab\xba\x0d\xda\xd0\x1d\x0a\xb6\x54\xb2\xe3\x4c\x65\x60\x90\x35\x1a\x51\x5a\xca\x39\xf5\x8b\x34\x85\xda\x7c\x0a\x69\x69\x52\xea\x61\x8f\x1f\x79\xeb\x7c\x55\xb0\x56\xee\xc7\x7e\x22\x22\x4b\xd7\x9d\x2a\xd9\xf5\x97\xf1\x2d\xcd\xd7\xc7\x16\x05\x18\xcc\xd7\x7b\xb5\x31\x7a\xc0\xea\x66\xb6\xa8\x0a\x2c\xc4\xe2\x8a\xe3\x88\x1c\x59\xdf\xf4\xd4\x68\x47\x79\x77\x6b\xf9\xe3\xac\xcc\x83\x84\xf2\xa1\xf0\x5c\xd3\xca\xdb\x34\x5a\x27\x66\x9e\xa1\xc0\x59\xe0\x86\xf4\x21\x34\x6a\xe2\xcf\x95\xd1\x9f\x75\x94\x1e\xed\x79\xc7\x75\xeb\x55\x7e\x25\x2e\x08\xd9\x66\x22\x04\x00\x6d\x2b\xa9\x37\x5b\xd8\x71\xf6\xb6\x4a\x06\x33\xa3\xb2\x71\xd8\xf1\xac\x39\xd3\x9e\x6a\x51\x00\xc9\x9e\xff\xd2\xa0\x9d\xf4\xb4\x9d\x1a\x41\x17\x6d\x4d\xe1\xa4\x23\x6c\x81\x90\xbf\xfa\xd2\x51\xa1\x13\xcc\x16\xd4\x99\xac\x21\x2d\xb3\x1b\x26\x49\x7a\x39\x9c\xe1\xac\xc2\xb4\xa6\x3c\xee\xe1\x93\xbf\xb9\x4b\xf9\x1d\xc3\x09\xc7\xba\x46\x64\xb4\xe9\x9c\x74\x57\x86\xb7", 4096); *(uint16_t*)0x20001080 = 2; *(uint16_t*)0x20001082 = htobe16(0x4e22); *(uint8_t*)0x20001084 = 0; *(uint8_t*)0x20001085 = 0; *(uint8_t*)0x20001086 = 0; *(uint8_t*)0x20001087 = 0; *(uint8_t*)0x20001088 = 0; *(uint8_t*)0x20001089 = 0; *(uint8_t*)0x2000108a = 0; *(uint8_t*)0x2000108b = 0; syscall(SYS_sendto, r[0], 0x20000080ul, 0x1000ul, 3ul, 0x20001080ul, 0xcul); break; case 2: *(uint16_t*)0x200011c0 = 2; *(uint16_t*)0x200011c2 = htobe16(0x4e20); *(uint8_t*)0x200011c4 = 0; *(uint8_t*)0x200011c5 = 0; *(uint8_t*)0x200011c6 = 0; *(uint8_t*)0x200011c7 = 0; *(uint8_t*)0x200011c8 = 0; *(uint8_t*)0x200011c9 = 0; *(uint8_t*)0x200011ca = 0; *(uint8_t*)0x200011cb = 0; syscall(SYS_recvfrom, 0xffffff9c, 0x200010c0ul, 0xcdul, 0x802ul, 0x200011c0ul, 0xcul); break; case 3: memcpy((void*)0x20001200, "\x65\x34\x64\x0a\x5e\x77\x48\x51\x1a\x23\xbf\x56\x23", 13); syscall(SYS_setsockopt, -1, 0, 1, 0x20001200ul, 0xdul); break; case 4: *(uint32_t*)0x20001280 = 0xc; res = syscall(SYS_paccept, 0xffffff9c, 0x20001240ul, 0x20001280ul, 0ul); if (res != -1) r[1] = res; break; case 5: *(uint16_t*)0x200012c0 = 0x18; *(uint16_t*)0x200012c2 = htobe16(0x4e23); *(uint32_t*)0x200012c4 = 1; *(uint32_t*)0x200012c8 = 0x800; syscall(SYS_connect, r[1], 0x200012c0ul, 0xcul); break; case 6: *(uint32_t*)0x20002340 = 0x1002; res = syscall(SYS_accept, -1, 0x20001300ul, 0x20002340ul); if (res != -1) r[2] = res; break; case 7: *(uint64_t*)0x200024c0 = 0x20002380; memcpy((void*)0x20002380, "\xce\x0f\xda\xd9\xa6\x4a\x58\xf7\x84\xd8\x08\x7a\xf8\x05\xaa\x2b\xd2\xf9\xb8\x6b\x22\xd9\xb2\xc3\x2c\x58\x73\xc3\xf3\x2b\xef\xbc\x76\xc4\x7e\x31\xe9\x5c\xb5\x77\x20\x09\x97\x41\x06\xdd\x56\xe9\xb7\x7e\x9e\xf2\x1b\x64\xeb\xda\x31\x08\x05\x30\xf8\xdb\xeb\x72\xd1\x92\x5f\x06\xc0\xe6\x16\x3c\x87\x37\x29\x3d\x33\x34\xcd\xfe\x5d\xe4\x21\xf3\x35\x04\xea\xa8\x02\x4b\xcb\x42\xa0\xad\x53\xd6\xbd\x25\xe3\xb6\x65\x03\x62\x96\x98\x53\x80\x33\x00\xc7\x1d\x12\x31\xf7\x3d\x20\x10\x9f\xd2\xb8\x05\xd7\xc0\xde\x06\x68\x00\x18\x86\xe4\xa3\x80\x88\x0e\x16\x9d\xe6\x77\xcb\x12\x4c\xc6\x05\x78\x02\x0f\xfe\xcb\xe8\x38\x19\x65\x69\x72\x96\xf8\x7c\xa1\xdd\x26\xd2\x39\xf0\x0c\x44\xd2\x8f\x44\x04\x68\x97\x8e\xdf\x01\x9a\x5d\xb0\x50\x91\x3f\x84\x18\x95\xd9\xd9\xa4\x2a\x50\xfd\x29\x53\xaf\x0b\xd6\xc6\x92\x83\x5f\x5f\x28\xb4\x67\x68\xfc\x54\x00\x14\xf8\xd3\xee\x3d\x80\x17\x5c\xd9\xbc\xa3\xe5\x2d\x0a\x15\xb8\x87\x73\xf3\xb8\x11\x08\x90\xf4\xdf\xfe\x75\x43\x3f\xda\xba\xc5\x4c\x62\x29\x8a", 242); *(uint64_t*)0x200024c8 = 0xf2; *(uint64_t*)0x200024d0 = 0x20002480; memcpy((void*)0x20002480, "\x80\x24\x2b\xeb\xc8\x1b\xd3\xda\xdc\xb9\x92\xd2\xde\x24\xb8\x13\x00\xa6\x36\xd3\xa6\x4b\xdf\xe9\x31\x33\xe1\x44\x29\xda\x14\xcf\x31\x7e\xde\xd2\x00\xe3\x71\xe3\x4a\xef\x0b\xba\xf2\x72\xa4\xe8\x77\x89\x08", 51); *(uint64_t*)0x200024d8 = 0x33; syscall(SYS_pwritev, r[2], 0x200024c0ul, 2ul, 0x51ul); break; case 8: *(uint32_t*)0x20002540 = 0xc; syscall(SYS_getpeername, r[2], 0x20002500ul, 0x20002540ul); break; case 9: syscall(SYS_dup2, -1, -1); break; case 10: memcpy((void*)0x20000000, "\x48\xf7\xf1\x90\xc6\x85\xfa\xd5\x02\x0b\x2c\x72\x6e\xad\xc8\x3c\x08\x67\xb0\x1c\x6b\x28\xea\x05\xf4\xbd\x05\x44\xeb\x88\x3e\xc3\xd8\x89\x7d\x9a\xee\x86\xbc\xb2\xc9\x0e\xbe\x68\x77\x4c\x20\x65\x70\xc9\x03", 51); syz_emit_ethernet(0x33, 0x20000000); break; case 11: memcpy((void*)0x20000040, "\xc4\x22\x7d\xb7\x4b\x0b\x45\x86\x57\xfb\x66\x44\x0f\x38\xdc\xd2\xc4\x81\xf9\x5b\xfe\x0f\x49\xf8\x66\x0f\x3a\x0c\x9b\xb4\x00\x00\x00\xfe\xc4\xa2\xfd\xa6\xfc\xc4\xa1\x4d\xd5\x16\xc4\x01\x94\x59\x6d\x64\x66\x41\x0f\x6c\x23", 55); syz_execute_func(0x20000040); break; case 12: syz_extract_tcp_res(0x20000080, 6, 0x8000); break; case 13: memcpy((void*)0x200000c0, "\x53\x89\x0e\xf7\x06\x9c\xeb\xf4\xab\x2e\x38\x62\xd4\xe8\xf0\xd7\xcd\x39\x04\x66\x11\xd8\x6e\xfa\x40\x3d\x25\x55\x8c\x0d\xe4\xab\x33\xf8\x31\xe6\xf5\xf5\x29\x56\x03\x28\x35\x78\x3b\xf2\xd0\xf5\x81\x7f\x8b\x8d\xda\x73\xc7\x54\x2d\x9f\x0d\x12\xa6\x31\xe2\x5a\x3e\xe4\xdc\xfb\x6a\xe2\xf9\x68\xa8\x25\xda\xc5\x81\x2d\x8c\x6b\x82\x64\xe0\xb7\x8c\x3d\xaa\x0c\x76\x23\x7a\x22\x3a\x71\xf5\x0b\xa3\x6e\x78\x4b\x03\xb1\xf3\x87\x05\xa2\x37\xcf\x14\xc4\x37\xfd\xc2\x36\x3d\xc7\x73\xb1\x94\x6b\xe9\x83\x5b\xd5\x9c\xf8\x39\x00\x38\xfb\x9b\xac\x19\x1e\xc2\x55\xea\xf7\x0e\xa2\xb5\x63\xdb\x02\x24\x60\xb0\x5e\x8d\x6a\xcc\x51\xea\x2d\xc2\x5f\xf0\x6b\x2a\xdd\x98\x89\x0a\x72\x78\x07\x07\x2b\x47\xf3\x8e\xe4\x2d\x63\x67\xe7\xd3\x54\x8d\x3f\x13\xca\x55\x74\x42\x6d\xf2\x94\x62\x6c\x3e\xf4\xb8\xcf\x7a\xea\x48\x30\xb7\x0d\x93\x12\x2e\xfd\x51\xfc\xe4\x84\x96\xa5\xbd\x03\xe3\x05\xf2\xad\x87\x19\x69\xc9\x7c\xef\xf6\xb6\xc2\x28\x6c\x54\x31\xb9\xfd\xbd\x88\x37\x62\x92\x98\xcb\x4e", 239); memcpy((void*)0x200001c0, "\xa1\x85\x22\x4a\x16\xff\x1a\x06\x2f\x6f\x97\x66\xae\xb7\xf5\x84\x08\xb0\x28\x45\x0e\x80\x97\x0d\x92\x50\x11\x4b\x2c\x87\x1d\x5d\x9e\xc6\x7f\x79\x90\xa3\x05\xb4\xbe\x2c\x41\xd3\x5d\x33\x16\xa7\xf4\xc9\xb2\x74\x01\xf8\x44\x0e\x71\xa5\x79\xb7\xf9\xac\xc6\x06\xd2\x0d\xa0\x88\xc7\x07\x7b\xbc\x3c\x36\x1e\x71\xc5\x77\x40\x61\x68\xbc\xc1\xbc\xb7\xf0\x2e\x41\x6e\x3f\x90\x84\x03\xe2\x3d\xb0\xc7\x27\xea\x76\x9d\xeb\xda\x4d\x0e\x52\x4f\x8a\xdf\x7f\x42\x18\x4a\x20\xba\x1a\x23\xf9\xc5\x8d\x46\x91\x4c\xc7\xb1\x2c\x19\x53\x7d\x55\xa4\x0f\xcd\x26\xc6\x8e\xfb\x09\xdc\x0a\xcc\x2e\xe7\x52\x4a\xbe\xc0\xb8\x03\x5a\xd2\xb1\xd1\x94\x33\x1e\x2e\xa4\xe4\x2e\xbc\x53\xd3\x88\x0e\x7c\x0d\xd6\xc5\x79\x02\xc8\x72\x7c\xef\xb0\xfd\x31\x92\xd6\x62", 181); syz_usb_connect(0x1e3d802a, 0xef, 0x200000c0, 0x200001c0); break; case 14: memcpy((void*)0x20000280, "\xb7\x48\xb2\x1b\x78\xea\x22\x21\x6c\x2c\xbf\xdc\xcb\x03\xec\x54\xd2\x0f\x30\xf4\xaf\x46\x2b\x7b\xfd\x5d\x30\x1b\x9a\x4f\xb8\xf9\xbb\xe6\x30\xdd\xe8\xd6\x08\x55\x02\x94\x47\xdf\x51\x12\x0e\x0d\x69\x0a\xe4\xa7\x3e\x5a\x06\x06\x4c\xc0\x6d\x83\x62\x2a\x66\xc3\xcf\x3c\xcd\x92\x0d\xf4\xa9\xde\xc5\x47\xf0\xc8\x53\x54\xb2\xe8\x03\x69\x9f\x52\xff\xc8\x14\x53\x6c\xe5\x19\xc7\xc1\x65\x26\xda\x56\xc6\x5b\x44\x29\xcb\x22\x4a\xd9\xc9\x7f\x63\x7e\xe6\xf2", 111); memcpy((void*)0x20000300, "\xfc\xa1\x69\x1e\x90\xfe\xf7\xc0\x69\x3e\x50\x16\x1f\x6b\xf9\xd6\xbe\x11\x62\x1b\x96\xa6\x5d\x50\x23\xd6\x6e\x18\xc9\xdc\x3b\xb3\x8c\xf4\x79\x30\x6e\xff\x4d\x2c\xf1\x75\xb6\xf8\x52\x15\x44\x6b\x23\x79\xfd\xc7\x32\x74\x56\x6c\x4c\xa7\xce\xc4\xd6\x6a\x48\x19\x12\xaf\xe2\x3a\x3f\x61\xad\xb9\x46\x7e\x5b\xf8\x28\x15\x64\x36\xeb\xe3\xd2\x9e\x30\x73\xe4\x25\x4b\x3a\x73\x4a\xcd\x66\xd1\x4e\xfb\x07\x36\xfc\xad\xff\x4d\xad\x73\xe0\x25\x31\x87\x0c\x30\xfa\xe0\xc3\x78\xc5\x15\x78\x6c\x88\xc1\x29\x27\x36\xcd\xf0\xb6\xa2\xe7\x9b\x47\xa7\x8e\x33\xf5\xe1\xd0\x68\x8a\x6f\x3c\xe2\xd9\xe1\x5b\xd3\xee\x2e\x2a\xfe\x1a\xc5\xc8\x52\x3a\x84\xa2\x08\x75\x5a\x7f\x82\x2f\x3d\x21\x1f\xe3\xa2\x6a\x86\x50\x7d\x98\x58\x3d\x56\x6a\x05\x91\xa7\x80\x2c\xb3\xf9\xf9\xdc\x35\xb9\x11\x0d\xe4\xb2\xf4\xd3\x93\x4b\xb2\x0b\x7a", 199); res = syz_usb_connect(0xa4, 0x6f, 0x20000280, 0x20000300); if (res != -1) r[3] = res; break; case 15: syz_usb_disconnect(r[3]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } : In function 'syz_usb_connect_impl': :648:63: error: unknown type name 'usb_ctrlrequest' :653:55: error: unknown type name 'usb_ctrlrequest' compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor364391919 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/8 (0.74s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:setuid Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000040)=0x8) sendto(r0, &(0x7f0000000080)="8d360d8e2229aab63aef8e41582b2d02e93c2190e2fe50c1f7f3b29e853f60fb587dd78a2c404615cdf3763b9a53dba141c66b4a485450d66e0a4a281e63e3527c88cdde73010e05449a77aee1e7a35fdddea497119a92fa7fb2d108d6475f90ca55e04b82e53d6ac1138cb913b8dbb0b6f922a1a85461459190969a7d79de9164f3b4e2e9dc65817cd3908bf131ac85e8713459e5da855dd94a0feea76b05dd56d5e0b5222332210506202af0c3718596bf5549077f213886eeb0b3e38b83e237290327d0cc6d5e374a365eccda88ebf8ce4141536b085424aadb2b0c5be557bea12ea53f3fd5b7d3b48edf54f860c8a8e1941e0a56d851b2c08b8d4c9bad81ad649d1479bb60644194385d680441c674f629c50abb98ea4859798a0a3edee95e33f9c2880db8c9279f971bd597b98978bd664047c144af6c7954cc4edb914a618047a063ee7531377216a1f42404fde995936f5d7aba61bb230700ac3390d8fbc62772094fb8e543f39134132c6815d1ebf15bd0068e3b7ea86bb183465b91a431f52fe38bd0e6e077298ae8265685e46961fa82b64c5f757eaf9a7d0f63ed2849b17af0c550118c7e8e5addd917ce997796319e6bcf9bc42b8ba87c94e5a31b1cecb2fde9c571f9a87a88230f8093a7ae80a0c45c3ceec69f1e1f844296045070f3728ec4fa644cd74881db3c72352e4b8318f8834ac6306a5698ce9a5eb314f3f8647067bd6de7c90940645931c310aa55e4268ecbaf64c9d8c9ace54fc9f224746ddd681840c392f274753342ef48ac1973abf5c38d0776bd61c087d7b54b1f93eaed1a7c9f73427e38d5e3ca2cd17fa00c69873921ed8f2b8b9f89509134f723b6980831f5504a65602bd9367a151c570a705910afd9f69116737327c193a8751d9c161b5b2ef4e406055fe79c570f7c3e8334623ef02b9f47eecb78d30db147d4fc90bc91faec2d9181206e41cccde0c21483bfd0c45d8765a13d69e22479c21816dbd590ae51e49f6058449b9d3dbe94075e2e57028f43f70201a1e4875b91697c29deb8c2572a105131c87f7685cad94d1321d4ae5cc6efede11ac80a0e00a63b2ba54fcc5195475c3f1ff572693d00e491a0445c987dedcbe73b69ec13d226b193ec03fa9a27a4a434d148983366c7d8e5bc3cea9fbeffd05b8b0090765159b380ac96429655125921507f97df3e9d41c66b2f5fffd0cad4826577916f941ac7c9ec7ab625ec9390e050c5885dbd2e7131f2794ecad5709e0ac395ad0edee0182822374e701167ad2cfda07ff9e9bddee1c688d483c132e197a9481c9eb0df2cf9669ab107cc936bf2c96268a120a44fb7f178b402ecd9c512f86908f43fea11cc6902c355929b910a523acd16d5931ea41753391a0368e5bbe9e8cd926da120d8440fce2c192b1e5986854de8551320c989533771f1a71fb41ff1c927ffba9e9e25ae533db6a3c804b0b340a0409e110ac76a7b58f912db41e33b115e1c3ae9aa0399edd621a0fd4b7be2176cb49682ee82b2a219baace63b3822b98ba6f48cd34a08143321993c4390b94b138e4adcfd47dd01982e24acb8d464738f44af04ff3353f8683f352306457522e653baa8937950448eef9879dfaa42e9fcca9a968971b60c413f4aa3e0f90b41c7828ad5dbb62aae0cd2d2ef85e248bf12e4d6d75b803aca52bb9616acc37bc8bdab1a66661a5329dc936b1dbc83fd598c57b9ad80ac42c21a6318b3fb8d0d865fffb043217c42f9546c050eb8cce5e3423371a93aff46471d2008c8cd5841f849d1f0d58317353a6d7308f7962d943795bd52a4dd5a8440640273c78ef6ebbeaae9143d5e6ee90cdaa257e132e6d42d02b9567ae69b75bc60f7596a1fdd8179cff323991701062930ce23a29e30023da9d631bf61a6440acc290bdeafbaaea78365f408aea8f864da220e7a560c9ac84bb9c975814c132f97e08b64ccad47ceb08f2941a4438feb76560b1d5e6f3289f50d054e949674eb6c3294cc4a27427650c4a37f53c65c55ca410fa62ee18a829220360a8272f8c0041e2bf33f047928feb0269c438bdf399b1d8f187b2454ea5cd873e352e1d0781570234c6d810c5a16bac9ea9ffafb0c978a022276903a1c653f17d96659cbb30abc1a320c584bdfcc00125270c2d4c90950029f711575dfa828feea3b1dc83c0701dffac1f89536583a0c0995550f862c3ec786c0f8fee0fd94fae0a661313f9e753362336db3ea0296d7fb913ad490bfc9dd155307ab14e67114fcde26d032435cec7d29247deb93bcf7fa48b4ddb5fb7449c0fda083d5a63e03922d5dfb361b7eeb122a094c3b08eacbd43cecc76c29a9bbcd4808bfa6eaeb78d3453e30660d1653569841869e3d8b90f3d047388da51919cf056ce1ce1d455177c95cdb8f76637d5336e82c9e10ddfd33515f7491ef28cbe4c8a477086daeb525d097844879d140965ef0463b3e1780065da2255e68aee903f7b06b0824b151525c56063d4be22ee31b82d2029fef15f38f9008d785dcab9f1454185ec4a3d76ed3aa8d27859f66ae63eddd338ac28f64048e46a5d0731f9b7ebe52218e11e78cb6d8172aea44f2c213ce7f5edfaed81c5de95a86aba484ec2e1950f61e743f11fbd881f2b0c891aa6e94fff4e5d747971313613da54b5483aabe5b12a8e661d455cdf442b86f3cd8b6e95e2ebfba7c62001769d5d9725f1df8ff364ff45f65b16fb2a828638313dbaac9818f990e8590d54b67613430b9f1869b7f2f756e4af19a145105b7b0f7c889b3146533114d001fc2c1b6b285ded35fd0b17857da527e80658f0b717a8c98920f72289896f05a686083fa9e84ee9f0590793b484365159cd18d9290fc7b342b3926bccdc830a519b8abd07e5b885cc4a6046423d5fa976588510cf5b0cfeaa38e7d170feb401bf9b3e4284415b8e2d2b8d73a0bfda6e246d4075c16f3bf8c1d8a1969dc57fc8786b1e4afb4ec6769534debe49ef6873e76289c6442c6d690457af91df631c7b0d4d0a18a43b26803bfe374a81de3c182b4dc50683f8545157b40f4b44db5eff729645421817ff5fdd0b4ca5cc2ba9b23c33256074b0cd5938aacea39e5cb5af7ec444267f1419867e355de6700ae0a63b7a57eaabe21aee216048612ec6c6993a577ca4d7a0071f5680d89baa337a37a5d1af9dc359d9708ddab0bb96323ae8f6a48d2b8b42d47d4a051b55d14116a359899c79011f2db86e08c2fb7c7d836355cd55f33aba9cb80a10c0844011e3ffa01f5472233fbaebe45f044154220094bf7da1a4035c195978e1b97eac6c41010b27dfb5df985ab16d219f415528b0403846b326f0a00f7b73c89933e1a2daa58dd8dee2f91e2d083eb25508ad3b3e916cf7e002140ed65ebe55ed8bec0cea09a5a61f7262aaa61cbf09d16ff6aac48c511fb8220dc5e20c3d4ce6283c53442a5cf408f3e66734208cc4f13a90a9ad6f90c1db802abcff903addba309ad25dd56cf6d37f32f82eb07fce24ac33e48451e7719e323f512a459a172172ff94d41be609aba82bcb7d827dfc73b4875209aa392c6f0d24f95bb900814fbff19c8d51d421270363bc808f29e21e14f6c99a13f8000fbfbc1cae461215fbba52511c9d14aaedb16e3a3725534b5713c554f1e5ebdc2abfaa712cf0d8ff6699cf0949f89b187e58bbac15927a701432f81b61e797136789ae2e824b0a74c553d59b7a1a1d512fec36c863422f0634560064ad2c310895d6d8a1a3f9429f08a7360cd4b4f9f208bf6d210d809796276e7a900ea994d3f8a3c3be28c3384c8d822fd108e8e9a195798149beb3e4eed373edac2bbc957b3f0432bcddc9556b734b19f91d94d21a881fbc882603f7da7f8993a74d5b12670f87aa69885abea718b67a700caf9fac78122a83b282099952664e5e8446a23b4bb3c01b1b4a9dca924fe0210445dd5e8ce3bdf2429463df24de0cb74bfc162847a6177d42feb487c89e1fd76fc59e4feaab91d6fadfa65a872a8128ea56f4914fb55165598db63bd701573f8ca7b78b69fe0983f1aadb99bb0ccbf9e2409d2833f9ab80296f9795c5e5740ebebb71238c6898dbd6e043cd6031c1590edfe763446a96d3806d62ef9a7467f4545d4b958ab916939d985856d06cc9369194329b961c0b767a76624104d3cacb9119d17499d83c1e6f95f4c79de2aae011413facd8962980b5327c7e22b516c841a985646e38126fb50c8bba642076489a8a8cc21cac2e92e6d459d5666b868da0e30121e972324076476490170f513efc5dcf57ce85d81c9fffceefb19ec98278e13abb2f322af44b980f9ef522e98d909507a8eeb7a0bd927d621e0fbfa06a9ca8f2f9978aae462db2cce9240c82942957472c722a0cbc1c84e6c7cd86bf6534d05090396b70cef7c77a29f06e5360d9c5c426988ee7653d022c1b49bc99494bc661c42b97b62c0f5351b5aabcaf1e22a6cb70d348753711f9063f87b292edf6137ac524b2a4cdf8d3a8ca035fd959ea40297645253a33946687bee09f66132f2cbca0f451b82108f4e68683fcef2cb3282d38fe47f6be597a0aba1b637e24fa2ea26f890f5e8cd2e438b0c42319c3f482b21b3b36e9b66907ab9451aa2d5b0d848c958179cd2c138e7a8133d10b952745c6f9c5ad206b13ae83e21236e06a27e60f54c15fdf96c084ee9253af3ae53f1e5c79bf61eef8cd90f382da1f2c072272bf9fc89b4fc6c18a57e197a366fdb5af0ff28131f42690ec69d59fae8c8f43c8f3cf4eacbdcf3e162e492e1bd533abe70bac53f9868c1995921c79d09f67a6b724410a468129f990d150e95663e54551feb97a4304f92ab3db2a43ca841ee3b0f6b62c751f6016b8439d5a08db8d34faa4ba7a7617fe5bbf1f8fcb5a9f55f1a1db83645eb93bde600032bbac895863cc54f09a9fe1e190a08abc6c080badd8245bb9918713ddaead377afbdcbc7cf4d191f6ca2fe2defa45c3c3353c277e1130284cd441da774eb16e7bf11ad0beef302022a18cf0479285df7f64feacacaef8ca50c201cb9001087611c4cd16f1ab6782d7eafae094c93cf301477a678c9ec482baa1d1d1a405494b67b35057b691af44dc3be73e26ab2b6fbe5d2e2117e0c6d0e964b3826a6e057c80e4f0ed78ed1310c24516b95dcefcf5dfd7e79e5e24e6922ade7efdc2242934973f636e300cbe5002f8bb0413a76baee10099b1008e384b8644188932abf79d0f26c66ebd662add68e039212bf4fd801114196e105d958ade15fb451fb5d5d90fee2ecb792bb5c864125bb3e63e0a7b59ff54f5d52ec590708840bbf134e25625690b262e5493a53ef206ce25c6b4dcbf3d8ebab2806f96b6a96eedebb2930fd7230e9601ce4ab66d721e856eedd6704f0b673e0febabd1148469bdf93c890c637c542b5fd4dc21b898c8c0150a1bc2817542e211205dc70be74977c37901fdc734613e5c1f40efbdf19b983abba0ddad01d0ab654b2e34c656090351a515aca39f58b3485da7c0a696952ea618f1f79eb7c55b056eec77e22224bd79d2ad9f597f12dcdd7c7160518ccd77bb5317ac0ea66b6a80a2cc4e28ae3881c59dff4d4684779776bf9e3accc8384f2a1f05cd3cadb345a27669ea1c059e086f421346ae2cf95d19f75941eed79c775eb557e252e08d9662204006d2ba9375bd871f6b64a0633a3b271d8f1ac39d39e6a5100c99effd2a09df4b49d1a41176d4de1a4236c8190bffad251a113cc16d499ac212db31b26497a399ce1acc2b4a63ceee193bfb94bf91dc309c7ba4664b4e99c745786b7", 0x1000, 0x3, &(0x7f0000001080)=@in={0x2, 0x2}, 0xc) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000010c0)=""/205, 0xcd, 0x802, &(0x7f00000011c0)={0x2, 0x0}, 0xc) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001200)="6534640a5e7748511a23bf5623", 0xd) r1 = paccept(0xffffffffffffff9c, &(0x7f0000001240)=@in, &(0x7f0000001280)=0xc, 0x0) connect$inet6(r1, &(0x7f00000012c0)={0x18, 0x3, 0x1, 0x800}, 0xc) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000001300)=@file={0x0, ""/4096}, &(0x7f0000002340)=0x1002) pwritev(r2, &(0x7f00000024c0)=[{&(0x7f0000002380)="ce0fdad9a64a58f784d8087af805aa2bd2f9b86b22d9b2c32c5873c3f32befbc76c47e31e95cb5772009974106dd56e9b77e9ef21b64ebda31080530f8dbeb72d1925f06c0e6163c8737293d3334cdfe5de421f33504eaa8024bcb42a0ad53d6bd25e3b6650362969853803300c71d1231f73d20109fd2b805d7c0de0668001886e4a380880e169de677cb124cc60578020ffecbe8381965697296f87ca1dd26d239f00c44d28f440468978edf019a5db050913f841895d9d9a42a50fd2953af0bd6c692835f5f28b46768fc540014f8d3ee3d80175cd9bca3e52d0a15b88773f3b8110890f4dffe75433fdabac54c62298a", 0xf2}, {&(0x7f0000002480)="80242bebc81bd3dadcb992d2de24b81300a636d3a64bdfe93133e14429da14cf317eded200e371e34aef0bbaf272a4e8778908", 0x33}], 0x2, 0x51) getpeername(r2, &(0x7f0000002500)=@in, &(0x7f0000002540)=0xc) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_ethernet(0x33, &(0x7f0000000000)="48f7f190c685fad5020b2c726eadc83c0867b01c6b28ea05f4bd0544eb883ec3d8897d9aee86bcb2c90ebe68774c206570c903") syz_execute_func(&(0x7f0000000040)="c4227db74b0b458657fb66440f38dcd2c481f95bfe0f49f8660f3a0c9bb4000000fec4a2fda6fcc4a14dd516c40194596d6466410f6c23") syz_extract_tcp_res(&(0x7f0000000080), 0x6, 0x8000) syz_usb_connect(0x1e3d802a, 0xef, &(0x7f00000000c0)="53890ef7069cebf4ab2e3862d4e8f0d7cd39046611d86efa403d25558c0de4ab33f831e6f5f52956032835783bf2d0f5817f8b8dda73c7542d9f0d12a631e25a3ee4dcfb6ae2f968a825dac5812d8c6b8264e0b78c3daa0c76237a223a71f50ba36e784b03b1f38705a237cf14c437fdc2363dc773b1946be9835bd59cf8390038fb9bac191ec255eaf70ea2b563db022460b05e8d6acc51ea2dc25ff06b2add98890a727807072b47f38ee42d6367e7d3548d3f13ca5574426df294626c3ef4b8cf7aea4830b70d93122efd51fce48496a5bd03e305f2ad871969c97ceff6b6c2286c5431b9fdbd8837629298cb4e", &(0x7f00000001c0)="a185224a16ff1a062f6f9766aeb7f58408b028450e80970d9250114b2c871d5d9ec67f7990a305b4be2c41d35d3316a7f4c9b27401f8440e71a579b7f9acc606d20da088c7077bbc3c361e71c577406168bcc1bcb7f02e416e3f908403e23db0c727ea769debda4d0e524f8adf7f42184a20ba1a23f9c58d46914cc7b12c19537d55a40fcd26c68efb09dc0acc2ee7524abec0b8035ad2b1d194331e2ea4e42ebc53d3880e7c0dd6c57902c8727cefb0fd3192d662") r3 = syz_usb_connect(0xa4, 0x6f, &(0x7f0000000280)="b748b21b78ea22216c2cbfdccb03ec54d20f30f4af462b7bfd5d301b9a4fb8f9bbe630dde8d60855029447df51120e0d690ae4a73e5a06064cc06d83622a66c3cf3ccd920df4a9dec547f0c85354b2e803699f52ffc814536ce519c7c16526da56c65b4429cb224ad9c97f637ee6f2", &(0x7f0000000300)="fca1691e90fef7c0693e50161f6bf9d6be11621b96a65d5023d66e18c9dc3bb38cf479306eff4d2cf175b6f85215446b2379fdc73274566c4ca7cec4d66a481912afe23a3f61adb9467e5bf828156436ebe3d29e3073e4254b3a734acd66d14efb0736fcadff4dad73e02531870c30fae0c378c515786c88c1292736cdf0b6a2e79b47a78e33f5e1d0688a6f3ce2d9e15bd3ee2e2afe1ac5c8523a84a208755a7f822f3d211fe3a26a86507d98583d566a0591a7802cb3f9f9dc35b9110de4b2f4d3934bb20b7a") syz_usb_disconnect(r3) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bEndpointAddress; uint8_t bmAttributes; uint16_t wMaxPacketSize; uint8_t bInterval; uint8_t bRefresh; uint8_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint16_t idVendor; uint16_t idProduct; uint16_t bcdDevice; uint8_t iManufacturer; uint8_t iProduct; uint8_t iSerialNumber; uint8_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t wTotalLength; uint8_t bNumInterfaces; uint8_t bConfigurationValue; uint8_t iConfiguration; uint8_t bmAttributes; uint8_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bNumEndpoints; uint8_t bInterfaceClass; uint8_t bInterfaceSubClass; uint8_t bInterfaceProtocol; uint8_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint8_t bNumConfigurations; uint8_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, WUNTRACED) != pid) { } return WEXITSTATUS(status); } static int do_sandbox_setuid(void) { int pid = fork(); if (pid != 0) return wait_for_loop(pid); sandbox_common(); char pwbuf[1024]; struct passwd *pw, pwres; if (getpwnam_r("nobody", &pwres, pwbuf, sizeof(pwbuf), &pw) != 0 || !pw) exit(1); if (setgroups(0, NULL)) exit(1); if (setgid(pw->pw_gid)) exit(1); if (setuid(pw->pw_uid)) exit(1); loop(); exit(1); } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_accept #define SYS_accept 30 #endif #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getpeername #define SYS_getpeername 31 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_pwritev #define SYS_pwritev 290 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 29 #endif #ifndef SYS_sendto #define SYS_sendto 133 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 105 #endif uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: *(uint32_t*)0x20000040 = 8; res = syscall(SYS_accept, -1, 0x20000000ul, 0x20000040ul); if (res != -1) r[0] = res; break; case 1: memcpy((void*)0x20000080, "\x8d\x36\x0d\x8e\x22\x29\xaa\xb6\x3a\xef\x8e\x41\x58\x2b\x2d\x02\xe9\x3c\x21\x90\xe2\xfe\x50\xc1\xf7\xf3\xb2\x9e\x85\x3f\x60\xfb\x58\x7d\xd7\x8a\x2c\x40\x46\x15\xcd\xf3\x76\x3b\x9a\x53\xdb\xa1\x41\xc6\x6b\x4a\x48\x54\x50\xd6\x6e\x0a\x4a\x28\x1e\x63\xe3\x52\x7c\x88\xcd\xde\x73\x01\x0e\x05\x44\x9a\x77\xae\xe1\xe7\xa3\x5f\xdd\xde\xa4\x97\x11\x9a\x92\xfa\x7f\xb2\xd1\x08\xd6\x47\x5f\x90\xca\x55\xe0\x4b\x82\xe5\x3d\x6a\xc1\x13\x8c\xb9\x13\xb8\xdb\xb0\xb6\xf9\x22\xa1\xa8\x54\x61\x45\x91\x90\x96\x9a\x7d\x79\xde\x91\x64\xf3\xb4\xe2\xe9\xdc\x65\x81\x7c\xd3\x90\x8b\xf1\x31\xac\x85\xe8\x71\x34\x59\xe5\xda\x85\x5d\xd9\x4a\x0f\xee\xa7\x6b\x05\xdd\x56\xd5\xe0\xb5\x22\x23\x32\x21\x05\x06\x20\x2a\xf0\xc3\x71\x85\x96\xbf\x55\x49\x07\x7f\x21\x38\x86\xee\xb0\xb3\xe3\x8b\x83\xe2\x37\x29\x03\x27\xd0\xcc\x6d\x5e\x37\x4a\x36\x5e\xcc\xda\x88\xeb\xf8\xce\x41\x41\x53\x6b\x08\x54\x24\xaa\xdb\x2b\x0c\x5b\xe5\x57\xbe\xa1\x2e\xa5\x3f\x3f\xd5\xb7\xd3\xb4\x8e\xdf\x54\xf8\x60\xc8\xa8\xe1\x94\x1e\x0a\x56\xd8\x51\xb2\xc0\x8b\x8d\x4c\x9b\xad\x81\xad\x64\x9d\x14\x79\xbb\x60\x64\x41\x94\x38\x5d\x68\x04\x41\xc6\x74\xf6\x29\xc5\x0a\xbb\x98\xea\x48\x59\x79\x8a\x0a\x3e\xde\xe9\x5e\x33\xf9\xc2\x88\x0d\xb8\xc9\x27\x9f\x97\x1b\xd5\x97\xb9\x89\x78\xbd\x66\x40\x47\xc1\x44\xaf\x6c\x79\x54\xcc\x4e\xdb\x91\x4a\x61\x80\x47\xa0\x63\xee\x75\x31\x37\x72\x16\xa1\xf4\x24\x04\xfd\xe9\x95\x93\x6f\x5d\x7a\xba\x61\xbb\x23\x07\x00\xac\x33\x90\xd8\xfb\xc6\x27\x72\x09\x4f\xb8\xe5\x43\xf3\x91\x34\x13\x2c\x68\x15\xd1\xeb\xf1\x5b\xd0\x06\x8e\x3b\x7e\xa8\x6b\xb1\x83\x46\x5b\x91\xa4\x31\xf5\x2f\xe3\x8b\xd0\xe6\xe0\x77\x29\x8a\xe8\x26\x56\x85\xe4\x69\x61\xfa\x82\xb6\x4c\x5f\x75\x7e\xaf\x9a\x7d\x0f\x63\xed\x28\x49\xb1\x7a\xf0\xc5\x50\x11\x8c\x7e\x8e\x5a\xdd\xd9\x17\xce\x99\x77\x96\x31\x9e\x6b\xcf\x9b\xc4\x2b\x8b\xa8\x7c\x94\xe5\xa3\x1b\x1c\xec\xb2\xfd\xe9\xc5\x71\xf9\xa8\x7a\x88\x23\x0f\x80\x93\xa7\xae\x80\xa0\xc4\x5c\x3c\xee\xc6\x9f\x1e\x1f\x84\x42\x96\x04\x50\x70\xf3\x72\x8e\xc4\xfa\x64\x4c\xd7\x48\x81\xdb\x3c\x72\x35\x2e\x4b\x83\x18\xf8\x83\x4a\xc6\x30\x6a\x56\x98\xce\x9a\x5e\xb3\x14\xf3\xf8\x64\x70\x67\xbd\x6d\xe7\xc9\x09\x40\x64\x59\x31\xc3\x10\xaa\x55\xe4\x26\x8e\xcb\xaf\x64\xc9\xd8\xc9\xac\xe5\x4f\xc9\xf2\x24\x74\x6d\xdd\x68\x18\x40\xc3\x92\xf2\x74\x75\x33\x42\xef\x48\xac\x19\x73\xab\xf5\xc3\x8d\x07\x76\xbd\x61\xc0\x87\xd7\xb5\x4b\x1f\x93\xea\xed\x1a\x7c\x9f\x73\x42\x7e\x38\xd5\xe3\xca\x2c\xd1\x7f\xa0\x0c\x69\x87\x39\x21\xed\x8f\x2b\x8b\x9f\x89\x50\x91\x34\xf7\x23\xb6\x98\x08\x31\xf5\x50\x4a\x65\x60\x2b\xd9\x36\x7a\x15\x1c\x57\x0a\x70\x59\x10\xaf\xd9\xf6\x91\x16\x73\x73\x27\xc1\x93\xa8\x75\x1d\x9c\x16\x1b\x5b\x2e\xf4\xe4\x06\x05\x5f\xe7\x9c\x57\x0f\x7c\x3e\x83\x34\x62\x3e\xf0\x2b\x9f\x47\xee\xcb\x78\xd3\x0d\xb1\x47\xd4\xfc\x90\xbc\x91\xfa\xec\x2d\x91\x81\x20\x6e\x41\xcc\xcd\xe0\xc2\x14\x83\xbf\xd0\xc4\x5d\x87\x65\xa1\x3d\x69\xe2\x24\x79\xc2\x18\x16\xdb\xd5\x90\xae\x51\xe4\x9f\x60\x58\x44\x9b\x9d\x3d\xbe\x94\x07\x5e\x2e\x57\x02\x8f\x43\xf7\x02\x01\xa1\xe4\x87\x5b\x91\x69\x7c\x29\xde\xb8\xc2\x57\x2a\x10\x51\x31\xc8\x7f\x76\x85\xca\xd9\x4d\x13\x21\xd4\xae\x5c\xc6\xef\xed\xe1\x1a\xc8\x0a\x0e\x00\xa6\x3b\x2b\xa5\x4f\xcc\x51\x95\x47\x5c\x3f\x1f\xf5\x72\x69\x3d\x00\xe4\x91\xa0\x44\x5c\x98\x7d\xed\xcb\xe7\x3b\x69\xec\x13\xd2\x26\xb1\x93\xec\x03\xfa\x9a\x27\xa4\xa4\x34\xd1\x48\x98\x33\x66\xc7\xd8\xe5\xbc\x3c\xea\x9f\xbe\xff\xd0\x5b\x8b\x00\x90\x76\x51\x59\xb3\x80\xac\x96\x42\x96\x55\x12\x59\x21\x50\x7f\x97\xdf\x3e\x9d\x41\xc6\x6b\x2f\x5f\xff\xd0\xca\xd4\x82\x65\x77\x91\x6f\x94\x1a\xc7\xc9\xec\x7a\xb6\x25\xec\x93\x90\xe0\x50\xc5\x88\x5d\xbd\x2e\x71\x31\xf2\x79\x4e\xca\xd5\x70\x9e\x0a\xc3\x95\xad\x0e\xde\xe0\x18\x28\x22\x37\x4e\x70\x11\x67\xad\x2c\xfd\xa0\x7f\xf9\xe9\xbd\xde\xe1\xc6\x88\xd4\x83\xc1\x32\xe1\x97\xa9\x48\x1c\x9e\xb0\xdf\x2c\xf9\x66\x9a\xb1\x07\xcc\x93\x6b\xf2\xc9\x62\x68\xa1\x20\xa4\x4f\xb7\xf1\x78\xb4\x02\xec\xd9\xc5\x12\xf8\x69\x08\xf4\x3f\xea\x11\xcc\x69\x02\xc3\x55\x92\x9b\x91\x0a\x52\x3a\xcd\x16\xd5\x93\x1e\xa4\x17\x53\x39\x1a\x03\x68\xe5\xbb\xe9\xe8\xcd\x92\x6d\xa1\x20\xd8\x44\x0f\xce\x2c\x19\x2b\x1e\x59\x86\x85\x4d\xe8\x55\x13\x20\xc9\x89\x53\x37\x71\xf1\xa7\x1f\xb4\x1f\xf1\xc9\x27\xff\xba\x9e\x9e\x25\xae\x53\x3d\xb6\xa3\xc8\x04\xb0\xb3\x40\xa0\x40\x9e\x11\x0a\xc7\x6a\x7b\x58\xf9\x12\xdb\x41\xe3\x3b\x11\x5e\x1c\x3a\xe9\xaa\x03\x99\xed\xd6\x21\xa0\xfd\x4b\x7b\xe2\x17\x6c\xb4\x96\x82\xee\x82\xb2\xa2\x19\xba\xac\xe6\x3b\x38\x22\xb9\x8b\xa6\xf4\x8c\xd3\x4a\x08\x14\x33\x21\x99\x3c\x43\x90\xb9\x4b\x13\x8e\x4a\xdc\xfd\x47\xdd\x01\x98\x2e\x24\xac\xb8\xd4\x64\x73\x8f\x44\xaf\x04\xff\x33\x53\xf8\x68\x3f\x35\x23\x06\x45\x75\x22\xe6\x53\xba\xa8\x93\x79\x50\x44\x8e\xef\x98\x79\xdf\xaa\x42\xe9\xfc\xca\x9a\x96\x89\x71\xb6\x0c\x41\x3f\x4a\xa3\xe0\xf9\x0b\x41\xc7\x82\x8a\xd5\xdb\xb6\x2a\xae\x0c\xd2\xd2\xef\x85\xe2\x48\xbf\x12\xe4\xd6\xd7\x5b\x80\x3a\xca\x52\xbb\x96\x16\xac\xc3\x7b\xc8\xbd\xab\x1a\x66\x66\x1a\x53\x29\xdc\x93\x6b\x1d\xbc\x83\xfd\x59\x8c\x57\xb9\xad\x80\xac\x42\xc2\x1a\x63\x18\xb3\xfb\x8d\x0d\x86\x5f\xff\xb0\x43\x21\x7c\x42\xf9\x54\x6c\x05\x0e\xb8\xcc\xe5\xe3\x42\x33\x71\xa9\x3a\xff\x46\x47\x1d\x20\x08\xc8\xcd\x58\x41\xf8\x49\xd1\xf0\xd5\x83\x17\x35\x3a\x6d\x73\x08\xf7\x96\x2d\x94\x37\x95\xbd\x52\xa4\xdd\x5a\x84\x40\x64\x02\x73\xc7\x8e\xf6\xeb\xbe\xaa\xe9\x14\x3d\x5e\x6e\xe9\x0c\xda\xa2\x57\xe1\x32\xe6\xd4\x2d\x02\xb9\x56\x7a\xe6\x9b\x75\xbc\x60\xf7\x59\x6a\x1f\xdd\x81\x79\xcf\xf3\x23\x99\x17\x01\x06\x29\x30\xce\x23\xa2\x9e\x30\x02\x3d\xa9\xd6\x31\xbf\x61\xa6\x44\x0a\xcc\x29\x0b\xde\xaf\xba\xae\xa7\x83\x65\xf4\x08\xae\xa8\xf8\x64\xda\x22\x0e\x7a\x56\x0c\x9a\xc8\x4b\xb9\xc9\x75\x81\x4c\x13\x2f\x97\xe0\x8b\x64\xcc\xad\x47\xce\xb0\x8f\x29\x41\xa4\x43\x8f\xeb\x76\x56\x0b\x1d\x5e\x6f\x32\x89\xf5\x0d\x05\x4e\x94\x96\x74\xeb\x6c\x32\x94\xcc\x4a\x27\x42\x76\x50\xc4\xa3\x7f\x53\xc6\x5c\x55\xca\x41\x0f\xa6\x2e\xe1\x8a\x82\x92\x20\x36\x0a\x82\x72\xf8\xc0\x04\x1e\x2b\xf3\x3f\x04\x79\x28\xfe\xb0\x26\x9c\x43\x8b\xdf\x39\x9b\x1d\x8f\x18\x7b\x24\x54\xea\x5c\xd8\x73\xe3\x52\xe1\xd0\x78\x15\x70\x23\x4c\x6d\x81\x0c\x5a\x16\xba\xc9\xea\x9f\xfa\xfb\x0c\x97\x8a\x02\x22\x76\x90\x3a\x1c\x65\x3f\x17\xd9\x66\x59\xcb\xb3\x0a\xbc\x1a\x32\x0c\x58\x4b\xdf\xcc\x00\x12\x52\x70\xc2\xd4\xc9\x09\x50\x02\x9f\x71\x15\x75\xdf\xa8\x28\xfe\xea\x3b\x1d\xc8\x3c\x07\x01\xdf\xfa\xc1\xf8\x95\x36\x58\x3a\x0c\x09\x95\x55\x0f\x86\x2c\x3e\xc7\x86\xc0\xf8\xfe\xe0\xfd\x94\xfa\xe0\xa6\x61\x31\x3f\x9e\x75\x33\x62\x33\x6d\xb3\xea\x02\x96\xd7\xfb\x91\x3a\xd4\x90\xbf\xc9\xdd\x15\x53\x07\xab\x14\xe6\x71\x14\xfc\xde\x26\xd0\x32\x43\x5c\xec\x7d\x29\x24\x7d\xeb\x93\xbc\xf7\xfa\x48\xb4\xdd\xb5\xfb\x74\x49\xc0\xfd\xa0\x83\xd5\xa6\x3e\x03\x92\x2d\x5d\xfb\x36\x1b\x7e\xeb\x12\x2a\x09\x4c\x3b\x08\xea\xcb\xd4\x3c\xec\xc7\x6c\x29\xa9\xbb\xcd\x48\x08\xbf\xa6\xea\xeb\x78\xd3\x45\x3e\x30\x66\x0d\x16\x53\x56\x98\x41\x86\x9e\x3d\x8b\x90\xf3\xd0\x47\x38\x8d\xa5\x19\x19\xcf\x05\x6c\xe1\xce\x1d\x45\x51\x77\xc9\x5c\xdb\x8f\x76\x63\x7d\x53\x36\xe8\x2c\x9e\x10\xdd\xfd\x33\x51\x5f\x74\x91\xef\x28\xcb\xe4\xc8\xa4\x77\x08\x6d\xae\xb5\x25\xd0\x97\x84\x48\x79\xd1\x40\x96\x5e\xf0\x46\x3b\x3e\x17\x80\x06\x5d\xa2\x25\x5e\x68\xae\xe9\x03\xf7\xb0\x6b\x08\x24\xb1\x51\x52\x5c\x56\x06\x3d\x4b\xe2\x2e\xe3\x1b\x82\xd2\x02\x9f\xef\x15\xf3\x8f\x90\x08\xd7\x85\xdc\xab\x9f\x14\x54\x18\x5e\xc4\xa3\xd7\x6e\xd3\xaa\x8d\x27\x85\x9f\x66\xae\x63\xed\xdd\x33\x8a\xc2\x8f\x64\x04\x8e\x46\xa5\xd0\x73\x1f\x9b\x7e\xbe\x52\x21\x8e\x11\xe7\x8c\xb6\xd8\x17\x2a\xea\x44\xf2\xc2\x13\xce\x7f\x5e\xdf\xae\xd8\x1c\x5d\xe9\x5a\x86\xab\xa4\x84\xec\x2e\x19\x50\xf6\x1e\x74\x3f\x11\xfb\xd8\x81\xf2\xb0\xc8\x91\xaa\x6e\x94\xff\xf4\xe5\xd7\x47\x97\x13\x13\x61\x3d\xa5\x4b\x54\x83\xaa\xbe\x5b\x12\xa8\xe6\x61\xd4\x55\xcd\xf4\x42\xb8\x6f\x3c\xd8\xb6\xe9\x5e\x2e\xbf\xba\x7c\x62\x00\x17\x69\xd5\xd9\x72\x5f\x1d\xf8\xff\x36\x4f\xf4\x5f\x65\xb1\x6f\xb2\xa8\x28\x63\x83\x13\xdb\xaa\xc9\x81\x8f\x99\x0e\x85\x90\xd5\x4b\x67\x61\x34\x30\xb9\xf1\x86\x9b\x7f\x2f\x75\x6e\x4a\xf1\x9a\x14\x51\x05\xb7\xb0\xf7\xc8\x89\xb3\x14\x65\x33\x11\x4d\x00\x1f\xc2\xc1\xb6\xb2\x85\xde\xd3\x5f\xd0\xb1\x78\x57\xda\x52\x7e\x80\x65\x8f\x0b\x71\x7a\x8c\x98\x92\x0f\x72\x28\x98\x96\xf0\x5a\x68\x60\x83\xfa\x9e\x84\xee\x9f\x05\x90\x79\x3b\x48\x43\x65\x15\x9c\xd1\x8d\x92\x90\xfc\x7b\x34\x2b\x39\x26\xbc\xcd\xc8\x30\xa5\x19\xb8\xab\xd0\x7e\x5b\x88\x5c\xc4\xa6\x04\x64\x23\xd5\xfa\x97\x65\x88\x51\x0c\xf5\xb0\xcf\xea\xa3\x8e\x7d\x17\x0f\xeb\x40\x1b\xf9\xb3\xe4\x28\x44\x15\xb8\xe2\xd2\xb8\xd7\x3a\x0b\xfd\xa6\xe2\x46\xd4\x07\x5c\x16\xf3\xbf\x8c\x1d\x8a\x19\x69\xdc\x57\xfc\x87\x86\xb1\xe4\xaf\xb4\xec\x67\x69\x53\x4d\xeb\xe4\x9e\xf6\x87\x3e\x76\x28\x9c\x64\x42\xc6\xd6\x90\x45\x7a\xf9\x1d\xf6\x31\xc7\xb0\xd4\xd0\xa1\x8a\x43\xb2\x68\x03\xbf\xe3\x74\xa8\x1d\xe3\xc1\x82\xb4\xdc\x50\x68\x3f\x85\x45\x15\x7b\x40\xf4\xb4\x4d\xb5\xef\xf7\x29\x64\x54\x21\x81\x7f\xf5\xfd\xd0\xb4\xca\x5c\xc2\xba\x9b\x23\xc3\x32\x56\x07\x4b\x0c\xd5\x93\x8a\xac\xea\x39\xe5\xcb\x5a\xf7\xec\x44\x42\x67\xf1\x41\x98\x67\xe3\x55\xde\x67\x00\xae\x0a\x63\xb7\xa5\x7e\xaa\xbe\x21\xae\xe2\x16\x04\x86\x12\xec\x6c\x69\x93\xa5\x77\xca\x4d\x7a\x00\x71\xf5\x68\x0d\x89\xba\xa3\x37\xa3\x7a\x5d\x1a\xf9\xdc\x35\x9d\x97\x08\xdd\xab\x0b\xb9\x63\x23\xae\x8f\x6a\x48\xd2\xb8\xb4\x2d\x47\xd4\xa0\x51\xb5\x5d\x14\x11\x6a\x35\x98\x99\xc7\x90\x11\xf2\xdb\x86\xe0\x8c\x2f\xb7\xc7\xd8\x36\x35\x5c\xd5\x5f\x33\xab\xa9\xcb\x80\xa1\x0c\x08\x44\x01\x1e\x3f\xfa\x01\xf5\x47\x22\x33\xfb\xae\xbe\x45\xf0\x44\x15\x42\x20\x09\x4b\xf7\xda\x1a\x40\x35\xc1\x95\x97\x8e\x1b\x97\xea\xc6\xc4\x10\x10\xb2\x7d\xfb\x5d\xf9\x85\xab\x16\xd2\x19\xf4\x15\x52\x8b\x04\x03\x84\x6b\x32\x6f\x0a\x00\xf7\xb7\x3c\x89\x93\x3e\x1a\x2d\xaa\x58\xdd\x8d\xee\x2f\x91\xe2\xd0\x83\xeb\x25\x50\x8a\xd3\xb3\xe9\x16\xcf\x7e\x00\x21\x40\xed\x65\xeb\xe5\x5e\xd8\xbe\xc0\xce\xa0\x9a\x5a\x61\xf7\x26\x2a\xaa\x61\xcb\xf0\x9d\x16\xff\x6a\xac\x48\xc5\x11\xfb\x82\x20\xdc\x5e\x20\xc3\xd4\xce\x62\x83\xc5\x34\x42\xa5\xcf\x40\x8f\x3e\x66\x73\x42\x08\xcc\x4f\x13\xa9\x0a\x9a\xd6\xf9\x0c\x1d\xb8\x02\xab\xcf\xf9\x03\xad\xdb\xa3\x09\xad\x25\xdd\x56\xcf\x6d\x37\xf3\x2f\x82\xeb\x07\xfc\xe2\x4a\xc3\x3e\x48\x45\x1e\x77\x19\xe3\x23\xf5\x12\xa4\x59\xa1\x72\x17\x2f\xf9\x4d\x41\xbe\x60\x9a\xba\x82\xbc\xb7\xd8\x27\xdf\xc7\x3b\x48\x75\x20\x9a\xa3\x92\xc6\xf0\xd2\x4f\x95\xbb\x90\x08\x14\xfb\xff\x19\xc8\xd5\x1d\x42\x12\x70\x36\x3b\xc8\x08\xf2\x9e\x21\xe1\x4f\x6c\x99\xa1\x3f\x80\x00\xfb\xfb\xc1\xca\xe4\x61\x21\x5f\xbb\xa5\x25\x11\xc9\xd1\x4a\xae\xdb\x16\xe3\xa3\x72\x55\x34\xb5\x71\x3c\x55\x4f\x1e\x5e\xbd\xc2\xab\xfa\xa7\x12\xcf\x0d\x8f\xf6\x69\x9c\xf0\x94\x9f\x89\xb1\x87\xe5\x8b\xba\xc1\x59\x27\xa7\x01\x43\x2f\x81\xb6\x1e\x79\x71\x36\x78\x9a\xe2\xe8\x24\xb0\xa7\x4c\x55\x3d\x59\xb7\xa1\xa1\xd5\x12\xfe\xc3\x6c\x86\x34\x22\xf0\x63\x45\x60\x06\x4a\xd2\xc3\x10\x89\x5d\x6d\x8a\x1a\x3f\x94\x29\xf0\x8a\x73\x60\xcd\x4b\x4f\x9f\x20\x8b\xf6\xd2\x10\xd8\x09\x79\x62\x76\xe7\xa9\x00\xea\x99\x4d\x3f\x8a\x3c\x3b\xe2\x8c\x33\x84\xc8\xd8\x22\xfd\x10\x8e\x8e\x9a\x19\x57\x98\x14\x9b\xeb\x3e\x4e\xed\x37\x3e\xda\xc2\xbb\xc9\x57\xb3\xf0\x43\x2b\xcd\xdc\x95\x56\xb7\x34\xb1\x9f\x91\xd9\x4d\x21\xa8\x81\xfb\xc8\x82\x60\x3f\x7d\xa7\xf8\x99\x3a\x74\xd5\xb1\x26\x70\xf8\x7a\xa6\x98\x85\xab\xea\x71\x8b\x67\xa7\x00\xca\xf9\xfa\xc7\x81\x22\xa8\x3b\x28\x20\x99\x95\x26\x64\xe5\xe8\x44\x6a\x23\xb4\xbb\x3c\x01\xb1\xb4\xa9\xdc\xa9\x24\xfe\x02\x10\x44\x5d\xd5\xe8\xce\x3b\xdf\x24\x29\x46\x3d\xf2\x4d\xe0\xcb\x74\xbf\xc1\x62\x84\x7a\x61\x77\xd4\x2f\xeb\x48\x7c\x89\xe1\xfd\x76\xfc\x59\xe4\xfe\xaa\xb9\x1d\x6f\xad\xfa\x65\xa8\x72\xa8\x12\x8e\xa5\x6f\x49\x14\xfb\x55\x16\x55\x98\xdb\x63\xbd\x70\x15\x73\xf8\xca\x7b\x78\xb6\x9f\xe0\x98\x3f\x1a\xad\xb9\x9b\xb0\xcc\xbf\x9e\x24\x09\xd2\x83\x3f\x9a\xb8\x02\x96\xf9\x79\x5c\x5e\x57\x40\xeb\xeb\xb7\x12\x38\xc6\x89\x8d\xbd\x6e\x04\x3c\xd6\x03\x1c\x15\x90\xed\xfe\x76\x34\x46\xa9\x6d\x38\x06\xd6\x2e\xf9\xa7\x46\x7f\x45\x45\xd4\xb9\x58\xab\x91\x69\x39\xd9\x85\x85\x6d\x06\xcc\x93\x69\x19\x43\x29\xb9\x61\xc0\xb7\x67\xa7\x66\x24\x10\x4d\x3c\xac\xb9\x11\x9d\x17\x49\x9d\x83\xc1\xe6\xf9\x5f\x4c\x79\xde\x2a\xae\x01\x14\x13\xfa\xcd\x89\x62\x98\x0b\x53\x27\xc7\xe2\x2b\x51\x6c\x84\x1a\x98\x56\x46\xe3\x81\x26\xfb\x50\xc8\xbb\xa6\x42\x07\x64\x89\xa8\xa8\xcc\x21\xca\xc2\xe9\x2e\x6d\x45\x9d\x56\x66\xb8\x68\xda\x0e\x30\x12\x1e\x97\x23\x24\x07\x64\x76\x49\x01\x70\xf5\x13\xef\xc5\xdc\xf5\x7c\xe8\x5d\x81\xc9\xff\xfc\xee\xfb\x19\xec\x98\x27\x8e\x13\xab\xb2\xf3\x22\xaf\x44\xb9\x80\xf9\xef\x52\x2e\x98\xd9\x09\x50\x7a\x8e\xeb\x7a\x0b\xd9\x27\xd6\x21\xe0\xfb\xfa\x06\xa9\xca\x8f\x2f\x99\x78\xaa\xe4\x62\xdb\x2c\xce\x92\x40\xc8\x29\x42\x95\x74\x72\xc7\x22\xa0\xcb\xc1\xc8\x4e\x6c\x7c\xd8\x6b\xf6\x53\x4d\x05\x09\x03\x96\xb7\x0c\xef\x7c\x77\xa2\x9f\x06\xe5\x36\x0d\x9c\x5c\x42\x69\x88\xee\x76\x53\xd0\x22\xc1\xb4\x9b\xc9\x94\x94\xbc\x66\x1c\x42\xb9\x7b\x62\xc0\xf5\x35\x1b\x5a\xab\xca\xf1\xe2\x2a\x6c\xb7\x0d\x34\x87\x53\x71\x1f\x90\x63\xf8\x7b\x29\x2e\xdf\x61\x37\xac\x52\x4b\x2a\x4c\xdf\x8d\x3a\x8c\xa0\x35\xfd\x95\x9e\xa4\x02\x97\x64\x52\x53\xa3\x39\x46\x68\x7b\xee\x09\xf6\x61\x32\xf2\xcb\xca\x0f\x45\x1b\x82\x10\x8f\x4e\x68\x68\x3f\xce\xf2\xcb\x32\x82\xd3\x8f\xe4\x7f\x6b\xe5\x97\xa0\xab\xa1\xb6\x37\xe2\x4f\xa2\xea\x26\xf8\x90\xf5\xe8\xcd\x2e\x43\x8b\x0c\x42\x31\x9c\x3f\x48\x2b\x21\xb3\xb3\x6e\x9b\x66\x90\x7a\xb9\x45\x1a\xa2\xd5\xb0\xd8\x48\xc9\x58\x17\x9c\xd2\xc1\x38\xe7\xa8\x13\x3d\x10\xb9\x52\x74\x5c\x6f\x9c\x5a\xd2\x06\xb1\x3a\xe8\x3e\x21\x23\x6e\x06\xa2\x7e\x60\xf5\x4c\x15\xfd\xf9\x6c\x08\x4e\xe9\x25\x3a\xf3\xae\x53\xf1\xe5\xc7\x9b\xf6\x1e\xef\x8c\xd9\x0f\x38\x2d\xa1\xf2\xc0\x72\x27\x2b\xf9\xfc\x89\xb4\xfc\x6c\x18\xa5\x7e\x19\x7a\x36\x6f\xdb\x5a\xf0\xff\x28\x13\x1f\x42\x69\x0e\xc6\x9d\x59\xfa\xe8\xc8\xf4\x3c\x8f\x3c\xf4\xea\xcb\xdc\xf3\xe1\x62\xe4\x92\xe1\xbd\x53\x3a\xbe\x70\xba\xc5\x3f\x98\x68\xc1\x99\x59\x21\xc7\x9d\x09\xf6\x7a\x6b\x72\x44\x10\xa4\x68\x12\x9f\x99\x0d\x15\x0e\x95\x66\x3e\x54\x55\x1f\xeb\x97\xa4\x30\x4f\x92\xab\x3d\xb2\xa4\x3c\xa8\x41\xee\x3b\x0f\x6b\x62\xc7\x51\xf6\x01\x6b\x84\x39\xd5\xa0\x8d\xb8\xd3\x4f\xaa\x4b\xa7\xa7\x61\x7f\xe5\xbb\xf1\xf8\xfc\xb5\xa9\xf5\x5f\x1a\x1d\xb8\x36\x45\xeb\x93\xbd\xe6\x00\x03\x2b\xba\xc8\x95\x86\x3c\xc5\x4f\x09\xa9\xfe\x1e\x19\x0a\x08\xab\xc6\xc0\x80\xba\xdd\x82\x45\xbb\x99\x18\x71\x3d\xda\xea\xd3\x77\xaf\xbd\xcb\xc7\xcf\x4d\x19\x1f\x6c\xa2\xfe\x2d\xef\xa4\x5c\x3c\x33\x53\xc2\x77\xe1\x13\x02\x84\xcd\x44\x1d\xa7\x74\xeb\x16\xe7\xbf\x11\xad\x0b\xee\xf3\x02\x02\x2a\x18\xcf\x04\x79\x28\x5d\xf7\xf6\x4f\xea\xca\xca\xef\x8c\xa5\x0c\x20\x1c\xb9\x00\x10\x87\x61\x1c\x4c\xd1\x6f\x1a\xb6\x78\x2d\x7e\xaf\xae\x09\x4c\x93\xcf\x30\x14\x77\xa6\x78\xc9\xec\x48\x2b\xaa\x1d\x1d\x1a\x40\x54\x94\xb6\x7b\x35\x05\x7b\x69\x1a\xf4\x4d\xc3\xbe\x73\xe2\x6a\xb2\xb6\xfb\xe5\xd2\xe2\x11\x7e\x0c\x6d\x0e\x96\x4b\x38\x26\xa6\xe0\x57\xc8\x0e\x4f\x0e\xd7\x8e\xd1\x31\x0c\x24\x51\x6b\x95\xdc\xef\xcf\x5d\xfd\x7e\x79\xe5\xe2\x4e\x69\x22\xad\xe7\xef\xdc\x22\x42\x93\x49\x73\xf6\x36\xe3\x00\xcb\xe5\x00\x2f\x8b\xb0\x41\x3a\x76\xba\xee\x10\x09\x9b\x10\x08\xe3\x84\xb8\x64\x41\x88\x93\x2a\xbf\x79\xd0\xf2\x6c\x66\xeb\xd6\x62\xad\xd6\x8e\x03\x92\x12\xbf\x4f\xd8\x01\x11\x41\x96\xe1\x05\xd9\x58\xad\xe1\x5f\xb4\x51\xfb\x5d\x5d\x90\xfe\xe2\xec\xb7\x92\xbb\x5c\x86\x41\x25\xbb\x3e\x63\xe0\xa7\xb5\x9f\xf5\x4f\x5d\x52\xec\x59\x07\x08\x84\x0b\xbf\x13\x4e\x25\x62\x56\x90\xb2\x62\xe5\x49\x3a\x53\xef\x20\x6c\xe2\x5c\x6b\x4d\xcb\xf3\xd8\xeb\xab\x28\x06\xf9\x6b\x6a\x96\xee\xde\xbb\x29\x30\xfd\x72\x30\xe9\x60\x1c\xe4\xab\x66\xd7\x21\xe8\x56\xee\xdd\x67\x04\xf0\xb6\x73\xe0\xfe\xba\xbd\x11\x48\x46\x9b\xdf\x93\xc8\x90\xc6\x37\xc5\x42\xb5\xfd\x4d\xc2\x1b\x89\x8c\x8c\x01\x50\xa1\xbc\x28\x17\x54\x2e\x21\x12\x05\xdc\x70\xbe\x74\x97\x7c\x37\x90\x1f\xdc\x73\x46\x13\xe5\xc1\xf4\x0e\xfb\xdf\x19\xb9\x83\xab\xba\x0d\xda\xd0\x1d\x0a\xb6\x54\xb2\xe3\x4c\x65\x60\x90\x35\x1a\x51\x5a\xca\x39\xf5\x8b\x34\x85\xda\x7c\x0a\x69\x69\x52\xea\x61\x8f\x1f\x79\xeb\x7c\x55\xb0\x56\xee\xc7\x7e\x22\x22\x4b\xd7\x9d\x2a\xd9\xf5\x97\xf1\x2d\xcd\xd7\xc7\x16\x05\x18\xcc\xd7\x7b\xb5\x31\x7a\xc0\xea\x66\xb6\xa8\x0a\x2c\xc4\xe2\x8a\xe3\x88\x1c\x59\xdf\xf4\xd4\x68\x47\x79\x77\x6b\xf9\xe3\xac\xcc\x83\x84\xf2\xa1\xf0\x5c\xd3\xca\xdb\x34\x5a\x27\x66\x9e\xa1\xc0\x59\xe0\x86\xf4\x21\x34\x6a\xe2\xcf\x95\xd1\x9f\x75\x94\x1e\xed\x79\xc7\x75\xeb\x55\x7e\x25\x2e\x08\xd9\x66\x22\x04\x00\x6d\x2b\xa9\x37\x5b\xd8\x71\xf6\xb6\x4a\x06\x33\xa3\xb2\x71\xd8\xf1\xac\x39\xd3\x9e\x6a\x51\x00\xc9\x9e\xff\xd2\xa0\x9d\xf4\xb4\x9d\x1a\x41\x17\x6d\x4d\xe1\xa4\x23\x6c\x81\x90\xbf\xfa\xd2\x51\xa1\x13\xcc\x16\xd4\x99\xac\x21\x2d\xb3\x1b\x26\x49\x7a\x39\x9c\xe1\xac\xc2\xb4\xa6\x3c\xee\xe1\x93\xbf\xb9\x4b\xf9\x1d\xc3\x09\xc7\xba\x46\x64\xb4\xe9\x9c\x74\x57\x86\xb7", 4096); *(uint16_t*)0x20001080 = 2; *(uint16_t*)0x20001082 = htobe16(0x4e22); *(uint8_t*)0x20001084 = 0; *(uint8_t*)0x20001085 = 0; *(uint8_t*)0x20001086 = 0; *(uint8_t*)0x20001087 = 0; *(uint8_t*)0x20001088 = 0; *(uint8_t*)0x20001089 = 0; *(uint8_t*)0x2000108a = 0; *(uint8_t*)0x2000108b = 0; syscall(SYS_sendto, r[0], 0x20000080ul, 0x1000ul, 3ul, 0x20001080ul, 0xcul); break; case 2: *(uint16_t*)0x200011c0 = 2; *(uint16_t*)0x200011c2 = htobe16(0x4e20); *(uint8_t*)0x200011c4 = 0; *(uint8_t*)0x200011c5 = 0; *(uint8_t*)0x200011c6 = 0; *(uint8_t*)0x200011c7 = 0; *(uint8_t*)0x200011c8 = 0; *(uint8_t*)0x200011c9 = 0; *(uint8_t*)0x200011ca = 0; *(uint8_t*)0x200011cb = 0; syscall(SYS_recvfrom, 0xffffff9c, 0x200010c0ul, 0xcdul, 0x802ul, 0x200011c0ul, 0xcul); break; case 3: memcpy((void*)0x20001200, "\x65\x34\x64\x0a\x5e\x77\x48\x51\x1a\x23\xbf\x56\x23", 13); syscall(SYS_setsockopt, -1, 0, 1, 0x20001200ul, 0xdul); break; case 4: *(uint32_t*)0x20001280 = 0xc; res = syscall(SYS_paccept, 0xffffff9c, 0x20001240ul, 0x20001280ul, 0ul); if (res != -1) r[1] = res; break; case 5: *(uint16_t*)0x200012c0 = 0x18; *(uint16_t*)0x200012c2 = htobe16(0x4e23); *(uint32_t*)0x200012c4 = 1; *(uint32_t*)0x200012c8 = 0x800; syscall(SYS_connect, r[1], 0x200012c0ul, 0xcul); break; case 6: *(uint32_t*)0x20002340 = 0x1002; res = syscall(SYS_accept, -1, 0x20001300ul, 0x20002340ul); if (res != -1) r[2] = res; break; case 7: *(uint64_t*)0x200024c0 = 0x20002380; memcpy((void*)0x20002380, "\xce\x0f\xda\xd9\xa6\x4a\x58\xf7\x84\xd8\x08\x7a\xf8\x05\xaa\x2b\xd2\xf9\xb8\x6b\x22\xd9\xb2\xc3\x2c\x58\x73\xc3\xf3\x2b\xef\xbc\x76\xc4\x7e\x31\xe9\x5c\xb5\x77\x20\x09\x97\x41\x06\xdd\x56\xe9\xb7\x7e\x9e\xf2\x1b\x64\xeb\xda\x31\x08\x05\x30\xf8\xdb\xeb\x72\xd1\x92\x5f\x06\xc0\xe6\x16\x3c\x87\x37\x29\x3d\x33\x34\xcd\xfe\x5d\xe4\x21\xf3\x35\x04\xea\xa8\x02\x4b\xcb\x42\xa0\xad\x53\xd6\xbd\x25\xe3\xb6\x65\x03\x62\x96\x98\x53\x80\x33\x00\xc7\x1d\x12\x31\xf7\x3d\x20\x10\x9f\xd2\xb8\x05\xd7\xc0\xde\x06\x68\x00\x18\x86\xe4\xa3\x80\x88\x0e\x16\x9d\xe6\x77\xcb\x12\x4c\xc6\x05\x78\x02\x0f\xfe\xcb\xe8\x38\x19\x65\x69\x72\x96\xf8\x7c\xa1\xdd\x26\xd2\x39\xf0\x0c\x44\xd2\x8f\x44\x04\x68\x97\x8e\xdf\x01\x9a\x5d\xb0\x50\x91\x3f\x84\x18\x95\xd9\xd9\xa4\x2a\x50\xfd\x29\x53\xaf\x0b\xd6\xc6\x92\x83\x5f\x5f\x28\xb4\x67\x68\xfc\x54\x00\x14\xf8\xd3\xee\x3d\x80\x17\x5c\xd9\xbc\xa3\xe5\x2d\x0a\x15\xb8\x87\x73\xf3\xb8\x11\x08\x90\xf4\xdf\xfe\x75\x43\x3f\xda\xba\xc5\x4c\x62\x29\x8a", 242); *(uint64_t*)0x200024c8 = 0xf2; *(uint64_t*)0x200024d0 = 0x20002480; memcpy((void*)0x20002480, "\x80\x24\x2b\xeb\xc8\x1b\xd3\xda\xdc\xb9\x92\xd2\xde\x24\xb8\x13\x00\xa6\x36\xd3\xa6\x4b\xdf\xe9\x31\x33\xe1\x44\x29\xda\x14\xcf\x31\x7e\xde\xd2\x00\xe3\x71\xe3\x4a\xef\x0b\xba\xf2\x72\xa4\xe8\x77\x89\x08", 51); *(uint64_t*)0x200024d8 = 0x33; syscall(SYS_pwritev, r[2], 0x200024c0ul, 2ul, 0x51ul); break; case 8: *(uint32_t*)0x20002540 = 0xc; syscall(SYS_getpeername, r[2], 0x20002500ul, 0x20002540ul); break; case 9: syscall(SYS_dup2, -1, -1); break; case 10: memcpy((void*)0x20000000, "\x48\xf7\xf1\x90\xc6\x85\xfa\xd5\x02\x0b\x2c\x72\x6e\xad\xc8\x3c\x08\x67\xb0\x1c\x6b\x28\xea\x05\xf4\xbd\x05\x44\xeb\x88\x3e\xc3\xd8\x89\x7d\x9a\xee\x86\xbc\xb2\xc9\x0e\xbe\x68\x77\x4c\x20\x65\x70\xc9\x03", 51); break; case 11: memcpy((void*)0x20000040, "\xc4\x22\x7d\xb7\x4b\x0b\x45\x86\x57\xfb\x66\x44\x0f\x38\xdc\xd2\xc4\x81\xf9\x5b\xfe\x0f\x49\xf8\x66\x0f\x3a\x0c\x9b\xb4\x00\x00\x00\xfe\xc4\xa2\xfd\xa6\xfc\xc4\xa1\x4d\xd5\x16\xc4\x01\x94\x59\x6d\x64\x66\x41\x0f\x6c\x23", 55); syz_execute_func(0x20000040); break; case 12: break; case 13: memcpy((void*)0x200000c0, "\x53\x89\x0e\xf7\x06\x9c\xeb\xf4\xab\x2e\x38\x62\xd4\xe8\xf0\xd7\xcd\x39\x04\x66\x11\xd8\x6e\xfa\x40\x3d\x25\x55\x8c\x0d\xe4\xab\x33\xf8\x31\xe6\xf5\xf5\x29\x56\x03\x28\x35\x78\x3b\xf2\xd0\xf5\x81\x7f\x8b\x8d\xda\x73\xc7\x54\x2d\x9f\x0d\x12\xa6\x31\xe2\x5a\x3e\xe4\xdc\xfb\x6a\xe2\xf9\x68\xa8\x25\xda\xc5\x81\x2d\x8c\x6b\x82\x64\xe0\xb7\x8c\x3d\xaa\x0c\x76\x23\x7a\x22\x3a\x71\xf5\x0b\xa3\x6e\x78\x4b\x03\xb1\xf3\x87\x05\xa2\x37\xcf\x14\xc4\x37\xfd\xc2\x36\x3d\xc7\x73\xb1\x94\x6b\xe9\x83\x5b\xd5\x9c\xf8\x39\x00\x38\xfb\x9b\xac\x19\x1e\xc2\x55\xea\xf7\x0e\xa2\xb5\x63\xdb\x02\x24\x60\xb0\x5e\x8d\x6a\xcc\x51\xea\x2d\xc2\x5f\xf0\x6b\x2a\xdd\x98\x89\x0a\x72\x78\x07\x07\x2b\x47\xf3\x8e\xe4\x2d\x63\x67\xe7\xd3\x54\x8d\x3f\x13\xca\x55\x74\x42\x6d\xf2\x94\x62\x6c\x3e\xf4\xb8\xcf\x7a\xea\x48\x30\xb7\x0d\x93\x12\x2e\xfd\x51\xfc\xe4\x84\x96\xa5\xbd\x03\xe3\x05\xf2\xad\x87\x19\x69\xc9\x7c\xef\xf6\xb6\xc2\x28\x6c\x54\x31\xb9\xfd\xbd\x88\x37\x62\x92\x98\xcb\x4e", 239); memcpy((void*)0x200001c0, "\xa1\x85\x22\x4a\x16\xff\x1a\x06\x2f\x6f\x97\x66\xae\xb7\xf5\x84\x08\xb0\x28\x45\x0e\x80\x97\x0d\x92\x50\x11\x4b\x2c\x87\x1d\x5d\x9e\xc6\x7f\x79\x90\xa3\x05\xb4\xbe\x2c\x41\xd3\x5d\x33\x16\xa7\xf4\xc9\xb2\x74\x01\xf8\x44\x0e\x71\xa5\x79\xb7\xf9\xac\xc6\x06\xd2\x0d\xa0\x88\xc7\x07\x7b\xbc\x3c\x36\x1e\x71\xc5\x77\x40\x61\x68\xbc\xc1\xbc\xb7\xf0\x2e\x41\x6e\x3f\x90\x84\x03\xe2\x3d\xb0\xc7\x27\xea\x76\x9d\xeb\xda\x4d\x0e\x52\x4f\x8a\xdf\x7f\x42\x18\x4a\x20\xba\x1a\x23\xf9\xc5\x8d\x46\x91\x4c\xc7\xb1\x2c\x19\x53\x7d\x55\xa4\x0f\xcd\x26\xc6\x8e\xfb\x09\xdc\x0a\xcc\x2e\xe7\x52\x4a\xbe\xc0\xb8\x03\x5a\xd2\xb1\xd1\x94\x33\x1e\x2e\xa4\xe4\x2e\xbc\x53\xd3\x88\x0e\x7c\x0d\xd6\xc5\x79\x02\xc8\x72\x7c\xef\xb0\xfd\x31\x92\xd6\x62", 181); syz_usb_connect(0x1e3d802a, 0xef, 0x200000c0, 0x200001c0); break; case 14: memcpy((void*)0x20000280, "\xb7\x48\xb2\x1b\x78\xea\x22\x21\x6c\x2c\xbf\xdc\xcb\x03\xec\x54\xd2\x0f\x30\xf4\xaf\x46\x2b\x7b\xfd\x5d\x30\x1b\x9a\x4f\xb8\xf9\xbb\xe6\x30\xdd\xe8\xd6\x08\x55\x02\x94\x47\xdf\x51\x12\x0e\x0d\x69\x0a\xe4\xa7\x3e\x5a\x06\x06\x4c\xc0\x6d\x83\x62\x2a\x66\xc3\xcf\x3c\xcd\x92\x0d\xf4\xa9\xde\xc5\x47\xf0\xc8\x53\x54\xb2\xe8\x03\x69\x9f\x52\xff\xc8\x14\x53\x6c\xe5\x19\xc7\xc1\x65\x26\xda\x56\xc6\x5b\x44\x29\xcb\x22\x4a\xd9\xc9\x7f\x63\x7e\xe6\xf2", 111); memcpy((void*)0x20000300, "\xfc\xa1\x69\x1e\x90\xfe\xf7\xc0\x69\x3e\x50\x16\x1f\x6b\xf9\xd6\xbe\x11\x62\x1b\x96\xa6\x5d\x50\x23\xd6\x6e\x18\xc9\xdc\x3b\xb3\x8c\xf4\x79\x30\x6e\xff\x4d\x2c\xf1\x75\xb6\xf8\x52\x15\x44\x6b\x23\x79\xfd\xc7\x32\x74\x56\x6c\x4c\xa7\xce\xc4\xd6\x6a\x48\x19\x12\xaf\xe2\x3a\x3f\x61\xad\xb9\x46\x7e\x5b\xf8\x28\x15\x64\x36\xeb\xe3\xd2\x9e\x30\x73\xe4\x25\x4b\x3a\x73\x4a\xcd\x66\xd1\x4e\xfb\x07\x36\xfc\xad\xff\x4d\xad\x73\xe0\x25\x31\x87\x0c\x30\xfa\xe0\xc3\x78\xc5\x15\x78\x6c\x88\xc1\x29\x27\x36\xcd\xf0\xb6\xa2\xe7\x9b\x47\xa7\x8e\x33\xf5\xe1\xd0\x68\x8a\x6f\x3c\xe2\xd9\xe1\x5b\xd3\xee\x2e\x2a\xfe\x1a\xc5\xc8\x52\x3a\x84\xa2\x08\x75\x5a\x7f\x82\x2f\x3d\x21\x1f\xe3\xa2\x6a\x86\x50\x7d\x98\x58\x3d\x56\x6a\x05\x91\xa7\x80\x2c\xb3\xf9\xf9\xdc\x35\xb9\x11\x0d\xe4\xb2\xf4\xd3\x93\x4b\xb2\x0b\x7a", 199); res = syz_usb_connect(0xa4, 0x6f, 0x20000280, 0x20000300); if (res != -1) r[3] = res; break; case 15: syz_usb_disconnect(r[3]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_setuid(); return 0; } : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor506859513 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/7 (0.48s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox: Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000040)=0x8) sendto(r0, &(0x7f0000000080)="8d360d8e2229aab63aef8e41582b2d02e93c2190e2fe50c1f7f3b29e853f60fb587dd78a2c404615cdf3763b9a53dba141c66b4a485450d66e0a4a281e63e3527c88cdde73010e05449a77aee1e7a35fdddea497119a92fa7fb2d108d6475f90ca55e04b82e53d6ac1138cb913b8dbb0b6f922a1a85461459190969a7d79de9164f3b4e2e9dc65817cd3908bf131ac85e8713459e5da855dd94a0feea76b05dd56d5e0b5222332210506202af0c3718596bf5549077f213886eeb0b3e38b83e237290327d0cc6d5e374a365eccda88ebf8ce4141536b085424aadb2b0c5be557bea12ea53f3fd5b7d3b48edf54f860c8a8e1941e0a56d851b2c08b8d4c9bad81ad649d1479bb60644194385d680441c674f629c50abb98ea4859798a0a3edee95e33f9c2880db8c9279f971bd597b98978bd664047c144af6c7954cc4edb914a618047a063ee7531377216a1f42404fde995936f5d7aba61bb230700ac3390d8fbc62772094fb8e543f39134132c6815d1ebf15bd0068e3b7ea86bb183465b91a431f52fe38bd0e6e077298ae8265685e46961fa82b64c5f757eaf9a7d0f63ed2849b17af0c550118c7e8e5addd917ce997796319e6bcf9bc42b8ba87c94e5a31b1cecb2fde9c571f9a87a88230f8093a7ae80a0c45c3ceec69f1e1f844296045070f3728ec4fa644cd74881db3c72352e4b8318f8834ac6306a5698ce9a5eb314f3f8647067bd6de7c90940645931c310aa55e4268ecbaf64c9d8c9ace54fc9f224746ddd681840c392f274753342ef48ac1973abf5c38d0776bd61c087d7b54b1f93eaed1a7c9f73427e38d5e3ca2cd17fa00c69873921ed8f2b8b9f89509134f723b6980831f5504a65602bd9367a151c570a705910afd9f69116737327c193a8751d9c161b5b2ef4e406055fe79c570f7c3e8334623ef02b9f47eecb78d30db147d4fc90bc91faec2d9181206e41cccde0c21483bfd0c45d8765a13d69e22479c21816dbd590ae51e49f6058449b9d3dbe94075e2e57028f43f70201a1e4875b91697c29deb8c2572a105131c87f7685cad94d1321d4ae5cc6efede11ac80a0e00a63b2ba54fcc5195475c3f1ff572693d00e491a0445c987dedcbe73b69ec13d226b193ec03fa9a27a4a434d148983366c7d8e5bc3cea9fbeffd05b8b0090765159b380ac96429655125921507f97df3e9d41c66b2f5fffd0cad4826577916f941ac7c9ec7ab625ec9390e050c5885dbd2e7131f2794ecad5709e0ac395ad0edee0182822374e701167ad2cfda07ff9e9bddee1c688d483c132e197a9481c9eb0df2cf9669ab107cc936bf2c96268a120a44fb7f178b402ecd9c512f86908f43fea11cc6902c355929b910a523acd16d5931ea41753391a0368e5bbe9e8cd926da120d8440fce2c192b1e5986854de8551320c989533771f1a71fb41ff1c927ffba9e9e25ae533db6a3c804b0b340a0409e110ac76a7b58f912db41e33b115e1c3ae9aa0399edd621a0fd4b7be2176cb49682ee82b2a219baace63b3822b98ba6f48cd34a08143321993c4390b94b138e4adcfd47dd01982e24acb8d464738f44af04ff3353f8683f352306457522e653baa8937950448eef9879dfaa42e9fcca9a968971b60c413f4aa3e0f90b41c7828ad5dbb62aae0cd2d2ef85e248bf12e4d6d75b803aca52bb9616acc37bc8bdab1a66661a5329dc936b1dbc83fd598c57b9ad80ac42c21a6318b3fb8d0d865fffb043217c42f9546c050eb8cce5e3423371a93aff46471d2008c8cd5841f849d1f0d58317353a6d7308f7962d943795bd52a4dd5a8440640273c78ef6ebbeaae9143d5e6ee90cdaa257e132e6d42d02b9567ae69b75bc60f7596a1fdd8179cff323991701062930ce23a29e30023da9d631bf61a6440acc290bdeafbaaea78365f408aea8f864da220e7a560c9ac84bb9c975814c132f97e08b64ccad47ceb08f2941a4438feb76560b1d5e6f3289f50d054e949674eb6c3294cc4a27427650c4a37f53c65c55ca410fa62ee18a829220360a8272f8c0041e2bf33f047928feb0269c438bdf399b1d8f187b2454ea5cd873e352e1d0781570234c6d810c5a16bac9ea9ffafb0c978a022276903a1c653f17d96659cbb30abc1a320c584bdfcc00125270c2d4c90950029f711575dfa828feea3b1dc83c0701dffac1f89536583a0c0995550f862c3ec786c0f8fee0fd94fae0a661313f9e753362336db3ea0296d7fb913ad490bfc9dd155307ab14e67114fcde26d032435cec7d29247deb93bcf7fa48b4ddb5fb7449c0fda083d5a63e03922d5dfb361b7eeb122a094c3b08eacbd43cecc76c29a9bbcd4808bfa6eaeb78d3453e30660d1653569841869e3d8b90f3d047388da51919cf056ce1ce1d455177c95cdb8f76637d5336e82c9e10ddfd33515f7491ef28cbe4c8a477086daeb525d097844879d140965ef0463b3e1780065da2255e68aee903f7b06b0824b151525c56063d4be22ee31b82d2029fef15f38f9008d785dcab9f1454185ec4a3d76ed3aa8d27859f66ae63eddd338ac28f64048e46a5d0731f9b7ebe52218e11e78cb6d8172aea44f2c213ce7f5edfaed81c5de95a86aba484ec2e1950f61e743f11fbd881f2b0c891aa6e94fff4e5d747971313613da54b5483aabe5b12a8e661d455cdf442b86f3cd8b6e95e2ebfba7c62001769d5d9725f1df8ff364ff45f65b16fb2a828638313dbaac9818f990e8590d54b67613430b9f1869b7f2f756e4af19a145105b7b0f7c889b3146533114d001fc2c1b6b285ded35fd0b17857da527e80658f0b717a8c98920f72289896f05a686083fa9e84ee9f0590793b484365159cd18d9290fc7b342b3926bccdc830a519b8abd07e5b885cc4a6046423d5fa976588510cf5b0cfeaa38e7d170feb401bf9b3e4284415b8e2d2b8d73a0bfda6e246d4075c16f3bf8c1d8a1969dc57fc8786b1e4afb4ec6769534debe49ef6873e76289c6442c6d690457af91df631c7b0d4d0a18a43b26803bfe374a81de3c182b4dc50683f8545157b40f4b44db5eff729645421817ff5fdd0b4ca5cc2ba9b23c33256074b0cd5938aacea39e5cb5af7ec444267f1419867e355de6700ae0a63b7a57eaabe21aee216048612ec6c6993a577ca4d7a0071f5680d89baa337a37a5d1af9dc359d9708ddab0bb96323ae8f6a48d2b8b42d47d4a051b55d14116a359899c79011f2db86e08c2fb7c7d836355cd55f33aba9cb80a10c0844011e3ffa01f5472233fbaebe45f044154220094bf7da1a4035c195978e1b97eac6c41010b27dfb5df985ab16d219f415528b0403846b326f0a00f7b73c89933e1a2daa58dd8dee2f91e2d083eb25508ad3b3e916cf7e002140ed65ebe55ed8bec0cea09a5a61f7262aaa61cbf09d16ff6aac48c511fb8220dc5e20c3d4ce6283c53442a5cf408f3e66734208cc4f13a90a9ad6f90c1db802abcff903addba309ad25dd56cf6d37f32f82eb07fce24ac33e48451e7719e323f512a459a172172ff94d41be609aba82bcb7d827dfc73b4875209aa392c6f0d24f95bb900814fbff19c8d51d421270363bc808f29e21e14f6c99a13f8000fbfbc1cae461215fbba52511c9d14aaedb16e3a3725534b5713c554f1e5ebdc2abfaa712cf0d8ff6699cf0949f89b187e58bbac15927a701432f81b61e797136789ae2e824b0a74c553d59b7a1a1d512fec36c863422f0634560064ad2c310895d6d8a1a3f9429f08a7360cd4b4f9f208bf6d210d809796276e7a900ea994d3f8a3c3be28c3384c8d822fd108e8e9a195798149beb3e4eed373edac2bbc957b3f0432bcddc9556b734b19f91d94d21a881fbc882603f7da7f8993a74d5b12670f87aa69885abea718b67a700caf9fac78122a83b282099952664e5e8446a23b4bb3c01b1b4a9dca924fe0210445dd5e8ce3bdf2429463df24de0cb74bfc162847a6177d42feb487c89e1fd76fc59e4feaab91d6fadfa65a872a8128ea56f4914fb55165598db63bd701573f8ca7b78b69fe0983f1aadb99bb0ccbf9e2409d2833f9ab80296f9795c5e5740ebebb71238c6898dbd6e043cd6031c1590edfe763446a96d3806d62ef9a7467f4545d4b958ab916939d985856d06cc9369194329b961c0b767a76624104d3cacb9119d17499d83c1e6f95f4c79de2aae011413facd8962980b5327c7e22b516c841a985646e38126fb50c8bba642076489a8a8cc21cac2e92e6d459d5666b868da0e30121e972324076476490170f513efc5dcf57ce85d81c9fffceefb19ec98278e13abb2f322af44b980f9ef522e98d909507a8eeb7a0bd927d621e0fbfa06a9ca8f2f9978aae462db2cce9240c82942957472c722a0cbc1c84e6c7cd86bf6534d05090396b70cef7c77a29f06e5360d9c5c426988ee7653d022c1b49bc99494bc661c42b97b62c0f5351b5aabcaf1e22a6cb70d348753711f9063f87b292edf6137ac524b2a4cdf8d3a8ca035fd959ea40297645253a33946687bee09f66132f2cbca0f451b82108f4e68683fcef2cb3282d38fe47f6be597a0aba1b637e24fa2ea26f890f5e8cd2e438b0c42319c3f482b21b3b36e9b66907ab9451aa2d5b0d848c958179cd2c138e7a8133d10b952745c6f9c5ad206b13ae83e21236e06a27e60f54c15fdf96c084ee9253af3ae53f1e5c79bf61eef8cd90f382da1f2c072272bf9fc89b4fc6c18a57e197a366fdb5af0ff28131f42690ec69d59fae8c8f43c8f3cf4eacbdcf3e162e492e1bd533abe70bac53f9868c1995921c79d09f67a6b724410a468129f990d150e95663e54551feb97a4304f92ab3db2a43ca841ee3b0f6b62c751f6016b8439d5a08db8d34faa4ba7a7617fe5bbf1f8fcb5a9f55f1a1db83645eb93bde600032bbac895863cc54f09a9fe1e190a08abc6c080badd8245bb9918713ddaead377afbdcbc7cf4d191f6ca2fe2defa45c3c3353c277e1130284cd441da774eb16e7bf11ad0beef302022a18cf0479285df7f64feacacaef8ca50c201cb9001087611c4cd16f1ab6782d7eafae094c93cf301477a678c9ec482baa1d1d1a405494b67b35057b691af44dc3be73e26ab2b6fbe5d2e2117e0c6d0e964b3826a6e057c80e4f0ed78ed1310c24516b95dcefcf5dfd7e79e5e24e6922ade7efdc2242934973f636e300cbe5002f8bb0413a76baee10099b1008e384b8644188932abf79d0f26c66ebd662add68e039212bf4fd801114196e105d958ade15fb451fb5d5d90fee2ecb792bb5c864125bb3e63e0a7b59ff54f5d52ec590708840bbf134e25625690b262e5493a53ef206ce25c6b4dcbf3d8ebab2806f96b6a96eedebb2930fd7230e9601ce4ab66d721e856eedd6704f0b673e0febabd1148469bdf93c890c637c542b5fd4dc21b898c8c0150a1bc2817542e211205dc70be74977c37901fdc734613e5c1f40efbdf19b983abba0ddad01d0ab654b2e34c656090351a515aca39f58b3485da7c0a696952ea618f1f79eb7c55b056eec77e22224bd79d2ad9f597f12dcdd7c7160518ccd77bb5317ac0ea66b6a80a2cc4e28ae3881c59dff4d4684779776bf9e3accc8384f2a1f05cd3cadb345a27669ea1c059e086f421346ae2cf95d19f75941eed79c775eb557e252e08d9662204006d2ba9375bd871f6b64a0633a3b271d8f1ac39d39e6a5100c99effd2a09df4b49d1a41176d4de1a4236c8190bffad251a113cc16d499ac212db31b26497a399ce1acc2b4a63ceee193bfb94bf91dc309c7ba4664b4e99c745786b7", 0x1000, 0x3, &(0x7f0000001080)=@in={0x2, 0x2}, 0xc) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000010c0)=""/205, 0xcd, 0x802, &(0x7f00000011c0)={0x2, 0x0}, 0xc) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001200)="6534640a5e7748511a23bf5623", 0xd) r1 = paccept(0xffffffffffffff9c, &(0x7f0000001240)=@in, &(0x7f0000001280)=0xc, 0x0) connect$inet6(r1, &(0x7f00000012c0)={0x18, 0x3, 0x1, 0x800}, 0xc) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000001300)=@file={0x0, ""/4096}, &(0x7f0000002340)=0x1002) pwritev(r2, &(0x7f00000024c0)=[{&(0x7f0000002380)="ce0fdad9a64a58f784d8087af805aa2bd2f9b86b22d9b2c32c5873c3f32befbc76c47e31e95cb5772009974106dd56e9b77e9ef21b64ebda31080530f8dbeb72d1925f06c0e6163c8737293d3334cdfe5de421f33504eaa8024bcb42a0ad53d6bd25e3b6650362969853803300c71d1231f73d20109fd2b805d7c0de0668001886e4a380880e169de677cb124cc60578020ffecbe8381965697296f87ca1dd26d239f00c44d28f440468978edf019a5db050913f841895d9d9a42a50fd2953af0bd6c692835f5f28b46768fc540014f8d3ee3d80175cd9bca3e52d0a15b88773f3b8110890f4dffe75433fdabac54c62298a", 0xf2}, {&(0x7f0000002480)="80242bebc81bd3dadcb992d2de24b81300a636d3a64bdfe93133e14429da14cf317eded200e371e34aef0bbaf272a4e8778908", 0x33}], 0x2, 0x51) getpeername(r2, &(0x7f0000002500)=@in, &(0x7f0000002540)=0xc) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_ethernet(0x33, &(0x7f0000000000)="48f7f190c685fad5020b2c726eadc83c0867b01c6b28ea05f4bd0544eb883ec3d8897d9aee86bcb2c90ebe68774c206570c903") syz_execute_func(&(0x7f0000000040)="c4227db74b0b458657fb66440f38dcd2c481f95bfe0f49f8660f3a0c9bb4000000fec4a2fda6fcc4a14dd516c40194596d6466410f6c23") syz_extract_tcp_res(&(0x7f0000000080), 0x6, 0x8000) syz_usb_connect(0x1e3d802a, 0xef, &(0x7f00000000c0)="53890ef7069cebf4ab2e3862d4e8f0d7cd39046611d86efa403d25558c0de4ab33f831e6f5f52956032835783bf2d0f5817f8b8dda73c7542d9f0d12a631e25a3ee4dcfb6ae2f968a825dac5812d8c6b8264e0b78c3daa0c76237a223a71f50ba36e784b03b1f38705a237cf14c437fdc2363dc773b1946be9835bd59cf8390038fb9bac191ec255eaf70ea2b563db022460b05e8d6acc51ea2dc25ff06b2add98890a727807072b47f38ee42d6367e7d3548d3f13ca5574426df294626c3ef4b8cf7aea4830b70d93122efd51fce48496a5bd03e305f2ad871969c97ceff6b6c2286c5431b9fdbd8837629298cb4e", &(0x7f00000001c0)="a185224a16ff1a062f6f9766aeb7f58408b028450e80970d9250114b2c871d5d9ec67f7990a305b4be2c41d35d3316a7f4c9b27401f8440e71a579b7f9acc606d20da088c7077bbc3c361e71c577406168bcc1bcb7f02e416e3f908403e23db0c727ea769debda4d0e524f8adf7f42184a20ba1a23f9c58d46914cc7b12c19537d55a40fcd26c68efb09dc0acc2ee7524abec0b8035ad2b1d194331e2ea4e42ebc53d3880e7c0dd6c57902c8727cefb0fd3192d662") r3 = syz_usb_connect(0xa4, 0x6f, &(0x7f0000000280)="b748b21b78ea22216c2cbfdccb03ec54d20f30f4af462b7bfd5d301b9a4fb8f9bbe630dde8d60855029447df51120e0d690ae4a73e5a06064cc06d83622a66c3cf3ccd920df4a9dec547f0c85354b2e803699f52ffc814536ce519c7c16526da56c65b4429cb224ad9c97f637ee6f2", &(0x7f0000000300)="fca1691e90fef7c0693e50161f6bf9d6be11621b96a65d5023d66e18c9dc3bb38cf479306eff4d2cf175b6f85215446b2379fdc73274566c4ca7cec4d66a481912afe23a3f61adb9467e5bf828156436ebe3d29e3073e4254b3a734acd66d14efb0736fcadff4dad73e02531870c30fae0c378c515786c88c1292736cdf0b6a2e79b47a78e33f5e1d0688a6f3ce2d9e15bd3ee2e2afe1ac5c8523a84a208755a7f822f3d211fe3a26a86507d98583d566a0591a7802cb3f9f9dc35b9110de4b2f4d3934bb20b7a") syz_usb_disconnect(r3) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bEndpointAddress; uint8_t bmAttributes; uint16_t wMaxPacketSize; uint8_t bInterval; uint8_t bRefresh; uint8_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint16_t idVendor; uint16_t idProduct; uint16_t bcdDevice; uint8_t iManufacturer; uint8_t iProduct; uint8_t iSerialNumber; uint8_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t wTotalLength; uint8_t bNumInterfaces; uint8_t bConfigurationValue; uint8_t iConfiguration; uint8_t bmAttributes; uint8_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bNumEndpoints; uint8_t bInterfaceClass; uint8_t bInterfaceSubClass; uint8_t bInterfaceProtocol; uint8_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint8_t bNumConfigurations; uint8_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_accept #define SYS_accept 30 #endif #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getpeername #define SYS_getpeername 31 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_pwritev #define SYS_pwritev 290 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 29 #endif #ifndef SYS_sendto #define SYS_sendto 133 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 105 #endif uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: *(uint32_t*)0x20000040 = 8; res = syscall(SYS_accept, -1, 0x20000000ul, 0x20000040ul); if (res != -1) r[0] = res; break; case 1: memcpy((void*)0x20000080, "\x8d\x36\x0d\x8e\x22\x29\xaa\xb6\x3a\xef\x8e\x41\x58\x2b\x2d\x02\xe9\x3c\x21\x90\xe2\xfe\x50\xc1\xf7\xf3\xb2\x9e\x85\x3f\x60\xfb\x58\x7d\xd7\x8a\x2c\x40\x46\x15\xcd\xf3\x76\x3b\x9a\x53\xdb\xa1\x41\xc6\x6b\x4a\x48\x54\x50\xd6\x6e\x0a\x4a\x28\x1e\x63\xe3\x52\x7c\x88\xcd\xde\x73\x01\x0e\x05\x44\x9a\x77\xae\xe1\xe7\xa3\x5f\xdd\xde\xa4\x97\x11\x9a\x92\xfa\x7f\xb2\xd1\x08\xd6\x47\x5f\x90\xca\x55\xe0\x4b\x82\xe5\x3d\x6a\xc1\x13\x8c\xb9\x13\xb8\xdb\xb0\xb6\xf9\x22\xa1\xa8\x54\x61\x45\x91\x90\x96\x9a\x7d\x79\xde\x91\x64\xf3\xb4\xe2\xe9\xdc\x65\x81\x7c\xd3\x90\x8b\xf1\x31\xac\x85\xe8\x71\x34\x59\xe5\xda\x85\x5d\xd9\x4a\x0f\xee\xa7\x6b\x05\xdd\x56\xd5\xe0\xb5\x22\x23\x32\x21\x05\x06\x20\x2a\xf0\xc3\x71\x85\x96\xbf\x55\x49\x07\x7f\x21\x38\x86\xee\xb0\xb3\xe3\x8b\x83\xe2\x37\x29\x03\x27\xd0\xcc\x6d\x5e\x37\x4a\x36\x5e\xcc\xda\x88\xeb\xf8\xce\x41\x41\x53\x6b\x08\x54\x24\xaa\xdb\x2b\x0c\x5b\xe5\x57\xbe\xa1\x2e\xa5\x3f\x3f\xd5\xb7\xd3\xb4\x8e\xdf\x54\xf8\x60\xc8\xa8\xe1\x94\x1e\x0a\x56\xd8\x51\xb2\xc0\x8b\x8d\x4c\x9b\xad\x81\xad\x64\x9d\x14\x79\xbb\x60\x64\x41\x94\x38\x5d\x68\x04\x41\xc6\x74\xf6\x29\xc5\x0a\xbb\x98\xea\x48\x59\x79\x8a\x0a\x3e\xde\xe9\x5e\x33\xf9\xc2\x88\x0d\xb8\xc9\x27\x9f\x97\x1b\xd5\x97\xb9\x89\x78\xbd\x66\x40\x47\xc1\x44\xaf\x6c\x79\x54\xcc\x4e\xdb\x91\x4a\x61\x80\x47\xa0\x63\xee\x75\x31\x37\x72\x16\xa1\xf4\x24\x04\xfd\xe9\x95\x93\x6f\x5d\x7a\xba\x61\xbb\x23\x07\x00\xac\x33\x90\xd8\xfb\xc6\x27\x72\x09\x4f\xb8\xe5\x43\xf3\x91\x34\x13\x2c\x68\x15\xd1\xeb\xf1\x5b\xd0\x06\x8e\x3b\x7e\xa8\x6b\xb1\x83\x46\x5b\x91\xa4\x31\xf5\x2f\xe3\x8b\xd0\xe6\xe0\x77\x29\x8a\xe8\x26\x56\x85\xe4\x69\x61\xfa\x82\xb6\x4c\x5f\x75\x7e\xaf\x9a\x7d\x0f\x63\xed\x28\x49\xb1\x7a\xf0\xc5\x50\x11\x8c\x7e\x8e\x5a\xdd\xd9\x17\xce\x99\x77\x96\x31\x9e\x6b\xcf\x9b\xc4\x2b\x8b\xa8\x7c\x94\xe5\xa3\x1b\x1c\xec\xb2\xfd\xe9\xc5\x71\xf9\xa8\x7a\x88\x23\x0f\x80\x93\xa7\xae\x80\xa0\xc4\x5c\x3c\xee\xc6\x9f\x1e\x1f\x84\x42\x96\x04\x50\x70\xf3\x72\x8e\xc4\xfa\x64\x4c\xd7\x48\x81\xdb\x3c\x72\x35\x2e\x4b\x83\x18\xf8\x83\x4a\xc6\x30\x6a\x56\x98\xce\x9a\x5e\xb3\x14\xf3\xf8\x64\x70\x67\xbd\x6d\xe7\xc9\x09\x40\x64\x59\x31\xc3\x10\xaa\x55\xe4\x26\x8e\xcb\xaf\x64\xc9\xd8\xc9\xac\xe5\x4f\xc9\xf2\x24\x74\x6d\xdd\x68\x18\x40\xc3\x92\xf2\x74\x75\x33\x42\xef\x48\xac\x19\x73\xab\xf5\xc3\x8d\x07\x76\xbd\x61\xc0\x87\xd7\xb5\x4b\x1f\x93\xea\xed\x1a\x7c\x9f\x73\x42\x7e\x38\xd5\xe3\xca\x2c\xd1\x7f\xa0\x0c\x69\x87\x39\x21\xed\x8f\x2b\x8b\x9f\x89\x50\x91\x34\xf7\x23\xb6\x98\x08\x31\xf5\x50\x4a\x65\x60\x2b\xd9\x36\x7a\x15\x1c\x57\x0a\x70\x59\x10\xaf\xd9\xf6\x91\x16\x73\x73\x27\xc1\x93\xa8\x75\x1d\x9c\x16\x1b\x5b\x2e\xf4\xe4\x06\x05\x5f\xe7\x9c\x57\x0f\x7c\x3e\x83\x34\x62\x3e\xf0\x2b\x9f\x47\xee\xcb\x78\xd3\x0d\xb1\x47\xd4\xfc\x90\xbc\x91\xfa\xec\x2d\x91\x81\x20\x6e\x41\xcc\xcd\xe0\xc2\x14\x83\xbf\xd0\xc4\x5d\x87\x65\xa1\x3d\x69\xe2\x24\x79\xc2\x18\x16\xdb\xd5\x90\xae\x51\xe4\x9f\x60\x58\x44\x9b\x9d\x3d\xbe\x94\x07\x5e\x2e\x57\x02\x8f\x43\xf7\x02\x01\xa1\xe4\x87\x5b\x91\x69\x7c\x29\xde\xb8\xc2\x57\x2a\x10\x51\x31\xc8\x7f\x76\x85\xca\xd9\x4d\x13\x21\xd4\xae\x5c\xc6\xef\xed\xe1\x1a\xc8\x0a\x0e\x00\xa6\x3b\x2b\xa5\x4f\xcc\x51\x95\x47\x5c\x3f\x1f\xf5\x72\x69\x3d\x00\xe4\x91\xa0\x44\x5c\x98\x7d\xed\xcb\xe7\x3b\x69\xec\x13\xd2\x26\xb1\x93\xec\x03\xfa\x9a\x27\xa4\xa4\x34\xd1\x48\x98\x33\x66\xc7\xd8\xe5\xbc\x3c\xea\x9f\xbe\xff\xd0\x5b\x8b\x00\x90\x76\x51\x59\xb3\x80\xac\x96\x42\x96\x55\x12\x59\x21\x50\x7f\x97\xdf\x3e\x9d\x41\xc6\x6b\x2f\x5f\xff\xd0\xca\xd4\x82\x65\x77\x91\x6f\x94\x1a\xc7\xc9\xec\x7a\xb6\x25\xec\x93\x90\xe0\x50\xc5\x88\x5d\xbd\x2e\x71\x31\xf2\x79\x4e\xca\xd5\x70\x9e\x0a\xc3\x95\xad\x0e\xde\xe0\x18\x28\x22\x37\x4e\x70\x11\x67\xad\x2c\xfd\xa0\x7f\xf9\xe9\xbd\xde\xe1\xc6\x88\xd4\x83\xc1\x32\xe1\x97\xa9\x48\x1c\x9e\xb0\xdf\x2c\xf9\x66\x9a\xb1\x07\xcc\x93\x6b\xf2\xc9\x62\x68\xa1\x20\xa4\x4f\xb7\xf1\x78\xb4\x02\xec\xd9\xc5\x12\xf8\x69\x08\xf4\x3f\xea\x11\xcc\x69\x02\xc3\x55\x92\x9b\x91\x0a\x52\x3a\xcd\x16\xd5\x93\x1e\xa4\x17\x53\x39\x1a\x03\x68\xe5\xbb\xe9\xe8\xcd\x92\x6d\xa1\x20\xd8\x44\x0f\xce\x2c\x19\x2b\x1e\x59\x86\x85\x4d\xe8\x55\x13\x20\xc9\x89\x53\x37\x71\xf1\xa7\x1f\xb4\x1f\xf1\xc9\x27\xff\xba\x9e\x9e\x25\xae\x53\x3d\xb6\xa3\xc8\x04\xb0\xb3\x40\xa0\x40\x9e\x11\x0a\xc7\x6a\x7b\x58\xf9\x12\xdb\x41\xe3\x3b\x11\x5e\x1c\x3a\xe9\xaa\x03\x99\xed\xd6\x21\xa0\xfd\x4b\x7b\xe2\x17\x6c\xb4\x96\x82\xee\x82\xb2\xa2\x19\xba\xac\xe6\x3b\x38\x22\xb9\x8b\xa6\xf4\x8c\xd3\x4a\x08\x14\x33\x21\x99\x3c\x43\x90\xb9\x4b\x13\x8e\x4a\xdc\xfd\x47\xdd\x01\x98\x2e\x24\xac\xb8\xd4\x64\x73\x8f\x44\xaf\x04\xff\x33\x53\xf8\x68\x3f\x35\x23\x06\x45\x75\x22\xe6\x53\xba\xa8\x93\x79\x50\x44\x8e\xef\x98\x79\xdf\xaa\x42\xe9\xfc\xca\x9a\x96\x89\x71\xb6\x0c\x41\x3f\x4a\xa3\xe0\xf9\x0b\x41\xc7\x82\x8a\xd5\xdb\xb6\x2a\xae\x0c\xd2\xd2\xef\x85\xe2\x48\xbf\x12\xe4\xd6\xd7\x5b\x80\x3a\xca\x52\xbb\x96\x16\xac\xc3\x7b\xc8\xbd\xab\x1a\x66\x66\x1a\x53\x29\xdc\x93\x6b\x1d\xbc\x83\xfd\x59\x8c\x57\xb9\xad\x80\xac\x42\xc2\x1a\x63\x18\xb3\xfb\x8d\x0d\x86\x5f\xff\xb0\x43\x21\x7c\x42\xf9\x54\x6c\x05\x0e\xb8\xcc\xe5\xe3\x42\x33\x71\xa9\x3a\xff\x46\x47\x1d\x20\x08\xc8\xcd\x58\x41\xf8\x49\xd1\xf0\xd5\x83\x17\x35\x3a\x6d\x73\x08\xf7\x96\x2d\x94\x37\x95\xbd\x52\xa4\xdd\x5a\x84\x40\x64\x02\x73\xc7\x8e\xf6\xeb\xbe\xaa\xe9\x14\x3d\x5e\x6e\xe9\x0c\xda\xa2\x57\xe1\x32\xe6\xd4\x2d\x02\xb9\x56\x7a\xe6\x9b\x75\xbc\x60\xf7\x59\x6a\x1f\xdd\x81\x79\xcf\xf3\x23\x99\x17\x01\x06\x29\x30\xce\x23\xa2\x9e\x30\x02\x3d\xa9\xd6\x31\xbf\x61\xa6\x44\x0a\xcc\x29\x0b\xde\xaf\xba\xae\xa7\x83\x65\xf4\x08\xae\xa8\xf8\x64\xda\x22\x0e\x7a\x56\x0c\x9a\xc8\x4b\xb9\xc9\x75\x81\x4c\x13\x2f\x97\xe0\x8b\x64\xcc\xad\x47\xce\xb0\x8f\x29\x41\xa4\x43\x8f\xeb\x76\x56\x0b\x1d\x5e\x6f\x32\x89\xf5\x0d\x05\x4e\x94\x96\x74\xeb\x6c\x32\x94\xcc\x4a\x27\x42\x76\x50\xc4\xa3\x7f\x53\xc6\x5c\x55\xca\x41\x0f\xa6\x2e\xe1\x8a\x82\x92\x20\x36\x0a\x82\x72\xf8\xc0\x04\x1e\x2b\xf3\x3f\x04\x79\x28\xfe\xb0\x26\x9c\x43\x8b\xdf\x39\x9b\x1d\x8f\x18\x7b\x24\x54\xea\x5c\xd8\x73\xe3\x52\xe1\xd0\x78\x15\x70\x23\x4c\x6d\x81\x0c\x5a\x16\xba\xc9\xea\x9f\xfa\xfb\x0c\x97\x8a\x02\x22\x76\x90\x3a\x1c\x65\x3f\x17\xd9\x66\x59\xcb\xb3\x0a\xbc\x1a\x32\x0c\x58\x4b\xdf\xcc\x00\x12\x52\x70\xc2\xd4\xc9\x09\x50\x02\x9f\x71\x15\x75\xdf\xa8\x28\xfe\xea\x3b\x1d\xc8\x3c\x07\x01\xdf\xfa\xc1\xf8\x95\x36\x58\x3a\x0c\x09\x95\x55\x0f\x86\x2c\x3e\xc7\x86\xc0\xf8\xfe\xe0\xfd\x94\xfa\xe0\xa6\x61\x31\x3f\x9e\x75\x33\x62\x33\x6d\xb3\xea\x02\x96\xd7\xfb\x91\x3a\xd4\x90\xbf\xc9\xdd\x15\x53\x07\xab\x14\xe6\x71\x14\xfc\xde\x26\xd0\x32\x43\x5c\xec\x7d\x29\x24\x7d\xeb\x93\xbc\xf7\xfa\x48\xb4\xdd\xb5\xfb\x74\x49\xc0\xfd\xa0\x83\xd5\xa6\x3e\x03\x92\x2d\x5d\xfb\x36\x1b\x7e\xeb\x12\x2a\x09\x4c\x3b\x08\xea\xcb\xd4\x3c\xec\xc7\x6c\x29\xa9\xbb\xcd\x48\x08\xbf\xa6\xea\xeb\x78\xd3\x45\x3e\x30\x66\x0d\x16\x53\x56\x98\x41\x86\x9e\x3d\x8b\x90\xf3\xd0\x47\x38\x8d\xa5\x19\x19\xcf\x05\x6c\xe1\xce\x1d\x45\x51\x77\xc9\x5c\xdb\x8f\x76\x63\x7d\x53\x36\xe8\x2c\x9e\x10\xdd\xfd\x33\x51\x5f\x74\x91\xef\x28\xcb\xe4\xc8\xa4\x77\x08\x6d\xae\xb5\x25\xd0\x97\x84\x48\x79\xd1\x40\x96\x5e\xf0\x46\x3b\x3e\x17\x80\x06\x5d\xa2\x25\x5e\x68\xae\xe9\x03\xf7\xb0\x6b\x08\x24\xb1\x51\x52\x5c\x56\x06\x3d\x4b\xe2\x2e\xe3\x1b\x82\xd2\x02\x9f\xef\x15\xf3\x8f\x90\x08\xd7\x85\xdc\xab\x9f\x14\x54\x18\x5e\xc4\xa3\xd7\x6e\xd3\xaa\x8d\x27\x85\x9f\x66\xae\x63\xed\xdd\x33\x8a\xc2\x8f\x64\x04\x8e\x46\xa5\xd0\x73\x1f\x9b\x7e\xbe\x52\x21\x8e\x11\xe7\x8c\xb6\xd8\x17\x2a\xea\x44\xf2\xc2\x13\xce\x7f\x5e\xdf\xae\xd8\x1c\x5d\xe9\x5a\x86\xab\xa4\x84\xec\x2e\x19\x50\xf6\x1e\x74\x3f\x11\xfb\xd8\x81\xf2\xb0\xc8\x91\xaa\x6e\x94\xff\xf4\xe5\xd7\x47\x97\x13\x13\x61\x3d\xa5\x4b\x54\x83\xaa\xbe\x5b\x12\xa8\xe6\x61\xd4\x55\xcd\xf4\x42\xb8\x6f\x3c\xd8\xb6\xe9\x5e\x2e\xbf\xba\x7c\x62\x00\x17\x69\xd5\xd9\x72\x5f\x1d\xf8\xff\x36\x4f\xf4\x5f\x65\xb1\x6f\xb2\xa8\x28\x63\x83\x13\xdb\xaa\xc9\x81\x8f\x99\x0e\x85\x90\xd5\x4b\x67\x61\x34\x30\xb9\xf1\x86\x9b\x7f\x2f\x75\x6e\x4a\xf1\x9a\x14\x51\x05\xb7\xb0\xf7\xc8\x89\xb3\x14\x65\x33\x11\x4d\x00\x1f\xc2\xc1\xb6\xb2\x85\xde\xd3\x5f\xd0\xb1\x78\x57\xda\x52\x7e\x80\x65\x8f\x0b\x71\x7a\x8c\x98\x92\x0f\x72\x28\x98\x96\xf0\x5a\x68\x60\x83\xfa\x9e\x84\xee\x9f\x05\x90\x79\x3b\x48\x43\x65\x15\x9c\xd1\x8d\x92\x90\xfc\x7b\x34\x2b\x39\x26\xbc\xcd\xc8\x30\xa5\x19\xb8\xab\xd0\x7e\x5b\x88\x5c\xc4\xa6\x04\x64\x23\xd5\xfa\x97\x65\x88\x51\x0c\xf5\xb0\xcf\xea\xa3\x8e\x7d\x17\x0f\xeb\x40\x1b\xf9\xb3\xe4\x28\x44\x15\xb8\xe2\xd2\xb8\xd7\x3a\x0b\xfd\xa6\xe2\x46\xd4\x07\x5c\x16\xf3\xbf\x8c\x1d\x8a\x19\x69\xdc\x57\xfc\x87\x86\xb1\xe4\xaf\xb4\xec\x67\x69\x53\x4d\xeb\xe4\x9e\xf6\x87\x3e\x76\x28\x9c\x64\x42\xc6\xd6\x90\x45\x7a\xf9\x1d\xf6\x31\xc7\xb0\xd4\xd0\xa1\x8a\x43\xb2\x68\x03\xbf\xe3\x74\xa8\x1d\xe3\xc1\x82\xb4\xdc\x50\x68\x3f\x85\x45\x15\x7b\x40\xf4\xb4\x4d\xb5\xef\xf7\x29\x64\x54\x21\x81\x7f\xf5\xfd\xd0\xb4\xca\x5c\xc2\xba\x9b\x23\xc3\x32\x56\x07\x4b\x0c\xd5\x93\x8a\xac\xea\x39\xe5\xcb\x5a\xf7\xec\x44\x42\x67\xf1\x41\x98\x67\xe3\x55\xde\x67\x00\xae\x0a\x63\xb7\xa5\x7e\xaa\xbe\x21\xae\xe2\x16\x04\x86\x12\xec\x6c\x69\x93\xa5\x77\xca\x4d\x7a\x00\x71\xf5\x68\x0d\x89\xba\xa3\x37\xa3\x7a\x5d\x1a\xf9\xdc\x35\x9d\x97\x08\xdd\xab\x0b\xb9\x63\x23\xae\x8f\x6a\x48\xd2\xb8\xb4\x2d\x47\xd4\xa0\x51\xb5\x5d\x14\x11\x6a\x35\x98\x99\xc7\x90\x11\xf2\xdb\x86\xe0\x8c\x2f\xb7\xc7\xd8\x36\x35\x5c\xd5\x5f\x33\xab\xa9\xcb\x80\xa1\x0c\x08\x44\x01\x1e\x3f\xfa\x01\xf5\x47\x22\x33\xfb\xae\xbe\x45\xf0\x44\x15\x42\x20\x09\x4b\xf7\xda\x1a\x40\x35\xc1\x95\x97\x8e\x1b\x97\xea\xc6\xc4\x10\x10\xb2\x7d\xfb\x5d\xf9\x85\xab\x16\xd2\x19\xf4\x15\x52\x8b\x04\x03\x84\x6b\x32\x6f\x0a\x00\xf7\xb7\x3c\x89\x93\x3e\x1a\x2d\xaa\x58\xdd\x8d\xee\x2f\x91\xe2\xd0\x83\xeb\x25\x50\x8a\xd3\xb3\xe9\x16\xcf\x7e\x00\x21\x40\xed\x65\xeb\xe5\x5e\xd8\xbe\xc0\xce\xa0\x9a\x5a\x61\xf7\x26\x2a\xaa\x61\xcb\xf0\x9d\x16\xff\x6a\xac\x48\xc5\x11\xfb\x82\x20\xdc\x5e\x20\xc3\xd4\xce\x62\x83\xc5\x34\x42\xa5\xcf\x40\x8f\x3e\x66\x73\x42\x08\xcc\x4f\x13\xa9\x0a\x9a\xd6\xf9\x0c\x1d\xb8\x02\xab\xcf\xf9\x03\xad\xdb\xa3\x09\xad\x25\xdd\x56\xcf\x6d\x37\xf3\x2f\x82\xeb\x07\xfc\xe2\x4a\xc3\x3e\x48\x45\x1e\x77\x19\xe3\x23\xf5\x12\xa4\x59\xa1\x72\x17\x2f\xf9\x4d\x41\xbe\x60\x9a\xba\x82\xbc\xb7\xd8\x27\xdf\xc7\x3b\x48\x75\x20\x9a\xa3\x92\xc6\xf0\xd2\x4f\x95\xbb\x90\x08\x14\xfb\xff\x19\xc8\xd5\x1d\x42\x12\x70\x36\x3b\xc8\x08\xf2\x9e\x21\xe1\x4f\x6c\x99\xa1\x3f\x80\x00\xfb\xfb\xc1\xca\xe4\x61\x21\x5f\xbb\xa5\x25\x11\xc9\xd1\x4a\xae\xdb\x16\xe3\xa3\x72\x55\x34\xb5\x71\x3c\x55\x4f\x1e\x5e\xbd\xc2\xab\xfa\xa7\x12\xcf\x0d\x8f\xf6\x69\x9c\xf0\x94\x9f\x89\xb1\x87\xe5\x8b\xba\xc1\x59\x27\xa7\x01\x43\x2f\x81\xb6\x1e\x79\x71\x36\x78\x9a\xe2\xe8\x24\xb0\xa7\x4c\x55\x3d\x59\xb7\xa1\xa1\xd5\x12\xfe\xc3\x6c\x86\x34\x22\xf0\x63\x45\x60\x06\x4a\xd2\xc3\x10\x89\x5d\x6d\x8a\x1a\x3f\x94\x29\xf0\x8a\x73\x60\xcd\x4b\x4f\x9f\x20\x8b\xf6\xd2\x10\xd8\x09\x79\x62\x76\xe7\xa9\x00\xea\x99\x4d\x3f\x8a\x3c\x3b\xe2\x8c\x33\x84\xc8\xd8\x22\xfd\x10\x8e\x8e\x9a\x19\x57\x98\x14\x9b\xeb\x3e\x4e\xed\x37\x3e\xda\xc2\xbb\xc9\x57\xb3\xf0\x43\x2b\xcd\xdc\x95\x56\xb7\x34\xb1\x9f\x91\xd9\x4d\x21\xa8\x81\xfb\xc8\x82\x60\x3f\x7d\xa7\xf8\x99\x3a\x74\xd5\xb1\x26\x70\xf8\x7a\xa6\x98\x85\xab\xea\x71\x8b\x67\xa7\x00\xca\xf9\xfa\xc7\x81\x22\xa8\x3b\x28\x20\x99\x95\x26\x64\xe5\xe8\x44\x6a\x23\xb4\xbb\x3c\x01\xb1\xb4\xa9\xdc\xa9\x24\xfe\x02\x10\x44\x5d\xd5\xe8\xce\x3b\xdf\x24\x29\x46\x3d\xf2\x4d\xe0\xcb\x74\xbf\xc1\x62\x84\x7a\x61\x77\xd4\x2f\xeb\x48\x7c\x89\xe1\xfd\x76\xfc\x59\xe4\xfe\xaa\xb9\x1d\x6f\xad\xfa\x65\xa8\x72\xa8\x12\x8e\xa5\x6f\x49\x14\xfb\x55\x16\x55\x98\xdb\x63\xbd\x70\x15\x73\xf8\xca\x7b\x78\xb6\x9f\xe0\x98\x3f\x1a\xad\xb9\x9b\xb0\xcc\xbf\x9e\x24\x09\xd2\x83\x3f\x9a\xb8\x02\x96\xf9\x79\x5c\x5e\x57\x40\xeb\xeb\xb7\x12\x38\xc6\x89\x8d\xbd\x6e\x04\x3c\xd6\x03\x1c\x15\x90\xed\xfe\x76\x34\x46\xa9\x6d\x38\x06\xd6\x2e\xf9\xa7\x46\x7f\x45\x45\xd4\xb9\x58\xab\x91\x69\x39\xd9\x85\x85\x6d\x06\xcc\x93\x69\x19\x43\x29\xb9\x61\xc0\xb7\x67\xa7\x66\x24\x10\x4d\x3c\xac\xb9\x11\x9d\x17\x49\x9d\x83\xc1\xe6\xf9\x5f\x4c\x79\xde\x2a\xae\x01\x14\x13\xfa\xcd\x89\x62\x98\x0b\x53\x27\xc7\xe2\x2b\x51\x6c\x84\x1a\x98\x56\x46\xe3\x81\x26\xfb\x50\xc8\xbb\xa6\x42\x07\x64\x89\xa8\xa8\xcc\x21\xca\xc2\xe9\x2e\x6d\x45\x9d\x56\x66\xb8\x68\xda\x0e\x30\x12\x1e\x97\x23\x24\x07\x64\x76\x49\x01\x70\xf5\x13\xef\xc5\xdc\xf5\x7c\xe8\x5d\x81\xc9\xff\xfc\xee\xfb\x19\xec\x98\x27\x8e\x13\xab\xb2\xf3\x22\xaf\x44\xb9\x80\xf9\xef\x52\x2e\x98\xd9\x09\x50\x7a\x8e\xeb\x7a\x0b\xd9\x27\xd6\x21\xe0\xfb\xfa\x06\xa9\xca\x8f\x2f\x99\x78\xaa\xe4\x62\xdb\x2c\xce\x92\x40\xc8\x29\x42\x95\x74\x72\xc7\x22\xa0\xcb\xc1\xc8\x4e\x6c\x7c\xd8\x6b\xf6\x53\x4d\x05\x09\x03\x96\xb7\x0c\xef\x7c\x77\xa2\x9f\x06\xe5\x36\x0d\x9c\x5c\x42\x69\x88\xee\x76\x53\xd0\x22\xc1\xb4\x9b\xc9\x94\x94\xbc\x66\x1c\x42\xb9\x7b\x62\xc0\xf5\x35\x1b\x5a\xab\xca\xf1\xe2\x2a\x6c\xb7\x0d\x34\x87\x53\x71\x1f\x90\x63\xf8\x7b\x29\x2e\xdf\x61\x37\xac\x52\x4b\x2a\x4c\xdf\x8d\x3a\x8c\xa0\x35\xfd\x95\x9e\xa4\x02\x97\x64\x52\x53\xa3\x39\x46\x68\x7b\xee\x09\xf6\x61\x32\xf2\xcb\xca\x0f\x45\x1b\x82\x10\x8f\x4e\x68\x68\x3f\xce\xf2\xcb\x32\x82\xd3\x8f\xe4\x7f\x6b\xe5\x97\xa0\xab\xa1\xb6\x37\xe2\x4f\xa2\xea\x26\xf8\x90\xf5\xe8\xcd\x2e\x43\x8b\x0c\x42\x31\x9c\x3f\x48\x2b\x21\xb3\xb3\x6e\x9b\x66\x90\x7a\xb9\x45\x1a\xa2\xd5\xb0\xd8\x48\xc9\x58\x17\x9c\xd2\xc1\x38\xe7\xa8\x13\x3d\x10\xb9\x52\x74\x5c\x6f\x9c\x5a\xd2\x06\xb1\x3a\xe8\x3e\x21\x23\x6e\x06\xa2\x7e\x60\xf5\x4c\x15\xfd\xf9\x6c\x08\x4e\xe9\x25\x3a\xf3\xae\x53\xf1\xe5\xc7\x9b\xf6\x1e\xef\x8c\xd9\x0f\x38\x2d\xa1\xf2\xc0\x72\x27\x2b\xf9\xfc\x89\xb4\xfc\x6c\x18\xa5\x7e\x19\x7a\x36\x6f\xdb\x5a\xf0\xff\x28\x13\x1f\x42\x69\x0e\xc6\x9d\x59\xfa\xe8\xc8\xf4\x3c\x8f\x3c\xf4\xea\xcb\xdc\xf3\xe1\x62\xe4\x92\xe1\xbd\x53\x3a\xbe\x70\xba\xc5\x3f\x98\x68\xc1\x99\x59\x21\xc7\x9d\x09\xf6\x7a\x6b\x72\x44\x10\xa4\x68\x12\x9f\x99\x0d\x15\x0e\x95\x66\x3e\x54\x55\x1f\xeb\x97\xa4\x30\x4f\x92\xab\x3d\xb2\xa4\x3c\xa8\x41\xee\x3b\x0f\x6b\x62\xc7\x51\xf6\x01\x6b\x84\x39\xd5\xa0\x8d\xb8\xd3\x4f\xaa\x4b\xa7\xa7\x61\x7f\xe5\xbb\xf1\xf8\xfc\xb5\xa9\xf5\x5f\x1a\x1d\xb8\x36\x45\xeb\x93\xbd\xe6\x00\x03\x2b\xba\xc8\x95\x86\x3c\xc5\x4f\x09\xa9\xfe\x1e\x19\x0a\x08\xab\xc6\xc0\x80\xba\xdd\x82\x45\xbb\x99\x18\x71\x3d\xda\xea\xd3\x77\xaf\xbd\xcb\xc7\xcf\x4d\x19\x1f\x6c\xa2\xfe\x2d\xef\xa4\x5c\x3c\x33\x53\xc2\x77\xe1\x13\x02\x84\xcd\x44\x1d\xa7\x74\xeb\x16\xe7\xbf\x11\xad\x0b\xee\xf3\x02\x02\x2a\x18\xcf\x04\x79\x28\x5d\xf7\xf6\x4f\xea\xca\xca\xef\x8c\xa5\x0c\x20\x1c\xb9\x00\x10\x87\x61\x1c\x4c\xd1\x6f\x1a\xb6\x78\x2d\x7e\xaf\xae\x09\x4c\x93\xcf\x30\x14\x77\xa6\x78\xc9\xec\x48\x2b\xaa\x1d\x1d\x1a\x40\x54\x94\xb6\x7b\x35\x05\x7b\x69\x1a\xf4\x4d\xc3\xbe\x73\xe2\x6a\xb2\xb6\xfb\xe5\xd2\xe2\x11\x7e\x0c\x6d\x0e\x96\x4b\x38\x26\xa6\xe0\x57\xc8\x0e\x4f\x0e\xd7\x8e\xd1\x31\x0c\x24\x51\x6b\x95\xdc\xef\xcf\x5d\xfd\x7e\x79\xe5\xe2\x4e\x69\x22\xad\xe7\xef\xdc\x22\x42\x93\x49\x73\xf6\x36\xe3\x00\xcb\xe5\x00\x2f\x8b\xb0\x41\x3a\x76\xba\xee\x10\x09\x9b\x10\x08\xe3\x84\xb8\x64\x41\x88\x93\x2a\xbf\x79\xd0\xf2\x6c\x66\xeb\xd6\x62\xad\xd6\x8e\x03\x92\x12\xbf\x4f\xd8\x01\x11\x41\x96\xe1\x05\xd9\x58\xad\xe1\x5f\xb4\x51\xfb\x5d\x5d\x90\xfe\xe2\xec\xb7\x92\xbb\x5c\x86\x41\x25\xbb\x3e\x63\xe0\xa7\xb5\x9f\xf5\x4f\x5d\x52\xec\x59\x07\x08\x84\x0b\xbf\x13\x4e\x25\x62\x56\x90\xb2\x62\xe5\x49\x3a\x53\xef\x20\x6c\xe2\x5c\x6b\x4d\xcb\xf3\xd8\xeb\xab\x28\x06\xf9\x6b\x6a\x96\xee\xde\xbb\x29\x30\xfd\x72\x30\xe9\x60\x1c\xe4\xab\x66\xd7\x21\xe8\x56\xee\xdd\x67\x04\xf0\xb6\x73\xe0\xfe\xba\xbd\x11\x48\x46\x9b\xdf\x93\xc8\x90\xc6\x37\xc5\x42\xb5\xfd\x4d\xc2\x1b\x89\x8c\x8c\x01\x50\xa1\xbc\x28\x17\x54\x2e\x21\x12\x05\xdc\x70\xbe\x74\x97\x7c\x37\x90\x1f\xdc\x73\x46\x13\xe5\xc1\xf4\x0e\xfb\xdf\x19\xb9\x83\xab\xba\x0d\xda\xd0\x1d\x0a\xb6\x54\xb2\xe3\x4c\x65\x60\x90\x35\x1a\x51\x5a\xca\x39\xf5\x8b\x34\x85\xda\x7c\x0a\x69\x69\x52\xea\x61\x8f\x1f\x79\xeb\x7c\x55\xb0\x56\xee\xc7\x7e\x22\x22\x4b\xd7\x9d\x2a\xd9\xf5\x97\xf1\x2d\xcd\xd7\xc7\x16\x05\x18\xcc\xd7\x7b\xb5\x31\x7a\xc0\xea\x66\xb6\xa8\x0a\x2c\xc4\xe2\x8a\xe3\x88\x1c\x59\xdf\xf4\xd4\x68\x47\x79\x77\x6b\xf9\xe3\xac\xcc\x83\x84\xf2\xa1\xf0\x5c\xd3\xca\xdb\x34\x5a\x27\x66\x9e\xa1\xc0\x59\xe0\x86\xf4\x21\x34\x6a\xe2\xcf\x95\xd1\x9f\x75\x94\x1e\xed\x79\xc7\x75\xeb\x55\x7e\x25\x2e\x08\xd9\x66\x22\x04\x00\x6d\x2b\xa9\x37\x5b\xd8\x71\xf6\xb6\x4a\x06\x33\xa3\xb2\x71\xd8\xf1\xac\x39\xd3\x9e\x6a\x51\x00\xc9\x9e\xff\xd2\xa0\x9d\xf4\xb4\x9d\x1a\x41\x17\x6d\x4d\xe1\xa4\x23\x6c\x81\x90\xbf\xfa\xd2\x51\xa1\x13\xcc\x16\xd4\x99\xac\x21\x2d\xb3\x1b\x26\x49\x7a\x39\x9c\xe1\xac\xc2\xb4\xa6\x3c\xee\xe1\x93\xbf\xb9\x4b\xf9\x1d\xc3\x09\xc7\xba\x46\x64\xb4\xe9\x9c\x74\x57\x86\xb7", 4096); *(uint16_t*)0x20001080 = 2; *(uint16_t*)0x20001082 = htobe16(0x4e22); *(uint8_t*)0x20001084 = 0; *(uint8_t*)0x20001085 = 0; *(uint8_t*)0x20001086 = 0; *(uint8_t*)0x20001087 = 0; *(uint8_t*)0x20001088 = 0; *(uint8_t*)0x20001089 = 0; *(uint8_t*)0x2000108a = 0; *(uint8_t*)0x2000108b = 0; syscall(SYS_sendto, r[0], 0x20000080ul, 0x1000ul, 3ul, 0x20001080ul, 0xcul); break; case 2: *(uint16_t*)0x200011c0 = 2; *(uint16_t*)0x200011c2 = htobe16(0x4e20); *(uint8_t*)0x200011c4 = 0; *(uint8_t*)0x200011c5 = 0; *(uint8_t*)0x200011c6 = 0; *(uint8_t*)0x200011c7 = 0; *(uint8_t*)0x200011c8 = 0; *(uint8_t*)0x200011c9 = 0; *(uint8_t*)0x200011ca = 0; *(uint8_t*)0x200011cb = 0; syscall(SYS_recvfrom, 0xffffff9c, 0x200010c0ul, 0xcdul, 0x802ul, 0x200011c0ul, 0xcul); break; case 3: memcpy((void*)0x20001200, "\x65\x34\x64\x0a\x5e\x77\x48\x51\x1a\x23\xbf\x56\x23", 13); syscall(SYS_setsockopt, -1, 0, 1, 0x20001200ul, 0xdul); break; case 4: *(uint32_t*)0x20001280 = 0xc; res = syscall(SYS_paccept, 0xffffff9c, 0x20001240ul, 0x20001280ul, 0ul); if (res != -1) r[1] = res; break; case 5: *(uint16_t*)0x200012c0 = 0x18; *(uint16_t*)0x200012c2 = htobe16(0x4e23); *(uint32_t*)0x200012c4 = 1; *(uint32_t*)0x200012c8 = 0x800; syscall(SYS_connect, r[1], 0x200012c0ul, 0xcul); break; case 6: *(uint32_t*)0x20002340 = 0x1002; res = syscall(SYS_accept, -1, 0x20001300ul, 0x20002340ul); if (res != -1) r[2] = res; break; case 7: *(uint64_t*)0x200024c0 = 0x20002380; memcpy((void*)0x20002380, "\xce\x0f\xda\xd9\xa6\x4a\x58\xf7\x84\xd8\x08\x7a\xf8\x05\xaa\x2b\xd2\xf9\xb8\x6b\x22\xd9\xb2\xc3\x2c\x58\x73\xc3\xf3\x2b\xef\xbc\x76\xc4\x7e\x31\xe9\x5c\xb5\x77\x20\x09\x97\x41\x06\xdd\x56\xe9\xb7\x7e\x9e\xf2\x1b\x64\xeb\xda\x31\x08\x05\x30\xf8\xdb\xeb\x72\xd1\x92\x5f\x06\xc0\xe6\x16\x3c\x87\x37\x29\x3d\x33\x34\xcd\xfe\x5d\xe4\x21\xf3\x35\x04\xea\xa8\x02\x4b\xcb\x42\xa0\xad\x53\xd6\xbd\x25\xe3\xb6\x65\x03\x62\x96\x98\x53\x80\x33\x00\xc7\x1d\x12\x31\xf7\x3d\x20\x10\x9f\xd2\xb8\x05\xd7\xc0\xde\x06\x68\x00\x18\x86\xe4\xa3\x80\x88\x0e\x16\x9d\xe6\x77\xcb\x12\x4c\xc6\x05\x78\x02\x0f\xfe\xcb\xe8\x38\x19\x65\x69\x72\x96\xf8\x7c\xa1\xdd\x26\xd2\x39\xf0\x0c\x44\xd2\x8f\x44\x04\x68\x97\x8e\xdf\x01\x9a\x5d\xb0\x50\x91\x3f\x84\x18\x95\xd9\xd9\xa4\x2a\x50\xfd\x29\x53\xaf\x0b\xd6\xc6\x92\x83\x5f\x5f\x28\xb4\x67\x68\xfc\x54\x00\x14\xf8\xd3\xee\x3d\x80\x17\x5c\xd9\xbc\xa3\xe5\x2d\x0a\x15\xb8\x87\x73\xf3\xb8\x11\x08\x90\xf4\xdf\xfe\x75\x43\x3f\xda\xba\xc5\x4c\x62\x29\x8a", 242); *(uint64_t*)0x200024c8 = 0xf2; *(uint64_t*)0x200024d0 = 0x20002480; memcpy((void*)0x20002480, "\x80\x24\x2b\xeb\xc8\x1b\xd3\xda\xdc\xb9\x92\xd2\xde\x24\xb8\x13\x00\xa6\x36\xd3\xa6\x4b\xdf\xe9\x31\x33\xe1\x44\x29\xda\x14\xcf\x31\x7e\xde\xd2\x00\xe3\x71\xe3\x4a\xef\x0b\xba\xf2\x72\xa4\xe8\x77\x89\x08", 51); *(uint64_t*)0x200024d8 = 0x33; syscall(SYS_pwritev, r[2], 0x200024c0ul, 2ul, 0x51ul); break; case 8: *(uint32_t*)0x20002540 = 0xc; syscall(SYS_getpeername, r[2], 0x20002500ul, 0x20002540ul); break; case 9: syscall(SYS_dup2, -1, -1); break; case 10: memcpy((void*)0x20000000, "\x48\xf7\xf1\x90\xc6\x85\xfa\xd5\x02\x0b\x2c\x72\x6e\xad\xc8\x3c\x08\x67\xb0\x1c\x6b\x28\xea\x05\xf4\xbd\x05\x44\xeb\x88\x3e\xc3\xd8\x89\x7d\x9a\xee\x86\xbc\xb2\xc9\x0e\xbe\x68\x77\x4c\x20\x65\x70\xc9\x03", 51); break; case 11: memcpy((void*)0x20000040, "\xc4\x22\x7d\xb7\x4b\x0b\x45\x86\x57\xfb\x66\x44\x0f\x38\xdc\xd2\xc4\x81\xf9\x5b\xfe\x0f\x49\xf8\x66\x0f\x3a\x0c\x9b\xb4\x00\x00\x00\xfe\xc4\xa2\xfd\xa6\xfc\xc4\xa1\x4d\xd5\x16\xc4\x01\x94\x59\x6d\x64\x66\x41\x0f\x6c\x23", 55); syz_execute_func(0x20000040); break; case 12: break; case 13: memcpy((void*)0x200000c0, "\x53\x89\x0e\xf7\x06\x9c\xeb\xf4\xab\x2e\x38\x62\xd4\xe8\xf0\xd7\xcd\x39\x04\x66\x11\xd8\x6e\xfa\x40\x3d\x25\x55\x8c\x0d\xe4\xab\x33\xf8\x31\xe6\xf5\xf5\x29\x56\x03\x28\x35\x78\x3b\xf2\xd0\xf5\x81\x7f\x8b\x8d\xda\x73\xc7\x54\x2d\x9f\x0d\x12\xa6\x31\xe2\x5a\x3e\xe4\xdc\xfb\x6a\xe2\xf9\x68\xa8\x25\xda\xc5\x81\x2d\x8c\x6b\x82\x64\xe0\xb7\x8c\x3d\xaa\x0c\x76\x23\x7a\x22\x3a\x71\xf5\x0b\xa3\x6e\x78\x4b\x03\xb1\xf3\x87\x05\xa2\x37\xcf\x14\xc4\x37\xfd\xc2\x36\x3d\xc7\x73\xb1\x94\x6b\xe9\x83\x5b\xd5\x9c\xf8\x39\x00\x38\xfb\x9b\xac\x19\x1e\xc2\x55\xea\xf7\x0e\xa2\xb5\x63\xdb\x02\x24\x60\xb0\x5e\x8d\x6a\xcc\x51\xea\x2d\xc2\x5f\xf0\x6b\x2a\xdd\x98\x89\x0a\x72\x78\x07\x07\x2b\x47\xf3\x8e\xe4\x2d\x63\x67\xe7\xd3\x54\x8d\x3f\x13\xca\x55\x74\x42\x6d\xf2\x94\x62\x6c\x3e\xf4\xb8\xcf\x7a\xea\x48\x30\xb7\x0d\x93\x12\x2e\xfd\x51\xfc\xe4\x84\x96\xa5\xbd\x03\xe3\x05\xf2\xad\x87\x19\x69\xc9\x7c\xef\xf6\xb6\xc2\x28\x6c\x54\x31\xb9\xfd\xbd\x88\x37\x62\x92\x98\xcb\x4e", 239); memcpy((void*)0x200001c0, "\xa1\x85\x22\x4a\x16\xff\x1a\x06\x2f\x6f\x97\x66\xae\xb7\xf5\x84\x08\xb0\x28\x45\x0e\x80\x97\x0d\x92\x50\x11\x4b\x2c\x87\x1d\x5d\x9e\xc6\x7f\x79\x90\xa3\x05\xb4\xbe\x2c\x41\xd3\x5d\x33\x16\xa7\xf4\xc9\xb2\x74\x01\xf8\x44\x0e\x71\xa5\x79\xb7\xf9\xac\xc6\x06\xd2\x0d\xa0\x88\xc7\x07\x7b\xbc\x3c\x36\x1e\x71\xc5\x77\x40\x61\x68\xbc\xc1\xbc\xb7\xf0\x2e\x41\x6e\x3f\x90\x84\x03\xe2\x3d\xb0\xc7\x27\xea\x76\x9d\xeb\xda\x4d\x0e\x52\x4f\x8a\xdf\x7f\x42\x18\x4a\x20\xba\x1a\x23\xf9\xc5\x8d\x46\x91\x4c\xc7\xb1\x2c\x19\x53\x7d\x55\xa4\x0f\xcd\x26\xc6\x8e\xfb\x09\xdc\x0a\xcc\x2e\xe7\x52\x4a\xbe\xc0\xb8\x03\x5a\xd2\xb1\xd1\x94\x33\x1e\x2e\xa4\xe4\x2e\xbc\x53\xd3\x88\x0e\x7c\x0d\xd6\xc5\x79\x02\xc8\x72\x7c\xef\xb0\xfd\x31\x92\xd6\x62", 181); syz_usb_connect(0x1e3d802a, 0xef, 0x200000c0, 0x200001c0); break; case 14: memcpy((void*)0x20000280, "\xb7\x48\xb2\x1b\x78\xea\x22\x21\x6c\x2c\xbf\xdc\xcb\x03\xec\x54\xd2\x0f\x30\xf4\xaf\x46\x2b\x7b\xfd\x5d\x30\x1b\x9a\x4f\xb8\xf9\xbb\xe6\x30\xdd\xe8\xd6\x08\x55\x02\x94\x47\xdf\x51\x12\x0e\x0d\x69\x0a\xe4\xa7\x3e\x5a\x06\x06\x4c\xc0\x6d\x83\x62\x2a\x66\xc3\xcf\x3c\xcd\x92\x0d\xf4\xa9\xde\xc5\x47\xf0\xc8\x53\x54\xb2\xe8\x03\x69\x9f\x52\xff\xc8\x14\x53\x6c\xe5\x19\xc7\xc1\x65\x26\xda\x56\xc6\x5b\x44\x29\xcb\x22\x4a\xd9\xc9\x7f\x63\x7e\xe6\xf2", 111); memcpy((void*)0x20000300, "\xfc\xa1\x69\x1e\x90\xfe\xf7\xc0\x69\x3e\x50\x16\x1f\x6b\xf9\xd6\xbe\x11\x62\x1b\x96\xa6\x5d\x50\x23\xd6\x6e\x18\xc9\xdc\x3b\xb3\x8c\xf4\x79\x30\x6e\xff\x4d\x2c\xf1\x75\xb6\xf8\x52\x15\x44\x6b\x23\x79\xfd\xc7\x32\x74\x56\x6c\x4c\xa7\xce\xc4\xd6\x6a\x48\x19\x12\xaf\xe2\x3a\x3f\x61\xad\xb9\x46\x7e\x5b\xf8\x28\x15\x64\x36\xeb\xe3\xd2\x9e\x30\x73\xe4\x25\x4b\x3a\x73\x4a\xcd\x66\xd1\x4e\xfb\x07\x36\xfc\xad\xff\x4d\xad\x73\xe0\x25\x31\x87\x0c\x30\xfa\xe0\xc3\x78\xc5\x15\x78\x6c\x88\xc1\x29\x27\x36\xcd\xf0\xb6\xa2\xe7\x9b\x47\xa7\x8e\x33\xf5\xe1\xd0\x68\x8a\x6f\x3c\xe2\xd9\xe1\x5b\xd3\xee\x2e\x2a\xfe\x1a\xc5\xc8\x52\x3a\x84\xa2\x08\x75\x5a\x7f\x82\x2f\x3d\x21\x1f\xe3\xa2\x6a\x86\x50\x7d\x98\x58\x3d\x56\x6a\x05\x91\xa7\x80\x2c\xb3\xf9\xf9\xdc\x35\xb9\x11\x0d\xe4\xb2\xf4\xd3\x93\x4b\xb2\x0b\x7a", 199); res = syz_usb_connect(0xa4, 0x6f, 0x20000280, 0x20000300); if (res != -1) r[3] = res; break; case 15: syz_usb_disconnect(r[3]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); loop(); return 0; } : In function 'syz_usb_connect_impl': :636:63: error: unknown type name 'usb_ctrlrequest' :641:55: error: unknown type name 'usb_ctrlrequest' compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor652525316 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/6 (0.43s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:4 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000040)=0x8) sendto(r0, &(0x7f0000000080)="8d360d8e2229aab63aef8e41582b2d02e93c2190e2fe50c1f7f3b29e853f60fb587dd78a2c404615cdf3763b9a53dba141c66b4a485450d66e0a4a281e63e3527c88cdde73010e05449a77aee1e7a35fdddea497119a92fa7fb2d108d6475f90ca55e04b82e53d6ac1138cb913b8dbb0b6f922a1a85461459190969a7d79de9164f3b4e2e9dc65817cd3908bf131ac85e8713459e5da855dd94a0feea76b05dd56d5e0b5222332210506202af0c3718596bf5549077f213886eeb0b3e38b83e237290327d0cc6d5e374a365eccda88ebf8ce4141536b085424aadb2b0c5be557bea12ea53f3fd5b7d3b48edf54f860c8a8e1941e0a56d851b2c08b8d4c9bad81ad649d1479bb60644194385d680441c674f629c50abb98ea4859798a0a3edee95e33f9c2880db8c9279f971bd597b98978bd664047c144af6c7954cc4edb914a618047a063ee7531377216a1f42404fde995936f5d7aba61bb230700ac3390d8fbc62772094fb8e543f39134132c6815d1ebf15bd0068e3b7ea86bb183465b91a431f52fe38bd0e6e077298ae8265685e46961fa82b64c5f757eaf9a7d0f63ed2849b17af0c550118c7e8e5addd917ce997796319e6bcf9bc42b8ba87c94e5a31b1cecb2fde9c571f9a87a88230f8093a7ae80a0c45c3ceec69f1e1f844296045070f3728ec4fa644cd74881db3c72352e4b8318f8834ac6306a5698ce9a5eb314f3f8647067bd6de7c90940645931c310aa55e4268ecbaf64c9d8c9ace54fc9f224746ddd681840c392f274753342ef48ac1973abf5c38d0776bd61c087d7b54b1f93eaed1a7c9f73427e38d5e3ca2cd17fa00c69873921ed8f2b8b9f89509134f723b6980831f5504a65602bd9367a151c570a705910afd9f69116737327c193a8751d9c161b5b2ef4e406055fe79c570f7c3e8334623ef02b9f47eecb78d30db147d4fc90bc91faec2d9181206e41cccde0c21483bfd0c45d8765a13d69e22479c21816dbd590ae51e49f6058449b9d3dbe94075e2e57028f43f70201a1e4875b91697c29deb8c2572a105131c87f7685cad94d1321d4ae5cc6efede11ac80a0e00a63b2ba54fcc5195475c3f1ff572693d00e491a0445c987dedcbe73b69ec13d226b193ec03fa9a27a4a434d148983366c7d8e5bc3cea9fbeffd05b8b0090765159b380ac96429655125921507f97df3e9d41c66b2f5fffd0cad4826577916f941ac7c9ec7ab625ec9390e050c5885dbd2e7131f2794ecad5709e0ac395ad0edee0182822374e701167ad2cfda07ff9e9bddee1c688d483c132e197a9481c9eb0df2cf9669ab107cc936bf2c96268a120a44fb7f178b402ecd9c512f86908f43fea11cc6902c355929b910a523acd16d5931ea41753391a0368e5bbe9e8cd926da120d8440fce2c192b1e5986854de8551320c989533771f1a71fb41ff1c927ffba9e9e25ae533db6a3c804b0b340a0409e110ac76a7b58f912db41e33b115e1c3ae9aa0399edd621a0fd4b7be2176cb49682ee82b2a219baace63b3822b98ba6f48cd34a08143321993c4390b94b138e4adcfd47dd01982e24acb8d464738f44af04ff3353f8683f352306457522e653baa8937950448eef9879dfaa42e9fcca9a968971b60c413f4aa3e0f90b41c7828ad5dbb62aae0cd2d2ef85e248bf12e4d6d75b803aca52bb9616acc37bc8bdab1a66661a5329dc936b1dbc83fd598c57b9ad80ac42c21a6318b3fb8d0d865fffb043217c42f9546c050eb8cce5e3423371a93aff46471d2008c8cd5841f849d1f0d58317353a6d7308f7962d943795bd52a4dd5a8440640273c78ef6ebbeaae9143d5e6ee90cdaa257e132e6d42d02b9567ae69b75bc60f7596a1fdd8179cff323991701062930ce23a29e30023da9d631bf61a6440acc290bdeafbaaea78365f408aea8f864da220e7a560c9ac84bb9c975814c132f97e08b64ccad47ceb08f2941a4438feb76560b1d5e6f3289f50d054e949674eb6c3294cc4a27427650c4a37f53c65c55ca410fa62ee18a829220360a8272f8c0041e2bf33f047928feb0269c438bdf399b1d8f187b2454ea5cd873e352e1d0781570234c6d810c5a16bac9ea9ffafb0c978a022276903a1c653f17d96659cbb30abc1a320c584bdfcc00125270c2d4c90950029f711575dfa828feea3b1dc83c0701dffac1f89536583a0c0995550f862c3ec786c0f8fee0fd94fae0a661313f9e753362336db3ea0296d7fb913ad490bfc9dd155307ab14e67114fcde26d032435cec7d29247deb93bcf7fa48b4ddb5fb7449c0fda083d5a63e03922d5dfb361b7eeb122a094c3b08eacbd43cecc76c29a9bbcd4808bfa6eaeb78d3453e30660d1653569841869e3d8b90f3d047388da51919cf056ce1ce1d455177c95cdb8f76637d5336e82c9e10ddfd33515f7491ef28cbe4c8a477086daeb525d097844879d140965ef0463b3e1780065da2255e68aee903f7b06b0824b151525c56063d4be22ee31b82d2029fef15f38f9008d785dcab9f1454185ec4a3d76ed3aa8d27859f66ae63eddd338ac28f64048e46a5d0731f9b7ebe52218e11e78cb6d8172aea44f2c213ce7f5edfaed81c5de95a86aba484ec2e1950f61e743f11fbd881f2b0c891aa6e94fff4e5d747971313613da54b5483aabe5b12a8e661d455cdf442b86f3cd8b6e95e2ebfba7c62001769d5d9725f1df8ff364ff45f65b16fb2a828638313dbaac9818f990e8590d54b67613430b9f1869b7f2f756e4af19a145105b7b0f7c889b3146533114d001fc2c1b6b285ded35fd0b17857da527e80658f0b717a8c98920f72289896f05a686083fa9e84ee9f0590793b484365159cd18d9290fc7b342b3926bccdc830a519b8abd07e5b885cc4a6046423d5fa976588510cf5b0cfeaa38e7d170feb401bf9b3e4284415b8e2d2b8d73a0bfda6e246d4075c16f3bf8c1d8a1969dc57fc8786b1e4afb4ec6769534debe49ef6873e76289c6442c6d690457af91df631c7b0d4d0a18a43b26803bfe374a81de3c182b4dc50683f8545157b40f4b44db5eff729645421817ff5fdd0b4ca5cc2ba9b23c33256074b0cd5938aacea39e5cb5af7ec444267f1419867e355de6700ae0a63b7a57eaabe21aee216048612ec6c6993a577ca4d7a0071f5680d89baa337a37a5d1af9dc359d9708ddab0bb96323ae8f6a48d2b8b42d47d4a051b55d14116a359899c79011f2db86e08c2fb7c7d836355cd55f33aba9cb80a10c0844011e3ffa01f5472233fbaebe45f044154220094bf7da1a4035c195978e1b97eac6c41010b27dfb5df985ab16d219f415528b0403846b326f0a00f7b73c89933e1a2daa58dd8dee2f91e2d083eb25508ad3b3e916cf7e002140ed65ebe55ed8bec0cea09a5a61f7262aaa61cbf09d16ff6aac48c511fb8220dc5e20c3d4ce6283c53442a5cf408f3e66734208cc4f13a90a9ad6f90c1db802abcff903addba309ad25dd56cf6d37f32f82eb07fce24ac33e48451e7719e323f512a459a172172ff94d41be609aba82bcb7d827dfc73b4875209aa392c6f0d24f95bb900814fbff19c8d51d421270363bc808f29e21e14f6c99a13f8000fbfbc1cae461215fbba52511c9d14aaedb16e3a3725534b5713c554f1e5ebdc2abfaa712cf0d8ff6699cf0949f89b187e58bbac15927a701432f81b61e797136789ae2e824b0a74c553d59b7a1a1d512fec36c863422f0634560064ad2c310895d6d8a1a3f9429f08a7360cd4b4f9f208bf6d210d809796276e7a900ea994d3f8a3c3be28c3384c8d822fd108e8e9a195798149beb3e4eed373edac2bbc957b3f0432bcddc9556b734b19f91d94d21a881fbc882603f7da7f8993a74d5b12670f87aa69885abea718b67a700caf9fac78122a83b282099952664e5e8446a23b4bb3c01b1b4a9dca924fe0210445dd5e8ce3bdf2429463df24de0cb74bfc162847a6177d42feb487c89e1fd76fc59e4feaab91d6fadfa65a872a8128ea56f4914fb55165598db63bd701573f8ca7b78b69fe0983f1aadb99bb0ccbf9e2409d2833f9ab80296f9795c5e5740ebebb71238c6898dbd6e043cd6031c1590edfe763446a96d3806d62ef9a7467f4545d4b958ab916939d985856d06cc9369194329b961c0b767a76624104d3cacb9119d17499d83c1e6f95f4c79de2aae011413facd8962980b5327c7e22b516c841a985646e38126fb50c8bba642076489a8a8cc21cac2e92e6d459d5666b868da0e30121e972324076476490170f513efc5dcf57ce85d81c9fffceefb19ec98278e13abb2f322af44b980f9ef522e98d909507a8eeb7a0bd927d621e0fbfa06a9ca8f2f9978aae462db2cce9240c82942957472c722a0cbc1c84e6c7cd86bf6534d05090396b70cef7c77a29f06e5360d9c5c426988ee7653d022c1b49bc99494bc661c42b97b62c0f5351b5aabcaf1e22a6cb70d348753711f9063f87b292edf6137ac524b2a4cdf8d3a8ca035fd959ea40297645253a33946687bee09f66132f2cbca0f451b82108f4e68683fcef2cb3282d38fe47f6be597a0aba1b637e24fa2ea26f890f5e8cd2e438b0c42319c3f482b21b3b36e9b66907ab9451aa2d5b0d848c958179cd2c138e7a8133d10b952745c6f9c5ad206b13ae83e21236e06a27e60f54c15fdf96c084ee9253af3ae53f1e5c79bf61eef8cd90f382da1f2c072272bf9fc89b4fc6c18a57e197a366fdb5af0ff28131f42690ec69d59fae8c8f43c8f3cf4eacbdcf3e162e492e1bd533abe70bac53f9868c1995921c79d09f67a6b724410a468129f990d150e95663e54551feb97a4304f92ab3db2a43ca841ee3b0f6b62c751f6016b8439d5a08db8d34faa4ba7a7617fe5bbf1f8fcb5a9f55f1a1db83645eb93bde600032bbac895863cc54f09a9fe1e190a08abc6c080badd8245bb9918713ddaead377afbdcbc7cf4d191f6ca2fe2defa45c3c3353c277e1130284cd441da774eb16e7bf11ad0beef302022a18cf0479285df7f64feacacaef8ca50c201cb9001087611c4cd16f1ab6782d7eafae094c93cf301477a678c9ec482baa1d1d1a405494b67b35057b691af44dc3be73e26ab2b6fbe5d2e2117e0c6d0e964b3826a6e057c80e4f0ed78ed1310c24516b95dcefcf5dfd7e79e5e24e6922ade7efdc2242934973f636e300cbe5002f8bb0413a76baee10099b1008e384b8644188932abf79d0f26c66ebd662add68e039212bf4fd801114196e105d958ade15fb451fb5d5d90fee2ecb792bb5c864125bb3e63e0a7b59ff54f5d52ec590708840bbf134e25625690b262e5493a53ef206ce25c6b4dcbf3d8ebab2806f96b6a96eedebb2930fd7230e9601ce4ab66d721e856eedd6704f0b673e0febabd1148469bdf93c890c637c542b5fd4dc21b898c8c0150a1bc2817542e211205dc70be74977c37901fdc734613e5c1f40efbdf19b983abba0ddad01d0ab654b2e34c656090351a515aca39f58b3485da7c0a696952ea618f1f79eb7c55b056eec77e22224bd79d2ad9f597f12dcdd7c7160518ccd77bb5317ac0ea66b6a80a2cc4e28ae3881c59dff4d4684779776bf9e3accc8384f2a1f05cd3cadb345a27669ea1c059e086f421346ae2cf95d19f75941eed79c775eb557e252e08d9662204006d2ba9375bd871f6b64a0633a3b271d8f1ac39d39e6a5100c99effd2a09df4b49d1a41176d4de1a4236c8190bffad251a113cc16d499ac212db31b26497a399ce1acc2b4a63ceee193bfb94bf91dc309c7ba4664b4e99c745786b7", 0x1000, 0x3, &(0x7f0000001080)=@in={0x2, 0x2}, 0xc) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000010c0)=""/205, 0xcd, 0x802, &(0x7f00000011c0)={0x2, 0x0}, 0xc) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001200)="6534640a5e7748511a23bf5623", 0xd) r1 = paccept(0xffffffffffffff9c, &(0x7f0000001240)=@in, &(0x7f0000001280)=0xc, 0x0) connect$inet6(r1, &(0x7f00000012c0)={0x18, 0x3, 0x1, 0x800}, 0xc) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000001300)=@file={0x0, ""/4096}, &(0x7f0000002340)=0x1002) pwritev(r2, &(0x7f00000024c0)=[{&(0x7f0000002380)="ce0fdad9a64a58f784d8087af805aa2bd2f9b86b22d9b2c32c5873c3f32befbc76c47e31e95cb5772009974106dd56e9b77e9ef21b64ebda31080530f8dbeb72d1925f06c0e6163c8737293d3334cdfe5de421f33504eaa8024bcb42a0ad53d6bd25e3b6650362969853803300c71d1231f73d20109fd2b805d7c0de0668001886e4a380880e169de677cb124cc60578020ffecbe8381965697296f87ca1dd26d239f00c44d28f440468978edf019a5db050913f841895d9d9a42a50fd2953af0bd6c692835f5f28b46768fc540014f8d3ee3d80175cd9bca3e52d0a15b88773f3b8110890f4dffe75433fdabac54c62298a", 0xf2}, {&(0x7f0000002480)="80242bebc81bd3dadcb992d2de24b81300a636d3a64bdfe93133e14429da14cf317eded200e371e34aef0bbaf272a4e8778908", 0x33}], 0x2, 0x51) getpeername(r2, &(0x7f0000002500)=@in, &(0x7f0000002540)=0xc) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_ethernet(0x33, &(0x7f0000000000)="48f7f190c685fad5020b2c726eadc83c0867b01c6b28ea05f4bd0544eb883ec3d8897d9aee86bcb2c90ebe68774c206570c903") syz_execute_func(&(0x7f0000000040)="c4227db74b0b458657fb66440f38dcd2c481f95bfe0f49f8660f3a0c9bb4000000fec4a2fda6fcc4a14dd516c40194596d6466410f6c23") syz_extract_tcp_res(&(0x7f0000000080), 0x6, 0x8000) syz_usb_connect(0x1e3d802a, 0xef, &(0x7f00000000c0)="53890ef7069cebf4ab2e3862d4e8f0d7cd39046611d86efa403d25558c0de4ab33f831e6f5f52956032835783bf2d0f5817f8b8dda73c7542d9f0d12a631e25a3ee4dcfb6ae2f968a825dac5812d8c6b8264e0b78c3daa0c76237a223a71f50ba36e784b03b1f38705a237cf14c437fdc2363dc773b1946be9835bd59cf8390038fb9bac191ec255eaf70ea2b563db022460b05e8d6acc51ea2dc25ff06b2add98890a727807072b47f38ee42d6367e7d3548d3f13ca5574426df294626c3ef4b8cf7aea4830b70d93122efd51fce48496a5bd03e305f2ad871969c97ceff6b6c2286c5431b9fdbd8837629298cb4e", &(0x7f00000001c0)="a185224a16ff1a062f6f9766aeb7f58408b028450e80970d9250114b2c871d5d9ec67f7990a305b4be2c41d35d3316a7f4c9b27401f8440e71a579b7f9acc606d20da088c7077bbc3c361e71c577406168bcc1bcb7f02e416e3f908403e23db0c727ea769debda4d0e524f8adf7f42184a20ba1a23f9c58d46914cc7b12c19537d55a40fcd26c68efb09dc0acc2ee7524abec0b8035ad2b1d194331e2ea4e42ebc53d3880e7c0dd6c57902c8727cefb0fd3192d662") r3 = syz_usb_connect(0xa4, 0x6f, &(0x7f0000000280)="b748b21b78ea22216c2cbfdccb03ec54d20f30f4af462b7bfd5d301b9a4fb8f9bbe630dde8d60855029447df51120e0d690ae4a73e5a06064cc06d83622a66c3cf3ccd920df4a9dec547f0c85354b2e803699f52ffc814536ce519c7c16526da56c65b4429cb224ad9c97f637ee6f2", &(0x7f0000000300)="fca1691e90fef7c0693e50161f6bf9d6be11621b96a65d5023d66e18c9dc3bb38cf479306eff4d2cf175b6f85215446b2379fdc73274566c4ca7cec4d66a481912afe23a3f61adb9467e5bf828156436ebe3d29e3073e4254b3a734acd66d14efb0736fcadff4dad73e02531870c30fae0c378c515786c88c1292736cdf0b6a2e79b47a78e33f5e1d0688a6f3ce2d9e15bd3ee2e2afe1ac5c8523a84a208755a7f822f3d211fe3a26a86507d98583d566a0591a7802cb3f9f9dc35b9110de4b2f4d3934bb20b7a") syz_usb_disconnect(r3) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bEndpointAddress; uint8_t bmAttributes; uint16_t wMaxPacketSize; uint8_t bInterval; uint8_t bRefresh; uint8_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint16_t idVendor; uint16_t idProduct; uint16_t bcdDevice; uint8_t iManufacturer; uint8_t iProduct; uint8_t iSerialNumber; uint8_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t wTotalLength; uint8_t bNumInterfaces; uint8_t bConfigurationValue; uint8_t iConfiguration; uint8_t bmAttributes; uint8_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bNumEndpoints; uint8_t bInterfaceClass; uint8_t bInterfaceSubClass; uint8_t bInterfaceProtocol; uint8_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint8_t bNumConfigurations; uint8_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_accept #define SYS_accept 30 #endif #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getpeername #define SYS_getpeername 31 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_pwritev #define SYS_pwritev 290 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 29 #endif #ifndef SYS_sendto #define SYS_sendto 133 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 105 #endif uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: *(uint32_t*)0x20000040 = 8; res = syscall(SYS_accept, -1, 0x20000000ul, 0x20000040ul); if (res != -1) r[0] = res; break; case 1: memcpy((void*)0x20000080, "\x8d\x36\x0d\x8e\x22\x29\xaa\xb6\x3a\xef\x8e\x41\x58\x2b\x2d\x02\xe9\x3c\x21\x90\xe2\xfe\x50\xc1\xf7\xf3\xb2\x9e\x85\x3f\x60\xfb\x58\x7d\xd7\x8a\x2c\x40\x46\x15\xcd\xf3\x76\x3b\x9a\x53\xdb\xa1\x41\xc6\x6b\x4a\x48\x54\x50\xd6\x6e\x0a\x4a\x28\x1e\x63\xe3\x52\x7c\x88\xcd\xde\x73\x01\x0e\x05\x44\x9a\x77\xae\xe1\xe7\xa3\x5f\xdd\xde\xa4\x97\x11\x9a\x92\xfa\x7f\xb2\xd1\x08\xd6\x47\x5f\x90\xca\x55\xe0\x4b\x82\xe5\x3d\x6a\xc1\x13\x8c\xb9\x13\xb8\xdb\xb0\xb6\xf9\x22\xa1\xa8\x54\x61\x45\x91\x90\x96\x9a\x7d\x79\xde\x91\x64\xf3\xb4\xe2\xe9\xdc\x65\x81\x7c\xd3\x90\x8b\xf1\x31\xac\x85\xe8\x71\x34\x59\xe5\xda\x85\x5d\xd9\x4a\x0f\xee\xa7\x6b\x05\xdd\x56\xd5\xe0\xb5\x22\x23\x32\x21\x05\x06\x20\x2a\xf0\xc3\x71\x85\x96\xbf\x55\x49\x07\x7f\x21\x38\x86\xee\xb0\xb3\xe3\x8b\x83\xe2\x37\x29\x03\x27\xd0\xcc\x6d\x5e\x37\x4a\x36\x5e\xcc\xda\x88\xeb\xf8\xce\x41\x41\x53\x6b\x08\x54\x24\xaa\xdb\x2b\x0c\x5b\xe5\x57\xbe\xa1\x2e\xa5\x3f\x3f\xd5\xb7\xd3\xb4\x8e\xdf\x54\xf8\x60\xc8\xa8\xe1\x94\x1e\x0a\x56\xd8\x51\xb2\xc0\x8b\x8d\x4c\x9b\xad\x81\xad\x64\x9d\x14\x79\xbb\x60\x64\x41\x94\x38\x5d\x68\x04\x41\xc6\x74\xf6\x29\xc5\x0a\xbb\x98\xea\x48\x59\x79\x8a\x0a\x3e\xde\xe9\x5e\x33\xf9\xc2\x88\x0d\xb8\xc9\x27\x9f\x97\x1b\xd5\x97\xb9\x89\x78\xbd\x66\x40\x47\xc1\x44\xaf\x6c\x79\x54\xcc\x4e\xdb\x91\x4a\x61\x80\x47\xa0\x63\xee\x75\x31\x37\x72\x16\xa1\xf4\x24\x04\xfd\xe9\x95\x93\x6f\x5d\x7a\xba\x61\xbb\x23\x07\x00\xac\x33\x90\xd8\xfb\xc6\x27\x72\x09\x4f\xb8\xe5\x43\xf3\x91\x34\x13\x2c\x68\x15\xd1\xeb\xf1\x5b\xd0\x06\x8e\x3b\x7e\xa8\x6b\xb1\x83\x46\x5b\x91\xa4\x31\xf5\x2f\xe3\x8b\xd0\xe6\xe0\x77\x29\x8a\xe8\x26\x56\x85\xe4\x69\x61\xfa\x82\xb6\x4c\x5f\x75\x7e\xaf\x9a\x7d\x0f\x63\xed\x28\x49\xb1\x7a\xf0\xc5\x50\x11\x8c\x7e\x8e\x5a\xdd\xd9\x17\xce\x99\x77\x96\x31\x9e\x6b\xcf\x9b\xc4\x2b\x8b\xa8\x7c\x94\xe5\xa3\x1b\x1c\xec\xb2\xfd\xe9\xc5\x71\xf9\xa8\x7a\x88\x23\x0f\x80\x93\xa7\xae\x80\xa0\xc4\x5c\x3c\xee\xc6\x9f\x1e\x1f\x84\x42\x96\x04\x50\x70\xf3\x72\x8e\xc4\xfa\x64\x4c\xd7\x48\x81\xdb\x3c\x72\x35\x2e\x4b\x83\x18\xf8\x83\x4a\xc6\x30\x6a\x56\x98\xce\x9a\x5e\xb3\x14\xf3\xf8\x64\x70\x67\xbd\x6d\xe7\xc9\x09\x40\x64\x59\x31\xc3\x10\xaa\x55\xe4\x26\x8e\xcb\xaf\x64\xc9\xd8\xc9\xac\xe5\x4f\xc9\xf2\x24\x74\x6d\xdd\x68\x18\x40\xc3\x92\xf2\x74\x75\x33\x42\xef\x48\xac\x19\x73\xab\xf5\xc3\x8d\x07\x76\xbd\x61\xc0\x87\xd7\xb5\x4b\x1f\x93\xea\xed\x1a\x7c\x9f\x73\x42\x7e\x38\xd5\xe3\xca\x2c\xd1\x7f\xa0\x0c\x69\x87\x39\x21\xed\x8f\x2b\x8b\x9f\x89\x50\x91\x34\xf7\x23\xb6\x98\x08\x31\xf5\x50\x4a\x65\x60\x2b\xd9\x36\x7a\x15\x1c\x57\x0a\x70\x59\x10\xaf\xd9\xf6\x91\x16\x73\x73\x27\xc1\x93\xa8\x75\x1d\x9c\x16\x1b\x5b\x2e\xf4\xe4\x06\x05\x5f\xe7\x9c\x57\x0f\x7c\x3e\x83\x34\x62\x3e\xf0\x2b\x9f\x47\xee\xcb\x78\xd3\x0d\xb1\x47\xd4\xfc\x90\xbc\x91\xfa\xec\x2d\x91\x81\x20\x6e\x41\xcc\xcd\xe0\xc2\x14\x83\xbf\xd0\xc4\x5d\x87\x65\xa1\x3d\x69\xe2\x24\x79\xc2\x18\x16\xdb\xd5\x90\xae\x51\xe4\x9f\x60\x58\x44\x9b\x9d\x3d\xbe\x94\x07\x5e\x2e\x57\x02\x8f\x43\xf7\x02\x01\xa1\xe4\x87\x5b\x91\x69\x7c\x29\xde\xb8\xc2\x57\x2a\x10\x51\x31\xc8\x7f\x76\x85\xca\xd9\x4d\x13\x21\xd4\xae\x5c\xc6\xef\xed\xe1\x1a\xc8\x0a\x0e\x00\xa6\x3b\x2b\xa5\x4f\xcc\x51\x95\x47\x5c\x3f\x1f\xf5\x72\x69\x3d\x00\xe4\x91\xa0\x44\x5c\x98\x7d\xed\xcb\xe7\x3b\x69\xec\x13\xd2\x26\xb1\x93\xec\x03\xfa\x9a\x27\xa4\xa4\x34\xd1\x48\x98\x33\x66\xc7\xd8\xe5\xbc\x3c\xea\x9f\xbe\xff\xd0\x5b\x8b\x00\x90\x76\x51\x59\xb3\x80\xac\x96\x42\x96\x55\x12\x59\x21\x50\x7f\x97\xdf\x3e\x9d\x41\xc6\x6b\x2f\x5f\xff\xd0\xca\xd4\x82\x65\x77\x91\x6f\x94\x1a\xc7\xc9\xec\x7a\xb6\x25\xec\x93\x90\xe0\x50\xc5\x88\x5d\xbd\x2e\x71\x31\xf2\x79\x4e\xca\xd5\x70\x9e\x0a\xc3\x95\xad\x0e\xde\xe0\x18\x28\x22\x37\x4e\x70\x11\x67\xad\x2c\xfd\xa0\x7f\xf9\xe9\xbd\xde\xe1\xc6\x88\xd4\x83\xc1\x32\xe1\x97\xa9\x48\x1c\x9e\xb0\xdf\x2c\xf9\x66\x9a\xb1\x07\xcc\x93\x6b\xf2\xc9\x62\x68\xa1\x20\xa4\x4f\xb7\xf1\x78\xb4\x02\xec\xd9\xc5\x12\xf8\x69\x08\xf4\x3f\xea\x11\xcc\x69\x02\xc3\x55\x92\x9b\x91\x0a\x52\x3a\xcd\x16\xd5\x93\x1e\xa4\x17\x53\x39\x1a\x03\x68\xe5\xbb\xe9\xe8\xcd\x92\x6d\xa1\x20\xd8\x44\x0f\xce\x2c\x19\x2b\x1e\x59\x86\x85\x4d\xe8\x55\x13\x20\xc9\x89\x53\x37\x71\xf1\xa7\x1f\xb4\x1f\xf1\xc9\x27\xff\xba\x9e\x9e\x25\xae\x53\x3d\xb6\xa3\xc8\x04\xb0\xb3\x40\xa0\x40\x9e\x11\x0a\xc7\x6a\x7b\x58\xf9\x12\xdb\x41\xe3\x3b\x11\x5e\x1c\x3a\xe9\xaa\x03\x99\xed\xd6\x21\xa0\xfd\x4b\x7b\xe2\x17\x6c\xb4\x96\x82\xee\x82\xb2\xa2\x19\xba\xac\xe6\x3b\x38\x22\xb9\x8b\xa6\xf4\x8c\xd3\x4a\x08\x14\x33\x21\x99\x3c\x43\x90\xb9\x4b\x13\x8e\x4a\xdc\xfd\x47\xdd\x01\x98\x2e\x24\xac\xb8\xd4\x64\x73\x8f\x44\xaf\x04\xff\x33\x53\xf8\x68\x3f\x35\x23\x06\x45\x75\x22\xe6\x53\xba\xa8\x93\x79\x50\x44\x8e\xef\x98\x79\xdf\xaa\x42\xe9\xfc\xca\x9a\x96\x89\x71\xb6\x0c\x41\x3f\x4a\xa3\xe0\xf9\x0b\x41\xc7\x82\x8a\xd5\xdb\xb6\x2a\xae\x0c\xd2\xd2\xef\x85\xe2\x48\xbf\x12\xe4\xd6\xd7\x5b\x80\x3a\xca\x52\xbb\x96\x16\xac\xc3\x7b\xc8\xbd\xab\x1a\x66\x66\x1a\x53\x29\xdc\x93\x6b\x1d\xbc\x83\xfd\x59\x8c\x57\xb9\xad\x80\xac\x42\xc2\x1a\x63\x18\xb3\xfb\x8d\x0d\x86\x5f\xff\xb0\x43\x21\x7c\x42\xf9\x54\x6c\x05\x0e\xb8\xcc\xe5\xe3\x42\x33\x71\xa9\x3a\xff\x46\x47\x1d\x20\x08\xc8\xcd\x58\x41\xf8\x49\xd1\xf0\xd5\x83\x17\x35\x3a\x6d\x73\x08\xf7\x96\x2d\x94\x37\x95\xbd\x52\xa4\xdd\x5a\x84\x40\x64\x02\x73\xc7\x8e\xf6\xeb\xbe\xaa\xe9\x14\x3d\x5e\x6e\xe9\x0c\xda\xa2\x57\xe1\x32\xe6\xd4\x2d\x02\xb9\x56\x7a\xe6\x9b\x75\xbc\x60\xf7\x59\x6a\x1f\xdd\x81\x79\xcf\xf3\x23\x99\x17\x01\x06\x29\x30\xce\x23\xa2\x9e\x30\x02\x3d\xa9\xd6\x31\xbf\x61\xa6\x44\x0a\xcc\x29\x0b\xde\xaf\xba\xae\xa7\x83\x65\xf4\x08\xae\xa8\xf8\x64\xda\x22\x0e\x7a\x56\x0c\x9a\xc8\x4b\xb9\xc9\x75\x81\x4c\x13\x2f\x97\xe0\x8b\x64\xcc\xad\x47\xce\xb0\x8f\x29\x41\xa4\x43\x8f\xeb\x76\x56\x0b\x1d\x5e\x6f\x32\x89\xf5\x0d\x05\x4e\x94\x96\x74\xeb\x6c\x32\x94\xcc\x4a\x27\x42\x76\x50\xc4\xa3\x7f\x53\xc6\x5c\x55\xca\x41\x0f\xa6\x2e\xe1\x8a\x82\x92\x20\x36\x0a\x82\x72\xf8\xc0\x04\x1e\x2b\xf3\x3f\x04\x79\x28\xfe\xb0\x26\x9c\x43\x8b\xdf\x39\x9b\x1d\x8f\x18\x7b\x24\x54\xea\x5c\xd8\x73\xe3\x52\xe1\xd0\x78\x15\x70\x23\x4c\x6d\x81\x0c\x5a\x16\xba\xc9\xea\x9f\xfa\xfb\x0c\x97\x8a\x02\x22\x76\x90\x3a\x1c\x65\x3f\x17\xd9\x66\x59\xcb\xb3\x0a\xbc\x1a\x32\x0c\x58\x4b\xdf\xcc\x00\x12\x52\x70\xc2\xd4\xc9\x09\x50\x02\x9f\x71\x15\x75\xdf\xa8\x28\xfe\xea\x3b\x1d\xc8\x3c\x07\x01\xdf\xfa\xc1\xf8\x95\x36\x58\x3a\x0c\x09\x95\x55\x0f\x86\x2c\x3e\xc7\x86\xc0\xf8\xfe\xe0\xfd\x94\xfa\xe0\xa6\x61\x31\x3f\x9e\x75\x33\x62\x33\x6d\xb3\xea\x02\x96\xd7\xfb\x91\x3a\xd4\x90\xbf\xc9\xdd\x15\x53\x07\xab\x14\xe6\x71\x14\xfc\xde\x26\xd0\x32\x43\x5c\xec\x7d\x29\x24\x7d\xeb\x93\xbc\xf7\xfa\x48\xb4\xdd\xb5\xfb\x74\x49\xc0\xfd\xa0\x83\xd5\xa6\x3e\x03\x92\x2d\x5d\xfb\x36\x1b\x7e\xeb\x12\x2a\x09\x4c\x3b\x08\xea\xcb\xd4\x3c\xec\xc7\x6c\x29\xa9\xbb\xcd\x48\x08\xbf\xa6\xea\xeb\x78\xd3\x45\x3e\x30\x66\x0d\x16\x53\x56\x98\x41\x86\x9e\x3d\x8b\x90\xf3\xd0\x47\x38\x8d\xa5\x19\x19\xcf\x05\x6c\xe1\xce\x1d\x45\x51\x77\xc9\x5c\xdb\x8f\x76\x63\x7d\x53\x36\xe8\x2c\x9e\x10\xdd\xfd\x33\x51\x5f\x74\x91\xef\x28\xcb\xe4\xc8\xa4\x77\x08\x6d\xae\xb5\x25\xd0\x97\x84\x48\x79\xd1\x40\x96\x5e\xf0\x46\x3b\x3e\x17\x80\x06\x5d\xa2\x25\x5e\x68\xae\xe9\x03\xf7\xb0\x6b\x08\x24\xb1\x51\x52\x5c\x56\x06\x3d\x4b\xe2\x2e\xe3\x1b\x82\xd2\x02\x9f\xef\x15\xf3\x8f\x90\x08\xd7\x85\xdc\xab\x9f\x14\x54\x18\x5e\xc4\xa3\xd7\x6e\xd3\xaa\x8d\x27\x85\x9f\x66\xae\x63\xed\xdd\x33\x8a\xc2\x8f\x64\x04\x8e\x46\xa5\xd0\x73\x1f\x9b\x7e\xbe\x52\x21\x8e\x11\xe7\x8c\xb6\xd8\x17\x2a\xea\x44\xf2\xc2\x13\xce\x7f\x5e\xdf\xae\xd8\x1c\x5d\xe9\x5a\x86\xab\xa4\x84\xec\x2e\x19\x50\xf6\x1e\x74\x3f\x11\xfb\xd8\x81\xf2\xb0\xc8\x91\xaa\x6e\x94\xff\xf4\xe5\xd7\x47\x97\x13\x13\x61\x3d\xa5\x4b\x54\x83\xaa\xbe\x5b\x12\xa8\xe6\x61\xd4\x55\xcd\xf4\x42\xb8\x6f\x3c\xd8\xb6\xe9\x5e\x2e\xbf\xba\x7c\x62\x00\x17\x69\xd5\xd9\x72\x5f\x1d\xf8\xff\x36\x4f\xf4\x5f\x65\xb1\x6f\xb2\xa8\x28\x63\x83\x13\xdb\xaa\xc9\x81\x8f\x99\x0e\x85\x90\xd5\x4b\x67\x61\x34\x30\xb9\xf1\x86\x9b\x7f\x2f\x75\x6e\x4a\xf1\x9a\x14\x51\x05\xb7\xb0\xf7\xc8\x89\xb3\x14\x65\x33\x11\x4d\x00\x1f\xc2\xc1\xb6\xb2\x85\xde\xd3\x5f\xd0\xb1\x78\x57\xda\x52\x7e\x80\x65\x8f\x0b\x71\x7a\x8c\x98\x92\x0f\x72\x28\x98\x96\xf0\x5a\x68\x60\x83\xfa\x9e\x84\xee\x9f\x05\x90\x79\x3b\x48\x43\x65\x15\x9c\xd1\x8d\x92\x90\xfc\x7b\x34\x2b\x39\x26\xbc\xcd\xc8\x30\xa5\x19\xb8\xab\xd0\x7e\x5b\x88\x5c\xc4\xa6\x04\x64\x23\xd5\xfa\x97\x65\x88\x51\x0c\xf5\xb0\xcf\xea\xa3\x8e\x7d\x17\x0f\xeb\x40\x1b\xf9\xb3\xe4\x28\x44\x15\xb8\xe2\xd2\xb8\xd7\x3a\x0b\xfd\xa6\xe2\x46\xd4\x07\x5c\x16\xf3\xbf\x8c\x1d\x8a\x19\x69\xdc\x57\xfc\x87\x86\xb1\xe4\xaf\xb4\xec\x67\x69\x53\x4d\xeb\xe4\x9e\xf6\x87\x3e\x76\x28\x9c\x64\x42\xc6\xd6\x90\x45\x7a\xf9\x1d\xf6\x31\xc7\xb0\xd4\xd0\xa1\x8a\x43\xb2\x68\x03\xbf\xe3\x74\xa8\x1d\xe3\xc1\x82\xb4\xdc\x50\x68\x3f\x85\x45\x15\x7b\x40\xf4\xb4\x4d\xb5\xef\xf7\x29\x64\x54\x21\x81\x7f\xf5\xfd\xd0\xb4\xca\x5c\xc2\xba\x9b\x23\xc3\x32\x56\x07\x4b\x0c\xd5\x93\x8a\xac\xea\x39\xe5\xcb\x5a\xf7\xec\x44\x42\x67\xf1\x41\x98\x67\xe3\x55\xde\x67\x00\xae\x0a\x63\xb7\xa5\x7e\xaa\xbe\x21\xae\xe2\x16\x04\x86\x12\xec\x6c\x69\x93\xa5\x77\xca\x4d\x7a\x00\x71\xf5\x68\x0d\x89\xba\xa3\x37\xa3\x7a\x5d\x1a\xf9\xdc\x35\x9d\x97\x08\xdd\xab\x0b\xb9\x63\x23\xae\x8f\x6a\x48\xd2\xb8\xb4\x2d\x47\xd4\xa0\x51\xb5\x5d\x14\x11\x6a\x35\x98\x99\xc7\x90\x11\xf2\xdb\x86\xe0\x8c\x2f\xb7\xc7\xd8\x36\x35\x5c\xd5\x5f\x33\xab\xa9\xcb\x80\xa1\x0c\x08\x44\x01\x1e\x3f\xfa\x01\xf5\x47\x22\x33\xfb\xae\xbe\x45\xf0\x44\x15\x42\x20\x09\x4b\xf7\xda\x1a\x40\x35\xc1\x95\x97\x8e\x1b\x97\xea\xc6\xc4\x10\x10\xb2\x7d\xfb\x5d\xf9\x85\xab\x16\xd2\x19\xf4\x15\x52\x8b\x04\x03\x84\x6b\x32\x6f\x0a\x00\xf7\xb7\x3c\x89\x93\x3e\x1a\x2d\xaa\x58\xdd\x8d\xee\x2f\x91\xe2\xd0\x83\xeb\x25\x50\x8a\xd3\xb3\xe9\x16\xcf\x7e\x00\x21\x40\xed\x65\xeb\xe5\x5e\xd8\xbe\xc0\xce\xa0\x9a\x5a\x61\xf7\x26\x2a\xaa\x61\xcb\xf0\x9d\x16\xff\x6a\xac\x48\xc5\x11\xfb\x82\x20\xdc\x5e\x20\xc3\xd4\xce\x62\x83\xc5\x34\x42\xa5\xcf\x40\x8f\x3e\x66\x73\x42\x08\xcc\x4f\x13\xa9\x0a\x9a\xd6\xf9\x0c\x1d\xb8\x02\xab\xcf\xf9\x03\xad\xdb\xa3\x09\xad\x25\xdd\x56\xcf\x6d\x37\xf3\x2f\x82\xeb\x07\xfc\xe2\x4a\xc3\x3e\x48\x45\x1e\x77\x19\xe3\x23\xf5\x12\xa4\x59\xa1\x72\x17\x2f\xf9\x4d\x41\xbe\x60\x9a\xba\x82\xbc\xb7\xd8\x27\xdf\xc7\x3b\x48\x75\x20\x9a\xa3\x92\xc6\xf0\xd2\x4f\x95\xbb\x90\x08\x14\xfb\xff\x19\xc8\xd5\x1d\x42\x12\x70\x36\x3b\xc8\x08\xf2\x9e\x21\xe1\x4f\x6c\x99\xa1\x3f\x80\x00\xfb\xfb\xc1\xca\xe4\x61\x21\x5f\xbb\xa5\x25\x11\xc9\xd1\x4a\xae\xdb\x16\xe3\xa3\x72\x55\x34\xb5\x71\x3c\x55\x4f\x1e\x5e\xbd\xc2\xab\xfa\xa7\x12\xcf\x0d\x8f\xf6\x69\x9c\xf0\x94\x9f\x89\xb1\x87\xe5\x8b\xba\xc1\x59\x27\xa7\x01\x43\x2f\x81\xb6\x1e\x79\x71\x36\x78\x9a\xe2\xe8\x24\xb0\xa7\x4c\x55\x3d\x59\xb7\xa1\xa1\xd5\x12\xfe\xc3\x6c\x86\x34\x22\xf0\x63\x45\x60\x06\x4a\xd2\xc3\x10\x89\x5d\x6d\x8a\x1a\x3f\x94\x29\xf0\x8a\x73\x60\xcd\x4b\x4f\x9f\x20\x8b\xf6\xd2\x10\xd8\x09\x79\x62\x76\xe7\xa9\x00\xea\x99\x4d\x3f\x8a\x3c\x3b\xe2\x8c\x33\x84\xc8\xd8\x22\xfd\x10\x8e\x8e\x9a\x19\x57\x98\x14\x9b\xeb\x3e\x4e\xed\x37\x3e\xda\xc2\xbb\xc9\x57\xb3\xf0\x43\x2b\xcd\xdc\x95\x56\xb7\x34\xb1\x9f\x91\xd9\x4d\x21\xa8\x81\xfb\xc8\x82\x60\x3f\x7d\xa7\xf8\x99\x3a\x74\xd5\xb1\x26\x70\xf8\x7a\xa6\x98\x85\xab\xea\x71\x8b\x67\xa7\x00\xca\xf9\xfa\xc7\x81\x22\xa8\x3b\x28\x20\x99\x95\x26\x64\xe5\xe8\x44\x6a\x23\xb4\xbb\x3c\x01\xb1\xb4\xa9\xdc\xa9\x24\xfe\x02\x10\x44\x5d\xd5\xe8\xce\x3b\xdf\x24\x29\x46\x3d\xf2\x4d\xe0\xcb\x74\xbf\xc1\x62\x84\x7a\x61\x77\xd4\x2f\xeb\x48\x7c\x89\xe1\xfd\x76\xfc\x59\xe4\xfe\xaa\xb9\x1d\x6f\xad\xfa\x65\xa8\x72\xa8\x12\x8e\xa5\x6f\x49\x14\xfb\x55\x16\x55\x98\xdb\x63\xbd\x70\x15\x73\xf8\xca\x7b\x78\xb6\x9f\xe0\x98\x3f\x1a\xad\xb9\x9b\xb0\xcc\xbf\x9e\x24\x09\xd2\x83\x3f\x9a\xb8\x02\x96\xf9\x79\x5c\x5e\x57\x40\xeb\xeb\xb7\x12\x38\xc6\x89\x8d\xbd\x6e\x04\x3c\xd6\x03\x1c\x15\x90\xed\xfe\x76\x34\x46\xa9\x6d\x38\x06\xd6\x2e\xf9\xa7\x46\x7f\x45\x45\xd4\xb9\x58\xab\x91\x69\x39\xd9\x85\x85\x6d\x06\xcc\x93\x69\x19\x43\x29\xb9\x61\xc0\xb7\x67\xa7\x66\x24\x10\x4d\x3c\xac\xb9\x11\x9d\x17\x49\x9d\x83\xc1\xe6\xf9\x5f\x4c\x79\xde\x2a\xae\x01\x14\x13\xfa\xcd\x89\x62\x98\x0b\x53\x27\xc7\xe2\x2b\x51\x6c\x84\x1a\x98\x56\x46\xe3\x81\x26\xfb\x50\xc8\xbb\xa6\x42\x07\x64\x89\xa8\xa8\xcc\x21\xca\xc2\xe9\x2e\x6d\x45\x9d\x56\x66\xb8\x68\xda\x0e\x30\x12\x1e\x97\x23\x24\x07\x64\x76\x49\x01\x70\xf5\x13\xef\xc5\xdc\xf5\x7c\xe8\x5d\x81\xc9\xff\xfc\xee\xfb\x19\xec\x98\x27\x8e\x13\xab\xb2\xf3\x22\xaf\x44\xb9\x80\xf9\xef\x52\x2e\x98\xd9\x09\x50\x7a\x8e\xeb\x7a\x0b\xd9\x27\xd6\x21\xe0\xfb\xfa\x06\xa9\xca\x8f\x2f\x99\x78\xaa\xe4\x62\xdb\x2c\xce\x92\x40\xc8\x29\x42\x95\x74\x72\xc7\x22\xa0\xcb\xc1\xc8\x4e\x6c\x7c\xd8\x6b\xf6\x53\x4d\x05\x09\x03\x96\xb7\x0c\xef\x7c\x77\xa2\x9f\x06\xe5\x36\x0d\x9c\x5c\x42\x69\x88\xee\x76\x53\xd0\x22\xc1\xb4\x9b\xc9\x94\x94\xbc\x66\x1c\x42\xb9\x7b\x62\xc0\xf5\x35\x1b\x5a\xab\xca\xf1\xe2\x2a\x6c\xb7\x0d\x34\x87\x53\x71\x1f\x90\x63\xf8\x7b\x29\x2e\xdf\x61\x37\xac\x52\x4b\x2a\x4c\xdf\x8d\x3a\x8c\xa0\x35\xfd\x95\x9e\xa4\x02\x97\x64\x52\x53\xa3\x39\x46\x68\x7b\xee\x09\xf6\x61\x32\xf2\xcb\xca\x0f\x45\x1b\x82\x10\x8f\x4e\x68\x68\x3f\xce\xf2\xcb\x32\x82\xd3\x8f\xe4\x7f\x6b\xe5\x97\xa0\xab\xa1\xb6\x37\xe2\x4f\xa2\xea\x26\xf8\x90\xf5\xe8\xcd\x2e\x43\x8b\x0c\x42\x31\x9c\x3f\x48\x2b\x21\xb3\xb3\x6e\x9b\x66\x90\x7a\xb9\x45\x1a\xa2\xd5\xb0\xd8\x48\xc9\x58\x17\x9c\xd2\xc1\x38\xe7\xa8\x13\x3d\x10\xb9\x52\x74\x5c\x6f\x9c\x5a\xd2\x06\xb1\x3a\xe8\x3e\x21\x23\x6e\x06\xa2\x7e\x60\xf5\x4c\x15\xfd\xf9\x6c\x08\x4e\xe9\x25\x3a\xf3\xae\x53\xf1\xe5\xc7\x9b\xf6\x1e\xef\x8c\xd9\x0f\x38\x2d\xa1\xf2\xc0\x72\x27\x2b\xf9\xfc\x89\xb4\xfc\x6c\x18\xa5\x7e\x19\x7a\x36\x6f\xdb\x5a\xf0\xff\x28\x13\x1f\x42\x69\x0e\xc6\x9d\x59\xfa\xe8\xc8\xf4\x3c\x8f\x3c\xf4\xea\xcb\xdc\xf3\xe1\x62\xe4\x92\xe1\xbd\x53\x3a\xbe\x70\xba\xc5\x3f\x98\x68\xc1\x99\x59\x21\xc7\x9d\x09\xf6\x7a\x6b\x72\x44\x10\xa4\x68\x12\x9f\x99\x0d\x15\x0e\x95\x66\x3e\x54\x55\x1f\xeb\x97\xa4\x30\x4f\x92\xab\x3d\xb2\xa4\x3c\xa8\x41\xee\x3b\x0f\x6b\x62\xc7\x51\xf6\x01\x6b\x84\x39\xd5\xa0\x8d\xb8\xd3\x4f\xaa\x4b\xa7\xa7\x61\x7f\xe5\xbb\xf1\xf8\xfc\xb5\xa9\xf5\x5f\x1a\x1d\xb8\x36\x45\xeb\x93\xbd\xe6\x00\x03\x2b\xba\xc8\x95\x86\x3c\xc5\x4f\x09\xa9\xfe\x1e\x19\x0a\x08\xab\xc6\xc0\x80\xba\xdd\x82\x45\xbb\x99\x18\x71\x3d\xda\xea\xd3\x77\xaf\xbd\xcb\xc7\xcf\x4d\x19\x1f\x6c\xa2\xfe\x2d\xef\xa4\x5c\x3c\x33\x53\xc2\x77\xe1\x13\x02\x84\xcd\x44\x1d\xa7\x74\xeb\x16\xe7\xbf\x11\xad\x0b\xee\xf3\x02\x02\x2a\x18\xcf\x04\x79\x28\x5d\xf7\xf6\x4f\xea\xca\xca\xef\x8c\xa5\x0c\x20\x1c\xb9\x00\x10\x87\x61\x1c\x4c\xd1\x6f\x1a\xb6\x78\x2d\x7e\xaf\xae\x09\x4c\x93\xcf\x30\x14\x77\xa6\x78\xc9\xec\x48\x2b\xaa\x1d\x1d\x1a\x40\x54\x94\xb6\x7b\x35\x05\x7b\x69\x1a\xf4\x4d\xc3\xbe\x73\xe2\x6a\xb2\xb6\xfb\xe5\xd2\xe2\x11\x7e\x0c\x6d\x0e\x96\x4b\x38\x26\xa6\xe0\x57\xc8\x0e\x4f\x0e\xd7\x8e\xd1\x31\x0c\x24\x51\x6b\x95\xdc\xef\xcf\x5d\xfd\x7e\x79\xe5\xe2\x4e\x69\x22\xad\xe7\xef\xdc\x22\x42\x93\x49\x73\xf6\x36\xe3\x00\xcb\xe5\x00\x2f\x8b\xb0\x41\x3a\x76\xba\xee\x10\x09\x9b\x10\x08\xe3\x84\xb8\x64\x41\x88\x93\x2a\xbf\x79\xd0\xf2\x6c\x66\xeb\xd6\x62\xad\xd6\x8e\x03\x92\x12\xbf\x4f\xd8\x01\x11\x41\x96\xe1\x05\xd9\x58\xad\xe1\x5f\xb4\x51\xfb\x5d\x5d\x90\xfe\xe2\xec\xb7\x92\xbb\x5c\x86\x41\x25\xbb\x3e\x63\xe0\xa7\xb5\x9f\xf5\x4f\x5d\x52\xec\x59\x07\x08\x84\x0b\xbf\x13\x4e\x25\x62\x56\x90\xb2\x62\xe5\x49\x3a\x53\xef\x20\x6c\xe2\x5c\x6b\x4d\xcb\xf3\xd8\xeb\xab\x28\x06\xf9\x6b\x6a\x96\xee\xde\xbb\x29\x30\xfd\x72\x30\xe9\x60\x1c\xe4\xab\x66\xd7\x21\xe8\x56\xee\xdd\x67\x04\xf0\xb6\x73\xe0\xfe\xba\xbd\x11\x48\x46\x9b\xdf\x93\xc8\x90\xc6\x37\xc5\x42\xb5\xfd\x4d\xc2\x1b\x89\x8c\x8c\x01\x50\xa1\xbc\x28\x17\x54\x2e\x21\x12\x05\xdc\x70\xbe\x74\x97\x7c\x37\x90\x1f\xdc\x73\x46\x13\xe5\xc1\xf4\x0e\xfb\xdf\x19\xb9\x83\xab\xba\x0d\xda\xd0\x1d\x0a\xb6\x54\xb2\xe3\x4c\x65\x60\x90\x35\x1a\x51\x5a\xca\x39\xf5\x8b\x34\x85\xda\x7c\x0a\x69\x69\x52\xea\x61\x8f\x1f\x79\xeb\x7c\x55\xb0\x56\xee\xc7\x7e\x22\x22\x4b\xd7\x9d\x2a\xd9\xf5\x97\xf1\x2d\xcd\xd7\xc7\x16\x05\x18\xcc\xd7\x7b\xb5\x31\x7a\xc0\xea\x66\xb6\xa8\x0a\x2c\xc4\xe2\x8a\xe3\x88\x1c\x59\xdf\xf4\xd4\x68\x47\x79\x77\x6b\xf9\xe3\xac\xcc\x83\x84\xf2\xa1\xf0\x5c\xd3\xca\xdb\x34\x5a\x27\x66\x9e\xa1\xc0\x59\xe0\x86\xf4\x21\x34\x6a\xe2\xcf\x95\xd1\x9f\x75\x94\x1e\xed\x79\xc7\x75\xeb\x55\x7e\x25\x2e\x08\xd9\x66\x22\x04\x00\x6d\x2b\xa9\x37\x5b\xd8\x71\xf6\xb6\x4a\x06\x33\xa3\xb2\x71\xd8\xf1\xac\x39\xd3\x9e\x6a\x51\x00\xc9\x9e\xff\xd2\xa0\x9d\xf4\xb4\x9d\x1a\x41\x17\x6d\x4d\xe1\xa4\x23\x6c\x81\x90\xbf\xfa\xd2\x51\xa1\x13\xcc\x16\xd4\x99\xac\x21\x2d\xb3\x1b\x26\x49\x7a\x39\x9c\xe1\xac\xc2\xb4\xa6\x3c\xee\xe1\x93\xbf\xb9\x4b\xf9\x1d\xc3\x09\xc7\xba\x46\x64\xb4\xe9\x9c\x74\x57\x86\xb7", 4096); *(uint16_t*)0x20001080 = 2; *(uint16_t*)0x20001082 = htobe16(0x4e22 + procid*4); *(uint8_t*)0x20001084 = 0; *(uint8_t*)0x20001085 = 0; *(uint8_t*)0x20001086 = 0; *(uint8_t*)0x20001087 = 0; *(uint8_t*)0x20001088 = 0; *(uint8_t*)0x20001089 = 0; *(uint8_t*)0x2000108a = 0; *(uint8_t*)0x2000108b = 0; syscall(SYS_sendto, r[0], 0x20000080ul, 0x1000ul, 3ul, 0x20001080ul, 0xcul); break; case 2: *(uint16_t*)0x200011c0 = 2; *(uint16_t*)0x200011c2 = htobe16(0x4e20 + procid*4); *(uint8_t*)0x200011c4 = 0; *(uint8_t*)0x200011c5 = 0; *(uint8_t*)0x200011c6 = 0; *(uint8_t*)0x200011c7 = 0; *(uint8_t*)0x200011c8 = 0; *(uint8_t*)0x200011c9 = 0; *(uint8_t*)0x200011ca = 0; *(uint8_t*)0x200011cb = 0; syscall(SYS_recvfrom, 0xffffff9c, 0x200010c0ul, 0xcdul, 0x802ul, 0x200011c0ul, 0xcul); break; case 3: memcpy((void*)0x20001200, "\x65\x34\x64\x0a\x5e\x77\x48\x51\x1a\x23\xbf\x56\x23", 13); syscall(SYS_setsockopt, -1, 0, 1, 0x20001200ul, 0xdul); break; case 4: *(uint32_t*)0x20001280 = 0xc; res = syscall(SYS_paccept, 0xffffff9c, 0x20001240ul, 0x20001280ul, 0ul); if (res != -1) r[1] = res; break; case 5: *(uint16_t*)0x200012c0 = 0x18; *(uint16_t*)0x200012c2 = htobe16(0x4e23 + procid*4); *(uint32_t*)0x200012c4 = 1; *(uint32_t*)0x200012c8 = 0x800; syscall(SYS_connect, r[1], 0x200012c0ul, 0xcul); break; case 6: *(uint32_t*)0x20002340 = 0x1002; res = syscall(SYS_accept, -1, 0x20001300ul, 0x20002340ul); if (res != -1) r[2] = res; break; case 7: *(uint64_t*)0x200024c0 = 0x20002380; memcpy((void*)0x20002380, "\xce\x0f\xda\xd9\xa6\x4a\x58\xf7\x84\xd8\x08\x7a\xf8\x05\xaa\x2b\xd2\xf9\xb8\x6b\x22\xd9\xb2\xc3\x2c\x58\x73\xc3\xf3\x2b\xef\xbc\x76\xc4\x7e\x31\xe9\x5c\xb5\x77\x20\x09\x97\x41\x06\xdd\x56\xe9\xb7\x7e\x9e\xf2\x1b\x64\xeb\xda\x31\x08\x05\x30\xf8\xdb\xeb\x72\xd1\x92\x5f\x06\xc0\xe6\x16\x3c\x87\x37\x29\x3d\x33\x34\xcd\xfe\x5d\xe4\x21\xf3\x35\x04\xea\xa8\x02\x4b\xcb\x42\xa0\xad\x53\xd6\xbd\x25\xe3\xb6\x65\x03\x62\x96\x98\x53\x80\x33\x00\xc7\x1d\x12\x31\xf7\x3d\x20\x10\x9f\xd2\xb8\x05\xd7\xc0\xde\x06\x68\x00\x18\x86\xe4\xa3\x80\x88\x0e\x16\x9d\xe6\x77\xcb\x12\x4c\xc6\x05\x78\x02\x0f\xfe\xcb\xe8\x38\x19\x65\x69\x72\x96\xf8\x7c\xa1\xdd\x26\xd2\x39\xf0\x0c\x44\xd2\x8f\x44\x04\x68\x97\x8e\xdf\x01\x9a\x5d\xb0\x50\x91\x3f\x84\x18\x95\xd9\xd9\xa4\x2a\x50\xfd\x29\x53\xaf\x0b\xd6\xc6\x92\x83\x5f\x5f\x28\xb4\x67\x68\xfc\x54\x00\x14\xf8\xd3\xee\x3d\x80\x17\x5c\xd9\xbc\xa3\xe5\x2d\x0a\x15\xb8\x87\x73\xf3\xb8\x11\x08\x90\xf4\xdf\xfe\x75\x43\x3f\xda\xba\xc5\x4c\x62\x29\x8a", 242); *(uint64_t*)0x200024c8 = 0xf2; *(uint64_t*)0x200024d0 = 0x20002480; memcpy((void*)0x20002480, "\x80\x24\x2b\xeb\xc8\x1b\xd3\xda\xdc\xb9\x92\xd2\xde\x24\xb8\x13\x00\xa6\x36\xd3\xa6\x4b\xdf\xe9\x31\x33\xe1\x44\x29\xda\x14\xcf\x31\x7e\xde\xd2\x00\xe3\x71\xe3\x4a\xef\x0b\xba\xf2\x72\xa4\xe8\x77\x89\x08", 51); *(uint64_t*)0x200024d8 = 0x33; syscall(SYS_pwritev, r[2], 0x200024c0ul, 2ul, 0x51ul); break; case 8: *(uint32_t*)0x20002540 = 0xc; syscall(SYS_getpeername, r[2], 0x20002500ul, 0x20002540ul); break; case 9: syscall(SYS_dup2, -1, -1); break; case 10: memcpy((void*)0x20000000, "\x48\xf7\xf1\x90\xc6\x85\xfa\xd5\x02\x0b\x2c\x72\x6e\xad\xc8\x3c\x08\x67\xb0\x1c\x6b\x28\xea\x05\xf4\xbd\x05\x44\xeb\x88\x3e\xc3\xd8\x89\x7d\x9a\xee\x86\xbc\xb2\xc9\x0e\xbe\x68\x77\x4c\x20\x65\x70\xc9\x03", 51); break; case 11: memcpy((void*)0x20000040, "\xc4\x22\x7d\xb7\x4b\x0b\x45\x86\x57\xfb\x66\x44\x0f\x38\xdc\xd2\xc4\x81\xf9\x5b\xfe\x0f\x49\xf8\x66\x0f\x3a\x0c\x9b\xb4\x00\x00\x00\xfe\xc4\xa2\xfd\xa6\xfc\xc4\xa1\x4d\xd5\x16\xc4\x01\x94\x59\x6d\x64\x66\x41\x0f\x6c\x23", 55); syz_execute_func(0x20000040); break; case 12: break; case 13: memcpy((void*)0x200000c0, "\x53\x89\x0e\xf7\x06\x9c\xeb\xf4\xab\x2e\x38\x62\xd4\xe8\xf0\xd7\xcd\x39\x04\x66\x11\xd8\x6e\xfa\x40\x3d\x25\x55\x8c\x0d\xe4\xab\x33\xf8\x31\xe6\xf5\xf5\x29\x56\x03\x28\x35\x78\x3b\xf2\xd0\xf5\x81\x7f\x8b\x8d\xda\x73\xc7\x54\x2d\x9f\x0d\x12\xa6\x31\xe2\x5a\x3e\xe4\xdc\xfb\x6a\xe2\xf9\x68\xa8\x25\xda\xc5\x81\x2d\x8c\x6b\x82\x64\xe0\xb7\x8c\x3d\xaa\x0c\x76\x23\x7a\x22\x3a\x71\xf5\x0b\xa3\x6e\x78\x4b\x03\xb1\xf3\x87\x05\xa2\x37\xcf\x14\xc4\x37\xfd\xc2\x36\x3d\xc7\x73\xb1\x94\x6b\xe9\x83\x5b\xd5\x9c\xf8\x39\x00\x38\xfb\x9b\xac\x19\x1e\xc2\x55\xea\xf7\x0e\xa2\xb5\x63\xdb\x02\x24\x60\xb0\x5e\x8d\x6a\xcc\x51\xea\x2d\xc2\x5f\xf0\x6b\x2a\xdd\x98\x89\x0a\x72\x78\x07\x07\x2b\x47\xf3\x8e\xe4\x2d\x63\x67\xe7\xd3\x54\x8d\x3f\x13\xca\x55\x74\x42\x6d\xf2\x94\x62\x6c\x3e\xf4\xb8\xcf\x7a\xea\x48\x30\xb7\x0d\x93\x12\x2e\xfd\x51\xfc\xe4\x84\x96\xa5\xbd\x03\xe3\x05\xf2\xad\x87\x19\x69\xc9\x7c\xef\xf6\xb6\xc2\x28\x6c\x54\x31\xb9\xfd\xbd\x88\x37\x62\x92\x98\xcb\x4e", 239); memcpy((void*)0x200001c0, "\xa1\x85\x22\x4a\x16\xff\x1a\x06\x2f\x6f\x97\x66\xae\xb7\xf5\x84\x08\xb0\x28\x45\x0e\x80\x97\x0d\x92\x50\x11\x4b\x2c\x87\x1d\x5d\x9e\xc6\x7f\x79\x90\xa3\x05\xb4\xbe\x2c\x41\xd3\x5d\x33\x16\xa7\xf4\xc9\xb2\x74\x01\xf8\x44\x0e\x71\xa5\x79\xb7\xf9\xac\xc6\x06\xd2\x0d\xa0\x88\xc7\x07\x7b\xbc\x3c\x36\x1e\x71\xc5\x77\x40\x61\x68\xbc\xc1\xbc\xb7\xf0\x2e\x41\x6e\x3f\x90\x84\x03\xe2\x3d\xb0\xc7\x27\xea\x76\x9d\xeb\xda\x4d\x0e\x52\x4f\x8a\xdf\x7f\x42\x18\x4a\x20\xba\x1a\x23\xf9\xc5\x8d\x46\x91\x4c\xc7\xb1\x2c\x19\x53\x7d\x55\xa4\x0f\xcd\x26\xc6\x8e\xfb\x09\xdc\x0a\xcc\x2e\xe7\x52\x4a\xbe\xc0\xb8\x03\x5a\xd2\xb1\xd1\x94\x33\x1e\x2e\xa4\xe4\x2e\xbc\x53\xd3\x88\x0e\x7c\x0d\xd6\xc5\x79\x02\xc8\x72\x7c\xef\xb0\xfd\x31\x92\xd6\x62", 181); syz_usb_connect(0x1e3d802a, 0xef, 0x200000c0, 0x200001c0); break; case 14: memcpy((void*)0x20000280, "\xb7\x48\xb2\x1b\x78\xea\x22\x21\x6c\x2c\xbf\xdc\xcb\x03\xec\x54\xd2\x0f\x30\xf4\xaf\x46\x2b\x7b\xfd\x5d\x30\x1b\x9a\x4f\xb8\xf9\xbb\xe6\x30\xdd\xe8\xd6\x08\x55\x02\x94\x47\xdf\x51\x12\x0e\x0d\x69\x0a\xe4\xa7\x3e\x5a\x06\x06\x4c\xc0\x6d\x83\x62\x2a\x66\xc3\xcf\x3c\xcd\x92\x0d\xf4\xa9\xde\xc5\x47\xf0\xc8\x53\x54\xb2\xe8\x03\x69\x9f\x52\xff\xc8\x14\x53\x6c\xe5\x19\xc7\xc1\x65\x26\xda\x56\xc6\x5b\x44\x29\xcb\x22\x4a\xd9\xc9\x7f\x63\x7e\xe6\xf2", 111); memcpy((void*)0x20000300, "\xfc\xa1\x69\x1e\x90\xfe\xf7\xc0\x69\x3e\x50\x16\x1f\x6b\xf9\xd6\xbe\x11\x62\x1b\x96\xa6\x5d\x50\x23\xd6\x6e\x18\xc9\xdc\x3b\xb3\x8c\xf4\x79\x30\x6e\xff\x4d\x2c\xf1\x75\xb6\xf8\x52\x15\x44\x6b\x23\x79\xfd\xc7\x32\x74\x56\x6c\x4c\xa7\xce\xc4\xd6\x6a\x48\x19\x12\xaf\xe2\x3a\x3f\x61\xad\xb9\x46\x7e\x5b\xf8\x28\x15\x64\x36\xeb\xe3\xd2\x9e\x30\x73\xe4\x25\x4b\x3a\x73\x4a\xcd\x66\xd1\x4e\xfb\x07\x36\xfc\xad\xff\x4d\xad\x73\xe0\x25\x31\x87\x0c\x30\xfa\xe0\xc3\x78\xc5\x15\x78\x6c\x88\xc1\x29\x27\x36\xcd\xf0\xb6\xa2\xe7\x9b\x47\xa7\x8e\x33\xf5\xe1\xd0\x68\x8a\x6f\x3c\xe2\xd9\xe1\x5b\xd3\xee\x2e\x2a\xfe\x1a\xc5\xc8\x52\x3a\x84\xa2\x08\x75\x5a\x7f\x82\x2f\x3d\x21\x1f\xe3\xa2\x6a\x86\x50\x7d\x98\x58\x3d\x56\x6a\x05\x91\xa7\x80\x2c\xb3\xf9\xf9\xdc\x35\xb9\x11\x0d\xe4\xb2\xf4\xd3\x93\x4b\xb2\x0b\x7a", 199); res = syz_usb_connect(0xa4, 0x6f, 0x20000280, 0x20000300); if (res != -1) r[3] = res; break; case 15: syz_usb_disconnect(r[3]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); for (procid = 0; procid < 4; procid++) { if (fork() == 0) { use_temporary_dir(); do_sandbox_none(); } } sleep(1000000); return 0; } : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor025968275 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/1 (0.43s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000040)=0x8) sendto(r0, &(0x7f0000000080)="8d360d8e2229aab63aef8e41582b2d02e93c2190e2fe50c1f7f3b29e853f60fb587dd78a2c404615cdf3763b9a53dba141c66b4a485450d66e0a4a281e63e3527c88cdde73010e05449a77aee1e7a35fdddea497119a92fa7fb2d108d6475f90ca55e04b82e53d6ac1138cb913b8dbb0b6f922a1a85461459190969a7d79de9164f3b4e2e9dc65817cd3908bf131ac85e8713459e5da855dd94a0feea76b05dd56d5e0b5222332210506202af0c3718596bf5549077f213886eeb0b3e38b83e237290327d0cc6d5e374a365eccda88ebf8ce4141536b085424aadb2b0c5be557bea12ea53f3fd5b7d3b48edf54f860c8a8e1941e0a56d851b2c08b8d4c9bad81ad649d1479bb60644194385d680441c674f629c50abb98ea4859798a0a3edee95e33f9c2880db8c9279f971bd597b98978bd664047c144af6c7954cc4edb914a618047a063ee7531377216a1f42404fde995936f5d7aba61bb230700ac3390d8fbc62772094fb8e543f39134132c6815d1ebf15bd0068e3b7ea86bb183465b91a431f52fe38bd0e6e077298ae8265685e46961fa82b64c5f757eaf9a7d0f63ed2849b17af0c550118c7e8e5addd917ce997796319e6bcf9bc42b8ba87c94e5a31b1cecb2fde9c571f9a87a88230f8093a7ae80a0c45c3ceec69f1e1f844296045070f3728ec4fa644cd74881db3c72352e4b8318f8834ac6306a5698ce9a5eb314f3f8647067bd6de7c90940645931c310aa55e4268ecbaf64c9d8c9ace54fc9f224746ddd681840c392f274753342ef48ac1973abf5c38d0776bd61c087d7b54b1f93eaed1a7c9f73427e38d5e3ca2cd17fa00c69873921ed8f2b8b9f89509134f723b6980831f5504a65602bd9367a151c570a705910afd9f69116737327c193a8751d9c161b5b2ef4e406055fe79c570f7c3e8334623ef02b9f47eecb78d30db147d4fc90bc91faec2d9181206e41cccde0c21483bfd0c45d8765a13d69e22479c21816dbd590ae51e49f6058449b9d3dbe94075e2e57028f43f70201a1e4875b91697c29deb8c2572a105131c87f7685cad94d1321d4ae5cc6efede11ac80a0e00a63b2ba54fcc5195475c3f1ff572693d00e491a0445c987dedcbe73b69ec13d226b193ec03fa9a27a4a434d148983366c7d8e5bc3cea9fbeffd05b8b0090765159b380ac96429655125921507f97df3e9d41c66b2f5fffd0cad4826577916f941ac7c9ec7ab625ec9390e050c5885dbd2e7131f2794ecad5709e0ac395ad0edee0182822374e701167ad2cfda07ff9e9bddee1c688d483c132e197a9481c9eb0df2cf9669ab107cc936bf2c96268a120a44fb7f178b402ecd9c512f86908f43fea11cc6902c355929b910a523acd16d5931ea41753391a0368e5bbe9e8cd926da120d8440fce2c192b1e5986854de8551320c989533771f1a71fb41ff1c927ffba9e9e25ae533db6a3c804b0b340a0409e110ac76a7b58f912db41e33b115e1c3ae9aa0399edd621a0fd4b7be2176cb49682ee82b2a219baace63b3822b98ba6f48cd34a08143321993c4390b94b138e4adcfd47dd01982e24acb8d464738f44af04ff3353f8683f352306457522e653baa8937950448eef9879dfaa42e9fcca9a968971b60c413f4aa3e0f90b41c7828ad5dbb62aae0cd2d2ef85e248bf12e4d6d75b803aca52bb9616acc37bc8bdab1a66661a5329dc936b1dbc83fd598c57b9ad80ac42c21a6318b3fb8d0d865fffb043217c42f9546c050eb8cce5e3423371a93aff46471d2008c8cd5841f849d1f0d58317353a6d7308f7962d943795bd52a4dd5a8440640273c78ef6ebbeaae9143d5e6ee90cdaa257e132e6d42d02b9567ae69b75bc60f7596a1fdd8179cff323991701062930ce23a29e30023da9d631bf61a6440acc290bdeafbaaea78365f408aea8f864da220e7a560c9ac84bb9c975814c132f97e08b64ccad47ceb08f2941a4438feb76560b1d5e6f3289f50d054e949674eb6c3294cc4a27427650c4a37f53c65c55ca410fa62ee18a829220360a8272f8c0041e2bf33f047928feb0269c438bdf399b1d8f187b2454ea5cd873e352e1d0781570234c6d810c5a16bac9ea9ffafb0c978a022276903a1c653f17d96659cbb30abc1a320c584bdfcc00125270c2d4c90950029f711575dfa828feea3b1dc83c0701dffac1f89536583a0c0995550f862c3ec786c0f8fee0fd94fae0a661313f9e753362336db3ea0296d7fb913ad490bfc9dd155307ab14e67114fcde26d032435cec7d29247deb93bcf7fa48b4ddb5fb7449c0fda083d5a63e03922d5dfb361b7eeb122a094c3b08eacbd43cecc76c29a9bbcd4808bfa6eaeb78d3453e30660d1653569841869e3d8b90f3d047388da51919cf056ce1ce1d455177c95cdb8f76637d5336e82c9e10ddfd33515f7491ef28cbe4c8a477086daeb525d097844879d140965ef0463b3e1780065da2255e68aee903f7b06b0824b151525c56063d4be22ee31b82d2029fef15f38f9008d785dcab9f1454185ec4a3d76ed3aa8d27859f66ae63eddd338ac28f64048e46a5d0731f9b7ebe52218e11e78cb6d8172aea44f2c213ce7f5edfaed81c5de95a86aba484ec2e1950f61e743f11fbd881f2b0c891aa6e94fff4e5d747971313613da54b5483aabe5b12a8e661d455cdf442b86f3cd8b6e95e2ebfba7c62001769d5d9725f1df8ff364ff45f65b16fb2a828638313dbaac9818f990e8590d54b67613430b9f1869b7f2f756e4af19a145105b7b0f7c889b3146533114d001fc2c1b6b285ded35fd0b17857da527e80658f0b717a8c98920f72289896f05a686083fa9e84ee9f0590793b484365159cd18d9290fc7b342b3926bccdc830a519b8abd07e5b885cc4a6046423d5fa976588510cf5b0cfeaa38e7d170feb401bf9b3e4284415b8e2d2b8d73a0bfda6e246d4075c16f3bf8c1d8a1969dc57fc8786b1e4afb4ec6769534debe49ef6873e76289c6442c6d690457af91df631c7b0d4d0a18a43b26803bfe374a81de3c182b4dc50683f8545157b40f4b44db5eff729645421817ff5fdd0b4ca5cc2ba9b23c33256074b0cd5938aacea39e5cb5af7ec444267f1419867e355de6700ae0a63b7a57eaabe21aee216048612ec6c6993a577ca4d7a0071f5680d89baa337a37a5d1af9dc359d9708ddab0bb96323ae8f6a48d2b8b42d47d4a051b55d14116a359899c79011f2db86e08c2fb7c7d836355cd55f33aba9cb80a10c0844011e3ffa01f5472233fbaebe45f044154220094bf7da1a4035c195978e1b97eac6c41010b27dfb5df985ab16d219f415528b0403846b326f0a00f7b73c89933e1a2daa58dd8dee2f91e2d083eb25508ad3b3e916cf7e002140ed65ebe55ed8bec0cea09a5a61f7262aaa61cbf09d16ff6aac48c511fb8220dc5e20c3d4ce6283c53442a5cf408f3e66734208cc4f13a90a9ad6f90c1db802abcff903addba309ad25dd56cf6d37f32f82eb07fce24ac33e48451e7719e323f512a459a172172ff94d41be609aba82bcb7d827dfc73b4875209aa392c6f0d24f95bb900814fbff19c8d51d421270363bc808f29e21e14f6c99a13f8000fbfbc1cae461215fbba52511c9d14aaedb16e3a3725534b5713c554f1e5ebdc2abfaa712cf0d8ff6699cf0949f89b187e58bbac15927a701432f81b61e797136789ae2e824b0a74c553d59b7a1a1d512fec36c863422f0634560064ad2c310895d6d8a1a3f9429f08a7360cd4b4f9f208bf6d210d809796276e7a900ea994d3f8a3c3be28c3384c8d822fd108e8e9a195798149beb3e4eed373edac2bbc957b3f0432bcddc9556b734b19f91d94d21a881fbc882603f7da7f8993a74d5b12670f87aa69885abea718b67a700caf9fac78122a83b282099952664e5e8446a23b4bb3c01b1b4a9dca924fe0210445dd5e8ce3bdf2429463df24de0cb74bfc162847a6177d42feb487c89e1fd76fc59e4feaab91d6fadfa65a872a8128ea56f4914fb55165598db63bd701573f8ca7b78b69fe0983f1aadb99bb0ccbf9e2409d2833f9ab80296f9795c5e5740ebebb71238c6898dbd6e043cd6031c1590edfe763446a96d3806d62ef9a7467f4545d4b958ab916939d985856d06cc9369194329b961c0b767a76624104d3cacb9119d17499d83c1e6f95f4c79de2aae011413facd8962980b5327c7e22b516c841a985646e38126fb50c8bba642076489a8a8cc21cac2e92e6d459d5666b868da0e30121e972324076476490170f513efc5dcf57ce85d81c9fffceefb19ec98278e13abb2f322af44b980f9ef522e98d909507a8eeb7a0bd927d621e0fbfa06a9ca8f2f9978aae462db2cce9240c82942957472c722a0cbc1c84e6c7cd86bf6534d05090396b70cef7c77a29f06e5360d9c5c426988ee7653d022c1b49bc99494bc661c42b97b62c0f5351b5aabcaf1e22a6cb70d348753711f9063f87b292edf6137ac524b2a4cdf8d3a8ca035fd959ea40297645253a33946687bee09f66132f2cbca0f451b82108f4e68683fcef2cb3282d38fe47f6be597a0aba1b637e24fa2ea26f890f5e8cd2e438b0c42319c3f482b21b3b36e9b66907ab9451aa2d5b0d848c958179cd2c138e7a8133d10b952745c6f9c5ad206b13ae83e21236e06a27e60f54c15fdf96c084ee9253af3ae53f1e5c79bf61eef8cd90f382da1f2c072272bf9fc89b4fc6c18a57e197a366fdb5af0ff28131f42690ec69d59fae8c8f43c8f3cf4eacbdcf3e162e492e1bd533abe70bac53f9868c1995921c79d09f67a6b724410a468129f990d150e95663e54551feb97a4304f92ab3db2a43ca841ee3b0f6b62c751f6016b8439d5a08db8d34faa4ba7a7617fe5bbf1f8fcb5a9f55f1a1db83645eb93bde600032bbac895863cc54f09a9fe1e190a08abc6c080badd8245bb9918713ddaead377afbdcbc7cf4d191f6ca2fe2defa45c3c3353c277e1130284cd441da774eb16e7bf11ad0beef302022a18cf0479285df7f64feacacaef8ca50c201cb9001087611c4cd16f1ab6782d7eafae094c93cf301477a678c9ec482baa1d1d1a405494b67b35057b691af44dc3be73e26ab2b6fbe5d2e2117e0c6d0e964b3826a6e057c80e4f0ed78ed1310c24516b95dcefcf5dfd7e79e5e24e6922ade7efdc2242934973f636e300cbe5002f8bb0413a76baee10099b1008e384b8644188932abf79d0f26c66ebd662add68e039212bf4fd801114196e105d958ade15fb451fb5d5d90fee2ecb792bb5c864125bb3e63e0a7b59ff54f5d52ec590708840bbf134e25625690b262e5493a53ef206ce25c6b4dcbf3d8ebab2806f96b6a96eedebb2930fd7230e9601ce4ab66d721e856eedd6704f0b673e0febabd1148469bdf93c890c637c542b5fd4dc21b898c8c0150a1bc2817542e211205dc70be74977c37901fdc734613e5c1f40efbdf19b983abba0ddad01d0ab654b2e34c656090351a515aca39f58b3485da7c0a696952ea618f1f79eb7c55b056eec77e22224bd79d2ad9f597f12dcdd7c7160518ccd77bb5317ac0ea66b6a80a2cc4e28ae3881c59dff4d4684779776bf9e3accc8384f2a1f05cd3cadb345a27669ea1c059e086f421346ae2cf95d19f75941eed79c775eb557e252e08d9662204006d2ba9375bd871f6b64a0633a3b271d8f1ac39d39e6a5100c99effd2a09df4b49d1a41176d4de1a4236c8190bffad251a113cc16d499ac212db31b26497a399ce1acc2b4a63ceee193bfb94bf91dc309c7ba4664b4e99c745786b7", 0x1000, 0x3, &(0x7f0000001080)=@in={0x2, 0x2}, 0xc) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000010c0)=""/205, 0xcd, 0x802, &(0x7f00000011c0)={0x2, 0x0}, 0xc) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001200)="6534640a5e7748511a23bf5623", 0xd) r1 = paccept(0xffffffffffffff9c, &(0x7f0000001240)=@in, &(0x7f0000001280)=0xc, 0x0) connect$inet6(r1, &(0x7f00000012c0)={0x18, 0x3, 0x1, 0x800}, 0xc) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000001300)=@file={0x0, ""/4096}, &(0x7f0000002340)=0x1002) pwritev(r2, &(0x7f00000024c0)=[{&(0x7f0000002380)="ce0fdad9a64a58f784d8087af805aa2bd2f9b86b22d9b2c32c5873c3f32befbc76c47e31e95cb5772009974106dd56e9b77e9ef21b64ebda31080530f8dbeb72d1925f06c0e6163c8737293d3334cdfe5de421f33504eaa8024bcb42a0ad53d6bd25e3b6650362969853803300c71d1231f73d20109fd2b805d7c0de0668001886e4a380880e169de677cb124cc60578020ffecbe8381965697296f87ca1dd26d239f00c44d28f440468978edf019a5db050913f841895d9d9a42a50fd2953af0bd6c692835f5f28b46768fc540014f8d3ee3d80175cd9bca3e52d0a15b88773f3b8110890f4dffe75433fdabac54c62298a", 0xf2}, {&(0x7f0000002480)="80242bebc81bd3dadcb992d2de24b81300a636d3a64bdfe93133e14429da14cf317eded200e371e34aef0bbaf272a4e8778908", 0x33}], 0x2, 0x51) getpeername(r2, &(0x7f0000002500)=@in, &(0x7f0000002540)=0xc) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_ethernet(0x33, &(0x7f0000000000)="48f7f190c685fad5020b2c726eadc83c0867b01c6b28ea05f4bd0544eb883ec3d8897d9aee86bcb2c90ebe68774c206570c903") syz_execute_func(&(0x7f0000000040)="c4227db74b0b458657fb66440f38dcd2c481f95bfe0f49f8660f3a0c9bb4000000fec4a2fda6fcc4a14dd516c40194596d6466410f6c23") syz_extract_tcp_res(&(0x7f0000000080), 0x6, 0x8000) syz_usb_connect(0x1e3d802a, 0xef, &(0x7f00000000c0)="53890ef7069cebf4ab2e3862d4e8f0d7cd39046611d86efa403d25558c0de4ab33f831e6f5f52956032835783bf2d0f5817f8b8dda73c7542d9f0d12a631e25a3ee4dcfb6ae2f968a825dac5812d8c6b8264e0b78c3daa0c76237a223a71f50ba36e784b03b1f38705a237cf14c437fdc2363dc773b1946be9835bd59cf8390038fb9bac191ec255eaf70ea2b563db022460b05e8d6acc51ea2dc25ff06b2add98890a727807072b47f38ee42d6367e7d3548d3f13ca5574426df294626c3ef4b8cf7aea4830b70d93122efd51fce48496a5bd03e305f2ad871969c97ceff6b6c2286c5431b9fdbd8837629298cb4e", &(0x7f00000001c0)="a185224a16ff1a062f6f9766aeb7f58408b028450e80970d9250114b2c871d5d9ec67f7990a305b4be2c41d35d3316a7f4c9b27401f8440e71a579b7f9acc606d20da088c7077bbc3c361e71c577406168bcc1bcb7f02e416e3f908403e23db0c727ea769debda4d0e524f8adf7f42184a20ba1a23f9c58d46914cc7b12c19537d55a40fcd26c68efb09dc0acc2ee7524abec0b8035ad2b1d194331e2ea4e42ebc53d3880e7c0dd6c57902c8727cefb0fd3192d662") r3 = syz_usb_connect(0xa4, 0x6f, &(0x7f0000000280)="b748b21b78ea22216c2cbfdccb03ec54d20f30f4af462b7bfd5d301b9a4fb8f9bbe630dde8d60855029447df51120e0d690ae4a73e5a06064cc06d83622a66c3cf3ccd920df4a9dec547f0c85354b2e803699f52ffc814536ce519c7c16526da56c65b4429cb224ad9c97f637ee6f2", &(0x7f0000000300)="fca1691e90fef7c0693e50161f6bf9d6be11621b96a65d5023d66e18c9dc3bb38cf479306eff4d2cf175b6f85215446b2379fdc73274566c4ca7cec4d66a481912afe23a3f61adb9467e5bf828156436ebe3d29e3073e4254b3a734acd66d14efb0736fcadff4dad73e02531870c30fae0c378c515786c88c1292736cdf0b6a2e79b47a78e33f5e1d0688a6f3ce2d9e15bd3ee2e2afe1ac5c8523a84a208755a7f822f3d211fe3a26a86507d98583d566a0591a7802cb3f9f9dc35b9110de4b2f4d3934bb20b7a") syz_usb_disconnect(r3) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bEndpointAddress; uint8_t bmAttributes; uint16_t wMaxPacketSize; uint8_t bInterval; uint8_t bRefresh; uint8_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint16_t idVendor; uint16_t idProduct; uint16_t bcdDevice; uint8_t iManufacturer; uint8_t iProduct; uint8_t iSerialNumber; uint8_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t wTotalLength; uint8_t bNumInterfaces; uint8_t bConfigurationValue; uint8_t iConfiguration; uint8_t bmAttributes; uint8_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bNumEndpoints; uint8_t bInterfaceClass; uint8_t bInterfaceSubClass; uint8_t bInterfaceProtocol; uint8_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint8_t bNumConfigurations; uint8_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_accept #define SYS_accept 30 #endif #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getpeername #define SYS_getpeername 31 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_pwritev #define SYS_pwritev 290 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 29 #endif #ifndef SYS_sendto #define SYS_sendto 133 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 105 #endif uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: *(uint32_t*)0x20000040 = 8; res = syscall(SYS_accept, -1, 0x20000000ul, 0x20000040ul); if (res != -1) r[0] = res; break; case 1: memcpy((void*)0x20000080, "\x8d\x36\x0d\x8e\x22\x29\xaa\xb6\x3a\xef\x8e\x41\x58\x2b\x2d\x02\xe9\x3c\x21\x90\xe2\xfe\x50\xc1\xf7\xf3\xb2\x9e\x85\x3f\x60\xfb\x58\x7d\xd7\x8a\x2c\x40\x46\x15\xcd\xf3\x76\x3b\x9a\x53\xdb\xa1\x41\xc6\x6b\x4a\x48\x54\x50\xd6\x6e\x0a\x4a\x28\x1e\x63\xe3\x52\x7c\x88\xcd\xde\x73\x01\x0e\x05\x44\x9a\x77\xae\xe1\xe7\xa3\x5f\xdd\xde\xa4\x97\x11\x9a\x92\xfa\x7f\xb2\xd1\x08\xd6\x47\x5f\x90\xca\x55\xe0\x4b\x82\xe5\x3d\x6a\xc1\x13\x8c\xb9\x13\xb8\xdb\xb0\xb6\xf9\x22\xa1\xa8\x54\x61\x45\x91\x90\x96\x9a\x7d\x79\xde\x91\x64\xf3\xb4\xe2\xe9\xdc\x65\x81\x7c\xd3\x90\x8b\xf1\x31\xac\x85\xe8\x71\x34\x59\xe5\xda\x85\x5d\xd9\x4a\x0f\xee\xa7\x6b\x05\xdd\x56\xd5\xe0\xb5\x22\x23\x32\x21\x05\x06\x20\x2a\xf0\xc3\x71\x85\x96\xbf\x55\x49\x07\x7f\x21\x38\x86\xee\xb0\xb3\xe3\x8b\x83\xe2\x37\x29\x03\x27\xd0\xcc\x6d\x5e\x37\x4a\x36\x5e\xcc\xda\x88\xeb\xf8\xce\x41\x41\x53\x6b\x08\x54\x24\xaa\xdb\x2b\x0c\x5b\xe5\x57\xbe\xa1\x2e\xa5\x3f\x3f\xd5\xb7\xd3\xb4\x8e\xdf\x54\xf8\x60\xc8\xa8\xe1\x94\x1e\x0a\x56\xd8\x51\xb2\xc0\x8b\x8d\x4c\x9b\xad\x81\xad\x64\x9d\x14\x79\xbb\x60\x64\x41\x94\x38\x5d\x68\x04\x41\xc6\x74\xf6\x29\xc5\x0a\xbb\x98\xea\x48\x59\x79\x8a\x0a\x3e\xde\xe9\x5e\x33\xf9\xc2\x88\x0d\xb8\xc9\x27\x9f\x97\x1b\xd5\x97\xb9\x89\x78\xbd\x66\x40\x47\xc1\x44\xaf\x6c\x79\x54\xcc\x4e\xdb\x91\x4a\x61\x80\x47\xa0\x63\xee\x75\x31\x37\x72\x16\xa1\xf4\x24\x04\xfd\xe9\x95\x93\x6f\x5d\x7a\xba\x61\xbb\x23\x07\x00\xac\x33\x90\xd8\xfb\xc6\x27\x72\x09\x4f\xb8\xe5\x43\xf3\x91\x34\x13\x2c\x68\x15\xd1\xeb\xf1\x5b\xd0\x06\x8e\x3b\x7e\xa8\x6b\xb1\x83\x46\x5b\x91\xa4\x31\xf5\x2f\xe3\x8b\xd0\xe6\xe0\x77\x29\x8a\xe8\x26\x56\x85\xe4\x69\x61\xfa\x82\xb6\x4c\x5f\x75\x7e\xaf\x9a\x7d\x0f\x63\xed\x28\x49\xb1\x7a\xf0\xc5\x50\x11\x8c\x7e\x8e\x5a\xdd\xd9\x17\xce\x99\x77\x96\x31\x9e\x6b\xcf\x9b\xc4\x2b\x8b\xa8\x7c\x94\xe5\xa3\x1b\x1c\xec\xb2\xfd\xe9\xc5\x71\xf9\xa8\x7a\x88\x23\x0f\x80\x93\xa7\xae\x80\xa0\xc4\x5c\x3c\xee\xc6\x9f\x1e\x1f\x84\x42\x96\x04\x50\x70\xf3\x72\x8e\xc4\xfa\x64\x4c\xd7\x48\x81\xdb\x3c\x72\x35\x2e\x4b\x83\x18\xf8\x83\x4a\xc6\x30\x6a\x56\x98\xce\x9a\x5e\xb3\x14\xf3\xf8\x64\x70\x67\xbd\x6d\xe7\xc9\x09\x40\x64\x59\x31\xc3\x10\xaa\x55\xe4\x26\x8e\xcb\xaf\x64\xc9\xd8\xc9\xac\xe5\x4f\xc9\xf2\x24\x74\x6d\xdd\x68\x18\x40\xc3\x92\xf2\x74\x75\x33\x42\xef\x48\xac\x19\x73\xab\xf5\xc3\x8d\x07\x76\xbd\x61\xc0\x87\xd7\xb5\x4b\x1f\x93\xea\xed\x1a\x7c\x9f\x73\x42\x7e\x38\xd5\xe3\xca\x2c\xd1\x7f\xa0\x0c\x69\x87\x39\x21\xed\x8f\x2b\x8b\x9f\x89\x50\x91\x34\xf7\x23\xb6\x98\x08\x31\xf5\x50\x4a\x65\x60\x2b\xd9\x36\x7a\x15\x1c\x57\x0a\x70\x59\x10\xaf\xd9\xf6\x91\x16\x73\x73\x27\xc1\x93\xa8\x75\x1d\x9c\x16\x1b\x5b\x2e\xf4\xe4\x06\x05\x5f\xe7\x9c\x57\x0f\x7c\x3e\x83\x34\x62\x3e\xf0\x2b\x9f\x47\xee\xcb\x78\xd3\x0d\xb1\x47\xd4\xfc\x90\xbc\x91\xfa\xec\x2d\x91\x81\x20\x6e\x41\xcc\xcd\xe0\xc2\x14\x83\xbf\xd0\xc4\x5d\x87\x65\xa1\x3d\x69\xe2\x24\x79\xc2\x18\x16\xdb\xd5\x90\xae\x51\xe4\x9f\x60\x58\x44\x9b\x9d\x3d\xbe\x94\x07\x5e\x2e\x57\x02\x8f\x43\xf7\x02\x01\xa1\xe4\x87\x5b\x91\x69\x7c\x29\xde\xb8\xc2\x57\x2a\x10\x51\x31\xc8\x7f\x76\x85\xca\xd9\x4d\x13\x21\xd4\xae\x5c\xc6\xef\xed\xe1\x1a\xc8\x0a\x0e\x00\xa6\x3b\x2b\xa5\x4f\xcc\x51\x95\x47\x5c\x3f\x1f\xf5\x72\x69\x3d\x00\xe4\x91\xa0\x44\x5c\x98\x7d\xed\xcb\xe7\x3b\x69\xec\x13\xd2\x26\xb1\x93\xec\x03\xfa\x9a\x27\xa4\xa4\x34\xd1\x48\x98\x33\x66\xc7\xd8\xe5\xbc\x3c\xea\x9f\xbe\xff\xd0\x5b\x8b\x00\x90\x76\x51\x59\xb3\x80\xac\x96\x42\x96\x55\x12\x59\x21\x50\x7f\x97\xdf\x3e\x9d\x41\xc6\x6b\x2f\x5f\xff\xd0\xca\xd4\x82\x65\x77\x91\x6f\x94\x1a\xc7\xc9\xec\x7a\xb6\x25\xec\x93\x90\xe0\x50\xc5\x88\x5d\xbd\x2e\x71\x31\xf2\x79\x4e\xca\xd5\x70\x9e\x0a\xc3\x95\xad\x0e\xde\xe0\x18\x28\x22\x37\x4e\x70\x11\x67\xad\x2c\xfd\xa0\x7f\xf9\xe9\xbd\xde\xe1\xc6\x88\xd4\x83\xc1\x32\xe1\x97\xa9\x48\x1c\x9e\xb0\xdf\x2c\xf9\x66\x9a\xb1\x07\xcc\x93\x6b\xf2\xc9\x62\x68\xa1\x20\xa4\x4f\xb7\xf1\x78\xb4\x02\xec\xd9\xc5\x12\xf8\x69\x08\xf4\x3f\xea\x11\xcc\x69\x02\xc3\x55\x92\x9b\x91\x0a\x52\x3a\xcd\x16\xd5\x93\x1e\xa4\x17\x53\x39\x1a\x03\x68\xe5\xbb\xe9\xe8\xcd\x92\x6d\xa1\x20\xd8\x44\x0f\xce\x2c\x19\x2b\x1e\x59\x86\x85\x4d\xe8\x55\x13\x20\xc9\x89\x53\x37\x71\xf1\xa7\x1f\xb4\x1f\xf1\xc9\x27\xff\xba\x9e\x9e\x25\xae\x53\x3d\xb6\xa3\xc8\x04\xb0\xb3\x40\xa0\x40\x9e\x11\x0a\xc7\x6a\x7b\x58\xf9\x12\xdb\x41\xe3\x3b\x11\x5e\x1c\x3a\xe9\xaa\x03\x99\xed\xd6\x21\xa0\xfd\x4b\x7b\xe2\x17\x6c\xb4\x96\x82\xee\x82\xb2\xa2\x19\xba\xac\xe6\x3b\x38\x22\xb9\x8b\xa6\xf4\x8c\xd3\x4a\x08\x14\x33\x21\x99\x3c\x43\x90\xb9\x4b\x13\x8e\x4a\xdc\xfd\x47\xdd\x01\x98\x2e\x24\xac\xb8\xd4\x64\x73\x8f\x44\xaf\x04\xff\x33\x53\xf8\x68\x3f\x35\x23\x06\x45\x75\x22\xe6\x53\xba\xa8\x93\x79\x50\x44\x8e\xef\x98\x79\xdf\xaa\x42\xe9\xfc\xca\x9a\x96\x89\x71\xb6\x0c\x41\x3f\x4a\xa3\xe0\xf9\x0b\x41\xc7\x82\x8a\xd5\xdb\xb6\x2a\xae\x0c\xd2\xd2\xef\x85\xe2\x48\xbf\x12\xe4\xd6\xd7\x5b\x80\x3a\xca\x52\xbb\x96\x16\xac\xc3\x7b\xc8\xbd\xab\x1a\x66\x66\x1a\x53\x29\xdc\x93\x6b\x1d\xbc\x83\xfd\x59\x8c\x57\xb9\xad\x80\xac\x42\xc2\x1a\x63\x18\xb3\xfb\x8d\x0d\x86\x5f\xff\xb0\x43\x21\x7c\x42\xf9\x54\x6c\x05\x0e\xb8\xcc\xe5\xe3\x42\x33\x71\xa9\x3a\xff\x46\x47\x1d\x20\x08\xc8\xcd\x58\x41\xf8\x49\xd1\xf0\xd5\x83\x17\x35\x3a\x6d\x73\x08\xf7\x96\x2d\x94\x37\x95\xbd\x52\xa4\xdd\x5a\x84\x40\x64\x02\x73\xc7\x8e\xf6\xeb\xbe\xaa\xe9\x14\x3d\x5e\x6e\xe9\x0c\xda\xa2\x57\xe1\x32\xe6\xd4\x2d\x02\xb9\x56\x7a\xe6\x9b\x75\xbc\x60\xf7\x59\x6a\x1f\xdd\x81\x79\xcf\xf3\x23\x99\x17\x01\x06\x29\x30\xce\x23\xa2\x9e\x30\x02\x3d\xa9\xd6\x31\xbf\x61\xa6\x44\x0a\xcc\x29\x0b\xde\xaf\xba\xae\xa7\x83\x65\xf4\x08\xae\xa8\xf8\x64\xda\x22\x0e\x7a\x56\x0c\x9a\xc8\x4b\xb9\xc9\x75\x81\x4c\x13\x2f\x97\xe0\x8b\x64\xcc\xad\x47\xce\xb0\x8f\x29\x41\xa4\x43\x8f\xeb\x76\x56\x0b\x1d\x5e\x6f\x32\x89\xf5\x0d\x05\x4e\x94\x96\x74\xeb\x6c\x32\x94\xcc\x4a\x27\x42\x76\x50\xc4\xa3\x7f\x53\xc6\x5c\x55\xca\x41\x0f\xa6\x2e\xe1\x8a\x82\x92\x20\x36\x0a\x82\x72\xf8\xc0\x04\x1e\x2b\xf3\x3f\x04\x79\x28\xfe\xb0\x26\x9c\x43\x8b\xdf\x39\x9b\x1d\x8f\x18\x7b\x24\x54\xea\x5c\xd8\x73\xe3\x52\xe1\xd0\x78\x15\x70\x23\x4c\x6d\x81\x0c\x5a\x16\xba\xc9\xea\x9f\xfa\xfb\x0c\x97\x8a\x02\x22\x76\x90\x3a\x1c\x65\x3f\x17\xd9\x66\x59\xcb\xb3\x0a\xbc\x1a\x32\x0c\x58\x4b\xdf\xcc\x00\x12\x52\x70\xc2\xd4\xc9\x09\x50\x02\x9f\x71\x15\x75\xdf\xa8\x28\xfe\xea\x3b\x1d\xc8\x3c\x07\x01\xdf\xfa\xc1\xf8\x95\x36\x58\x3a\x0c\x09\x95\x55\x0f\x86\x2c\x3e\xc7\x86\xc0\xf8\xfe\xe0\xfd\x94\xfa\xe0\xa6\x61\x31\x3f\x9e\x75\x33\x62\x33\x6d\xb3\xea\x02\x96\xd7\xfb\x91\x3a\xd4\x90\xbf\xc9\xdd\x15\x53\x07\xab\x14\xe6\x71\x14\xfc\xde\x26\xd0\x32\x43\x5c\xec\x7d\x29\x24\x7d\xeb\x93\xbc\xf7\xfa\x48\xb4\xdd\xb5\xfb\x74\x49\xc0\xfd\xa0\x83\xd5\xa6\x3e\x03\x92\x2d\x5d\xfb\x36\x1b\x7e\xeb\x12\x2a\x09\x4c\x3b\x08\xea\xcb\xd4\x3c\xec\xc7\x6c\x29\xa9\xbb\xcd\x48\x08\xbf\xa6\xea\xeb\x78\xd3\x45\x3e\x30\x66\x0d\x16\x53\x56\x98\x41\x86\x9e\x3d\x8b\x90\xf3\xd0\x47\x38\x8d\xa5\x19\x19\xcf\x05\x6c\xe1\xce\x1d\x45\x51\x77\xc9\x5c\xdb\x8f\x76\x63\x7d\x53\x36\xe8\x2c\x9e\x10\xdd\xfd\x33\x51\x5f\x74\x91\xef\x28\xcb\xe4\xc8\xa4\x77\x08\x6d\xae\xb5\x25\xd0\x97\x84\x48\x79\xd1\x40\x96\x5e\xf0\x46\x3b\x3e\x17\x80\x06\x5d\xa2\x25\x5e\x68\xae\xe9\x03\xf7\xb0\x6b\x08\x24\xb1\x51\x52\x5c\x56\x06\x3d\x4b\xe2\x2e\xe3\x1b\x82\xd2\x02\x9f\xef\x15\xf3\x8f\x90\x08\xd7\x85\xdc\xab\x9f\x14\x54\x18\x5e\xc4\xa3\xd7\x6e\xd3\xaa\x8d\x27\x85\x9f\x66\xae\x63\xed\xdd\x33\x8a\xc2\x8f\x64\x04\x8e\x46\xa5\xd0\x73\x1f\x9b\x7e\xbe\x52\x21\x8e\x11\xe7\x8c\xb6\xd8\x17\x2a\xea\x44\xf2\xc2\x13\xce\x7f\x5e\xdf\xae\xd8\x1c\x5d\xe9\x5a\x86\xab\xa4\x84\xec\x2e\x19\x50\xf6\x1e\x74\x3f\x11\xfb\xd8\x81\xf2\xb0\xc8\x91\xaa\x6e\x94\xff\xf4\xe5\xd7\x47\x97\x13\x13\x61\x3d\xa5\x4b\x54\x83\xaa\xbe\x5b\x12\xa8\xe6\x61\xd4\x55\xcd\xf4\x42\xb8\x6f\x3c\xd8\xb6\xe9\x5e\x2e\xbf\xba\x7c\x62\x00\x17\x69\xd5\xd9\x72\x5f\x1d\xf8\xff\x36\x4f\xf4\x5f\x65\xb1\x6f\xb2\xa8\x28\x63\x83\x13\xdb\xaa\xc9\x81\x8f\x99\x0e\x85\x90\xd5\x4b\x67\x61\x34\x30\xb9\xf1\x86\x9b\x7f\x2f\x75\x6e\x4a\xf1\x9a\x14\x51\x05\xb7\xb0\xf7\xc8\x89\xb3\x14\x65\x33\x11\x4d\x00\x1f\xc2\xc1\xb6\xb2\x85\xde\xd3\x5f\xd0\xb1\x78\x57\xda\x52\x7e\x80\x65\x8f\x0b\x71\x7a\x8c\x98\x92\x0f\x72\x28\x98\x96\xf0\x5a\x68\x60\x83\xfa\x9e\x84\xee\x9f\x05\x90\x79\x3b\x48\x43\x65\x15\x9c\xd1\x8d\x92\x90\xfc\x7b\x34\x2b\x39\x26\xbc\xcd\xc8\x30\xa5\x19\xb8\xab\xd0\x7e\x5b\x88\x5c\xc4\xa6\x04\x64\x23\xd5\xfa\x97\x65\x88\x51\x0c\xf5\xb0\xcf\xea\xa3\x8e\x7d\x17\x0f\xeb\x40\x1b\xf9\xb3\xe4\x28\x44\x15\xb8\xe2\xd2\xb8\xd7\x3a\x0b\xfd\xa6\xe2\x46\xd4\x07\x5c\x16\xf3\xbf\x8c\x1d\x8a\x19\x69\xdc\x57\xfc\x87\x86\xb1\xe4\xaf\xb4\xec\x67\x69\x53\x4d\xeb\xe4\x9e\xf6\x87\x3e\x76\x28\x9c\x64\x42\xc6\xd6\x90\x45\x7a\xf9\x1d\xf6\x31\xc7\xb0\xd4\xd0\xa1\x8a\x43\xb2\x68\x03\xbf\xe3\x74\xa8\x1d\xe3\xc1\x82\xb4\xdc\x50\x68\x3f\x85\x45\x15\x7b\x40\xf4\xb4\x4d\xb5\xef\xf7\x29\x64\x54\x21\x81\x7f\xf5\xfd\xd0\xb4\xca\x5c\xc2\xba\x9b\x23\xc3\x32\x56\x07\x4b\x0c\xd5\x93\x8a\xac\xea\x39\xe5\xcb\x5a\xf7\xec\x44\x42\x67\xf1\x41\x98\x67\xe3\x55\xde\x67\x00\xae\x0a\x63\xb7\xa5\x7e\xaa\xbe\x21\xae\xe2\x16\x04\x86\x12\xec\x6c\x69\x93\xa5\x77\xca\x4d\x7a\x00\x71\xf5\x68\x0d\x89\xba\xa3\x37\xa3\x7a\x5d\x1a\xf9\xdc\x35\x9d\x97\x08\xdd\xab\x0b\xb9\x63\x23\xae\x8f\x6a\x48\xd2\xb8\xb4\x2d\x47\xd4\xa0\x51\xb5\x5d\x14\x11\x6a\x35\x98\x99\xc7\x90\x11\xf2\xdb\x86\xe0\x8c\x2f\xb7\xc7\xd8\x36\x35\x5c\xd5\x5f\x33\xab\xa9\xcb\x80\xa1\x0c\x08\x44\x01\x1e\x3f\xfa\x01\xf5\x47\x22\x33\xfb\xae\xbe\x45\xf0\x44\x15\x42\x20\x09\x4b\xf7\xda\x1a\x40\x35\xc1\x95\x97\x8e\x1b\x97\xea\xc6\xc4\x10\x10\xb2\x7d\xfb\x5d\xf9\x85\xab\x16\xd2\x19\xf4\x15\x52\x8b\x04\x03\x84\x6b\x32\x6f\x0a\x00\xf7\xb7\x3c\x89\x93\x3e\x1a\x2d\xaa\x58\xdd\x8d\xee\x2f\x91\xe2\xd0\x83\xeb\x25\x50\x8a\xd3\xb3\xe9\x16\xcf\x7e\x00\x21\x40\xed\x65\xeb\xe5\x5e\xd8\xbe\xc0\xce\xa0\x9a\x5a\x61\xf7\x26\x2a\xaa\x61\xcb\xf0\x9d\x16\xff\x6a\xac\x48\xc5\x11\xfb\x82\x20\xdc\x5e\x20\xc3\xd4\xce\x62\x83\xc5\x34\x42\xa5\xcf\x40\x8f\x3e\x66\x73\x42\x08\xcc\x4f\x13\xa9\x0a\x9a\xd6\xf9\x0c\x1d\xb8\x02\xab\xcf\xf9\x03\xad\xdb\xa3\x09\xad\x25\xdd\x56\xcf\x6d\x37\xf3\x2f\x82\xeb\x07\xfc\xe2\x4a\xc3\x3e\x48\x45\x1e\x77\x19\xe3\x23\xf5\x12\xa4\x59\xa1\x72\x17\x2f\xf9\x4d\x41\xbe\x60\x9a\xba\x82\xbc\xb7\xd8\x27\xdf\xc7\x3b\x48\x75\x20\x9a\xa3\x92\xc6\xf0\xd2\x4f\x95\xbb\x90\x08\x14\xfb\xff\x19\xc8\xd5\x1d\x42\x12\x70\x36\x3b\xc8\x08\xf2\x9e\x21\xe1\x4f\x6c\x99\xa1\x3f\x80\x00\xfb\xfb\xc1\xca\xe4\x61\x21\x5f\xbb\xa5\x25\x11\xc9\xd1\x4a\xae\xdb\x16\xe3\xa3\x72\x55\x34\xb5\x71\x3c\x55\x4f\x1e\x5e\xbd\xc2\xab\xfa\xa7\x12\xcf\x0d\x8f\xf6\x69\x9c\xf0\x94\x9f\x89\xb1\x87\xe5\x8b\xba\xc1\x59\x27\xa7\x01\x43\x2f\x81\xb6\x1e\x79\x71\x36\x78\x9a\xe2\xe8\x24\xb0\xa7\x4c\x55\x3d\x59\xb7\xa1\xa1\xd5\x12\xfe\xc3\x6c\x86\x34\x22\xf0\x63\x45\x60\x06\x4a\xd2\xc3\x10\x89\x5d\x6d\x8a\x1a\x3f\x94\x29\xf0\x8a\x73\x60\xcd\x4b\x4f\x9f\x20\x8b\xf6\xd2\x10\xd8\x09\x79\x62\x76\xe7\xa9\x00\xea\x99\x4d\x3f\x8a\x3c\x3b\xe2\x8c\x33\x84\xc8\xd8\x22\xfd\x10\x8e\x8e\x9a\x19\x57\x98\x14\x9b\xeb\x3e\x4e\xed\x37\x3e\xda\xc2\xbb\xc9\x57\xb3\xf0\x43\x2b\xcd\xdc\x95\x56\xb7\x34\xb1\x9f\x91\xd9\x4d\x21\xa8\x81\xfb\xc8\x82\x60\x3f\x7d\xa7\xf8\x99\x3a\x74\xd5\xb1\x26\x70\xf8\x7a\xa6\x98\x85\xab\xea\x71\x8b\x67\xa7\x00\xca\xf9\xfa\xc7\x81\x22\xa8\x3b\x28\x20\x99\x95\x26\x64\xe5\xe8\x44\x6a\x23\xb4\xbb\x3c\x01\xb1\xb4\xa9\xdc\xa9\x24\xfe\x02\x10\x44\x5d\xd5\xe8\xce\x3b\xdf\x24\x29\x46\x3d\xf2\x4d\xe0\xcb\x74\xbf\xc1\x62\x84\x7a\x61\x77\xd4\x2f\xeb\x48\x7c\x89\xe1\xfd\x76\xfc\x59\xe4\xfe\xaa\xb9\x1d\x6f\xad\xfa\x65\xa8\x72\xa8\x12\x8e\xa5\x6f\x49\x14\xfb\x55\x16\x55\x98\xdb\x63\xbd\x70\x15\x73\xf8\xca\x7b\x78\xb6\x9f\xe0\x98\x3f\x1a\xad\xb9\x9b\xb0\xcc\xbf\x9e\x24\x09\xd2\x83\x3f\x9a\xb8\x02\x96\xf9\x79\x5c\x5e\x57\x40\xeb\xeb\xb7\x12\x38\xc6\x89\x8d\xbd\x6e\x04\x3c\xd6\x03\x1c\x15\x90\xed\xfe\x76\x34\x46\xa9\x6d\x38\x06\xd6\x2e\xf9\xa7\x46\x7f\x45\x45\xd4\xb9\x58\xab\x91\x69\x39\xd9\x85\x85\x6d\x06\xcc\x93\x69\x19\x43\x29\xb9\x61\xc0\xb7\x67\xa7\x66\x24\x10\x4d\x3c\xac\xb9\x11\x9d\x17\x49\x9d\x83\xc1\xe6\xf9\x5f\x4c\x79\xde\x2a\xae\x01\x14\x13\xfa\xcd\x89\x62\x98\x0b\x53\x27\xc7\xe2\x2b\x51\x6c\x84\x1a\x98\x56\x46\xe3\x81\x26\xfb\x50\xc8\xbb\xa6\x42\x07\x64\x89\xa8\xa8\xcc\x21\xca\xc2\xe9\x2e\x6d\x45\x9d\x56\x66\xb8\x68\xda\x0e\x30\x12\x1e\x97\x23\x24\x07\x64\x76\x49\x01\x70\xf5\x13\xef\xc5\xdc\xf5\x7c\xe8\x5d\x81\xc9\xff\xfc\xee\xfb\x19\xec\x98\x27\x8e\x13\xab\xb2\xf3\x22\xaf\x44\xb9\x80\xf9\xef\x52\x2e\x98\xd9\x09\x50\x7a\x8e\xeb\x7a\x0b\xd9\x27\xd6\x21\xe0\xfb\xfa\x06\xa9\xca\x8f\x2f\x99\x78\xaa\xe4\x62\xdb\x2c\xce\x92\x40\xc8\x29\x42\x95\x74\x72\xc7\x22\xa0\xcb\xc1\xc8\x4e\x6c\x7c\xd8\x6b\xf6\x53\x4d\x05\x09\x03\x96\xb7\x0c\xef\x7c\x77\xa2\x9f\x06\xe5\x36\x0d\x9c\x5c\x42\x69\x88\xee\x76\x53\xd0\x22\xc1\xb4\x9b\xc9\x94\x94\xbc\x66\x1c\x42\xb9\x7b\x62\xc0\xf5\x35\x1b\x5a\xab\xca\xf1\xe2\x2a\x6c\xb7\x0d\x34\x87\x53\x71\x1f\x90\x63\xf8\x7b\x29\x2e\xdf\x61\x37\xac\x52\x4b\x2a\x4c\xdf\x8d\x3a\x8c\xa0\x35\xfd\x95\x9e\xa4\x02\x97\x64\x52\x53\xa3\x39\x46\x68\x7b\xee\x09\xf6\x61\x32\xf2\xcb\xca\x0f\x45\x1b\x82\x10\x8f\x4e\x68\x68\x3f\xce\xf2\xcb\x32\x82\xd3\x8f\xe4\x7f\x6b\xe5\x97\xa0\xab\xa1\xb6\x37\xe2\x4f\xa2\xea\x26\xf8\x90\xf5\xe8\xcd\x2e\x43\x8b\x0c\x42\x31\x9c\x3f\x48\x2b\x21\xb3\xb3\x6e\x9b\x66\x90\x7a\xb9\x45\x1a\xa2\xd5\xb0\xd8\x48\xc9\x58\x17\x9c\xd2\xc1\x38\xe7\xa8\x13\x3d\x10\xb9\x52\x74\x5c\x6f\x9c\x5a\xd2\x06\xb1\x3a\xe8\x3e\x21\x23\x6e\x06\xa2\x7e\x60\xf5\x4c\x15\xfd\xf9\x6c\x08\x4e\xe9\x25\x3a\xf3\xae\x53\xf1\xe5\xc7\x9b\xf6\x1e\xef\x8c\xd9\x0f\x38\x2d\xa1\xf2\xc0\x72\x27\x2b\xf9\xfc\x89\xb4\xfc\x6c\x18\xa5\x7e\x19\x7a\x36\x6f\xdb\x5a\xf0\xff\x28\x13\x1f\x42\x69\x0e\xc6\x9d\x59\xfa\xe8\xc8\xf4\x3c\x8f\x3c\xf4\xea\xcb\xdc\xf3\xe1\x62\xe4\x92\xe1\xbd\x53\x3a\xbe\x70\xba\xc5\x3f\x98\x68\xc1\x99\x59\x21\xc7\x9d\x09\xf6\x7a\x6b\x72\x44\x10\xa4\x68\x12\x9f\x99\x0d\x15\x0e\x95\x66\x3e\x54\x55\x1f\xeb\x97\xa4\x30\x4f\x92\xab\x3d\xb2\xa4\x3c\xa8\x41\xee\x3b\x0f\x6b\x62\xc7\x51\xf6\x01\x6b\x84\x39\xd5\xa0\x8d\xb8\xd3\x4f\xaa\x4b\xa7\xa7\x61\x7f\xe5\xbb\xf1\xf8\xfc\xb5\xa9\xf5\x5f\x1a\x1d\xb8\x36\x45\xeb\x93\xbd\xe6\x00\x03\x2b\xba\xc8\x95\x86\x3c\xc5\x4f\x09\xa9\xfe\x1e\x19\x0a\x08\xab\xc6\xc0\x80\xba\xdd\x82\x45\xbb\x99\x18\x71\x3d\xda\xea\xd3\x77\xaf\xbd\xcb\xc7\xcf\x4d\x19\x1f\x6c\xa2\xfe\x2d\xef\xa4\x5c\x3c\x33\x53\xc2\x77\xe1\x13\x02\x84\xcd\x44\x1d\xa7\x74\xeb\x16\xe7\xbf\x11\xad\x0b\xee\xf3\x02\x02\x2a\x18\xcf\x04\x79\x28\x5d\xf7\xf6\x4f\xea\xca\xca\xef\x8c\xa5\x0c\x20\x1c\xb9\x00\x10\x87\x61\x1c\x4c\xd1\x6f\x1a\xb6\x78\x2d\x7e\xaf\xae\x09\x4c\x93\xcf\x30\x14\x77\xa6\x78\xc9\xec\x48\x2b\xaa\x1d\x1d\x1a\x40\x54\x94\xb6\x7b\x35\x05\x7b\x69\x1a\xf4\x4d\xc3\xbe\x73\xe2\x6a\xb2\xb6\xfb\xe5\xd2\xe2\x11\x7e\x0c\x6d\x0e\x96\x4b\x38\x26\xa6\xe0\x57\xc8\x0e\x4f\x0e\xd7\x8e\xd1\x31\x0c\x24\x51\x6b\x95\xdc\xef\xcf\x5d\xfd\x7e\x79\xe5\xe2\x4e\x69\x22\xad\xe7\xef\xdc\x22\x42\x93\x49\x73\xf6\x36\xe3\x00\xcb\xe5\x00\x2f\x8b\xb0\x41\x3a\x76\xba\xee\x10\x09\x9b\x10\x08\xe3\x84\xb8\x64\x41\x88\x93\x2a\xbf\x79\xd0\xf2\x6c\x66\xeb\xd6\x62\xad\xd6\x8e\x03\x92\x12\xbf\x4f\xd8\x01\x11\x41\x96\xe1\x05\xd9\x58\xad\xe1\x5f\xb4\x51\xfb\x5d\x5d\x90\xfe\xe2\xec\xb7\x92\xbb\x5c\x86\x41\x25\xbb\x3e\x63\xe0\xa7\xb5\x9f\xf5\x4f\x5d\x52\xec\x59\x07\x08\x84\x0b\xbf\x13\x4e\x25\x62\x56\x90\xb2\x62\xe5\x49\x3a\x53\xef\x20\x6c\xe2\x5c\x6b\x4d\xcb\xf3\xd8\xeb\xab\x28\x06\xf9\x6b\x6a\x96\xee\xde\xbb\x29\x30\xfd\x72\x30\xe9\x60\x1c\xe4\xab\x66\xd7\x21\xe8\x56\xee\xdd\x67\x04\xf0\xb6\x73\xe0\xfe\xba\xbd\x11\x48\x46\x9b\xdf\x93\xc8\x90\xc6\x37\xc5\x42\xb5\xfd\x4d\xc2\x1b\x89\x8c\x8c\x01\x50\xa1\xbc\x28\x17\x54\x2e\x21\x12\x05\xdc\x70\xbe\x74\x97\x7c\x37\x90\x1f\xdc\x73\x46\x13\xe5\xc1\xf4\x0e\xfb\xdf\x19\xb9\x83\xab\xba\x0d\xda\xd0\x1d\x0a\xb6\x54\xb2\xe3\x4c\x65\x60\x90\x35\x1a\x51\x5a\xca\x39\xf5\x8b\x34\x85\xda\x7c\x0a\x69\x69\x52\xea\x61\x8f\x1f\x79\xeb\x7c\x55\xb0\x56\xee\xc7\x7e\x22\x22\x4b\xd7\x9d\x2a\xd9\xf5\x97\xf1\x2d\xcd\xd7\xc7\x16\x05\x18\xcc\xd7\x7b\xb5\x31\x7a\xc0\xea\x66\xb6\xa8\x0a\x2c\xc4\xe2\x8a\xe3\x88\x1c\x59\xdf\xf4\xd4\x68\x47\x79\x77\x6b\xf9\xe3\xac\xcc\x83\x84\xf2\xa1\xf0\x5c\xd3\xca\xdb\x34\x5a\x27\x66\x9e\xa1\xc0\x59\xe0\x86\xf4\x21\x34\x6a\xe2\xcf\x95\xd1\x9f\x75\x94\x1e\xed\x79\xc7\x75\xeb\x55\x7e\x25\x2e\x08\xd9\x66\x22\x04\x00\x6d\x2b\xa9\x37\x5b\xd8\x71\xf6\xb6\x4a\x06\x33\xa3\xb2\x71\xd8\xf1\xac\x39\xd3\x9e\x6a\x51\x00\xc9\x9e\xff\xd2\xa0\x9d\xf4\xb4\x9d\x1a\x41\x17\x6d\x4d\xe1\xa4\x23\x6c\x81\x90\xbf\xfa\xd2\x51\xa1\x13\xcc\x16\xd4\x99\xac\x21\x2d\xb3\x1b\x26\x49\x7a\x39\x9c\xe1\xac\xc2\xb4\xa6\x3c\xee\xe1\x93\xbf\xb9\x4b\xf9\x1d\xc3\x09\xc7\xba\x46\x64\xb4\xe9\x9c\x74\x57\x86\xb7", 4096); *(uint16_t*)0x20001080 = 2; *(uint16_t*)0x20001082 = htobe16(0x4e22); *(uint8_t*)0x20001084 = 0; *(uint8_t*)0x20001085 = 0; *(uint8_t*)0x20001086 = 0; *(uint8_t*)0x20001087 = 0; *(uint8_t*)0x20001088 = 0; *(uint8_t*)0x20001089 = 0; *(uint8_t*)0x2000108a = 0; *(uint8_t*)0x2000108b = 0; syscall(SYS_sendto, r[0], 0x20000080ul, 0x1000ul, 3ul, 0x20001080ul, 0xcul); break; case 2: *(uint16_t*)0x200011c0 = 2; *(uint16_t*)0x200011c2 = htobe16(0x4e20); *(uint8_t*)0x200011c4 = 0; *(uint8_t*)0x200011c5 = 0; *(uint8_t*)0x200011c6 = 0; *(uint8_t*)0x200011c7 = 0; *(uint8_t*)0x200011c8 = 0; *(uint8_t*)0x200011c9 = 0; *(uint8_t*)0x200011ca = 0; *(uint8_t*)0x200011cb = 0; syscall(SYS_recvfrom, 0xffffff9c, 0x200010c0ul, 0xcdul, 0x802ul, 0x200011c0ul, 0xcul); break; case 3: memcpy((void*)0x20001200, "\x65\x34\x64\x0a\x5e\x77\x48\x51\x1a\x23\xbf\x56\x23", 13); syscall(SYS_setsockopt, -1, 0, 1, 0x20001200ul, 0xdul); break; case 4: *(uint32_t*)0x20001280 = 0xc; res = syscall(SYS_paccept, 0xffffff9c, 0x20001240ul, 0x20001280ul, 0ul); if (res != -1) r[1] = res; break; case 5: *(uint16_t*)0x200012c0 = 0x18; *(uint16_t*)0x200012c2 = htobe16(0x4e23); *(uint32_t*)0x200012c4 = 1; *(uint32_t*)0x200012c8 = 0x800; syscall(SYS_connect, r[1], 0x200012c0ul, 0xcul); break; case 6: *(uint32_t*)0x20002340 = 0x1002; res = syscall(SYS_accept, -1, 0x20001300ul, 0x20002340ul); if (res != -1) r[2] = res; break; case 7: *(uint64_t*)0x200024c0 = 0x20002380; memcpy((void*)0x20002380, "\xce\x0f\xda\xd9\xa6\x4a\x58\xf7\x84\xd8\x08\x7a\xf8\x05\xaa\x2b\xd2\xf9\xb8\x6b\x22\xd9\xb2\xc3\x2c\x58\x73\xc3\xf3\x2b\xef\xbc\x76\xc4\x7e\x31\xe9\x5c\xb5\x77\x20\x09\x97\x41\x06\xdd\x56\xe9\xb7\x7e\x9e\xf2\x1b\x64\xeb\xda\x31\x08\x05\x30\xf8\xdb\xeb\x72\xd1\x92\x5f\x06\xc0\xe6\x16\x3c\x87\x37\x29\x3d\x33\x34\xcd\xfe\x5d\xe4\x21\xf3\x35\x04\xea\xa8\x02\x4b\xcb\x42\xa0\xad\x53\xd6\xbd\x25\xe3\xb6\x65\x03\x62\x96\x98\x53\x80\x33\x00\xc7\x1d\x12\x31\xf7\x3d\x20\x10\x9f\xd2\xb8\x05\xd7\xc0\xde\x06\x68\x00\x18\x86\xe4\xa3\x80\x88\x0e\x16\x9d\xe6\x77\xcb\x12\x4c\xc6\x05\x78\x02\x0f\xfe\xcb\xe8\x38\x19\x65\x69\x72\x96\xf8\x7c\xa1\xdd\x26\xd2\x39\xf0\x0c\x44\xd2\x8f\x44\x04\x68\x97\x8e\xdf\x01\x9a\x5d\xb0\x50\x91\x3f\x84\x18\x95\xd9\xd9\xa4\x2a\x50\xfd\x29\x53\xaf\x0b\xd6\xc6\x92\x83\x5f\x5f\x28\xb4\x67\x68\xfc\x54\x00\x14\xf8\xd3\xee\x3d\x80\x17\x5c\xd9\xbc\xa3\xe5\x2d\x0a\x15\xb8\x87\x73\xf3\xb8\x11\x08\x90\xf4\xdf\xfe\x75\x43\x3f\xda\xba\xc5\x4c\x62\x29\x8a", 242); *(uint64_t*)0x200024c8 = 0xf2; *(uint64_t*)0x200024d0 = 0x20002480; memcpy((void*)0x20002480, "\x80\x24\x2b\xeb\xc8\x1b\xd3\xda\xdc\xb9\x92\xd2\xde\x24\xb8\x13\x00\xa6\x36\xd3\xa6\x4b\xdf\xe9\x31\x33\xe1\x44\x29\xda\x14\xcf\x31\x7e\xde\xd2\x00\xe3\x71\xe3\x4a\xef\x0b\xba\xf2\x72\xa4\xe8\x77\x89\x08", 51); *(uint64_t*)0x200024d8 = 0x33; syscall(SYS_pwritev, r[2], 0x200024c0ul, 2ul, 0x51ul); break; case 8: *(uint32_t*)0x20002540 = 0xc; syscall(SYS_getpeername, r[2], 0x20002500ul, 0x20002540ul); break; case 9: syscall(SYS_dup2, -1, -1); break; case 10: memcpy((void*)0x20000000, "\x48\xf7\xf1\x90\xc6\x85\xfa\xd5\x02\x0b\x2c\x72\x6e\xad\xc8\x3c\x08\x67\xb0\x1c\x6b\x28\xea\x05\xf4\xbd\x05\x44\xeb\x88\x3e\xc3\xd8\x89\x7d\x9a\xee\x86\xbc\xb2\xc9\x0e\xbe\x68\x77\x4c\x20\x65\x70\xc9\x03", 51); break; case 11: memcpy((void*)0x20000040, "\xc4\x22\x7d\xb7\x4b\x0b\x45\x86\x57\xfb\x66\x44\x0f\x38\xdc\xd2\xc4\x81\xf9\x5b\xfe\x0f\x49\xf8\x66\x0f\x3a\x0c\x9b\xb4\x00\x00\x00\xfe\xc4\xa2\xfd\xa6\xfc\xc4\xa1\x4d\xd5\x16\xc4\x01\x94\x59\x6d\x64\x66\x41\x0f\x6c\x23", 55); syz_execute_func(0x20000040); break; case 12: break; case 13: memcpy((void*)0x200000c0, "\x53\x89\x0e\xf7\x06\x9c\xeb\xf4\xab\x2e\x38\x62\xd4\xe8\xf0\xd7\xcd\x39\x04\x66\x11\xd8\x6e\xfa\x40\x3d\x25\x55\x8c\x0d\xe4\xab\x33\xf8\x31\xe6\xf5\xf5\x29\x56\x03\x28\x35\x78\x3b\xf2\xd0\xf5\x81\x7f\x8b\x8d\xda\x73\xc7\x54\x2d\x9f\x0d\x12\xa6\x31\xe2\x5a\x3e\xe4\xdc\xfb\x6a\xe2\xf9\x68\xa8\x25\xda\xc5\x81\x2d\x8c\x6b\x82\x64\xe0\xb7\x8c\x3d\xaa\x0c\x76\x23\x7a\x22\x3a\x71\xf5\x0b\xa3\x6e\x78\x4b\x03\xb1\xf3\x87\x05\xa2\x37\xcf\x14\xc4\x37\xfd\xc2\x36\x3d\xc7\x73\xb1\x94\x6b\xe9\x83\x5b\xd5\x9c\xf8\x39\x00\x38\xfb\x9b\xac\x19\x1e\xc2\x55\xea\xf7\x0e\xa2\xb5\x63\xdb\x02\x24\x60\xb0\x5e\x8d\x6a\xcc\x51\xea\x2d\xc2\x5f\xf0\x6b\x2a\xdd\x98\x89\x0a\x72\x78\x07\x07\x2b\x47\xf3\x8e\xe4\x2d\x63\x67\xe7\xd3\x54\x8d\x3f\x13\xca\x55\x74\x42\x6d\xf2\x94\x62\x6c\x3e\xf4\xb8\xcf\x7a\xea\x48\x30\xb7\x0d\x93\x12\x2e\xfd\x51\xfc\xe4\x84\x96\xa5\xbd\x03\xe3\x05\xf2\xad\x87\x19\x69\xc9\x7c\xef\xf6\xb6\xc2\x28\x6c\x54\x31\xb9\xfd\xbd\x88\x37\x62\x92\x98\xcb\x4e", 239); memcpy((void*)0x200001c0, "\xa1\x85\x22\x4a\x16\xff\x1a\x06\x2f\x6f\x97\x66\xae\xb7\xf5\x84\x08\xb0\x28\x45\x0e\x80\x97\x0d\x92\x50\x11\x4b\x2c\x87\x1d\x5d\x9e\xc6\x7f\x79\x90\xa3\x05\xb4\xbe\x2c\x41\xd3\x5d\x33\x16\xa7\xf4\xc9\xb2\x74\x01\xf8\x44\x0e\x71\xa5\x79\xb7\xf9\xac\xc6\x06\xd2\x0d\xa0\x88\xc7\x07\x7b\xbc\x3c\x36\x1e\x71\xc5\x77\x40\x61\x68\xbc\xc1\xbc\xb7\xf0\x2e\x41\x6e\x3f\x90\x84\x03\xe2\x3d\xb0\xc7\x27\xea\x76\x9d\xeb\xda\x4d\x0e\x52\x4f\x8a\xdf\x7f\x42\x18\x4a\x20\xba\x1a\x23\xf9\xc5\x8d\x46\x91\x4c\xc7\xb1\x2c\x19\x53\x7d\x55\xa4\x0f\xcd\x26\xc6\x8e\xfb\x09\xdc\x0a\xcc\x2e\xe7\x52\x4a\xbe\xc0\xb8\x03\x5a\xd2\xb1\xd1\x94\x33\x1e\x2e\xa4\xe4\x2e\xbc\x53\xd3\x88\x0e\x7c\x0d\xd6\xc5\x79\x02\xc8\x72\x7c\xef\xb0\xfd\x31\x92\xd6\x62", 181); syz_usb_connect(0x1e3d802a, 0xef, 0x200000c0, 0x200001c0); break; case 14: memcpy((void*)0x20000280, "\xb7\x48\xb2\x1b\x78\xea\x22\x21\x6c\x2c\xbf\xdc\xcb\x03\xec\x54\xd2\x0f\x30\xf4\xaf\x46\x2b\x7b\xfd\x5d\x30\x1b\x9a\x4f\xb8\xf9\xbb\xe6\x30\xdd\xe8\xd6\x08\x55\x02\x94\x47\xdf\x51\x12\x0e\x0d\x69\x0a\xe4\xa7\x3e\x5a\x06\x06\x4c\xc0\x6d\x83\x62\x2a\x66\xc3\xcf\x3c\xcd\x92\x0d\xf4\xa9\xde\xc5\x47\xf0\xc8\x53\x54\xb2\xe8\x03\x69\x9f\x52\xff\xc8\x14\x53\x6c\xe5\x19\xc7\xc1\x65\x26\xda\x56\xc6\x5b\x44\x29\xcb\x22\x4a\xd9\xc9\x7f\x63\x7e\xe6\xf2", 111); memcpy((void*)0x20000300, "\xfc\xa1\x69\x1e\x90\xfe\xf7\xc0\x69\x3e\x50\x16\x1f\x6b\xf9\xd6\xbe\x11\x62\x1b\x96\xa6\x5d\x50\x23\xd6\x6e\x18\xc9\xdc\x3b\xb3\x8c\xf4\x79\x30\x6e\xff\x4d\x2c\xf1\x75\xb6\xf8\x52\x15\x44\x6b\x23\x79\xfd\xc7\x32\x74\x56\x6c\x4c\xa7\xce\xc4\xd6\x6a\x48\x19\x12\xaf\xe2\x3a\x3f\x61\xad\xb9\x46\x7e\x5b\xf8\x28\x15\x64\x36\xeb\xe3\xd2\x9e\x30\x73\xe4\x25\x4b\x3a\x73\x4a\xcd\x66\xd1\x4e\xfb\x07\x36\xfc\xad\xff\x4d\xad\x73\xe0\x25\x31\x87\x0c\x30\xfa\xe0\xc3\x78\xc5\x15\x78\x6c\x88\xc1\x29\x27\x36\xcd\xf0\xb6\xa2\xe7\x9b\x47\xa7\x8e\x33\xf5\xe1\xd0\x68\x8a\x6f\x3c\xe2\xd9\xe1\x5b\xd3\xee\x2e\x2a\xfe\x1a\xc5\xc8\x52\x3a\x84\xa2\x08\x75\x5a\x7f\x82\x2f\x3d\x21\x1f\xe3\xa2\x6a\x86\x50\x7d\x98\x58\x3d\x56\x6a\x05\x91\xa7\x80\x2c\xb3\xf9\xf9\xdc\x35\xb9\x11\x0d\xe4\xb2\xf4\xd3\x93\x4b\xb2\x0b\x7a", 199); res = syz_usb_connect(0xa4, 0x6f, 0x20000280, 0x20000300); if (res != -1) r[3] = res; break; case 15: syz_usb_disconnect(r[3]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor305981654 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/14 (0.39s) csource_test.go:123: opts: {Threaded:true Collide:true Repeat:true RepeatTimes:0 Procs:2 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:true Trace:false} program: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000040)=0x8) sendto(r0, &(0x7f0000000080)="8d360d8e2229aab63aef8e41582b2d02e93c2190e2fe50c1f7f3b29e853f60fb587dd78a2c404615cdf3763b9a53dba141c66b4a485450d66e0a4a281e63e3527c88cdde73010e05449a77aee1e7a35fdddea497119a92fa7fb2d108d6475f90ca55e04b82e53d6ac1138cb913b8dbb0b6f922a1a85461459190969a7d79de9164f3b4e2e9dc65817cd3908bf131ac85e8713459e5da855dd94a0feea76b05dd56d5e0b5222332210506202af0c3718596bf5549077f213886eeb0b3e38b83e237290327d0cc6d5e374a365eccda88ebf8ce4141536b085424aadb2b0c5be557bea12ea53f3fd5b7d3b48edf54f860c8a8e1941e0a56d851b2c08b8d4c9bad81ad649d1479bb60644194385d680441c674f629c50abb98ea4859798a0a3edee95e33f9c2880db8c9279f971bd597b98978bd664047c144af6c7954cc4edb914a618047a063ee7531377216a1f42404fde995936f5d7aba61bb230700ac3390d8fbc62772094fb8e543f39134132c6815d1ebf15bd0068e3b7ea86bb183465b91a431f52fe38bd0e6e077298ae8265685e46961fa82b64c5f757eaf9a7d0f63ed2849b17af0c550118c7e8e5addd917ce997796319e6bcf9bc42b8ba87c94e5a31b1cecb2fde9c571f9a87a88230f8093a7ae80a0c45c3ceec69f1e1f844296045070f3728ec4fa644cd74881db3c72352e4b8318f8834ac6306a5698ce9a5eb314f3f8647067bd6de7c90940645931c310aa55e4268ecbaf64c9d8c9ace54fc9f224746ddd681840c392f274753342ef48ac1973abf5c38d0776bd61c087d7b54b1f93eaed1a7c9f73427e38d5e3ca2cd17fa00c69873921ed8f2b8b9f89509134f723b6980831f5504a65602bd9367a151c570a705910afd9f69116737327c193a8751d9c161b5b2ef4e406055fe79c570f7c3e8334623ef02b9f47eecb78d30db147d4fc90bc91faec2d9181206e41cccde0c21483bfd0c45d8765a13d69e22479c21816dbd590ae51e49f6058449b9d3dbe94075e2e57028f43f70201a1e4875b91697c29deb8c2572a105131c87f7685cad94d1321d4ae5cc6efede11ac80a0e00a63b2ba54fcc5195475c3f1ff572693d00e491a0445c987dedcbe73b69ec13d226b193ec03fa9a27a4a434d148983366c7d8e5bc3cea9fbeffd05b8b0090765159b380ac96429655125921507f97df3e9d41c66b2f5fffd0cad4826577916f941ac7c9ec7ab625ec9390e050c5885dbd2e7131f2794ecad5709e0ac395ad0edee0182822374e701167ad2cfda07ff9e9bddee1c688d483c132e197a9481c9eb0df2cf9669ab107cc936bf2c96268a120a44fb7f178b402ecd9c512f86908f43fea11cc6902c355929b910a523acd16d5931ea41753391a0368e5bbe9e8cd926da120d8440fce2c192b1e5986854de8551320c989533771f1a71fb41ff1c927ffba9e9e25ae533db6a3c804b0b340a0409e110ac76a7b58f912db41e33b115e1c3ae9aa0399edd621a0fd4b7be2176cb49682ee82b2a219baace63b3822b98ba6f48cd34a08143321993c4390b94b138e4adcfd47dd01982e24acb8d464738f44af04ff3353f8683f352306457522e653baa8937950448eef9879dfaa42e9fcca9a968971b60c413f4aa3e0f90b41c7828ad5dbb62aae0cd2d2ef85e248bf12e4d6d75b803aca52bb9616acc37bc8bdab1a66661a5329dc936b1dbc83fd598c57b9ad80ac42c21a6318b3fb8d0d865fffb043217c42f9546c050eb8cce5e3423371a93aff46471d2008c8cd5841f849d1f0d58317353a6d7308f7962d943795bd52a4dd5a8440640273c78ef6ebbeaae9143d5e6ee90cdaa257e132e6d42d02b9567ae69b75bc60f7596a1fdd8179cff323991701062930ce23a29e30023da9d631bf61a6440acc290bdeafbaaea78365f408aea8f864da220e7a560c9ac84bb9c975814c132f97e08b64ccad47ceb08f2941a4438feb76560b1d5e6f3289f50d054e949674eb6c3294cc4a27427650c4a37f53c65c55ca410fa62ee18a829220360a8272f8c0041e2bf33f047928feb0269c438bdf399b1d8f187b2454ea5cd873e352e1d0781570234c6d810c5a16bac9ea9ffafb0c978a022276903a1c653f17d96659cbb30abc1a320c584bdfcc00125270c2d4c90950029f711575dfa828feea3b1dc83c0701dffac1f89536583a0c0995550f862c3ec786c0f8fee0fd94fae0a661313f9e753362336db3ea0296d7fb913ad490bfc9dd155307ab14e67114fcde26d032435cec7d29247deb93bcf7fa48b4ddb5fb7449c0fda083d5a63e03922d5dfb361b7eeb122a094c3b08eacbd43cecc76c29a9bbcd4808bfa6eaeb78d3453e30660d1653569841869e3d8b90f3d047388da51919cf056ce1ce1d455177c95cdb8f76637d5336e82c9e10ddfd33515f7491ef28cbe4c8a477086daeb525d097844879d140965ef0463b3e1780065da2255e68aee903f7b06b0824b151525c56063d4be22ee31b82d2029fef15f38f9008d785dcab9f1454185ec4a3d76ed3aa8d27859f66ae63eddd338ac28f64048e46a5d0731f9b7ebe52218e11e78cb6d8172aea44f2c213ce7f5edfaed81c5de95a86aba484ec2e1950f61e743f11fbd881f2b0c891aa6e94fff4e5d747971313613da54b5483aabe5b12a8e661d455cdf442b86f3cd8b6e95e2ebfba7c62001769d5d9725f1df8ff364ff45f65b16fb2a828638313dbaac9818f990e8590d54b67613430b9f1869b7f2f756e4af19a145105b7b0f7c889b3146533114d001fc2c1b6b285ded35fd0b17857da527e80658f0b717a8c98920f72289896f05a686083fa9e84ee9f0590793b484365159cd18d9290fc7b342b3926bccdc830a519b8abd07e5b885cc4a6046423d5fa976588510cf5b0cfeaa38e7d170feb401bf9b3e4284415b8e2d2b8d73a0bfda6e246d4075c16f3bf8c1d8a1969dc57fc8786b1e4afb4ec6769534debe49ef6873e76289c6442c6d690457af91df631c7b0d4d0a18a43b26803bfe374a81de3c182b4dc50683f8545157b40f4b44db5eff729645421817ff5fdd0b4ca5cc2ba9b23c33256074b0cd5938aacea39e5cb5af7ec444267f1419867e355de6700ae0a63b7a57eaabe21aee216048612ec6c6993a577ca4d7a0071f5680d89baa337a37a5d1af9dc359d9708ddab0bb96323ae8f6a48d2b8b42d47d4a051b55d14116a359899c79011f2db86e08c2fb7c7d836355cd55f33aba9cb80a10c0844011e3ffa01f5472233fbaebe45f044154220094bf7da1a4035c195978e1b97eac6c41010b27dfb5df985ab16d219f415528b0403846b326f0a00f7b73c89933e1a2daa58dd8dee2f91e2d083eb25508ad3b3e916cf7e002140ed65ebe55ed8bec0cea09a5a61f7262aaa61cbf09d16ff6aac48c511fb8220dc5e20c3d4ce6283c53442a5cf408f3e66734208cc4f13a90a9ad6f90c1db802abcff903addba309ad25dd56cf6d37f32f82eb07fce24ac33e48451e7719e323f512a459a172172ff94d41be609aba82bcb7d827dfc73b4875209aa392c6f0d24f95bb900814fbff19c8d51d421270363bc808f29e21e14f6c99a13f8000fbfbc1cae461215fbba52511c9d14aaedb16e3a3725534b5713c554f1e5ebdc2abfaa712cf0d8ff6699cf0949f89b187e58bbac15927a701432f81b61e797136789ae2e824b0a74c553d59b7a1a1d512fec36c863422f0634560064ad2c310895d6d8a1a3f9429f08a7360cd4b4f9f208bf6d210d809796276e7a900ea994d3f8a3c3be28c3384c8d822fd108e8e9a195798149beb3e4eed373edac2bbc957b3f0432bcddc9556b734b19f91d94d21a881fbc882603f7da7f8993a74d5b12670f87aa69885abea718b67a700caf9fac78122a83b282099952664e5e8446a23b4bb3c01b1b4a9dca924fe0210445dd5e8ce3bdf2429463df24de0cb74bfc162847a6177d42feb487c89e1fd76fc59e4feaab91d6fadfa65a872a8128ea56f4914fb55165598db63bd701573f8ca7b78b69fe0983f1aadb99bb0ccbf9e2409d2833f9ab80296f9795c5e5740ebebb71238c6898dbd6e043cd6031c1590edfe763446a96d3806d62ef9a7467f4545d4b958ab916939d985856d06cc9369194329b961c0b767a76624104d3cacb9119d17499d83c1e6f95f4c79de2aae011413facd8962980b5327c7e22b516c841a985646e38126fb50c8bba642076489a8a8cc21cac2e92e6d459d5666b868da0e30121e972324076476490170f513efc5dcf57ce85d81c9fffceefb19ec98278e13abb2f322af44b980f9ef522e98d909507a8eeb7a0bd927d621e0fbfa06a9ca8f2f9978aae462db2cce9240c82942957472c722a0cbc1c84e6c7cd86bf6534d05090396b70cef7c77a29f06e5360d9c5c426988ee7653d022c1b49bc99494bc661c42b97b62c0f5351b5aabcaf1e22a6cb70d348753711f9063f87b292edf6137ac524b2a4cdf8d3a8ca035fd959ea40297645253a33946687bee09f66132f2cbca0f451b82108f4e68683fcef2cb3282d38fe47f6be597a0aba1b637e24fa2ea26f890f5e8cd2e438b0c42319c3f482b21b3b36e9b66907ab9451aa2d5b0d848c958179cd2c138e7a8133d10b952745c6f9c5ad206b13ae83e21236e06a27e60f54c15fdf96c084ee9253af3ae53f1e5c79bf61eef8cd90f382da1f2c072272bf9fc89b4fc6c18a57e197a366fdb5af0ff28131f42690ec69d59fae8c8f43c8f3cf4eacbdcf3e162e492e1bd533abe70bac53f9868c1995921c79d09f67a6b724410a468129f990d150e95663e54551feb97a4304f92ab3db2a43ca841ee3b0f6b62c751f6016b8439d5a08db8d34faa4ba7a7617fe5bbf1f8fcb5a9f55f1a1db83645eb93bde600032bbac895863cc54f09a9fe1e190a08abc6c080badd8245bb9918713ddaead377afbdcbc7cf4d191f6ca2fe2defa45c3c3353c277e1130284cd441da774eb16e7bf11ad0beef302022a18cf0479285df7f64feacacaef8ca50c201cb9001087611c4cd16f1ab6782d7eafae094c93cf301477a678c9ec482baa1d1d1a405494b67b35057b691af44dc3be73e26ab2b6fbe5d2e2117e0c6d0e964b3826a6e057c80e4f0ed78ed1310c24516b95dcefcf5dfd7e79e5e24e6922ade7efdc2242934973f636e300cbe5002f8bb0413a76baee10099b1008e384b8644188932abf79d0f26c66ebd662add68e039212bf4fd801114196e105d958ade15fb451fb5d5d90fee2ecb792bb5c864125bb3e63e0a7b59ff54f5d52ec590708840bbf134e25625690b262e5493a53ef206ce25c6b4dcbf3d8ebab2806f96b6a96eedebb2930fd7230e9601ce4ab66d721e856eedd6704f0b673e0febabd1148469bdf93c890c637c542b5fd4dc21b898c8c0150a1bc2817542e211205dc70be74977c37901fdc734613e5c1f40efbdf19b983abba0ddad01d0ab654b2e34c656090351a515aca39f58b3485da7c0a696952ea618f1f79eb7c55b056eec77e22224bd79d2ad9f597f12dcdd7c7160518ccd77bb5317ac0ea66b6a80a2cc4e28ae3881c59dff4d4684779776bf9e3accc8384f2a1f05cd3cadb345a27669ea1c059e086f421346ae2cf95d19f75941eed79c775eb557e252e08d9662204006d2ba9375bd871f6b64a0633a3b271d8f1ac39d39e6a5100c99effd2a09df4b49d1a41176d4de1a4236c8190bffad251a113cc16d499ac212db31b26497a399ce1acc2b4a63ceee193bfb94bf91dc309c7ba4664b4e99c745786b7", 0x1000, 0x3, &(0x7f0000001080)=@in={0x2, 0x2}, 0xc) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000010c0)=""/205, 0xcd, 0x802, &(0x7f00000011c0)={0x2, 0x0}, 0xc) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001200)="6534640a5e7748511a23bf5623", 0xd) r1 = paccept(0xffffffffffffff9c, &(0x7f0000001240)=@in, &(0x7f0000001280)=0xc, 0x0) connect$inet6(r1, &(0x7f00000012c0)={0x18, 0x3, 0x1, 0x800}, 0xc) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000001300)=@file={0x0, ""/4096}, &(0x7f0000002340)=0x1002) pwritev(r2, &(0x7f00000024c0)=[{&(0x7f0000002380)="ce0fdad9a64a58f784d8087af805aa2bd2f9b86b22d9b2c32c5873c3f32befbc76c47e31e95cb5772009974106dd56e9b77e9ef21b64ebda31080530f8dbeb72d1925f06c0e6163c8737293d3334cdfe5de421f33504eaa8024bcb42a0ad53d6bd25e3b6650362969853803300c71d1231f73d20109fd2b805d7c0de0668001886e4a380880e169de677cb124cc60578020ffecbe8381965697296f87ca1dd26d239f00c44d28f440468978edf019a5db050913f841895d9d9a42a50fd2953af0bd6c692835f5f28b46768fc540014f8d3ee3d80175cd9bca3e52d0a15b88773f3b8110890f4dffe75433fdabac54c62298a", 0xf2}, {&(0x7f0000002480)="80242bebc81bd3dadcb992d2de24b81300a636d3a64bdfe93133e14429da14cf317eded200e371e34aef0bbaf272a4e8778908", 0x33}], 0x2, 0x51) getpeername(r2, &(0x7f0000002500)=@in, &(0x7f0000002540)=0xc) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_ethernet(0x33, &(0x7f0000000000)="48f7f190c685fad5020b2c726eadc83c0867b01c6b28ea05f4bd0544eb883ec3d8897d9aee86bcb2c90ebe68774c206570c903") syz_execute_func(&(0x7f0000000040)="c4227db74b0b458657fb66440f38dcd2c481f95bfe0f49f8660f3a0c9bb4000000fec4a2fda6fcc4a14dd516c40194596d6466410f6c23") syz_extract_tcp_res(&(0x7f0000000080), 0x6, 0x8000) syz_usb_connect(0x1e3d802a, 0xef, &(0x7f00000000c0)="53890ef7069cebf4ab2e3862d4e8f0d7cd39046611d86efa403d25558c0de4ab33f831e6f5f52956032835783bf2d0f5817f8b8dda73c7542d9f0d12a631e25a3ee4dcfb6ae2f968a825dac5812d8c6b8264e0b78c3daa0c76237a223a71f50ba36e784b03b1f38705a237cf14c437fdc2363dc773b1946be9835bd59cf8390038fb9bac191ec255eaf70ea2b563db022460b05e8d6acc51ea2dc25ff06b2add98890a727807072b47f38ee42d6367e7d3548d3f13ca5574426df294626c3ef4b8cf7aea4830b70d93122efd51fce48496a5bd03e305f2ad871969c97ceff6b6c2286c5431b9fdbd8837629298cb4e", &(0x7f00000001c0)="a185224a16ff1a062f6f9766aeb7f58408b028450e80970d9250114b2c871d5d9ec67f7990a305b4be2c41d35d3316a7f4c9b27401f8440e71a579b7f9acc606d20da088c7077bbc3c361e71c577406168bcc1bcb7f02e416e3f908403e23db0c727ea769debda4d0e524f8adf7f42184a20ba1a23f9c58d46914cc7b12c19537d55a40fcd26c68efb09dc0acc2ee7524abec0b8035ad2b1d194331e2ea4e42ebc53d3880e7c0dd6c57902c8727cefb0fd3192d662") r3 = syz_usb_connect(0xa4, 0x6f, &(0x7f0000000280)="b748b21b78ea22216c2cbfdccb03ec54d20f30f4af462b7bfd5d301b9a4fb8f9bbe630dde8d60855029447df51120e0d690ae4a73e5a06064cc06d83622a66c3cf3ccd920df4a9dec547f0c85354b2e803699f52ffc814536ce519c7c16526da56c65b4429cb224ad9c97f637ee6f2", &(0x7f0000000300)="fca1691e90fef7c0693e50161f6bf9d6be11621b96a65d5023d66e18c9dc3bb38cf479306eff4d2cf175b6f85215446b2379fdc73274566c4ca7cec4d66a481912afe23a3f61adb9467e5bf828156436ebe3d29e3073e4254b3a734acd66d14efb0736fcadff4dad73e02531870c30fae0c378c515786c88c1292736cdf0b6a2e79b47a78e33f5e1d0688a6f3ce2d9e15bd3ee2e2afe1ac5c8523a84a208755a7f822f3d211fe3a26a86507d98583d566a0591a7802cb3f9f9dc35b9110de4b2f4d3934bb20b7a") syz_usb_disconnect(r3) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bEndpointAddress; uint8_t bmAttributes; uint16_t wMaxPacketSize; uint8_t bInterval; uint8_t bRefresh; uint8_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint16_t idVendor; uint16_t idProduct; uint16_t bcdDevice; uint8_t iManufacturer; uint8_t iProduct; uint8_t iSerialNumber; uint8_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t wTotalLength; uint8_t bNumInterfaces; uint8_t bConfigurationValue; uint8_t iConfiguration; uint8_t bmAttributes; uint8_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bNumEndpoints; uint8_t bInterfaceClass; uint8_t bInterfaceSubClass; uint8_t bInterfaceProtocol; uint8_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t bLength; uint8_t bDescriptorType; uint16_t bcdUSB; uint8_t bDeviceClass; uint8_t bDeviceSubClass; uint8_t bDeviceProtocol; uint8_t bMaxPacketSize0; uint8_t bNumConfigurations; uint8_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t* ptr = (uint8_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } int i, call, thread; int collide = 0; again: for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); if (collide && (call % 2) == 0) break; event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); if (!collide) { collide = 1; goto again; } } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_accept #define SYS_accept 30 #endif #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getpeername #define SYS_getpeername 31 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_pwritev #define SYS_pwritev 290 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 29 #endif #ifndef SYS_sendto #define SYS_sendto 133 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 105 #endif uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: *(uint32_t*)0x20000040 = 8; res = syscall(SYS_accept, -1, 0x20000000ul, 0x20000040ul); if (res != -1) r[0] = res; break; case 1: memcpy((void*)0x20000080, "\x8d\x36\x0d\x8e\x22\x29\xaa\xb6\x3a\xef\x8e\x41\x58\x2b\x2d\x02\xe9\x3c\x21\x90\xe2\xfe\x50\xc1\xf7\xf3\xb2\x9e\x85\x3f\x60\xfb\x58\x7d\xd7\x8a\x2c\x40\x46\x15\xcd\xf3\x76\x3b\x9a\x53\xdb\xa1\x41\xc6\x6b\x4a\x48\x54\x50\xd6\x6e\x0a\x4a\x28\x1e\x63\xe3\x52\x7c\x88\xcd\xde\x73\x01\x0e\x05\x44\x9a\x77\xae\xe1\xe7\xa3\x5f\xdd\xde\xa4\x97\x11\x9a\x92\xfa\x7f\xb2\xd1\x08\xd6\x47\x5f\x90\xca\x55\xe0\x4b\x82\xe5\x3d\x6a\xc1\x13\x8c\xb9\x13\xb8\xdb\xb0\xb6\xf9\x22\xa1\xa8\x54\x61\x45\x91\x90\x96\x9a\x7d\x79\xde\x91\x64\xf3\xb4\xe2\xe9\xdc\x65\x81\x7c\xd3\x90\x8b\xf1\x31\xac\x85\xe8\x71\x34\x59\xe5\xda\x85\x5d\xd9\x4a\x0f\xee\xa7\x6b\x05\xdd\x56\xd5\xe0\xb5\x22\x23\x32\x21\x05\x06\x20\x2a\xf0\xc3\x71\x85\x96\xbf\x55\x49\x07\x7f\x21\x38\x86\xee\xb0\xb3\xe3\x8b\x83\xe2\x37\x29\x03\x27\xd0\xcc\x6d\x5e\x37\x4a\x36\x5e\xcc\xda\x88\xeb\xf8\xce\x41\x41\x53\x6b\x08\x54\x24\xaa\xdb\x2b\x0c\x5b\xe5\x57\xbe\xa1\x2e\xa5\x3f\x3f\xd5\xb7\xd3\xb4\x8e\xdf\x54\xf8\x60\xc8\xa8\xe1\x94\x1e\x0a\x56\xd8\x51\xb2\xc0\x8b\x8d\x4c\x9b\xad\x81\xad\x64\x9d\x14\x79\xbb\x60\x64\x41\x94\x38\x5d\x68\x04\x41\xc6\x74\xf6\x29\xc5\x0a\xbb\x98\xea\x48\x59\x79\x8a\x0a\x3e\xde\xe9\x5e\x33\xf9\xc2\x88\x0d\xb8\xc9\x27\x9f\x97\x1b\xd5\x97\xb9\x89\x78\xbd\x66\x40\x47\xc1\x44\xaf\x6c\x79\x54\xcc\x4e\xdb\x91\x4a\x61\x80\x47\xa0\x63\xee\x75\x31\x37\x72\x16\xa1\xf4\x24\x04\xfd\xe9\x95\x93\x6f\x5d\x7a\xba\x61\xbb\x23\x07\x00\xac\x33\x90\xd8\xfb\xc6\x27\x72\x09\x4f\xb8\xe5\x43\xf3\x91\x34\x13\x2c\x68\x15\xd1\xeb\xf1\x5b\xd0\x06\x8e\x3b\x7e\xa8\x6b\xb1\x83\x46\x5b\x91\xa4\x31\xf5\x2f\xe3\x8b\xd0\xe6\xe0\x77\x29\x8a\xe8\x26\x56\x85\xe4\x69\x61\xfa\x82\xb6\x4c\x5f\x75\x7e\xaf\x9a\x7d\x0f\x63\xed\x28\x49\xb1\x7a\xf0\xc5\x50\x11\x8c\x7e\x8e\x5a\xdd\xd9\x17\xce\x99\x77\x96\x31\x9e\x6b\xcf\x9b\xc4\x2b\x8b\xa8\x7c\x94\xe5\xa3\x1b\x1c\xec\xb2\xfd\xe9\xc5\x71\xf9\xa8\x7a\x88\x23\x0f\x80\x93\xa7\xae\x80\xa0\xc4\x5c\x3c\xee\xc6\x9f\x1e\x1f\x84\x42\x96\x04\x50\x70\xf3\x72\x8e\xc4\xfa\x64\x4c\xd7\x48\x81\xdb\x3c\x72\x35\x2e\x4b\x83\x18\xf8\x83\x4a\xc6\x30\x6a\x56\x98\xce\x9a\x5e\xb3\x14\xf3\xf8\x64\x70\x67\xbd\x6d\xe7\xc9\x09\x40\x64\x59\x31\xc3\x10\xaa\x55\xe4\x26\x8e\xcb\xaf\x64\xc9\xd8\xc9\xac\xe5\x4f\xc9\xf2\x24\x74\x6d\xdd\x68\x18\x40\xc3\x92\xf2\x74\x75\x33\x42\xef\x48\xac\x19\x73\xab\xf5\xc3\x8d\x07\x76\xbd\x61\xc0\x87\xd7\xb5\x4b\x1f\x93\xea\xed\x1a\x7c\x9f\x73\x42\x7e\x38\xd5\xe3\xca\x2c\xd1\x7f\xa0\x0c\x69\x87\x39\x21\xed\x8f\x2b\x8b\x9f\x89\x50\x91\x34\xf7\x23\xb6\x98\x08\x31\xf5\x50\x4a\x65\x60\x2b\xd9\x36\x7a\x15\x1c\x57\x0a\x70\x59\x10\xaf\xd9\xf6\x91\x16\x73\x73\x27\xc1\x93\xa8\x75\x1d\x9c\x16\x1b\x5b\x2e\xf4\xe4\x06\x05\x5f\xe7\x9c\x57\x0f\x7c\x3e\x83\x34\x62\x3e\xf0\x2b\x9f\x47\xee\xcb\x78\xd3\x0d\xb1\x47\xd4\xfc\x90\xbc\x91\xfa\xec\x2d\x91\x81\x20\x6e\x41\xcc\xcd\xe0\xc2\x14\x83\xbf\xd0\xc4\x5d\x87\x65\xa1\x3d\x69\xe2\x24\x79\xc2\x18\x16\xdb\xd5\x90\xae\x51\xe4\x9f\x60\x58\x44\x9b\x9d\x3d\xbe\x94\x07\x5e\x2e\x57\x02\x8f\x43\xf7\x02\x01\xa1\xe4\x87\x5b\x91\x69\x7c\x29\xde\xb8\xc2\x57\x2a\x10\x51\x31\xc8\x7f\x76\x85\xca\xd9\x4d\x13\x21\xd4\xae\x5c\xc6\xef\xed\xe1\x1a\xc8\x0a\x0e\x00\xa6\x3b\x2b\xa5\x4f\xcc\x51\x95\x47\x5c\x3f\x1f\xf5\x72\x69\x3d\x00\xe4\x91\xa0\x44\x5c\x98\x7d\xed\xcb\xe7\x3b\x69\xec\x13\xd2\x26\xb1\x93\xec\x03\xfa\x9a\x27\xa4\xa4\x34\xd1\x48\x98\x33\x66\xc7\xd8\xe5\xbc\x3c\xea\x9f\xbe\xff\xd0\x5b\x8b\x00\x90\x76\x51\x59\xb3\x80\xac\x96\x42\x96\x55\x12\x59\x21\x50\x7f\x97\xdf\x3e\x9d\x41\xc6\x6b\x2f\x5f\xff\xd0\xca\xd4\x82\x65\x77\x91\x6f\x94\x1a\xc7\xc9\xec\x7a\xb6\x25\xec\x93\x90\xe0\x50\xc5\x88\x5d\xbd\x2e\x71\x31\xf2\x79\x4e\xca\xd5\x70\x9e\x0a\xc3\x95\xad\x0e\xde\xe0\x18\x28\x22\x37\x4e\x70\x11\x67\xad\x2c\xfd\xa0\x7f\xf9\xe9\xbd\xde\xe1\xc6\x88\xd4\x83\xc1\x32\xe1\x97\xa9\x48\x1c\x9e\xb0\xdf\x2c\xf9\x66\x9a\xb1\x07\xcc\x93\x6b\xf2\xc9\x62\x68\xa1\x20\xa4\x4f\xb7\xf1\x78\xb4\x02\xec\xd9\xc5\x12\xf8\x69\x08\xf4\x3f\xea\x11\xcc\x69\x02\xc3\x55\x92\x9b\x91\x0a\x52\x3a\xcd\x16\xd5\x93\x1e\xa4\x17\x53\x39\x1a\x03\x68\xe5\xbb\xe9\xe8\xcd\x92\x6d\xa1\x20\xd8\x44\x0f\xce\x2c\x19\x2b\x1e\x59\x86\x85\x4d\xe8\x55\x13\x20\xc9\x89\x53\x37\x71\xf1\xa7\x1f\xb4\x1f\xf1\xc9\x27\xff\xba\x9e\x9e\x25\xae\x53\x3d\xb6\xa3\xc8\x04\xb0\xb3\x40\xa0\x40\x9e\x11\x0a\xc7\x6a\x7b\x58\xf9\x12\xdb\x41\xe3\x3b\x11\x5e\x1c\x3a\xe9\xaa\x03\x99\xed\xd6\x21\xa0\xfd\x4b\x7b\xe2\x17\x6c\xb4\x96\x82\xee\x82\xb2\xa2\x19\xba\xac\xe6\x3b\x38\x22\xb9\x8b\xa6\xf4\x8c\xd3\x4a\x08\x14\x33\x21\x99\x3c\x43\x90\xb9\x4b\x13\x8e\x4a\xdc\xfd\x47\xdd\x01\x98\x2e\x24\xac\xb8\xd4\x64\x73\x8f\x44\xaf\x04\xff\x33\x53\xf8\x68\x3f\x35\x23\x06\x45\x75\x22\xe6\x53\xba\xa8\x93\x79\x50\x44\x8e\xef\x98\x79\xdf\xaa\x42\xe9\xfc\xca\x9a\x96\x89\x71\xb6\x0c\x41\x3f\x4a\xa3\xe0\xf9\x0b\x41\xc7\x82\x8a\xd5\xdb\xb6\x2a\xae\x0c\xd2\xd2\xef\x85\xe2\x48\xbf\x12\xe4\xd6\xd7\x5b\x80\x3a\xca\x52\xbb\x96\x16\xac\xc3\x7b\xc8\xbd\xab\x1a\x66\x66\x1a\x53\x29\xdc\x93\x6b\x1d\xbc\x83\xfd\x59\x8c\x57\xb9\xad\x80\xac\x42\xc2\x1a\x63\x18\xb3\xfb\x8d\x0d\x86\x5f\xff\xb0\x43\x21\x7c\x42\xf9\x54\x6c\x05\x0e\xb8\xcc\xe5\xe3\x42\x33\x71\xa9\x3a\xff\x46\x47\x1d\x20\x08\xc8\xcd\x58\x41\xf8\x49\xd1\xf0\xd5\x83\x17\x35\x3a\x6d\x73\x08\xf7\x96\x2d\x94\x37\x95\xbd\x52\xa4\xdd\x5a\x84\x40\x64\x02\x73\xc7\x8e\xf6\xeb\xbe\xaa\xe9\x14\x3d\x5e\x6e\xe9\x0c\xda\xa2\x57\xe1\x32\xe6\xd4\x2d\x02\xb9\x56\x7a\xe6\x9b\x75\xbc\x60\xf7\x59\x6a\x1f\xdd\x81\x79\xcf\xf3\x23\x99\x17\x01\x06\x29\x30\xce\x23\xa2\x9e\x30\x02\x3d\xa9\xd6\x31\xbf\x61\xa6\x44\x0a\xcc\x29\x0b\xde\xaf\xba\xae\xa7\x83\x65\xf4\x08\xae\xa8\xf8\x64\xda\x22\x0e\x7a\x56\x0c\x9a\xc8\x4b\xb9\xc9\x75\x81\x4c\x13\x2f\x97\xe0\x8b\x64\xcc\xad\x47\xce\xb0\x8f\x29\x41\xa4\x43\x8f\xeb\x76\x56\x0b\x1d\x5e\x6f\x32\x89\xf5\x0d\x05\x4e\x94\x96\x74\xeb\x6c\x32\x94\xcc\x4a\x27\x42\x76\x50\xc4\xa3\x7f\x53\xc6\x5c\x55\xca\x41\x0f\xa6\x2e\xe1\x8a\x82\x92\x20\x36\x0a\x82\x72\xf8\xc0\x04\x1e\x2b\xf3\x3f\x04\x79\x28\xfe\xb0\x26\x9c\x43\x8b\xdf\x39\x9b\x1d\x8f\x18\x7b\x24\x54\xea\x5c\xd8\x73\xe3\x52\xe1\xd0\x78\x15\x70\x23\x4c\x6d\x81\x0c\x5a\x16\xba\xc9\xea\x9f\xfa\xfb\x0c\x97\x8a\x02\x22\x76\x90\x3a\x1c\x65\x3f\x17\xd9\x66\x59\xcb\xb3\x0a\xbc\x1a\x32\x0c\x58\x4b\xdf\xcc\x00\x12\x52\x70\xc2\xd4\xc9\x09\x50\x02\x9f\x71\x15\x75\xdf\xa8\x28\xfe\xea\x3b\x1d\xc8\x3c\x07\x01\xdf\xfa\xc1\xf8\x95\x36\x58\x3a\x0c\x09\x95\x55\x0f\x86\x2c\x3e\xc7\x86\xc0\xf8\xfe\xe0\xfd\x94\xfa\xe0\xa6\x61\x31\x3f\x9e\x75\x33\x62\x33\x6d\xb3\xea\x02\x96\xd7\xfb\x91\x3a\xd4\x90\xbf\xc9\xdd\x15\x53\x07\xab\x14\xe6\x71\x14\xfc\xde\x26\xd0\x32\x43\x5c\xec\x7d\x29\x24\x7d\xeb\x93\xbc\xf7\xfa\x48\xb4\xdd\xb5\xfb\x74\x49\xc0\xfd\xa0\x83\xd5\xa6\x3e\x03\x92\x2d\x5d\xfb\x36\x1b\x7e\xeb\x12\x2a\x09\x4c\x3b\x08\xea\xcb\xd4\x3c\xec\xc7\x6c\x29\xa9\xbb\xcd\x48\x08\xbf\xa6\xea\xeb\x78\xd3\x45\x3e\x30\x66\x0d\x16\x53\x56\x98\x41\x86\x9e\x3d\x8b\x90\xf3\xd0\x47\x38\x8d\xa5\x19\x19\xcf\x05\x6c\xe1\xce\x1d\x45\x51\x77\xc9\x5c\xdb\x8f\x76\x63\x7d\x53\x36\xe8\x2c\x9e\x10\xdd\xfd\x33\x51\x5f\x74\x91\xef\x28\xcb\xe4\xc8\xa4\x77\x08\x6d\xae\xb5\x25\xd0\x97\x84\x48\x79\xd1\x40\x96\x5e\xf0\x46\x3b\x3e\x17\x80\x06\x5d\xa2\x25\x5e\x68\xae\xe9\x03\xf7\xb0\x6b\x08\x24\xb1\x51\x52\x5c\x56\x06\x3d\x4b\xe2\x2e\xe3\x1b\x82\xd2\x02\x9f\xef\x15\xf3\x8f\x90\x08\xd7\x85\xdc\xab\x9f\x14\x54\x18\x5e\xc4\xa3\xd7\x6e\xd3\xaa\x8d\x27\x85\x9f\x66\xae\x63\xed\xdd\x33\x8a\xc2\x8f\x64\x04\x8e\x46\xa5\xd0\x73\x1f\x9b\x7e\xbe\x52\x21\x8e\x11\xe7\x8c\xb6\xd8\x17\x2a\xea\x44\xf2\xc2\x13\xce\x7f\x5e\xdf\xae\xd8\x1c\x5d\xe9\x5a\x86\xab\xa4\x84\xec\x2e\x19\x50\xf6\x1e\x74\x3f\x11\xfb\xd8\x81\xf2\xb0\xc8\x91\xaa\x6e\x94\xff\xf4\xe5\xd7\x47\x97\x13\x13\x61\x3d\xa5\x4b\x54\x83\xaa\xbe\x5b\x12\xa8\xe6\x61\xd4\x55\xcd\xf4\x42\xb8\x6f\x3c\xd8\xb6\xe9\x5e\x2e\xbf\xba\x7c\x62\x00\x17\x69\xd5\xd9\x72\x5f\x1d\xf8\xff\x36\x4f\xf4\x5f\x65\xb1\x6f\xb2\xa8\x28\x63\x83\x13\xdb\xaa\xc9\x81\x8f\x99\x0e\x85\x90\xd5\x4b\x67\x61\x34\x30\xb9\xf1\x86\x9b\x7f\x2f\x75\x6e\x4a\xf1\x9a\x14\x51\x05\xb7\xb0\xf7\xc8\x89\xb3\x14\x65\x33\x11\x4d\x00\x1f\xc2\xc1\xb6\xb2\x85\xde\xd3\x5f\xd0\xb1\x78\x57\xda\x52\x7e\x80\x65\x8f\x0b\x71\x7a\x8c\x98\x92\x0f\x72\x28\x98\x96\xf0\x5a\x68\x60\x83\xfa\x9e\x84\xee\x9f\x05\x90\x79\x3b\x48\x43\x65\x15\x9c\xd1\x8d\x92\x90\xfc\x7b\x34\x2b\x39\x26\xbc\xcd\xc8\x30\xa5\x19\xb8\xab\xd0\x7e\x5b\x88\x5c\xc4\xa6\x04\x64\x23\xd5\xfa\x97\x65\x88\x51\x0c\xf5\xb0\xcf\xea\xa3\x8e\x7d\x17\x0f\xeb\x40\x1b\xf9\xb3\xe4\x28\x44\x15\xb8\xe2\xd2\xb8\xd7\x3a\x0b\xfd\xa6\xe2\x46\xd4\x07\x5c\x16\xf3\xbf\x8c\x1d\x8a\x19\x69\xdc\x57\xfc\x87\x86\xb1\xe4\xaf\xb4\xec\x67\x69\x53\x4d\xeb\xe4\x9e\xf6\x87\x3e\x76\x28\x9c\x64\x42\xc6\xd6\x90\x45\x7a\xf9\x1d\xf6\x31\xc7\xb0\xd4\xd0\xa1\x8a\x43\xb2\x68\x03\xbf\xe3\x74\xa8\x1d\xe3\xc1\x82\xb4\xdc\x50\x68\x3f\x85\x45\x15\x7b\x40\xf4\xb4\x4d\xb5\xef\xf7\x29\x64\x54\x21\x81\x7f\xf5\xfd\xd0\xb4\xca\x5c\xc2\xba\x9b\x23\xc3\x32\x56\x07\x4b\x0c\xd5\x93\x8a\xac\xea\x39\xe5\xcb\x5a\xf7\xec\x44\x42\x67\xf1\x41\x98\x67\xe3\x55\xde\x67\x00\xae\x0a\x63\xb7\xa5\x7e\xaa\xbe\x21\xae\xe2\x16\x04\x86\x12\xec\x6c\x69\x93\xa5\x77\xca\x4d\x7a\x00\x71\xf5\x68\x0d\x89\xba\xa3\x37\xa3\x7a\x5d\x1a\xf9\xdc\x35\x9d\x97\x08\xdd\xab\x0b\xb9\x63\x23\xae\x8f\x6a\x48\xd2\xb8\xb4\x2d\x47\xd4\xa0\x51\xb5\x5d\x14\x11\x6a\x35\x98\x99\xc7\x90\x11\xf2\xdb\x86\xe0\x8c\x2f\xb7\xc7\xd8\x36\x35\x5c\xd5\x5f\x33\xab\xa9\xcb\x80\xa1\x0c\x08\x44\x01\x1e\x3f\xfa\x01\xf5\x47\x22\x33\xfb\xae\xbe\x45\xf0\x44\x15\x42\x20\x09\x4b\xf7\xda\x1a\x40\x35\xc1\x95\x97\x8e\x1b\x97\xea\xc6\xc4\x10\x10\xb2\x7d\xfb\x5d\xf9\x85\xab\x16\xd2\x19\xf4\x15\x52\x8b\x04\x03\x84\x6b\x32\x6f\x0a\x00\xf7\xb7\x3c\x89\x93\x3e\x1a\x2d\xaa\x58\xdd\x8d\xee\x2f\x91\xe2\xd0\x83\xeb\x25\x50\x8a\xd3\xb3\xe9\x16\xcf\x7e\x00\x21\x40\xed\x65\xeb\xe5\x5e\xd8\xbe\xc0\xce\xa0\x9a\x5a\x61\xf7\x26\x2a\xaa\x61\xcb\xf0\x9d\x16\xff\x6a\xac\x48\xc5\x11\xfb\x82\x20\xdc\x5e\x20\xc3\xd4\xce\x62\x83\xc5\x34\x42\xa5\xcf\x40\x8f\x3e\x66\x73\x42\x08\xcc\x4f\x13\xa9\x0a\x9a\xd6\xf9\x0c\x1d\xb8\x02\xab\xcf\xf9\x03\xad\xdb\xa3\x09\xad\x25\xdd\x56\xcf\x6d\x37\xf3\x2f\x82\xeb\x07\xfc\xe2\x4a\xc3\x3e\x48\x45\x1e\x77\x19\xe3\x23\xf5\x12\xa4\x59\xa1\x72\x17\x2f\xf9\x4d\x41\xbe\x60\x9a\xba\x82\xbc\xb7\xd8\x27\xdf\xc7\x3b\x48\x75\x20\x9a\xa3\x92\xc6\xf0\xd2\x4f\x95\xbb\x90\x08\x14\xfb\xff\x19\xc8\xd5\x1d\x42\x12\x70\x36\x3b\xc8\x08\xf2\x9e\x21\xe1\x4f\x6c\x99\xa1\x3f\x80\x00\xfb\xfb\xc1\xca\xe4\x61\x21\x5f\xbb\xa5\x25\x11\xc9\xd1\x4a\xae\xdb\x16\xe3\xa3\x72\x55\x34\xb5\x71\x3c\x55\x4f\x1e\x5e\xbd\xc2\xab\xfa\xa7\x12\xcf\x0d\x8f\xf6\x69\x9c\xf0\x94\x9f\x89\xb1\x87\xe5\x8b\xba\xc1\x59\x27\xa7\x01\x43\x2f\x81\xb6\x1e\x79\x71\x36\x78\x9a\xe2\xe8\x24\xb0\xa7\x4c\x55\x3d\x59\xb7\xa1\xa1\xd5\x12\xfe\xc3\x6c\x86\x34\x22\xf0\x63\x45\x60\x06\x4a\xd2\xc3\x10\x89\x5d\x6d\x8a\x1a\x3f\x94\x29\xf0\x8a\x73\x60\xcd\x4b\x4f\x9f\x20\x8b\xf6\xd2\x10\xd8\x09\x79\x62\x76\xe7\xa9\x00\xea\x99\x4d\x3f\x8a\x3c\x3b\xe2\x8c\x33\x84\xc8\xd8\x22\xfd\x10\x8e\x8e\x9a\x19\x57\x98\x14\x9b\xeb\x3e\x4e\xed\x37\x3e\xda\xc2\xbb\xc9\x57\xb3\xf0\x43\x2b\xcd\xdc\x95\x56\xb7\x34\xb1\x9f\x91\xd9\x4d\x21\xa8\x81\xfb\xc8\x82\x60\x3f\x7d\xa7\xf8\x99\x3a\x74\xd5\xb1\x26\x70\xf8\x7a\xa6\x98\x85\xab\xea\x71\x8b\x67\xa7\x00\xca\xf9\xfa\xc7\x81\x22\xa8\x3b\x28\x20\x99\x95\x26\x64\xe5\xe8\x44\x6a\x23\xb4\xbb\x3c\x01\xb1\xb4\xa9\xdc\xa9\x24\xfe\x02\x10\x44\x5d\xd5\xe8\xce\x3b\xdf\x24\x29\x46\x3d\xf2\x4d\xe0\xcb\x74\xbf\xc1\x62\x84\x7a\x61\x77\xd4\x2f\xeb\x48\x7c\x89\xe1\xfd\x76\xfc\x59\xe4\xfe\xaa\xb9\x1d\x6f\xad\xfa\x65\xa8\x72\xa8\x12\x8e\xa5\x6f\x49\x14\xfb\x55\x16\x55\x98\xdb\x63\xbd\x70\x15\x73\xf8\xca\x7b\x78\xb6\x9f\xe0\x98\x3f\x1a\xad\xb9\x9b\xb0\xcc\xbf\x9e\x24\x09\xd2\x83\x3f\x9a\xb8\x02\x96\xf9\x79\x5c\x5e\x57\x40\xeb\xeb\xb7\x12\x38\xc6\x89\x8d\xbd\x6e\x04\x3c\xd6\x03\x1c\x15\x90\xed\xfe\x76\x34\x46\xa9\x6d\x38\x06\xd6\x2e\xf9\xa7\x46\x7f\x45\x45\xd4\xb9\x58\xab\x91\x69\x39\xd9\x85\x85\x6d\x06\xcc\x93\x69\x19\x43\x29\xb9\x61\xc0\xb7\x67\xa7\x66\x24\x10\x4d\x3c\xac\xb9\x11\x9d\x17\x49\x9d\x83\xc1\xe6\xf9\x5f\x4c\x79\xde\x2a\xae\x01\x14\x13\xfa\xcd\x89\x62\x98\x0b\x53\x27\xc7\xe2\x2b\x51\x6c\x84\x1a\x98\x56\x46\xe3\x81\x26\xfb\x50\xc8\xbb\xa6\x42\x07\x64\x89\xa8\xa8\xcc\x21\xca\xc2\xe9\x2e\x6d\x45\x9d\x56\x66\xb8\x68\xda\x0e\x30\x12\x1e\x97\x23\x24\x07\x64\x76\x49\x01\x70\xf5\x13\xef\xc5\xdc\xf5\x7c\xe8\x5d\x81\xc9\xff\xfc\xee\xfb\x19\xec\x98\x27\x8e\x13\xab\xb2\xf3\x22\xaf\x44\xb9\x80\xf9\xef\x52\x2e\x98\xd9\x09\x50\x7a\x8e\xeb\x7a\x0b\xd9\x27\xd6\x21\xe0\xfb\xfa\x06\xa9\xca\x8f\x2f\x99\x78\xaa\xe4\x62\xdb\x2c\xce\x92\x40\xc8\x29\x42\x95\x74\x72\xc7\x22\xa0\xcb\xc1\xc8\x4e\x6c\x7c\xd8\x6b\xf6\x53\x4d\x05\x09\x03\x96\xb7\x0c\xef\x7c\x77\xa2\x9f\x06\xe5\x36\x0d\x9c\x5c\x42\x69\x88\xee\x76\x53\xd0\x22\xc1\xb4\x9b\xc9\x94\x94\xbc\x66\x1c\x42\xb9\x7b\x62\xc0\xf5\x35\x1b\x5a\xab\xca\xf1\xe2\x2a\x6c\xb7\x0d\x34\x87\x53\x71\x1f\x90\x63\xf8\x7b\x29\x2e\xdf\x61\x37\xac\x52\x4b\x2a\x4c\xdf\x8d\x3a\x8c\xa0\x35\xfd\x95\x9e\xa4\x02\x97\x64\x52\x53\xa3\x39\x46\x68\x7b\xee\x09\xf6\x61\x32\xf2\xcb\xca\x0f\x45\x1b\x82\x10\x8f\x4e\x68\x68\x3f\xce\xf2\xcb\x32\x82\xd3\x8f\xe4\x7f\x6b\xe5\x97\xa0\xab\xa1\xb6\x37\xe2\x4f\xa2\xea\x26\xf8\x90\xf5\xe8\xcd\x2e\x43\x8b\x0c\x42\x31\x9c\x3f\x48\x2b\x21\xb3\xb3\x6e\x9b\x66\x90\x7a\xb9\x45\x1a\xa2\xd5\xb0\xd8\x48\xc9\x58\x17\x9c\xd2\xc1\x38\xe7\xa8\x13\x3d\x10\xb9\x52\x74\x5c\x6f\x9c\x5a\xd2\x06\xb1\x3a\xe8\x3e\x21\x23\x6e\x06\xa2\x7e\x60\xf5\x4c\x15\xfd\xf9\x6c\x08\x4e\xe9\x25\x3a\xf3\xae\x53\xf1\xe5\xc7\x9b\xf6\x1e\xef\x8c\xd9\x0f\x38\x2d\xa1\xf2\xc0\x72\x27\x2b\xf9\xfc\x89\xb4\xfc\x6c\x18\xa5\x7e\x19\x7a\x36\x6f\xdb\x5a\xf0\xff\x28\x13\x1f\x42\x69\x0e\xc6\x9d\x59\xfa\xe8\xc8\xf4\x3c\x8f\x3c\xf4\xea\xcb\xdc\xf3\xe1\x62\xe4\x92\xe1\xbd\x53\x3a\xbe\x70\xba\xc5\x3f\x98\x68\xc1\x99\x59\x21\xc7\x9d\x09\xf6\x7a\x6b\x72\x44\x10\xa4\x68\x12\x9f\x99\x0d\x15\x0e\x95\x66\x3e\x54\x55\x1f\xeb\x97\xa4\x30\x4f\x92\xab\x3d\xb2\xa4\x3c\xa8\x41\xee\x3b\x0f\x6b\x62\xc7\x51\xf6\x01\x6b\x84\x39\xd5\xa0\x8d\xb8\xd3\x4f\xaa\x4b\xa7\xa7\x61\x7f\xe5\xbb\xf1\xf8\xfc\xb5\xa9\xf5\x5f\x1a\x1d\xb8\x36\x45\xeb\x93\xbd\xe6\x00\x03\x2b\xba\xc8\x95\x86\x3c\xc5\x4f\x09\xa9\xfe\x1e\x19\x0a\x08\xab\xc6\xc0\x80\xba\xdd\x82\x45\xbb\x99\x18\x71\x3d\xda\xea\xd3\x77\xaf\xbd\xcb\xc7\xcf\x4d\x19\x1f\x6c\xa2\xfe\x2d\xef\xa4\x5c\x3c\x33\x53\xc2\x77\xe1\x13\x02\x84\xcd\x44\x1d\xa7\x74\xeb\x16\xe7\xbf\x11\xad\x0b\xee\xf3\x02\x02\x2a\x18\xcf\x04\x79\x28\x5d\xf7\xf6\x4f\xea\xca\xca\xef\x8c\xa5\x0c\x20\x1c\xb9\x00\x10\x87\x61\x1c\x4c\xd1\x6f\x1a\xb6\x78\x2d\x7e\xaf\xae\x09\x4c\x93\xcf\x30\x14\x77\xa6\x78\xc9\xec\x48\x2b\xaa\x1d\x1d\x1a\x40\x54\x94\xb6\x7b\x35\x05\x7b\x69\x1a\xf4\x4d\xc3\xbe\x73\xe2\x6a\xb2\xb6\xfb\xe5\xd2\xe2\x11\x7e\x0c\x6d\x0e\x96\x4b\x38\x26\xa6\xe0\x57\xc8\x0e\x4f\x0e\xd7\x8e\xd1\x31\x0c\x24\x51\x6b\x95\xdc\xef\xcf\x5d\xfd\x7e\x79\xe5\xe2\x4e\x69\x22\xad\xe7\xef\xdc\x22\x42\x93\x49\x73\xf6\x36\xe3\x00\xcb\xe5\x00\x2f\x8b\xb0\x41\x3a\x76\xba\xee\x10\x09\x9b\x10\x08\xe3\x84\xb8\x64\x41\x88\x93\x2a\xbf\x79\xd0\xf2\x6c\x66\xeb\xd6\x62\xad\xd6\x8e\x03\x92\x12\xbf\x4f\xd8\x01\x11\x41\x96\xe1\x05\xd9\x58\xad\xe1\x5f\xb4\x51\xfb\x5d\x5d\x90\xfe\xe2\xec\xb7\x92\xbb\x5c\x86\x41\x25\xbb\x3e\x63\xe0\xa7\xb5\x9f\xf5\x4f\x5d\x52\xec\x59\x07\x08\x84\x0b\xbf\x13\x4e\x25\x62\x56\x90\xb2\x62\xe5\x49\x3a\x53\xef\x20\x6c\xe2\x5c\x6b\x4d\xcb\xf3\xd8\xeb\xab\x28\x06\xf9\x6b\x6a\x96\xee\xde\xbb\x29\x30\xfd\x72\x30\xe9\x60\x1c\xe4\xab\x66\xd7\x21\xe8\x56\xee\xdd\x67\x04\xf0\xb6\x73\xe0\xfe\xba\xbd\x11\x48\x46\x9b\xdf\x93\xc8\x90\xc6\x37\xc5\x42\xb5\xfd\x4d\xc2\x1b\x89\x8c\x8c\x01\x50\xa1\xbc\x28\x17\x54\x2e\x21\x12\x05\xdc\x70\xbe\x74\x97\x7c\x37\x90\x1f\xdc\x73\x46\x13\xe5\xc1\xf4\x0e\xfb\xdf\x19\xb9\x83\xab\xba\x0d\xda\xd0\x1d\x0a\xb6\x54\xb2\xe3\x4c\x65\x60\x90\x35\x1a\x51\x5a\xca\x39\xf5\x8b\x34\x85\xda\x7c\x0a\x69\x69\x52\xea\x61\x8f\x1f\x79\xeb\x7c\x55\xb0\x56\xee\xc7\x7e\x22\x22\x4b\xd7\x9d\x2a\xd9\xf5\x97\xf1\x2d\xcd\xd7\xc7\x16\x05\x18\xcc\xd7\x7b\xb5\x31\x7a\xc0\xea\x66\xb6\xa8\x0a\x2c\xc4\xe2\x8a\xe3\x88\x1c\x59\xdf\xf4\xd4\x68\x47\x79\x77\x6b\xf9\xe3\xac\xcc\x83\x84\xf2\xa1\xf0\x5c\xd3\xca\xdb\x34\x5a\x27\x66\x9e\xa1\xc0\x59\xe0\x86\xf4\x21\x34\x6a\xe2\xcf\x95\xd1\x9f\x75\x94\x1e\xed\x79\xc7\x75\xeb\x55\x7e\x25\x2e\x08\xd9\x66\x22\x04\x00\x6d\x2b\xa9\x37\x5b\xd8\x71\xf6\xb6\x4a\x06\x33\xa3\xb2\x71\xd8\xf1\xac\x39\xd3\x9e\x6a\x51\x00\xc9\x9e\xff\xd2\xa0\x9d\xf4\xb4\x9d\x1a\x41\x17\x6d\x4d\xe1\xa4\x23\x6c\x81\x90\xbf\xfa\xd2\x51\xa1\x13\xcc\x16\xd4\x99\xac\x21\x2d\xb3\x1b\x26\x49\x7a\x39\x9c\xe1\xac\xc2\xb4\xa6\x3c\xee\xe1\x93\xbf\xb9\x4b\xf9\x1d\xc3\x09\xc7\xba\x46\x64\xb4\xe9\x9c\x74\x57\x86\xb7", 4096); *(uint16_t*)0x20001080 = 2; *(uint16_t*)0x20001082 = htobe16(0x4e22 + procid*4); *(uint8_t*)0x20001084 = 0; *(uint8_t*)0x20001085 = 0; *(uint8_t*)0x20001086 = 0; *(uint8_t*)0x20001087 = 0; *(uint8_t*)0x20001088 = 0; *(uint8_t*)0x20001089 = 0; *(uint8_t*)0x2000108a = 0; *(uint8_t*)0x2000108b = 0; syscall(SYS_sendto, r[0], 0x20000080ul, 0x1000ul, 3ul, 0x20001080ul, 0xcul); break; case 2: *(uint16_t*)0x200011c0 = 2; *(uint16_t*)0x200011c2 = htobe16(0x4e20 + procid*4); *(uint8_t*)0x200011c4 = 0; *(uint8_t*)0x200011c5 = 0; *(uint8_t*)0x200011c6 = 0; *(uint8_t*)0x200011c7 = 0; *(uint8_t*)0x200011c8 = 0; *(uint8_t*)0x200011c9 = 0; *(uint8_t*)0x200011ca = 0; *(uint8_t*)0x200011cb = 0; syscall(SYS_recvfrom, 0xffffff9c, 0x200010c0ul, 0xcdul, 0x802ul, 0x200011c0ul, 0xcul); break; case 3: memcpy((void*)0x20001200, "\x65\x34\x64\x0a\x5e\x77\x48\x51\x1a\x23\xbf\x56\x23", 13); syscall(SYS_setsockopt, -1, 0, 1, 0x20001200ul, 0xdul); break; case 4: *(uint32_t*)0x20001280 = 0xc; res = syscall(SYS_paccept, 0xffffff9c, 0x20001240ul, 0x20001280ul, 0ul); if (res != -1) r[1] = res; break; case 5: *(uint16_t*)0x200012c0 = 0x18; *(uint16_t*)0x200012c2 = htobe16(0x4e23 + procid*4); *(uint32_t*)0x200012c4 = 1; *(uint32_t*)0x200012c8 = 0x800; syscall(SYS_connect, r[1], 0x200012c0ul, 0xcul); break; case 6: *(uint32_t*)0x20002340 = 0x1002; res = syscall(SYS_accept, -1, 0x20001300ul, 0x20002340ul); if (res != -1) r[2] = res; break; case 7: *(uint64_t*)0x200024c0 = 0x20002380; memcpy((void*)0x20002380, "\xce\x0f\xda\xd9\xa6\x4a\x58\xf7\x84\xd8\x08\x7a\xf8\x05\xaa\x2b\xd2\xf9\xb8\x6b\x22\xd9\xb2\xc3\x2c\x58\x73\xc3\xf3\x2b\xef\xbc\x76\xc4\x7e\x31\xe9\x5c\xb5\x77\x20\x09\x97\x41\x06\xdd\x56\xe9\xb7\x7e\x9e\xf2\x1b\x64\xeb\xda\x31\x08\x05\x30\xf8\xdb\xeb\x72\xd1\x92\x5f\x06\xc0\xe6\x16\x3c\x87\x37\x29\x3d\x33\x34\xcd\xfe\x5d\xe4\x21\xf3\x35\x04\xea\xa8\x02\x4b\xcb\x42\xa0\xad\x53\xd6\xbd\x25\xe3\xb6\x65\x03\x62\x96\x98\x53\x80\x33\x00\xc7\x1d\x12\x31\xf7\x3d\x20\x10\x9f\xd2\xb8\x05\xd7\xc0\xde\x06\x68\x00\x18\x86\xe4\xa3\x80\x88\x0e\x16\x9d\xe6\x77\xcb\x12\x4c\xc6\x05\x78\x02\x0f\xfe\xcb\xe8\x38\x19\x65\x69\x72\x96\xf8\x7c\xa1\xdd\x26\xd2\x39\xf0\x0c\x44\xd2\x8f\x44\x04\x68\x97\x8e\xdf\x01\x9a\x5d\xb0\x50\x91\x3f\x84\x18\x95\xd9\xd9\xa4\x2a\x50\xfd\x29\x53\xaf\x0b\xd6\xc6\x92\x83\x5f\x5f\x28\xb4\x67\x68\xfc\x54\x00\x14\xf8\xd3\xee\x3d\x80\x17\x5c\xd9\xbc\xa3\xe5\x2d\x0a\x15\xb8\x87\x73\xf3\xb8\x11\x08\x90\xf4\xdf\xfe\x75\x43\x3f\xda\xba\xc5\x4c\x62\x29\x8a", 242); *(uint64_t*)0x200024c8 = 0xf2; *(uint64_t*)0x200024d0 = 0x20002480; memcpy((void*)0x20002480, "\x80\x24\x2b\xeb\xc8\x1b\xd3\xda\xdc\xb9\x92\xd2\xde\x24\xb8\x13\x00\xa6\x36\xd3\xa6\x4b\xdf\xe9\x31\x33\xe1\x44\x29\xda\x14\xcf\x31\x7e\xde\xd2\x00\xe3\x71\xe3\x4a\xef\x0b\xba\xf2\x72\xa4\xe8\x77\x89\x08", 51); *(uint64_t*)0x200024d8 = 0x33; syscall(SYS_pwritev, r[2], 0x200024c0ul, 2ul, 0x51ul); break; case 8: *(uint32_t*)0x20002540 = 0xc; syscall(SYS_getpeername, r[2], 0x20002500ul, 0x20002540ul); break; case 9: syscall(SYS_dup2, -1, -1); break; case 10: memcpy((void*)0x20000000, "\x48\xf7\xf1\x90\xc6\x85\xfa\xd5\x02\x0b\x2c\x72\x6e\xad\xc8\x3c\x08\x67\xb0\x1c\x6b\x28\xea\x05\xf4\xbd\x05\x44\xeb\x88\x3e\xc3\xd8\x89\x7d\x9a\xee\x86\xbc\xb2\xc9\x0e\xbe\x68\x77\x4c\x20\x65\x70\xc9\x03", 51); break; case 11: memcpy((void*)0x20000040, "\xc4\x22\x7d\xb7\x4b\x0b\x45\x86\x57\xfb\x66\x44\x0f\x38\xdc\xd2\xc4\x81\xf9\x5b\xfe\x0f\x49\xf8\x66\x0f\x3a\x0c\x9b\xb4\x00\x00\x00\xfe\xc4\xa2\xfd\xa6\xfc\xc4\xa1\x4d\xd5\x16\xc4\x01\x94\x59\x6d\x64\x66\x41\x0f\x6c\x23", 55); syz_execute_func(0x20000040); break; case 12: break; case 13: memcpy((void*)0x200000c0, "\x53\x89\x0e\xf7\x06\x9c\xeb\xf4\xab\x2e\x38\x62\xd4\xe8\xf0\xd7\xcd\x39\x04\x66\x11\xd8\x6e\xfa\x40\x3d\x25\x55\x8c\x0d\xe4\xab\x33\xf8\x31\xe6\xf5\xf5\x29\x56\x03\x28\x35\x78\x3b\xf2\xd0\xf5\x81\x7f\x8b\x8d\xda\x73\xc7\x54\x2d\x9f\x0d\x12\xa6\x31\xe2\x5a\x3e\xe4\xdc\xfb\x6a\xe2\xf9\x68\xa8\x25\xda\xc5\x81\x2d\x8c\x6b\x82\x64\xe0\xb7\x8c\x3d\xaa\x0c\x76\x23\x7a\x22\x3a\x71\xf5\x0b\xa3\x6e\x78\x4b\x03\xb1\xf3\x87\x05\xa2\x37\xcf\x14\xc4\x37\xfd\xc2\x36\x3d\xc7\x73\xb1\x94\x6b\xe9\x83\x5b\xd5\x9c\xf8\x39\x00\x38\xfb\x9b\xac\x19\x1e\xc2\x55\xea\xf7\x0e\xa2\xb5\x63\xdb\x02\x24\x60\xb0\x5e\x8d\x6a\xcc\x51\xea\x2d\xc2\x5f\xf0\x6b\x2a\xdd\x98\x89\x0a\x72\x78\x07\x07\x2b\x47\xf3\x8e\xe4\x2d\x63\x67\xe7\xd3\x54\x8d\x3f\x13\xca\x55\x74\x42\x6d\xf2\x94\x62\x6c\x3e\xf4\xb8\xcf\x7a\xea\x48\x30\xb7\x0d\x93\x12\x2e\xfd\x51\xfc\xe4\x84\x96\xa5\xbd\x03\xe3\x05\xf2\xad\x87\x19\x69\xc9\x7c\xef\xf6\xb6\xc2\x28\x6c\x54\x31\xb9\xfd\xbd\x88\x37\x62\x92\x98\xcb\x4e", 239); memcpy((void*)0x200001c0, "\xa1\x85\x22\x4a\x16\xff\x1a\x06\x2f\x6f\x97\x66\xae\xb7\xf5\x84\x08\xb0\x28\x45\x0e\x80\x97\x0d\x92\x50\x11\x4b\x2c\x87\x1d\x5d\x9e\xc6\x7f\x79\x90\xa3\x05\xb4\xbe\x2c\x41\xd3\x5d\x33\x16\xa7\xf4\xc9\xb2\x74\x01\xf8\x44\x0e\x71\xa5\x79\xb7\xf9\xac\xc6\x06\xd2\x0d\xa0\x88\xc7\x07\x7b\xbc\x3c\x36\x1e\x71\xc5\x77\x40\x61\x68\xbc\xc1\xbc\xb7\xf0\x2e\x41\x6e\x3f\x90\x84\x03\xe2\x3d\xb0\xc7\x27\xea\x76\x9d\xeb\xda\x4d\x0e\x52\x4f\x8a\xdf\x7f\x42\x18\x4a\x20\xba\x1a\x23\xf9\xc5\x8d\x46\x91\x4c\xc7\xb1\x2c\x19\x53\x7d\x55\xa4\x0f\xcd\x26\xc6\x8e\xfb\x09\xdc\x0a\xcc\x2e\xe7\x52\x4a\xbe\xc0\xb8\x03\x5a\xd2\xb1\xd1\x94\x33\x1e\x2e\xa4\xe4\x2e\xbc\x53\xd3\x88\x0e\x7c\x0d\xd6\xc5\x79\x02\xc8\x72\x7c\xef\xb0\xfd\x31\x92\xd6\x62", 181); syz_usb_connect(0x1e3d802a, 0xef, 0x200000c0, 0x200001c0); break; case 14: memcpy((void*)0x20000280, "\xb7\x48\xb2\x1b\x78\xea\x22\x21\x6c\x2c\xbf\xdc\xcb\x03\xec\x54\xd2\x0f\x30\xf4\xaf\x46\x2b\x7b\xfd\x5d\x30\x1b\x9a\x4f\xb8\xf9\xbb\xe6\x30\xdd\xe8\xd6\x08\x55\x02\x94\x47\xdf\x51\x12\x0e\x0d\x69\x0a\xe4\xa7\x3e\x5a\x06\x06\x4c\xc0\x6d\x83\x62\x2a\x66\xc3\xcf\x3c\xcd\x92\x0d\xf4\xa9\xde\xc5\x47\xf0\xc8\x53\x54\xb2\xe8\x03\x69\x9f\x52\xff\xc8\x14\x53\x6c\xe5\x19\xc7\xc1\x65\x26\xda\x56\xc6\x5b\x44\x29\xcb\x22\x4a\xd9\xc9\x7f\x63\x7e\xe6\xf2", 111); memcpy((void*)0x20000300, "\xfc\xa1\x69\x1e\x90\xfe\xf7\xc0\x69\x3e\x50\x16\x1f\x6b\xf9\xd6\xbe\x11\x62\x1b\x96\xa6\x5d\x50\x23\xd6\x6e\x18\xc9\xdc\x3b\xb3\x8c\xf4\x79\x30\x6e\xff\x4d\x2c\xf1\x75\xb6\xf8\x52\x15\x44\x6b\x23\x79\xfd\xc7\x32\x74\x56\x6c\x4c\xa7\xce\xc4\xd6\x6a\x48\x19\x12\xaf\xe2\x3a\x3f\x61\xad\xb9\x46\x7e\x5b\xf8\x28\x15\x64\x36\xeb\xe3\xd2\x9e\x30\x73\xe4\x25\x4b\x3a\x73\x4a\xcd\x66\xd1\x4e\xfb\x07\x36\xfc\xad\xff\x4d\xad\x73\xe0\x25\x31\x87\x0c\x30\xfa\xe0\xc3\x78\xc5\x15\x78\x6c\x88\xc1\x29\x27\x36\xcd\xf0\xb6\xa2\xe7\x9b\x47\xa7\x8e\x33\xf5\xe1\xd0\x68\x8a\x6f\x3c\xe2\xd9\xe1\x5b\xd3\xee\x2e\x2a\xfe\x1a\xc5\xc8\x52\x3a\x84\xa2\x08\x75\x5a\x7f\x82\x2f\x3d\x21\x1f\xe3\xa2\x6a\x86\x50\x7d\x98\x58\x3d\x56\x6a\x05\x91\xa7\x80\x2c\xb3\xf9\xf9\xdc\x35\xb9\x11\x0d\xe4\xb2\xf4\xd3\x93\x4b\xb2\x0b\x7a", 199); res = syz_usb_connect(0xa4, 0x6f, 0x20000280, 0x20000300); if (res != -1) r[3] = res; break; case 15: syz_usb_disconnect(r[3]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); for (procid = 0; procid < 2; procid++) { if (fork() == 0) { use_temporary_dir(); do_sandbox_none(); } } sleep(1000000); return 0; } : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor559200317 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/13 (0.41s) csource_test.go:121: --- FAIL: TestGenerate/netbsd/amd64/11 (0.38s) csource_test.go:121: --- FAIL: TestGenerate/netbsd/amd64/12 (0.40s) csource_test.go:121: --- FAIL: TestGenerate/netbsd/amd64/10 (0.37s) csource_test.go:121: --- FAIL: TestGenerate/netbsd/amd64/2 (0.35s) csource_test.go:121: FAIL FAIL github.com/google/syzkaller/pkg/csource 5.510s ok github.com/google/syzkaller/pkg/db 1.959s ok github.com/google/syzkaller/pkg/email (cached) ? github.com/google/syzkaller/pkg/gce [no test files] ? github.com/google/syzkaller/pkg/gcs [no test files] ? github.com/google/syzkaller/pkg/hash [no test files] ok github.com/google/syzkaller/pkg/host 11.579s ? github.com/google/syzkaller/pkg/html [no test files] ok github.com/google/syzkaller/pkg/ifuzz (cached) ? github.com/google/syzkaller/pkg/ifuzz/gen [no test files] ? github.com/google/syzkaller/pkg/ifuzz/generated [no test files] ok github.com/google/syzkaller/pkg/instance 2.851s ok github.com/google/syzkaller/pkg/ipc 8.678s ? github.com/google/syzkaller/pkg/ipc/ipcconfig [no test files] ok github.com/google/syzkaller/pkg/kd (cached) ok github.com/google/syzkaller/pkg/log (cached) ok github.com/google/syzkaller/pkg/mgrconfig 3.091s ok github.com/google/syzkaller/pkg/osutil (cached) ok github.com/google/syzkaller/pkg/report 7.171s ok github.com/google/syzkaller/pkg/repro 2.980s ? github.com/google/syzkaller/pkg/rpctype [no test files] ok github.com/google/syzkaller/pkg/runtest 16.078s ok github.com/google/syzkaller/pkg/serializer (cached) ? github.com/google/syzkaller/pkg/signal [no test files] ok github.com/google/syzkaller/pkg/symbolizer (cached) ok github.com/google/syzkaller/pkg/vcs (cached) ok github.com/google/syzkaller/prog 12.160s ok github.com/google/syzkaller/prog/test 1.814s ? github.com/google/syzkaller/sys [no test files] ? github.com/google/syzkaller/sys/akaros [no test files] ? github.com/google/syzkaller/sys/akaros/gen [no test files] ? github.com/google/syzkaller/sys/freebsd [no test files] ? github.com/google/syzkaller/sys/freebsd/gen [no test files] ? github.com/google/syzkaller/sys/fuchsia [no test files] ? github.com/google/syzkaller/sys/fuchsia/fidlgen [no test files] ? github.com/google/syzkaller/sys/fuchsia/gen [no test files] ? github.com/google/syzkaller/sys/fuchsia/layout [no test files] ok github.com/google/syzkaller/sys/linux 0.271s ? github.com/google/syzkaller/sys/linux/gen [no test files] ? github.com/google/syzkaller/sys/netbsd [no test files] ? github.com/google/syzkaller/sys/netbsd/gen [no test files] ok github.com/google/syzkaller/sys/openbsd 0.352s ? github.com/google/syzkaller/sys/openbsd/gen [no test files] ? github.com/google/syzkaller/sys/syz-extract [no test files] ? github.com/google/syzkaller/sys/syz-sysgen [no test files] ? github.com/google/syzkaller/sys/targets [no test files] ? github.com/google/syzkaller/sys/test [no test files] ? github.com/google/syzkaller/sys/test/gen [no test files] ? github.com/google/syzkaller/sys/trusty [no test files] ? github.com/google/syzkaller/sys/trusty/gen [no test files] ? github.com/google/syzkaller/sys/windows [no test files] ? github.com/google/syzkaller/sys/windows/gen [no test files] ok github.com/google/syzkaller/syz-ci 5.645s ok github.com/google/syzkaller/syz-fuzzer 1.681s ok github.com/google/syzkaller/syz-hub 1.049s ok github.com/google/syzkaller/syz-hub/state 0.167s ? github.com/google/syzkaller/syz-manager [no test files] ? github.com/google/syzkaller/tools/syz-benchcmp [no test files] ? github.com/google/syzkaller/tools/syz-bisect [no test files] ? github.com/google/syzkaller/tools/syz-check [no test files] ? github.com/google/syzkaller/tools/syz-cover [no test files] ? github.com/google/syzkaller/tools/syz-crush [no test files] ? github.com/google/syzkaller/tools/syz-db [no test files] ? github.com/google/syzkaller/tools/syz-execprog [no test files] ? github.com/google/syzkaller/tools/syz-expand [no test files] ? github.com/google/syzkaller/tools/syz-fmt [no test files] ? github.com/google/syzkaller/tools/syz-imagegen [no test files] ? github.com/google/syzkaller/tools/syz-make [no test files] ? github.com/google/syzkaller/tools/syz-mutate [no test files] ? github.com/google/syzkaller/tools/syz-prog2c [no test files] ? github.com/google/syzkaller/tools/syz-repro [no test files] ? github.com/google/syzkaller/tools/syz-reprolist [no test files] ? github.com/google/syzkaller/tools/syz-runtest [no test files] ? github.com/google/syzkaller/tools/syz-showprio [no test files] ? github.com/google/syzkaller/tools/syz-stress [no test files] ? github.com/google/syzkaller/tools/syz-symbolize [no test files] ? github.com/google/syzkaller/tools/syz-testbuild [no test files] ? github.com/google/syzkaller/tools/syz-trace2syz [no test files] ok github.com/google/syzkaller/tools/syz-trace2syz/parser 0.878s ok github.com/google/syzkaller/tools/syz-trace2syz/proggen 2.149s ? github.com/google/syzkaller/tools/syz-tty [no test files] ? github.com/google/syzkaller/tools/syz-upgrade [no test files] ? github.com/google/syzkaller/tools/syz-usbgen [no test files] ok github.com/google/syzkaller/vm 12.940s ? github.com/google/syzkaller/vm/adb [no test files] ? github.com/google/syzkaller/vm/bhyve [no test files] ? github.com/google/syzkaller/vm/gce [no test files] ? github.com/google/syzkaller/vm/gvisor [no test files] ok github.com/google/syzkaller/vm/isolated (cached) ? github.com/google/syzkaller/vm/kvm [no test files] ? github.com/google/syzkaller/vm/odroid [no test files] ? github.com/google/syzkaller/vm/qemu [no test files] ok github.com/google/syzkaller/vm/vmimpl (cached) ? github.com/google/syzkaller/vm/vmm [no test files]