// https://syzkaller.appspot.com/bug?id=65f6ff6f1bea5ba54c3d9a70f2131a1115aa1b68 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } struct nlmsg { char* pos; int nesting; struct nlattr* nested[8]; char buf[4096]; }; static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, const void* data, int size) { memset(nlmsg, 0, sizeof(*nlmsg)); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_type = typ; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; memcpy(hdr + 1, data, size); nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); } static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, int size) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_len = sizeof(*attr) + size; attr->nla_type = typ; if (size > 0) memcpy(attr + 1, data, size); nlmsg->pos += NLMSG_ALIGN(attr->nla_len); } static void netlink_nest(struct nlmsg* nlmsg, int typ) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_type = typ; nlmsg->pos += sizeof(*attr); nlmsg->nested[nlmsg->nesting++] = attr; } static void netlink_done(struct nlmsg* nlmsg) { struct nlattr* attr = nlmsg->nested[--nlmsg->nesting]; attr->nla_len = nlmsg->pos - (char*)attr; } static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, int* reply_len, bool dofail) { if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); if (n != (ssize_t)hdr->nlmsg_len) { if (dofail) exit(1); return -1; } n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); if (reply_len) *reply_len = 0; if (n < 0) { if (dofail) exit(1); return -1; } if (n < (ssize_t)sizeof(struct nlmsghdr)) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type == NLMSG_DONE) return 0; if (reply_len && hdr->nlmsg_type == reply_type) { *reply_len = n; return 0; } if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type != NLMSG_ERROR) { errno = EINVAL; if (dofail) exit(1); return -1; } errno = -((struct nlmsgerr*)(hdr + 1))->error; return -errno; } static int netlink_send(struct nlmsg* nlmsg, int sock) { return netlink_send_ext(nlmsg, sock, 0, NULL, true); } static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = CTRL_CMD_GETFAMILY; netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1); int n = 0; int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); if (err < 0) { return -1; } uint16_t id = 0; struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { id = *(uint16_t*)(attr + 1); break; } } if (!id) { errno = EINVAL; return -1; } recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); return id; } static int netlink_next_msg(struct nlmsg* nlmsg, unsigned int offset, unsigned int total_len) { struct nlmsghdr* hdr = (struct nlmsghdr*)(nlmsg->buf + offset); if (offset == total_len || offset + hdr->nlmsg_len > total_len) return -1; return hdr->nlmsg_len; } static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type, const char* name, bool up) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); if (name) netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name)); netlink_nest(nlmsg, IFLA_LINKINFO); netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type)); } static void netlink_add_device(struct nlmsg* nlmsg, int sock, const char* type, const char* name) { netlink_add_device_impl(nlmsg, type, name, false); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_veth(struct nlmsg* nlmsg, int sock, const char* name, const char* peer) { netlink_add_device_impl(nlmsg, "veth", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_nest(nlmsg, VETH_INFO_PEER); nlmsg->pos += sizeof(struct ifinfomsg); netlink_attr(nlmsg, IFLA_IFNAME, peer, strlen(peer)); netlink_done(nlmsg); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_xfrm(struct nlmsg* nlmsg, int sock, const char* name) { netlink_add_device_impl(nlmsg, "xfrm", name, true); netlink_nest(nlmsg, IFLA_INFO_DATA); int if_id = 1; netlink_attr(nlmsg, 2, &if_id, sizeof(if_id)); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_hsr(struct nlmsg* nlmsg, int sock, const char* name, const char* slave1, const char* slave2) { netlink_add_device_impl(nlmsg, "hsr", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); int ifindex1 = if_nametoindex(slave1); netlink_attr(nlmsg, IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1)); int ifindex2 = if_nametoindex(slave2); netlink_attr(nlmsg, IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2)); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_linked(struct nlmsg* nlmsg, int sock, const char* type, const char* name, const char* link) { netlink_add_device_impl(nlmsg, type, name, false); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_vlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t id, uint16_t proto) { netlink_add_device_impl(nlmsg, "vlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_attr(nlmsg, IFLA_VLAN_ID, &id, sizeof(id)); netlink_attr(nlmsg, IFLA_VLAN_PROTOCOL, &proto, sizeof(proto)); netlink_done(nlmsg); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_macvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link) { netlink_add_device_impl(nlmsg, "macvlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); uint32_t mode = MACVLAN_MODE_BRIDGE; netlink_attr(nlmsg, IFLA_MACVLAN_MODE, &mode, sizeof(mode)); netlink_done(nlmsg); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_geneve(struct nlmsg* nlmsg, int sock, const char* name, uint32_t vni, struct in_addr* addr4, struct in6_addr* addr6) { netlink_add_device_impl(nlmsg, "geneve", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_attr(nlmsg, IFLA_GENEVE_ID, &vni, sizeof(vni)); if (addr4) netlink_attr(nlmsg, IFLA_GENEVE_REMOTE, addr4, sizeof(*addr4)); if (addr6) netlink_attr(nlmsg, IFLA_GENEVE_REMOTE6, addr6, sizeof(*addr6)); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } #define IFLA_IPVLAN_FLAGS 2 #define IPVLAN_MODE_L3S 2 #undef IPVLAN_F_VEPA #define IPVLAN_F_VEPA 2 static void netlink_add_ipvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t mode, uint16_t flags) { netlink_add_device_impl(nlmsg, "ipvlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_attr(nlmsg, IFLA_IPVLAN_MODE, &mode, sizeof(mode)); netlink_attr(nlmsg, IFLA_IPVLAN_FLAGS, &flags, sizeof(flags)); netlink_done(nlmsg); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_device_change(struct nlmsg* nlmsg, int sock, const char* name, bool up, const char* master, const void* mac, int macsize, const char* new_name) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; hdr.ifi_index = if_nametoindex(name); netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr)); if (new_name) netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name)); if (master) { int ifindex = if_nametoindex(master); netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex)); } if (macsize) netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev, const void* addr, int addrsize) { struct ifaddrmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120; hdr.ifa_scope = RT_SCOPE_UNIVERSE; hdr.ifa_index = if_nametoindex(dev); netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr)); netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize); netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize); return netlink_send(nlmsg, sock); } static void netlink_add_addr4(struct nlmsg* nlmsg, int sock, const char* dev, const char* addr) { struct in_addr in_addr; inet_pton(AF_INET, addr, &in_addr); int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr)); if (err < 0) { } } static void netlink_add_addr6(struct nlmsg* nlmsg, int sock, const char* dev, const char* addr) { struct in6_addr in6_addr; inet_pton(AF_INET6, addr, &in6_addr); int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr)); if (err < 0) { } } static struct nlmsg nlmsg; #define DEVLINK_FAMILY_NAME "devlink" #define DEVLINK_CMD_PORT_GET 5 #define DEVLINK_ATTR_BUS_NAME 1 #define DEVLINK_ATTR_DEV_NAME 2 #define DEVLINK_ATTR_NETDEV_NAME 7 static struct nlmsg nlmsg2; static void initialize_devlink_ports(const char* bus_name, const char* dev_name, const char* netdev_prefix) { struct genlmsghdr genlhdr; int len, total_len, id, err, offset; uint16_t netdev_index; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock == -1) exit(1); int rtsock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (rtsock == -1) exit(1); id = netlink_query_family_id(&nlmsg, sock, DEVLINK_FAMILY_NAME, true); if (id == -1) goto error; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = DEVLINK_CMD_PORT_GET; netlink_init(&nlmsg, id, NLM_F_DUMP, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, DEVLINK_ATTR_BUS_NAME, bus_name, strlen(bus_name) + 1); netlink_attr(&nlmsg, DEVLINK_ATTR_DEV_NAME, dev_name, strlen(dev_name) + 1); err = netlink_send_ext(&nlmsg, sock, id, &total_len, true); if (err < 0) { goto error; } offset = 0; netdev_index = 0; while ((len = netlink_next_msg(&nlmsg, offset, total_len)) != -1) { struct nlattr* attr = (struct nlattr*)(nlmsg.buf + offset + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg.buf + offset + len; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == DEVLINK_ATTR_NETDEV_NAME) { char* port_name; char netdev_name[IFNAMSIZ]; port_name = (char*)(attr + 1); snprintf(netdev_name, sizeof(netdev_name), "%s%d", netdev_prefix, netdev_index); netlink_device_change(&nlmsg2, rtsock, port_name, true, 0, 0, 0, netdev_name); break; } } offset += len; netdev_index++; } error: close(rtsock); close(sock); } #define DEV_IPV4 "172.20.20.%d" #define DEV_IPV6 "fe80::%02x" #define DEV_MAC 0x00aaaaaaaaaa static void netdevsim_add(unsigned int addr, unsigned int port_count) { write_file("/sys/bus/netdevsim/del_device", "%u", addr); if (write_file("/sys/bus/netdevsim/new_device", "%u %u", addr, port_count)) { char buf[32]; snprintf(buf, sizeof(buf), "netdevsim%d", addr); initialize_devlink_ports("netdevsim", buf, "netdevsim"); } } #define WG_GENL_NAME "wireguard" enum wg_cmd { WG_CMD_GET_DEVICE, WG_CMD_SET_DEVICE, }; enum wgdevice_attribute { WGDEVICE_A_UNSPEC, WGDEVICE_A_IFINDEX, WGDEVICE_A_IFNAME, WGDEVICE_A_PRIVATE_KEY, WGDEVICE_A_PUBLIC_KEY, WGDEVICE_A_FLAGS, WGDEVICE_A_LISTEN_PORT, WGDEVICE_A_FWMARK, WGDEVICE_A_PEERS, }; enum wgpeer_attribute { WGPEER_A_UNSPEC, WGPEER_A_PUBLIC_KEY, WGPEER_A_PRESHARED_KEY, WGPEER_A_FLAGS, WGPEER_A_ENDPOINT, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, WGPEER_A_LAST_HANDSHAKE_TIME, WGPEER_A_RX_BYTES, WGPEER_A_TX_BYTES, WGPEER_A_ALLOWEDIPS, WGPEER_A_PROTOCOL_VERSION, }; enum wgallowedip_attribute { WGALLOWEDIP_A_UNSPEC, WGALLOWEDIP_A_FAMILY, WGALLOWEDIP_A_IPADDR, WGALLOWEDIP_A_CIDR_MASK, }; static void netlink_wireguard_setup(void) { const char ifname_a[] = "wg0"; const char ifname_b[] = "wg1"; const char ifname_c[] = "wg2"; const char private_a[] = "\xa0\x5c\xa8\x4f\x6c\x9c\x8e\x38\x53\xe2\xfd\x7a\x70\xae\x0f\xb2\x0f\xa1" "\x52\x60\x0c\xb0\x08\x45\x17\x4f\x08\x07\x6f\x8d\x78\x43"; const char private_b[] = "\xb0\x80\x73\xe8\xd4\x4e\x91\xe3\xda\x92\x2c\x22\x43\x82\x44\xbb\x88\x5c" "\x69\xe2\x69\xc8\xe9\xd8\x35\xb1\x14\x29\x3a\x4d\xdc\x6e"; const char private_c[] = "\xa0\xcb\x87\x9a\x47\xf5\xbc\x64\x4c\x0e\x69\x3f\xa6\xd0\x31\xc7\x4a\x15" "\x53\xb6\xe9\x01\xb9\xff\x2f\x51\x8c\x78\x04\x2f\xb5\x42"; const char public_a[] = "\x97\x5c\x9d\x81\xc9\x83\xc8\x20\x9e\xe7\x81\x25\x4b\x89\x9f\x8e\xd9\x25" "\xae\x9f\x09\x23\xc2\x3c\x62\xf5\x3c\x57\xcd\xbf\x69\x1c"; const char public_b[] = "\xd1\x73\x28\x99\xf6\x11\xcd\x89\x94\x03\x4d\x7f\x41\x3d\xc9\x57\x63\x0e" "\x54\x93\xc2\x85\xac\xa4\x00\x65\xcb\x63\x11\xbe\x69\x6b"; const char public_c[] = "\xf4\x4d\xa3\x67\xa8\x8e\xe6\x56\x4f\x02\x02\x11\x45\x67\x27\x08\x2f\x5c" "\xeb\xee\x8b\x1b\xf5\xeb\x73\x37\x34\x1b\x45\x9b\x39\x22"; const uint16_t listen_a = 20001; const uint16_t listen_b = 20002; const uint16_t listen_c = 20003; const uint16_t af_inet = AF_INET; const uint16_t af_inet6 = AF_INET6; const struct sockaddr_in endpoint_b_v4 = { .sin_family = AF_INET, .sin_port = htons(listen_b), .sin_addr = {htonl(INADDR_LOOPBACK)}}; const struct sockaddr_in endpoint_c_v4 = { .sin_family = AF_INET, .sin_port = htons(listen_c), .sin_addr = {htonl(INADDR_LOOPBACK)}}; struct sockaddr_in6 endpoint_a_v6 = {.sin6_family = AF_INET6, .sin6_port = htons(listen_a)}; endpoint_a_v6.sin6_addr = in6addr_loopback; struct sockaddr_in6 endpoint_c_v6 = {.sin6_family = AF_INET6, .sin6_port = htons(listen_c)}; endpoint_c_v6.sin6_addr = in6addr_loopback; const struct in_addr first_half_v4 = {0}; const struct in_addr second_half_v4 = {(uint32_t)htonl(128 << 24)}; const struct in6_addr first_half_v6 = {{{0}}}; const struct in6_addr second_half_v6 = {{{0x80}}}; const uint8_t half_cidr = 1; const uint16_t persistent_keepalives[] = {1, 3, 7, 9, 14, 19}; struct genlmsghdr genlhdr = {.cmd = WG_CMD_SET_DEVICE, .version = 1}; int sock; int id, err; sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock == -1) { return; } id = netlink_query_family_id(&nlmsg, sock, WG_GENL_NAME, true); if (id == -1) goto error; netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_a, strlen(ifname_a) + 1); netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_a, 32); netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_a, 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[0], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v6, sizeof(endpoint_c_v6)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[1], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); err = netlink_send(&nlmsg, sock); if (err < 0) { } netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_b, strlen(ifname_b) + 1); netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_b, 32); netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_b, 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[2], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v4, sizeof(endpoint_c_v4)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[3], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); err = netlink_send(&nlmsg, sock); if (err < 0) { } netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_c, strlen(ifname_c) + 1); netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_c, 32); netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_c, 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[4], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[5], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); err = netlink_send(&nlmsg, sock); if (err < 0) { } error: close(sock); } static void initialize_netdevices(void) { char netdevsim[16]; sprintf(netdevsim, "netdevsim%d", (int)procid); struct { const char* type; const char* dev; } devtypes[] = { {"ip6gretap", "ip6gretap0"}, {"bridge", "bridge0"}, {"vcan", "vcan0"}, {"bond", "bond0"}, {"team", "team0"}, {"dummy", "dummy0"}, {"nlmon", "nlmon0"}, {"caif", "caif0"}, {"batadv", "batadv0"}, {"vxcan", "vxcan1"}, {"veth", 0}, {"wireguard", "wg0"}, {"wireguard", "wg1"}, {"wireguard", "wg2"}, }; const char* devmasters[] = {"bridge", "bond", "team", "batadv"}; struct { const char* name; int macsize; bool noipv6; } devices[] = { {"lo", ETH_ALEN}, {"sit0", 0}, {"bridge0", ETH_ALEN}, {"vcan0", 0, true}, {"tunl0", 0}, {"gre0", 0}, {"gretap0", ETH_ALEN}, {"ip_vti0", 0}, {"ip6_vti0", 0}, {"ip6tnl0", 0}, {"ip6gre0", 0}, {"ip6gretap0", ETH_ALEN}, {"erspan0", ETH_ALEN}, {"bond0", ETH_ALEN}, {"veth0", ETH_ALEN}, {"veth1", ETH_ALEN}, {"team0", ETH_ALEN}, {"veth0_to_bridge", ETH_ALEN}, {"veth1_to_bridge", ETH_ALEN}, {"veth0_to_bond", ETH_ALEN}, {"veth1_to_bond", ETH_ALEN}, {"veth0_to_team", ETH_ALEN}, {"veth1_to_team", ETH_ALEN}, {"veth0_to_hsr", ETH_ALEN}, {"veth1_to_hsr", ETH_ALEN}, {"hsr0", 0}, {"dummy0", ETH_ALEN}, {"nlmon0", 0}, {"vxcan0", 0, true}, {"vxcan1", 0, true}, {"caif0", ETH_ALEN}, {"batadv0", ETH_ALEN}, {netdevsim, ETH_ALEN}, {"xfrm0", ETH_ALEN}, {"veth0_virt_wifi", ETH_ALEN}, {"veth1_virt_wifi", ETH_ALEN}, {"virt_wifi0", ETH_ALEN}, {"veth0_vlan", ETH_ALEN}, {"veth1_vlan", ETH_ALEN}, {"vlan0", ETH_ALEN}, {"vlan1", ETH_ALEN}, {"macvlan0", ETH_ALEN}, {"macvlan1", ETH_ALEN}, {"ipvlan0", ETH_ALEN}, {"ipvlan1", ETH_ALEN}, {"veth0_macvtap", ETH_ALEN}, {"veth1_macvtap", ETH_ALEN}, {"macvtap0", ETH_ALEN}, {"macsec0", ETH_ALEN}, {"veth0_to_batadv", ETH_ALEN}, {"veth1_to_batadv", ETH_ALEN}, {"batadv_slave_0", ETH_ALEN}, {"batadv_slave_1", ETH_ALEN}, {"geneve0", ETH_ALEN}, {"geneve1", ETH_ALEN}, {"wg0", 0}, {"wg1", 0}, {"wg2", 0}, }; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); unsigned i; for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) netlink_add_device(&nlmsg, sock, devtypes[i].type, devtypes[i].dev); for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) { char master[32], slave0[32], veth0[32], slave1[32], veth1[32]; sprintf(slave0, "%s_slave_0", devmasters[i]); sprintf(veth0, "veth0_to_%s", devmasters[i]); netlink_add_veth(&nlmsg, sock, slave0, veth0); sprintf(slave1, "%s_slave_1", devmasters[i]); sprintf(veth1, "veth1_to_%s", devmasters[i]); netlink_add_veth(&nlmsg, sock, slave1, veth1); sprintf(master, "%s0", devmasters[i]); netlink_device_change(&nlmsg, sock, slave0, false, master, 0, 0, NULL); netlink_device_change(&nlmsg, sock, slave1, false, master, 0, 0, NULL); } netlink_add_xfrm(&nlmsg, sock, "xfrm0"); netlink_device_change(&nlmsg, sock, "bridge_slave_0", true, 0, 0, 0, NULL); netlink_device_change(&nlmsg, sock, "bridge_slave_1", true, 0, 0, 0, NULL); netlink_add_veth(&nlmsg, sock, "hsr_slave_0", "veth0_to_hsr"); netlink_add_veth(&nlmsg, sock, "hsr_slave_1", "veth1_to_hsr"); netlink_add_hsr(&nlmsg, sock, "hsr0", "hsr_slave_0", "hsr_slave_1"); netlink_device_change(&nlmsg, sock, "hsr_slave_0", true, 0, 0, 0, NULL); netlink_device_change(&nlmsg, sock, "hsr_slave_1", true, 0, 0, 0, NULL); netlink_add_veth(&nlmsg, sock, "veth0_virt_wifi", "veth1_virt_wifi"); netlink_add_linked(&nlmsg, sock, "virt_wifi", "virt_wifi0", "veth1_virt_wifi"); netlink_add_veth(&nlmsg, sock, "veth0_vlan", "veth1_vlan"); netlink_add_vlan(&nlmsg, sock, "vlan0", "veth0_vlan", 0, htons(ETH_P_8021Q)); netlink_add_vlan(&nlmsg, sock, "vlan1", "veth0_vlan", 1, htons(ETH_P_8021AD)); netlink_add_macvlan(&nlmsg, sock, "macvlan0", "veth1_vlan"); netlink_add_macvlan(&nlmsg, sock, "macvlan1", "veth1_vlan"); netlink_add_ipvlan(&nlmsg, sock, "ipvlan0", "veth0_vlan", IPVLAN_MODE_L2, 0); netlink_add_ipvlan(&nlmsg, sock, "ipvlan1", "veth0_vlan", IPVLAN_MODE_L3S, IPVLAN_F_VEPA); netlink_add_veth(&nlmsg, sock, "veth0_macvtap", "veth1_macvtap"); netlink_add_linked(&nlmsg, sock, "macvtap", "macvtap0", "veth0_macvtap"); netlink_add_linked(&nlmsg, sock, "macsec", "macsec0", "veth1_macvtap"); char addr[32]; sprintf(addr, DEV_IPV4, 14 + 10); struct in_addr geneve_addr4; if (inet_pton(AF_INET, addr, &geneve_addr4) <= 0) exit(1); struct in6_addr geneve_addr6; if (inet_pton(AF_INET6, "fc00::01", &geneve_addr6) <= 0) exit(1); netlink_add_geneve(&nlmsg, sock, "geneve0", 0, &geneve_addr4, 0); netlink_add_geneve(&nlmsg, sock, "geneve1", 1, 0, &geneve_addr6); netdevsim_add((int)procid, 4); netlink_wireguard_setup(); for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) { char addr[32]; sprintf(addr, DEV_IPV4, i + 10); netlink_add_addr4(&nlmsg, sock, devices[i].name, addr); if (!devices[i].noipv6) { sprintf(addr, DEV_IPV6, i + 10); netlink_add_addr6(&nlmsg, sock, devices[i].name, addr); } uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40); netlink_device_change(&nlmsg, sock, devices[i].name, true, 0, &macaddr, devices[i].macsize, NULL); } close(sock); } static void initialize_netdevices_init(void) { int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); struct { const char* type; int macsize; bool noipv6; bool noup; } devtypes[] = { {"nr", 7, true}, {"rose", 5, true, true}, }; unsigned i; for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) { char dev[32], addr[32]; sprintf(dev, "%s%d", devtypes[i].type, (int)procid); sprintf(addr, "172.30.%d.%d", i, (int)procid + 1); netlink_add_addr4(&nlmsg, sock, dev, addr); if (!devtypes[i].noipv6) { sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1); netlink_add_addr6(&nlmsg, sock, dev, addr); } int macsize = devtypes[i].macsize; uint64_t macaddr = 0xbbbbbb + ((unsigned long long)i << (8 * (macsize - 2))) + (procid << (8 * (macsize - 1))); netlink_device_change(&nlmsg, sock, dev, !devtypes[i].noup, 0, &macaddr, macsize, NULL); } close(sock); } #define MAX_FDS 30 static void setup_common() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void setup_binderfs() { if (mkdir("/dev/binderfs", 0777)) { } if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { } if (symlink("/dev/binderfs", "./binderfs")) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setsid(); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 128 << 20; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); setup_common(); sandbox_common(); drop_caps(); initialize_netdevices_init(); if (unshare(CLONE_NEWNET)) { } write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); initialize_netdevices(); setup_binderfs(); loop(); exit(1); } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void close_fds() { for (int fd = 3; fd < MAX_FDS; fd++) close(fd); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); close_fds(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; memcpy((void*)0x20000140, "/dev/ptmx\000", 10); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20000140ul, 0x101000ul, 0ul); if (res != -1) r[0] = res; *(uint32_t*)0x20000080 = 3; syscall(__NR_ioctl, r[0], 0x5423, 0x20000080ul); *(uint32_t*)0x20000180 = 1; *(uint32_t*)0x20000184 = 0; *(uint64_t*)0x20000188 = 0; *(uint64_t*)0x20000190 = 0; *(uint32_t*)0x20000198 = 0; *(uint32_t*)0x2000019c = 0; *(uint64_t*)0x200001a0 = 0; *(uint32_t*)0x200001a8 = 0x40f00; *(uint32_t*)0x200001ac = 4; memset((void*)0x200001b0, 0, 16); *(uint32_t*)0x200001c0 = 0; *(uint32_t*)0x200001c4 = 0; *(uint32_t*)0x200001c8 = -1; *(uint32_t*)0x200001cc = 8; *(uint64_t*)0x200001d0 = 0; *(uint32_t*)0x200001d8 = 0; *(uint32_t*)0x200001dc = 0x10; *(uint64_t*)0x200001e0 = 0; *(uint32_t*)0x200001e8 = 0; *(uint32_t*)0x200001ec = -1; *(uint32_t*)0x200001f0 = -1; *(uint32_t*)0x200001f4 = 0; *(uint64_t*)0x200001f8 = 0; syscall(__NR_bpf, 5ul, 0x20000180ul, 0x78ul); memcpy((void*)0x20000040, "/dev/ppp\000", 9); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20000040ul, 0x1a01ul, 0ul); if (res != -1) r[1] = res; syscall(__NR_ioctl, r[1], 0x40047438, 0x20000180ul); *(uint64_t*)0x20000380 = 0x200010c0; memcpy( (void*)0x200010c0, "\xaa\xbf\x75\xaa\x76\xc3\xad\xa7\x4b\xf4\x4a\xc8\x95\x55\x81\x05\x7e\x17" "\x78\x60\x4d\xf7\x76\x93\x55\x9f\xfa\xd6\xcc\x78\x74\x16\x42\xe0\xf2\x1c" "\x50\x7a\x79\xc2\x9d\xab\xa6\x41\xa2\x68\xce\x55\xab\xe3\x6b\x0f\xa2\x26" "\x8a\x6f\xff\xbb\x80\x16\xb6\x25\x49\x41\x8c\xd3\xf9\x51\xd1\x85\x08\x54" "\xec\x21\x0e\xa8\x03\x4f\xaf\x16\x26\xe6\x16\xa3\x6c\x6b\xc0\xc9\xb4\x37" "\x2b\x0e\x28\x21\x30\x19\xe3\xdb\x18\x2f\xd0\x85\x8a\x17\xe8\x7f\xf7\xa5" "\xdd\xdc\x89\x59\x42\x25\xd7\x84\x41\xa5\x33\x08\x2e\xd3\xe8\x04\x7f\x12" "\x26\x97\x78\xc4\x07\x21\xca\xcf\x71\xf3\x25\x43\x87\x4a\x34\x59\x38\x22" "\x44\x19\xdc\xe2\xfd\x44\xb7\xa6\x2c\x1d\x0d\x98\xa0\xcf\x23\xc2\xfc\x16" "\x89\x4b\xa5\x49\xa2\xed\xfb\x7e\x30\x0f\x14\xc3\x0f\x64\x42\x9d\x25\xea" "\x9b\x26\xb9\xfb\xf8\x39\xfb\x03\x9e\x46\xbc\x8d\xcf\x12\xd7\xce\x62\xc8" "\xcb\xc9\xf0\xd5\xff\xff\x56\xa5\x77\xed\xd8\x69\x49\xd1\x0e\x6e\x37\xe3" "\x12\x97\xce\x4e\x55\x85\xbc\x3d\x3a\xc0\x0a\xcb\xee\xc5\x1d\x81\x64\x35" "\x92\x04\xa9\x18\xb4\xd1\xde\x45\x14\x70\x5d\x55\xe2\x10\x50\x84\xae\xce" "\x8a\x83\xf2\x8f\xb3\xe4\x6e\xb4\xf2\x4b\x96\x6a\xf6\x22\xfc\xf3\x1c\x4c" "\xb6\x01\xf5\xa2\xb8\x2d\x42\xa2\x17\x2a\xd0\xb1\x93\x9c\x58\x58\x91\x94" "\x0b\x81\xaa\x9c\x5c\x6c\xdb\x06\x76\xb9\x98\x02\x5e\xa4\xac\x0f\xc1\x8a" "\xa2\x4f\xd5\xd5\x62\xb1\xdd\x4f\x23\xe3\xac\x63\xf0\x23\x3f\xb4\x46\x5c" "\x5e\x5a\x96\x59\x9e\xcc\x0f\xd8\xdd\x7e\x7d\x48\xa8\xb9\x6d\xb0\x36\x30" "\x61\x39\x05\xfd\x61\x0c\xee\xc2\xeb\x9b\x69\x62\x64\x5b\xd9\x59\xcb\x08" "\x49\x38\x06\xbb\x6d\x0c\xcb\x06\x7a\x04\x8c\x7e\xc3\x4c\xc3\xab\x4a\xec" "\x1b\x8e\x42\x53\xde\x22\x94\x9b\x0c\x9a\x9d\x1d\xec\x77\xd9\x03\xd6\x01" "\x8e\xaf\xd0\xe8\x1d\xc7\x09\x0e\xa1\x08\x05\x7e\x63\x10\x03\xda\x31\x04" "\xc2\xeb\x83\x9b\xc8\x42\x8b\xe6\xa4\x97\xa0\x51\xb0\x3b\x80\xc0\x2d\x8f" "\x8e\xfc\x20\x33\x08\x53\xa8\x1b\xa6\xe3\x6c\x41\xfc\xbc\x63\xe2\x34\x50" "\x75\xa9\x91\x64\xf8\x10\x84\x52\xc2\x98\xa4\x9d\xa5\x00\xc1\x6e\xcd\x20" "\xfc\xa9\x57\x78\x14\xe6\x57\xa7\x67\xc5\xf3\x10\xd0\xc8\xa7\x1b\x13\x4a" "\x99\x5e\x40\xc7\x92\x4e\xc6\xff\xe9\x56\xab\x10\xff\x39\xe3\xa0\x7b\x28" "\xaf\x2a\x66\x8d\xf9\x44\x86\x9b\xff\xd3\x94\x94\xfa\x01\x50\xa7\xa4\x64" "\x91\x65\x9c\x0a\xfb\x12\x2c\x91\xa5\x0d\x08\xbd\x50\xe0\x14\xbc\x4c\x1f" "\x7c\x9f\xf3\xfd\x2d\x1d\x81\x3c\xd0\xcd\xd3\x81\x51\x03\x80\xc9\x67\xae" "\xd0\x13\x30\x55\x37\x0c\x29\xcb\xf1\xb3\xe5\xd1\x0e\xd2\xae\x10\x3d\xe7" "\xdf\xa7\x7e\x76\xff\x55\xf4\x1f\x1e\x18\x04\xe4\xf0\x6b\xd0\x13\xce\x28" "\x51\x1e\x34\x69\x81\x7b\x01\x54\xe5\x83\x78\x34\x59\x28\x07\x1d\x63\xe4" "\x74\xe4\xd8\xac\x2d\x50\xc5\xf7\x62\x6f\xc7\x69\xb2\xe1\xc3\xb2\x53\x4f" "\xec\x20\xa8\x44\x0f\xd3\x33\xe2\x22\x0d\xe7\x6c\x21\xdd\xf8\x3c\x0e\x61" "\x56\xf1\x2d\xbe\xf6\x10\xa9\x8a\x05\x00\xaa\xaf\xc0\x27\x8c\xeb\x32\x59" "\x1a\x8c\x27\xd7\xf0\x5c\xbb\x17\x18\xda\x94\xa9\x5d\xf1\x9f\x72\xb8\x07" "\x2a\xe0\x1b\xe8\xd1\x9a\x3e\x34\xae\x4c\xb0\x59\xce\xcc\x5f\xd9\x5c\xb1" "\xd9\x11\x6b\xa6\x2b\xf1\xb8\x92\x6a\x91\x9a\x9d\x88\x49\x1e\x85\x16\xa5" "\x07\x0c\xd5\xb7\x4f\xc4\x6d\x26\xe3\x6c\x57\x42\xaa\xca\x35\x1d\xc5\xc9" "\x8f\x97\xf0\x6e\x9d\x7c\xbc\x9c\x31\x8b\x00\xa0\xe7\x38\x29\xac\xab\xa5" "\x60\xcb\xf0\xc6\x7c\x4e\x60\x32\x1e\xea\xc2\xe5\x6d\x35\x5c\xa4\x83\x86" "\x8e\x76\xa7\xe0\x39\x7a\x50\x09\xa8\xc8\x38\x25\xbe\x2f\xbb\xb4\xfd\x48" "\xe1\xa0\x68\x2f\xab\x59\x97\xca\x24\x04\x60\x08\xd5\xd4\x87\x40\xb6\x14" "\xbb\xa2\xc4\xf4\x8c\xcc\x67\x77\xee\x90\xab\x07\xb0\xe6\x18\x1f\x52\xd6" "\x4f\x24\xec\x0a\xd4\x3b\x21\x25\xd2\x46\x4d\x55\xe9\x77\xd6\xb7\xeb\x62" "\xe1\x1c\x2c\xf4\x18\xdc\xcb\xe1\x66\x44\xa3\xcc\xe7\x8f\x68\xe3\xfa\x83" "\xf7\x3c\xdd\x43\x69\xcb\xd3\x78\x9e\xfe\x48\x02\xd0\x2f\x36\x4e\xca\xc0" "\x4a\xa6\x86\x8b\x0f\xa9\x5e\xc1\xed\x1d\x50\xf4\x03\xd2\xea\x5c\x7e\x20" "\x1e\x2e\x55\x63\xd9\x40\x46\x6d\x77\xe0\xf1\xe3\x98\x8a\xbc\xf6\xb2\x5a" "\xee\xeb\xb0\x79\xd4\xda\x21\xe6\x33\xe8\x3e\x4b\x5c\x09\x09\x57\x81\x2a" "\xb8\x42\x32\xf7\x0b\xa4\x20\x98\x16\x28\xc7\x4f\x0b\xf5\xe3\x63\xef\x01" "\x7f\xa6\xc9\x15\x7b\x84\x4b\x36\xf6\x18\x8e\x79\x55\xf9\x92\xd5\x87\xcd" "\xe5\x28\xb8\x53\x15\xf8\x25\xee\x3d\x7c\x3d\xb5\x7d\xb6\x2b\xca\x9d\xfc" "\xa8\xab\x40\x14\xa6\x72\xd4\x3c\x3c\x46\x2a\xba\x6d\xe5\xf1\x7a\xb2\x52" "\xe5\xce\xd7\x31\xa0\xf5\xed\x01\x8c\xbf\x76\x62\x90\xc2\x8b\x6a\xd4\xf1" "\xef\x37\x8c\x05\x62\x91\x17\x2c\x8a\xe0\xf2\x4b\x7a\x50\xe2\x8e\x69\x64" "\xf7\x2c\xa1\x34\x5a\x13\x22\x36\x37\xb4\xeb\xdc\x19\xae\xcf\x4f\x93\xb4" "\xc4\x81\x9b\xa4\x38\x0c\xcd\x51\x59\x59\x38\xf2\x25\x5c\xb2\x2d\x4d\x9b" "\x27\x0e\xbb\x23\x67\xb8\x04\x5d\x95\x0e\x92\x01\xda\x44\x66\xf1\xad\xaa" "\x6d\x19\xd6\x38\x7b\x97\x1a\xd3\x75\x05\xc6\x4e\x6f\xfd\x7f\x4f\x04\xcf" "\xfb\x72\xfd\xe1\xf0\xc0\x89\x12\xde\x1c\x89\x0b\xa8\x35\x32\x83\x99\x63" "\xf5\x27\x14\x9d\x4a\xe5\x01\xba\xab\xe8\x34\xeb\x1d\xc4\xa2\xc4\x2c\x64" "\x6c\x4c\xfc\x1b\x73\x5a\x0c\x60\xac\xdf\x8a\x54\xcc\x20\x07\x33\x28\x21" "\x69\xa8\xec\x10\xe2\x3b\x34\xe7\x13\xf4\x7e\xb5\xc8\xd1\x8b\x17\x00\xbb" "\x4c\xa7\x7a\x0c\x04\xb5\x5e\xc5\x46\xf1\xf9\x02\x11\x90\x6a\x90\x73\x8b" "\xd3\x82\x7e\x9e\xc5\xaa\x2b\x64\xcc\x28\xb6\x7a\x0d\x3b\x33\xe4\xa2\x10" "\xb3\xb4\xf9\xe1\x15\x90\x7f\x2e\x66\x0e\xe8\x49\x67\x7a\x99\xfd\x3e\xa2" "\xa8\xbb\xaf\x07\x36\x9f\xc0\x36\xd5\x1d\x2b\x4b\xdd\x94\xa6\xab\x74\x21" "\xdb\x46\x86\xae\xab\xeb\xc3\x67\x99\x60\x28\x6e\xa0\x44\x46\x94\xbd\xe2" "\xd7\x6e\x69\xfd\xa9\x6b\xdb\xfd\xe7\x8d\x73\x45\xc7\xa1\x43\xab\xab\x5d" "\x04\x12\x26\x9d\x83\x3c\x5e\x31\x5d\x77\x05\xe6\x91\xcc\x5c\xe6\xf7\x0d" "\x7f\x22\xf7\x62\xbd\x3c\xd2\xe2\x5d\x40\xbc\x4e\x5a\xf3\xe9\xee\x65\x1e" "\x14\x00\xda\xa8\xed\xf2\xe6\xe3\xd7\x02\x6f\x1e\x22\xc8\x8a\x15\xcb\x4f" "\xa9\x09\x37\x59\x99\xbc\xc3\x4e\xf1\x2d\x0a\x40\xb3\xf3\xcd\xcb\x0b\xe3" "\x40\x0e\xdd\x8c\x04\x99\x1e\xe8\xcd\x77\x78\xf8\x8b\x54\xc5\x17\xde\xb9" "\xc9\x55\xd8\xa4\x3a\x36\x06\xae\xef\x44\xc6\xdb\x65\x6b\xab\x11\x64\xdd" "\xdc\x31\x2d\x1a\x2b\x74\xa5\x20\xb9\x88\xfb\x62\xfc\xf0\x8d\xe1\xb8\x2e" "\x90\x93\xdb\x5a\xdc\xa8\x22\x23\x40\x25\x7f\xff\xb5\xda\x79\xb8\x2a\xdb" "\x6f\x49\x47\x3c\xef\x3a\x65\xcb\xb2\x0a\x9f\xfe\x57\x60\xd1\xf4\xc6\xa3" "\xf3\xcc\x9d\xb3\xeb\x1d\xd9\xeb\x44\xc6\xa8\x40\x74\xf1\x3f\xee\xd4\xd4" "\x5b\x47\x03\x72\x80\xc7\xa0\x96\xda\x61\xb3\x97\xe8\x00\x20\x93\xc6\x42" "\x8d\x00\xd2\xa0\xd2\x49\xd5\x18\x63\x6a\x8a\xe4\x2f\x07\x78\xbd\xdd\x72" "\x3e\x84\x10\x20\x9c\xa1\xeb\xce\x29\x7d\x2d\x88\x78\x1a\x37\x8d\x0e\x7b" "\x86\x95\x08\x0f\x2e\xc5\xf9\x07\xf5\xcd\xbf\x1a\x8a\xe0\xb0\xd2\x3b\x52" "\x39\xdd\x7b\xed\x96\x30\x4c\xb5\x61\xbe\x61\xd6\x8f\xf3\xec\x90\xb6\xbf" "\x30\xf6\x93\xfa\x2b\xb4\x16\xd9\x35\xf1\x07\xe4\x45\xeb\x0f\x49\x20\x71" "\xdf\x1c\xfc\xbc\x9e\x34\x17\x3b\xf3\xfe\xad\xfa\x3d\x64\xf9\x9b\x07\x8f" "\x60\x3a\x5a\x50\x47\x04\x62\x5b\xd8\xd8\x5e\x8a\x54\x54\xed\xfa\xf9\x2b" "\x0a\xb9\x50\x36\xc8\xae\xbc\x29\x7f\x4f\xb8\xc5\x1f\xf9\x77\x40\xf8\x2f" "\x5c\x22\x0f\xca\xee\xd0\xd7\x7e\xe9\x00\x76\x36\xdc\x70\x25\x2d\x89\x1f" "\x2a\x00\xef\x01\x0a\xc4\x81\x53\xe5\xd5\xfd\x83\xf8\x8b\x5c\x00\x10\xe4" "\x1d\x31\x2f\x36\x8a\x66\x0c\x50\xd1\x57\x4d\x07\x24\x22\x70\xb8\x14\xf5" "\x9a\xbc\x8c\x25\xa2\x6e\x5c\xb6\xed\x89\x15\xee\xd0\xed\x18\x8c\x13\xf4" "\x50\x45\xaf\xe4\x4e\x0d\x8a\x5e\x37\xe5\x1b\xb7\xda\x9b\x71\x55\x41\xc2" "\xb5\x4f\xb5\xd2\xe8\x27\xbe\x94\x53\x0b\x6f\xdd\x29\x9d\x67\x89\x8e\x89" "\xd3\xd6\x8e\x07\x30\x37\x5d\x9e\x8b\x42\x5b\x06\xc6\x1f\xe3\xe4\x1b\x93" "\xee\xd3\xa2\x39\xdf\x5d\xf5\x9e\x6a\xdd\x4c\x8b\x8c\xf4\x8c\x1b\x17\x5b" "\xf9\x12\x5a\x51\x79\x8e\xd5\x64\x73\x77\xe5\x2a\x38\x79\x2f\xf2\x26\x3c" "\x42\x6c\x40\xcc\x86\x02\x11\x3f\x56\x64\x98\x68\x58\x93\x9d\x09\x7f\x76" "\x7d\x67\xb7\x06\x05\x32\x68\xa3\x6c\x7f\x99\x03\xcf\x14\x8a\x88\xd4\x01" "\x21\x36\xed\x96\x05\x7c\x43\x92\x2f\xaf\xd6\x73\x93\xaf\xa0\xf4\xf2\x45" "\xe9\xe1\xa8\xb5\x3a\x27\x08\x7b\xc8\xbd\xe7\x67\x20\x88\x41\xc4\x12\xa4" "\x87\xcb\xf7\xfa\x9a\x83\xbe\xe7\x49\xa8\xf0\x95\xbb\x35\xf8\xbd\x51\x97" "\x66\xd4\x28\xf2\x46\xc4\x7b\x8f\x50\xff\xd5\x2a\xac\xbd\xd8\x46\x96\xfb" "\x7c\x57\x61\xb9\x9a\x15\xb0\x80\x9c\x34\x65\xe1\x0e\xf6\x58\xd3\xd2\xe2" "\x6a\x5b\x01\x87\x40\xab\x4f\x64\xb7\x6a\x41\x4b\xf4\x11\x84\xd3\x33\x4a" "\xf3\xf7\xc7\xf5\x34\x9e\x55\xad\x2e\x96\x66\x9d\xa6\xf6\x10\x5b\x7c\x0a" "\x74\xd8\x44\x8b\xea\x96\x66\x56\x61\x29\x82\xf8\x6c\x55\xfc\xad\x79\x1c" "\x25\x32\xdc\x1d\xbd\x27\xdd\xda\x62\x4f\x75\x15\x9e\xe4\x0c\xb3\x3f\xab" "\x8b\x47\x70\xa4\x94\x7c\xad\x4d\x93\x6a\xa5\xb7\xe9\x4c\x0e\x57\xb7\x93" "\xfe\x33\xaa\x8d\x5e\x89\x6a\x2c\x28\xeb\x80\x44\x71\xeb\x9a\xa1\x7a\xbf" "\x8c\x3e\xb7\x2e\xf8\x22\x39\x95\x37\x6e\x57\x95\xb9\xbc\xd5\xd3\x30\x7b" "\x55\x7d\x27\xab\x1c\xfa\x50\xd0\xee\xa7\x59\x39\x1a\xd9\xf6\xd6\x2d\x1b" "\x10\x00\x27\x86\x33\xe9\x0c\xfb\xf3\x50\x2e\x2a\x39\xf3\xb0\x5b\x05\x1e" "\xd1\x20\x0d\x57\xc9\x6a\x9e\xed\x32\x88\x37\x33\xc2\x26\x04\xa1\xb4\x5d" "\xd2\xaa\x1a\x85\xa0\x77\x7b\x34\x84\xbc\x50\x0d\x22\x15\xf8\xa3\xd0\x3c" "\x96\xde\x14\x12\x5e\xd5\x3d\xb3\x41\x3f\x08\xd7\x39\x6d\xfd\x28\x97\x70" "\x8a\x0c\xac\x7c\x98\xb6\x15\x25\x64\x6f\xb9\x84\xfb\x2a\x72\x37\x23\x8f" "\xee\x9e\x4c\xc7\x93\x8a\xc8\xd5\xb7\x67\x20\x07\xbe\x06\x20\x40\xb7\x03" "\xfb\xad\xd4\xb2\x49\x68\x9e\xdf\x00\xc0\xca\xbd\xa6\x44\xfd\x0a\xb2\xf6" "\x08\xe9\x1e\x5d\x59\xaf\x82\x7d\x0f\x48\xff\xbf\xfa\xa2\x85\x4f\x62\xcb" "\xd8\x95\xa6\xcc\xd0\x26\x7f\x88\xf3\x43\xa7\x27\xc2\x71\x56\xf7\x2c\xd8" "\x0a\x38\x34\xf3\x27\xfd\x50\x0a\x8f\xde\x96\x5a\x59\xde\x1a\x7c\x1f\xea" "\x7d\x51\x9b\x0e\x33\x53\x54\x99\x97\x03\x07\xeb\x6e\xa0\x15\x8d\xe5\x16" "\x77\xc1\xff\x71\x1d\x6e\x28\x8d\x07\x0a\x4e\xa3\x4f\xc3\xe9\x18\x83\x98" "\xbd\xc4\xe4\xcf\x8b\xf7\x94\x82\xac\xda\xe4\x3c\xe1\x1a\x01\xfd\x11\x3c" "\x0f\xd6\x76\x79\xc8\xcc\x1c\xc8\x10\x51\x21\x4a\x62\xa8\xda\x68\xa1\x23" "\xe1\xbb\xda\x8d\x62\x42\x62\xf7\x95\xc1\x25\x2f\x69\x0e\x89\xd0\xab\xde" "\xfd\xec\xb0\x63\x0b\x97\x63\x5d\x87\x74\x85\x81\xda\x01\x01\xc8\xfb\xe0" "\x93\x62\xbc\x5d\x62\x68\x5e\x8f\x8a\x81\xd2\x4e\x1c\x25\x06\x64\x60\xe4" "\xfe\xa9\xfc\x3d\x87\x67\x11\x2c\x6b\x08\x4f\x9c\x17\x49\x1f\x7d\x66\x71" "\x32\xa5\xa0\x0a\x55\xf9\x3c\x97\x4f\x6d\xa6\x68\x7b\x4b\x43\x7a\x3a\x84" "\x2a\xa9\xb0\xe0\x71\x44\xe5\xf0\x4a\xb3\x2f\xe3\xe6\x37\xec\xb2\x30\x78" "\x69\x8b\x32\x5b\x1d\xe6\xca\x62\x9e\x53\x5e\x8b\x69\x42\x3d\xab\x9d\x25" "\xbc\xfb\x96\x2b\x5d\xab\x26\xdc\x18\x3e\xd4\xf3\x05\xb3\x9f\x4e\xf9\x38" "\x32\xbb\x72\xd1\xa7\x05\xc5\x79\x37\xc3\x42\x22\xed\x87\x8a\xf1\x9c\x20" "\xd2\x20\xb2\x21\x3e\x96\x61\x8b\x5b\x78\x46\x44\xda\x0d\xfc\xeb\x63\x9c" "\xbb\xa8\x68\x5a\x38\x09\x1d\xd4\xba\x28\x50\x26\xd9\x12\xb2\xba\x97\xb5" "\x92\xd0\x6a\x1a\x86\x00\xf0\x41\x49\xac\x6c\x69\xe5\x71\x46\x70\x27\x56" "\x39\x35\x7b\x2f\x2b\x40\xbc\x11\x80\xac\x61\x3a\x54\x42\x9a\x17\xb8\x1e" "\xb7\xd8\x45\xec\x5b\x4a\x6d\x31\xee\xa4\xde\x29\xe4\x59\x14\x25\xa6\xec" "\x94\x78\x93\x70\xff\xf8\x72\x35\x21\x18\x76\x8a\x6e\x47\x7c\x3f\xc5\x97" "\x8f\x7f\xfd\x43\x0a\x50\xa2\x01\x27\x6f\xaa\xd5\x6d\xb1\x77\xda\xb3\x1e" "\x4d\x59\x2c\x91\x56\x55\x1b\xf4\xe4\x72\xb4\x3f\x07\x83\xb5\x84\x8f\x5f" "\x51\x65\x0d\xbc\x4e\x3d\xa1\xd4\x54\xf9\x30\x04\x41\x5f\x8d\xd4\x54\xff" "\x87\x99\x7a\x35\x18\x53\xd2\x41\x23\xe6\xff\x9c\x84\xa4\x19\x3e\xf5\x3c" "\x77\xb7\x42\x20\x4c\xf9\x43\x70\xd3\x33\x6d\x7c\x88\xb7\x68\xa3\xd2\x76" "\x63\x46\x80\x1e\xfa\xde\x0b\xaa\x37\x96\x4c\x4f\xd1\x00\x03\xf4\x8f\xb5" "\x1c\xcf\x66\x9c\x14\x6a\x8e\xdf\x0c\xcf\x03\x53\xb0\x31\x36\x84\xc7\xdd" "\x23\x18\x59\x40\xb8\xe6\x38\x7f\xc0\x1e\x80\xe8\x7a\x6b\xd2\x19\xc5\xfd" "\x24\x37\xeb\x74\xfa\x7a\xa8\xe1\x72\xc2\xa2\xcf\x33\xcc\x2e\x99\x03\x23" "\xa8\xb1\x46\x36\x90\x6c\xa6\x39\xc0\xd4\xc3\x7f\x07\x35\xe2\x27\xd4\x8f" "\x75\x2b\x72\x72\x0f\x89\x61\xf6\x0f\x3e\x14\x72\x2b\x4c\xd3\xad\xc5\xfb" "\x23\x35\x95\x92\x90\x35\xd8\x2d\x45\xee\x4c\xfc\xa3\x74\x53\x03\xce\xa0" "\x20\xaa\xd4\x48\x7e\x7b\xee\x26\xe3\x42\x60\xe2\x78\x3a\xd0\xfb\x0e\x6a" "\x3d\x38\xa6\xaa\x1c\xed\x14\x1d\xbb\xc3\x29\x1a\x7d\xe9\x61\x18\x4c\x3c" "\x22\xf7\xf6\x23\x56\x29\xcb\x59\xd6\x8d\xb1\x41\x03\xf4\xdb\x09\x56\xaf" "\x92\x1a\x31\x27\x82\x05\x2e\x79\xf0\xb8\x8e\x0d\x86\x21\x96\x6c\x22\x94" "\x49\xdb\xac\x54\x63\x7a\x34\xa5\x19\x05\x0d\x67\x0b\x72\x03\xeb\x53\x40" "\x7c\x24\xe2\xfe\x3f\xf2\xf8\x2f\x57\xa3\xd2\x66\x36\x3f\xda\xb8\xd9\x55" "\xa0\x70\xc8\x97\xeb\x9c\x80\x7a\xfc\xac\xa9\xc5\x0a\xe0\x57\x5e\x32\x7c" "\x81\x58\x33\x0c\x78\x67\x50\xb6\x08\xcd\x40\x7e\x11\x6b\x68\x39\x1a\x74" "\x3b\x36\xd3\xea\xbb\x05\xa0\xd4\xdf\x0c\x72\x33\x76\xdf\xb2\x8e\x5d\x66" "\x5c\xee\x44\xa7\x50\x38\xea\x30\x90\x94\x44\x6d\xb3\x02\xfc\xac\x6e\xbe" "\xeb\xd8\x09\x8f\x21\xa9\xdc\xcf\x30\x58\xfc\x27\x90\xb2\x8e\x1b\x75\x27" "\x13\x02\x94\x73\xa4\x91\xdd\x76\xc6\xeb\x5b\xac\x47\xcc\x78\xe3\xac\xa0" "\xdd\xe8\x14\xf2\x65\x75\x19\x77\xa4\x92\xeb\xf1\x4c\x2c\x0b\x3a\x90\x00" "\x0d\x9f\xf2\x13\x7e\xd0\xfe\x79\xcc\x9f\xa2\xac\x64\xd0\x6d\xc1\x77\x30" "\x58\xeb\xd8\x3b\x74\x6a\x86\x96\xe8\x77\x7b\x3f\x26\x7e\xb7\x15\x45\xfb" "\x09\x94\x19\x57\x6d\x16\x6b\x6b\x02\x79\x18\x7f\x62\x33\x03\x2b\x5c\x0e" "\x91\x70\xf6\x99\xb1\xed\xee\xf6\xfa\x10\x08\x1e\x5f\xe4\xc3\xe6\x44\x99" "\x22\x6a\x10\xdd\x1f\x47\x4a\x2f\x3c\x7d\x13\x6e\x42\x43\x11\x6e\x0f\x62" "\x0a\x46\xf1\xdc\xc6\x9d\x90\x67\x76\x75\xea\x18\x0f\xc7\x42\x01\x50\xc2" "\xac\xdf\xa5\xc9\x88\x0e\x8f\xb8\xbd\xcf\xbc\xd2\x23\xc4\x40\x51\x5e\x5f" "\x35\xc0\x72\x6a\xc8\xc0\x27\x24\x4b\x0d\x54\xfe\x8f\x66\xde\xc9\xb0\xda" "\xb1\x4b\x8a\xc2\x89\x3f\x21\x59\xe3\xfd\xb9\xc2\x44\x39\x44\x07\x24\x62" "\xaf\xd5\x7d\xa8\xc7\xdd\xe2\xe6\x19\xc7\x90\xbb\xec\x8d\xd7\x3d\xfc\xbf" "\x8e\x36\x68\x20\xa8\x88\x29\xc2\x88\x56\x59\x6f\x6c\xc4\x98\x84\x9b\x00" "\xcb\xff\x3b\xb1\xe7\x75\xab\x92\x97\x78\x04\xe4\x94\xcb\x06\x2d\x38\x15" "\xff\x40\xff\x0f\xbf\x09\x2b\xa5\x4e\xf5\x0e\x26\x94\x74\xde\xd2\xd2\xda" "\x15\xb9\x98\xe6\x35\x02\xf0\x2d\x48\x46\x1a\x98\x62\xbe\xf3\xc7\xeb\x72" "\xc2\xb8\x4a\x15\x7e\x60\x42\x36\x76\x1d\x6b\x33\x47\x08\xc0\xb3\xc9\x1f" "\xa5\x1e\xe0\x19\x6e\xf6\x66\x2e\x01\x34\xfd\x93\x7c\xc5\xc5\xbe\x11\x26" "\xa8\xb0\xb0\x19\x0a\x58\x24\xee\xd5\x58\xaf\xae\x75\xa0\x76\x12\xf3\xb2" "\x90\xed\xdc\x7b\x57\xbb\x26\xa1\xe2\x9a\x04\x05\x9c\xc1\x31\xa8\x6a\x94" "\x97\x02\x47\x52\x44\xb9\x18\xb8\x22\xd1\x1d\xcf\xa0\x7d\x49\xd2\x57\xd2" "\x70\xa5\x90\x32\xa8\x24\x4f\x4b\x93\x1d\xdd\x01\x78\x36\xa4\xd8\xd6\xa2" "\xa3\xe7\x8f\x4f\x34\x3d\xd9\x6a\x12\xe4\x6b\x45\x15\x0a\xc2\xe3\x10\xc0" "\x7c\x3f\xe8\x8f\x21\x06\xac\x01\x48\x5f\xb3\xcb\x39\xfa\x0a\xca\x6e\x5c" "\x3e\x72\x7c\xf1\x83\x9b\x85\x46\xaa\x89\x3d\x98\x49\x77\xf5\x85\x8a\x35" "\xf3\x7b\x34\x88\xd8\x3c\x04\x8c\x33\xfd\x63\x39\xac\x4c\xdc\x75\x60\xc6" "\x0d\x53\xdc\x9f\x8e\x0b\xb5\x4d\xff\x79\x52\x3b\x5b\xd9\x96\x99\xe2\x3b" "\xb8\x31\x65\xa8\x3c\x76\x88\xb4\xfa\x2d\xae\xdb\x96\xd6\x93\x4e\xc3\xd8" "\x76\x94\x30\x23\xa2\x0d\x18\x1e\xb4\x86\x4b\x71\xcd\xa5\x55\x5d\x63\xf2" "\xc9\xb8\x8f\xfc\xed\xa8\xd4\xc9\xea\x83\x03\x80\x72\x90\x7e\xc8\x81\x57" "\x3a\x23\x90\x1d\x87\xd9\x65\x47\x6e\x59\x66\x63\xba\x56\xcf\x36\xa9\xaf" "\xcc\x8b\x47\xa1\xc5\xbc\x48\xf5\x40\xf4\xc5\xd4\x83\xc8\x22\x8c\xaf\x11" "\xeb\xb3\x4f\x35\xb3\x24\x86\x22\xf8\x63\xda\x6f\xf3\xe9\x6c\x86\x55\xe6" "\x67\xed\xf5\xd9\x08\xad\x40\x9b\x0b\xb2\x0a\x4b\x80\xc2\xb1\x09\x14\x1b" "\xa4\xd0\x29\x57\xd9\x37\x28\x9e\x88\x9f\x85\x8f\x3a\xe2\xee\xb0\xb3\x96" "\x1e\x84\x0b\x3c\x95\x33\x43\x91\xe6\x23\xf3\xb2\xd2\x2b\x6e\x93\x90\xc7" "\xa2\x55\x4c\x3c\x45\x32\xdf\x0d\xf4\xbd\x0d\x0b\x4e\x36\xed\x51\x72\x18" "\x42\x5c\x38\x8b\x5e\x0b\x8e\x5b\xbc\x91\x7f\x58\xdf\x74\xd9\x2f\x62\x30" "\xfa\x7b\x2c\x7e\xb8\x01\x0f\x83\x3a\xb0\x2c\xa4\x6e\x44\x3b\x30\x93\xbb" "\xb7\x5d\x53\x38\x83\x85\x0f\xe3\x80\x48\x2d\xee\x22\x60\x03\x5a\x54\x14" "\xcc\xd4\x65\x2f\xf9\x47\xf7\x1a\x80\x16\xfa\x42\x5f\x6d\x7f\x9d\x29\xa3" "\x13\xf1\x2e\x83\xc8\xc7\xb8\x9d\xd3\xf8\x4f\x50\x3b\xff\x1a\x01\xa3\x1f" "\xa7\x71\xf3\x75\x00\x22\x7a\x60\x3a\xc8\x05\x58\x8c\xe4\x9b\x09\x40\x5c" "\x0f\xea\xfd\xc2\xa2\x85\x21\x32\x74\xf7\xe7\x65\x61\xfc\xbc\x58\x68\xde" "\x9c\x84\x4b\xac\xb6\x49\xbe\x31\xe2\x19\xd1\x0e\xe5\xb3\x55\xef\x38\x46" "\xa6\x63\x3d\x53\xea\x21\xd9\x73\x67\x3d\x85\x6b\x18\xf5\x9a\x23\x76\x77" "\xbe\xd3\x72\x55\xe1\xa1\x11\x31\x81\xe0\x79\xdc\xf5\x90\xd4\xbe\x79\x09" "\x01\x5b\xa4\x83\x2b\x54\x1a\x48\xf0\x8d\x50\x31\x78\xda\xb0\xf2\xf8\x2b" "\x8f\x81\x8b\xb5\xe3\x04\xff\x9d\x21\x1f\x6e\xdd\x8d\x20\x04\x18\xa9\xe6" "\x0c\x04\x49\xed\x16\x44\xef\x3c\xf6\x1c\x66\x73\x11\x47\x48\x84\xf7\x6d" "\x11\xf6\xcd\x95\xa1\x76\x6f\xdd\x3b\x04\x44\xaf\x42\x98\xd1\xb2\x44\xdd" "\x89\xf7\xf6\xa4\x8a\x49\xd0\xc1\xf8\xa4\xcb\x05\xe3\xb6\xbb\xfe\x4f\xf7" "\xa9\x96\x07\x18\xb4\xe7\x39\xd4\xab\x05\x6d\xaf\x44\x10\x46\xbb\xf0\x30" "\xea\x89\xd2\xdd\x16\x30\x83\x55\xc2\x41\x2c\xa4\x44\xc4\xa7\xb5\x97\x80" "\xe9\xab\x74\xda\x2f\x71\x07\x23\x02\x59\xb5\xd7\x1b\x9d\x94\xb2\x92\xac" "\x7e\xa4\x60\x60\xf2\x42\x31\x72\x7e\x9b\xf3\x57\xb8\x9d\x2a\xee\xbd\xb4" "\xdb\x02\x0d\x26\xd5\x9a\xc9\xdd\xd1\x7b\x81\xe4\xb9\xcb\x8f\x24\x8f\x3c" "\x08\x50\x20\xef\xd1\xa6\x40\x3a\x1c\x85\x2b\xa8\x25\x43\xca\x09\xd5\x1f" "\xa5\xc6\xa2\xb9\x74\x3a\x5b\xec\xfc\x16\xb7\xfe\x2c\xda\xe1\x95\x84\x94" "\x95\x6c\x6b\xcf\x81\xae\xe6\x62\x95\x9a\xa7\x42\xe0\xde\x61\xc2\x52\xe3" "\xfb\xee\x94\xa5\xdd\x8f\x8f\x45\xfb\x6f", 4096); *(uint64_t*)0x20000388 = 0x1000; *(uint64_t*)0x20000390 = 0; *(uint64_t*)0x20000398 = 0; *(uint64_t*)0x200003a0 = 0; *(uint64_t*)0x200003a8 = 0; syscall(__NR_pwritev, r[1], 0x20000380ul, 3ul, 0xf1, 4); } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); for (procid = 0; procid < 4; procid++) { if (fork() == 0) { do_sandbox_none(); } } sleep(1000000); return 0; }