| // kernel BUG at kernel/time/timer.c:LINE! (2) |
| // https://syzkaller.appspot.com/bug?id=896177e5e24481c07897a3bc3b8de90760c40b27 |
| // status:fixed |
| // autogenerated by syzkaller (https://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| |
| #include <dirent.h> |
| #include <endian.h> |
| #include <errno.h> |
| #include <fcntl.h> |
| #include <pthread.h> |
| #include <sched.h> |
| #include <signal.h> |
| #include <stdarg.h> |
| #include <stdbool.h> |
| #include <stdint.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <sys/ioctl.h> |
| #include <sys/mount.h> |
| #include <sys/prctl.h> |
| #include <sys/resource.h> |
| #include <sys/stat.h> |
| #include <sys/syscall.h> |
| #include <sys/time.h> |
| #include <sys/types.h> |
| #include <sys/wait.h> |
| #include <time.h> |
| #include <unistd.h> |
| |
| #include <linux/futex.h> |
| |
| static void sleep_ms(uint64_t ms) |
| { |
| usleep(ms * 1000); |
| } |
| |
| static uint64_t current_time_ms(void) |
| { |
| struct timespec ts; |
| if (clock_gettime(CLOCK_MONOTONIC, &ts)) |
| exit(1); |
| return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; |
| } |
| |
| static void thread_start(void* (*fn)(void*), void* arg) |
| { |
| pthread_t th; |
| pthread_attr_t attr; |
| pthread_attr_init(&attr); |
| pthread_attr_setstacksize(&attr, 128 << 10); |
| if (pthread_create(&th, &attr, fn, arg)) |
| exit(1); |
| pthread_attr_destroy(&attr); |
| } |
| |
| typedef struct { |
| int state; |
| } event_t; |
| |
| static void event_init(event_t* ev) |
| { |
| ev->state = 0; |
| } |
| |
| static void event_reset(event_t* ev) |
| { |
| ev->state = 0; |
| } |
| |
| static void event_set(event_t* ev) |
| { |
| if (ev->state) |
| exit(1); |
| __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); |
| syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG); |
| } |
| |
| static void event_wait(event_t* ev) |
| { |
| while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) |
| syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); |
| } |
| |
| static int event_isset(event_t* ev) |
| { |
| return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); |
| } |
| |
| static int event_timedwait(event_t* ev, uint64_t timeout) |
| { |
| uint64_t start = current_time_ms(); |
| uint64_t now = start; |
| for (;;) { |
| uint64_t remain = timeout - (now - start); |
| struct timespec ts; |
| ts.tv_sec = remain / 1000; |
| ts.tv_nsec = (remain % 1000) * 1000 * 1000; |
| syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); |
| if (__atomic_load_n(&ev->state, __ATOMIC_RELAXED)) |
| return 1; |
| now = current_time_ms(); |
| if (now - start > timeout) |
| return 0; |
| } |
| } |
| |
| static bool write_file(const char* file, const char* what, ...) |
| { |
| char buf[1024]; |
| va_list args; |
| va_start(args, what); |
| vsnprintf(buf, sizeof(buf), what, args); |
| va_end(args); |
| buf[sizeof(buf) - 1] = 0; |
| int len = strlen(buf); |
| int fd = open(file, O_WRONLY | O_CLOEXEC); |
| if (fd == -1) |
| return false; |
| if (write(fd, buf, len) != len) { |
| int err = errno; |
| close(fd); |
| errno = err; |
| return false; |
| } |
| close(fd); |
| return true; |
| } |
| |
| static long syz_open_dev(long a0, long a1, long a2) |
| { |
| if (a0 == 0xc || a0 == 0xb) { |
| char buf[128]; |
| sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, |
| (uint8_t)a2); |
| return open(buf, O_RDWR, 0); |
| } else { |
| char buf[1024]; |
| char* hash; |
| strncpy(buf, (char*)a0, sizeof(buf) - 1); |
| buf[sizeof(buf) - 1] = 0; |
| while ((hash = strchr(buf, '#'))) { |
| *hash = '0' + (char)(a1 % 10); |
| a1 /= 10; |
| } |
| return open(buf, a2, 0); |
| } |
| } |
| |
| static long syz_open_pts(long a0, long a1) |
| { |
| int ptyno = 0; |
| if (ioctl(a0, TIOCGPTN, &ptyno)) |
| return -1; |
| char buf[128]; |
| sprintf(buf, "/dev/pts/%d", ptyno); |
| return open(buf, a1, 0); |
| } |
| |
| static void setup_common() |
| { |
| if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { |
| } |
| } |
| |
| static void loop(); |
| |
| static void sandbox_common() |
| { |
| prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); |
| setpgrp(); |
| setsid(); |
| struct rlimit rlim; |
| rlim.rlim_cur = rlim.rlim_max = 200 << 20; |
| setrlimit(RLIMIT_AS, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 32 << 20; |
| setrlimit(RLIMIT_MEMLOCK, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 136 << 20; |
| setrlimit(RLIMIT_FSIZE, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 1 << 20; |
| setrlimit(RLIMIT_STACK, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 0; |
| setrlimit(RLIMIT_CORE, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 256; |
| setrlimit(RLIMIT_NOFILE, &rlim); |
| if (unshare(CLONE_NEWNS)) { |
| } |
| if (unshare(CLONE_NEWIPC)) { |
| } |
| if (unshare(0x02000000)) { |
| } |
| if (unshare(CLONE_NEWUTS)) { |
| } |
| if (unshare(CLONE_SYSVSEM)) { |
| } |
| typedef struct { |
| const char* name; |
| const char* value; |
| } sysctl_t; |
| static const sysctl_t sysctls[] = { |
| {"/proc/sys/kernel/shmmax", "16777216"}, |
| {"/proc/sys/kernel/shmall", "536870912"}, |
| {"/proc/sys/kernel/shmmni", "1024"}, |
| {"/proc/sys/kernel/msgmax", "8192"}, |
| {"/proc/sys/kernel/msgmni", "1024"}, |
| {"/proc/sys/kernel/msgmnb", "1024"}, |
| {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, |
| }; |
| unsigned i; |
| for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) |
| write_file(sysctls[i].name, sysctls[i].value); |
| } |
| |
| int wait_for_loop(int pid) |
| { |
| if (pid < 0) |
| exit(1); |
| int status = 0; |
| while (waitpid(-1, &status, __WALL) != pid) { |
| } |
| return WEXITSTATUS(status); |
| } |
| |
| static int do_sandbox_none(void) |
| { |
| if (unshare(CLONE_NEWPID)) { |
| } |
| int pid = fork(); |
| if (pid != 0) |
| return wait_for_loop(pid); |
| setup_common(); |
| sandbox_common(); |
| if (unshare(CLONE_NEWNET)) { |
| } |
| loop(); |
| exit(1); |
| } |
| |
| static void kill_and_wait(int pid, int* status) |
| { |
| kill(-pid, SIGKILL); |
| kill(pid, SIGKILL); |
| int i; |
| for (i = 0; i < 100; i++) { |
| if (waitpid(-1, status, WNOHANG | __WALL) == pid) |
| return; |
| usleep(1000); |
| } |
| DIR* dir = opendir("/sys/fs/fuse/connections"); |
| if (dir) { |
| for (;;) { |
| struct dirent* ent = readdir(dir); |
| if (!ent) |
| break; |
| if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) |
| continue; |
| char abort[300]; |
| snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", |
| ent->d_name); |
| int fd = open(abort, O_WRONLY); |
| if (fd == -1) { |
| continue; |
| } |
| if (write(fd, abort, 1) < 0) { |
| } |
| close(fd); |
| } |
| closedir(dir); |
| } else { |
| } |
| while (waitpid(-1, status, __WALL) != pid) { |
| } |
| } |
| |
| #define SYZ_HAVE_SETUP_TEST 1 |
| static void setup_test() |
| { |
| prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); |
| setpgrp(); |
| } |
| |
| #define SYZ_HAVE_RESET_TEST 1 |
| static void reset_test() |
| { |
| int fd; |
| for (fd = 3; fd < 30; fd++) |
| close(fd); |
| } |
| |
| struct thread_t { |
| int created, call; |
| event_t ready, done; |
| }; |
| |
| static struct thread_t threads[16]; |
| static void execute_call(int call); |
| static int running; |
| |
| static void* thr(void* arg) |
| { |
| struct thread_t* th = (struct thread_t*)arg; |
| for (;;) { |
| event_wait(&th->ready); |
| event_reset(&th->ready); |
| execute_call(th->call); |
| __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); |
| event_set(&th->done); |
| } |
| return 0; |
| } |
| |
| static void execute_one(void) |
| { |
| int i, call, thread; |
| for (call = 0; call < 10; call++) { |
| for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); |
| thread++) { |
| struct thread_t* th = &threads[thread]; |
| if (!th->created) { |
| th->created = 1; |
| event_init(&th->ready); |
| event_init(&th->done); |
| event_set(&th->done); |
| thread_start(thr, th); |
| } |
| if (!event_isset(&th->done)) |
| continue; |
| event_reset(&th->done); |
| th->call = call; |
| __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); |
| event_set(&th->ready); |
| event_timedwait(&th->done, 45); |
| break; |
| } |
| } |
| for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) |
| sleep_ms(1); |
| } |
| |
| static void execute_one(void); |
| |
| #define WAIT_FLAGS __WALL |
| |
| static void loop(void) |
| { |
| int iter; |
| for (iter = 0;; iter++) { |
| int pid = fork(); |
| if (pid < 0) |
| exit(1); |
| if (pid == 0) { |
| setup_test(); |
| execute_one(); |
| reset_test(); |
| exit(0); |
| } |
| int status = 0; |
| uint64_t start = current_time_ms(); |
| for (;;) { |
| if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) |
| break; |
| sleep_ms(1); |
| if (current_time_ms() - start < 5 * 1000) |
| continue; |
| kill_and_wait(pid, &status); |
| break; |
| } |
| } |
| } |
| #ifndef __NR_bpf |
| #define __NR_bpf 321 |
| #endif |
| |
| uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; |
| |
| void execute_call(int call) |
| { |
| long res; |
| switch (call) { |
| case 0: |
| memcpy((void*)0x203e0000, "/dev/ptmx\x00", 10); |
| res = syscall(__NR_openat, 0xffffffffffffff9c, 0x203e0000, 6, 0); |
| if (res != -1) |
| r[0] = res; |
| break; |
| case 1: |
| memcpy((void*)0x20000440, "/dev/mixer\x00", 11); |
| res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000440, 0x2000, 0); |
| if (res != -1) |
| r[1] = res; |
| break; |
| case 2: |
| *(uint32_t*)0x20000640 = r[0]; |
| sprintf((char*)0x20000644, "%023llo", (long long)-1); |
| *(uint64_t*)0x2000065b = 0; |
| *(uint64_t*)0x20000663 = 0x20000780; |
| sprintf((char*)0x20000780, "0x%016llx", (long long)r[0]); |
| sprintf((char*)0x20000792, "%020llu", (long long)0); |
| memcpy((void*)0x200007a6, |
| "\x68\xfa\x37\xcc\xdd\x69\xf3\x15\x49\x87\xee\xf1\x30\xd1\xd6\x19" |
| "\xfd\xaf\xfb\xf9\x26\x45\x2b\xfa\x53\x44\x6e\x90\xdf\x9b\x1f\xf5" |
| "\x66\x11\x10\xb2\x71\x21\xd5\x39\x30\x7b\x5b\xad\x9f\xbd\x3c\x3b" |
| "\xc4\x0b\xf7\xb0\x37\x94\x51\x47\x4f\xc7\x65\xde\x99\xb5\x5a\xb1" |
| "\xd4\xce\x09\x31\x2d\xf8\xd4\x2d\x9d\x48\xf3\xad\x2d\x3d\xda\xfa" |
| "\xe8\x8c\xff\x4d\x9f\x4d\x80\x10\xac\x1a\x9b\x85\xe5\x13\x62\x2b" |
| "\x33\x33\x55\x84\xd0\x6f\x1f\xdb\xaf\xaf\x5f\x59\x97\x99\x10\xd5" |
| "\xbe\xe6\x26\x38\x47\x87\x93\xef\xd3\xec\x08\xe5\x14\x7d\x42\x8b" |
| "\x36\xe2\x96\xd5\x82\xc6\x3d\x3e\x5d\x4d\x06\x78\xfc\x88\x2f\x69" |
| "\x61\xe9\x49\xc3\xd0\xd6\x47\xdc\x19\xf0\xd6\xd0\x99\x77\x1d\xae" |
| "\xb6\x0b\x6f\x8f\x4c\x96\xa9\x27\xb5\x80\x2a\x42\xa3\x6e\x99\x52" |
| "\x39\x5e\x1d\x3e\xd1\x7b\x8c\xf6\x42\xd3\xf1\x05\x99\x1d\x7a\x09" |
| "\xee\x40\x61\x9d\x93\xfd\xde\x71\x4e\x57\x71\xe3\x75\x21\x73\x42" |
| "\xd3\x37\xed\xaa\xc0\xfb\xef\xce\x22\x2a\x7a\x4b\x02\x30\x7c\xd9" |
| "\xbf\x31\xfc\xef\x11\x65\x2a\xca\x44\x10\x30\x2e\xa1\x45\xe3\xd6" |
| "\x10\x88\x1d\xd4\x84\x48\xdd", |
| 247); |
| *(uint64_t*)0x2000089d = 0; |
| *(uint32_t*)0x200008a5 = -1; |
| memcpy( |
| (void*)0x200008a9, |
| "\x27\x6c\x82\x11\x9f\x6f\xb8\x83\x15\x7b\xbc\x63\x88\xd7\x0a\xde\xf4" |
| "\xe1\x7c\xcb\xef\xcb\x2f\x57\xa6\x81\xf3\x72\x0d\x5a\x81\xf9\x63\x8e" |
| "\xcd\x27\x49\x83\x26\x12\x68\x81\x26\x7b\xc1\xe1\x00\x42\xb3\x5a\x9d" |
| "\xee\xd5\xbb\x69\xcb\xbe\x44\xc8\x08\xad\x61\x6d\xf3\xf2\x58\xd4\x14" |
| "\xd2\x4f\xd6\x2c\x7a\xf6\x29\x2c\xfd\x48\x02\x83\xfb\xc8\x29\x2e\x0c" |
| "\xc4\x44\x45\xaf\xe6\x37\x8d\x22\xf8\xf7\x84\x4c\xb8\x8b\x04\x35\x16" |
| "\xb5\x5e\xde\xe4\x85\xf7\xd3\x9c\x87\x73\xc0\xfa\x35\x90\x93\xcf\x47" |
| "\x25\x22\xfd\xa9\xf0\x65\xc6\x08\x3c\x3e\x20\x92\x4b\x78\xcb\x7b\x7f" |
| "\xe7\x39\xc8\x32\x36\x79\x9d\x9a\xa4\xf9\x5d\x4c\x0f\xb2\xb6\x0a\x65" |
| "\x4a\x3d\x14\x3e\x38\x7d\x9d\x32\x26\xb7\x1d\xae\x03\x40\x8d\x42\x0b" |
| "\x66\x72\x60\xc1\x3f\xfd\x36\xd6\x6d\xc3\xf6\x79\x32\xfb\x02\xf6\x69" |
| "\x3a\x41\x4f\x66\x5b\x3a\x5e\xc3\x09\xe6\x39\xe5\x04\x77\x45\x3e\x34" |
| "\x1c\x64\xf5\x35\x98\xa6\xf0\x5c\x21\x40\x73\x55\x0d\x04\xd0\x82\x3b" |
| "\xc1\xce\x8f\xfe\x22\x20\x66\x0e\x97\x3b\xfc\xe1\x8d\x33\xac\x38\x0a" |
| "\x54\x41\x21\x43\x20\x57\x9b\x25\xd2\x89\xa4\x74\x07\xd9\x1d\x00\x72" |
| "\xa7\x44\x11\xe0\xf5\xf4\x39\x9c\xfa\x17\xa1\x57\x80\x77\x71\xc5\x94" |
| "\x4a\xd3\xa4\xc7\xa1\x8e\xc4\x79\xf7\x79\x84\xc6\x76\x21\x53\xa6\x2d" |
| "\x2e\xa3\xdb\xab\x87\xab\x65\x65\x2c\x6e\x11\x23\x57\xc7\xe9\xb1\xd1" |
| "\xd4\x14\x8a\x6c\xef\x50\xcd\xa0\xd0\x4e\xd2\xee\xa4\x1d\x7b\x79\x1f" |
| "\x2a\x64\xd3\x8e\xdf\x5a\x1a\x0d\x01\x27\xd9\x33\x4d\x3a\xa2\x2f\x78" |
| "\x52\x75\x9f\xcd\x94\x75\x2d\xf6\x0a\x66\x3c\x18\xcd\x82\xb7\x1a\x5e" |
| "\xdd\x9b\x5e\x42\x5f\xe2\x30\xb3\x68\x24\xf1\xd8\x91\x27\x1b\xe4\xd0" |
| "\x35\xaa\xc5\xef\xf4\x38\x69\xf5\x71\xc0\xa3\x3b\x56\xe2\x30\x50\x0c" |
| "\x83\xe9\x2d\xf4\x59\x28\xfa\x18\x50\x8b\x05\x85\x70\xe5\x2d\x25\x2d" |
| "\x54\xb6\x43\xfa\x60\x2f\x4e\xca\x37\xec\xec\x0a\x79\x4d\x8c\xb1\xf3" |
| "\xf1\x4a\x8b\xb3\x8b\xb8\x8d\x4a\x4d\xc1\x3c\x02\xc2\x65\x6c\xc0\x76" |
| "\x61\xeb\x42\xd0\xe1\x1a\xad\xe5\x36\xc6\x5b\x90\x89\x07\xba\xe8\x1c" |
| "\xa2\x82\xc8\xe2\x55\x2f\x27\x66\xa9\x1d\x63\x7b\x70\x3a\x5a\xdb\x14" |
| "\xb7\xe2\xa1\x34\x93\xe6\xad\x69\x58\xa9\x70\xdd\xb7\xf6\x4e\x93\x53" |
| "\x12\x08\xab\xa8\xee\xf8\xf0\xff\x86\xb4\xea\xb2\xec\xfd\xc3\xf9\xce" |
| "\xb3\x7c\xf7\xa1\x6d\x63\xfb\x09\xbe\x25\xc3\x03\x92\x46\xaa\x99\x8c" |
| "\x68\xea\x17\x03\xe6\x8f\x12\xb3\xa6\xe8\x57\x02\xf5\x13\x74\x50\x37" |
| "\xe3\xa1\x44\x87\x3c\xc2\x01\x06\x4d\x2e\x67\x2f\x86\x72\x10\x22\xc9" |
| "\x58\xa8\xee\xdd\xdc\x04\x85\x25\x96\x29\x5d\x23\x88\x82\x92\x2d\xc2" |
| "\x01\x03\xb6\xcf\x4f\xc6\x60\x55\xbe\xa4\xd2\x1a\xcc\x0e\x18\x3d\x13" |
| "\xac\xc1\x04\xa7\x85\x14\xd2\x1c\x99\xf4\xfb\x13\x5a\xba\xbd\xb3\xce" |
| "\xe8\x0a\xf8\xb4\x49\x51\xd8\xb5\xce\x14\x45\x30\xf9\x49\x4e\xa7\xe5" |
| "\x8d\x35\x41\xdf\x35\xd1\xef\x8b\x34\x62\x87\x80\xa5\xb8\x70\x9f\x0a" |
| "\xe2\x9e\x2c\xeb\x6b\xb6\x1a\x6a\x37\x25\x1a\x41\x29\x2c\x9e\x99\x1b" |
| "\xcb\xc7\xb2\x36\xa2\xba\x95\xed\x0a\xa8\x60\x1a\x58\xc0\xbb\x5a\xa0" |
| "\x23\x7d\xe3\x40\x42\x62\xb3\x49\x93\x60\x1a\xf8\xce\xbe\x92\x3c\x98" |
| "\x2a\x7e\x6c\x83\xaa\x10\x04\x46\xd5\x52\xf6\x53\xb8\x21\x44\x51\x46" |
| "\x6e\x35\x87\xca\x44\xa1\x15\xe2\x76\xc9\x96\xa2\xb5\xac\x05\x63\xd8" |
| "\x82\x68\x8a\x05\x20\x76\xc1\x72\xde\x74\x99\xe3\x62\xaa\x03\x8c\x11" |
| "\x8d\x54\x7c\x46\x2d\xf0\x32\xbd\x1b\x0f\xb4\xd5\x28\xf5\x0b\x8c\xcc" |
| "\xd0\xb0\x3b\xd1\x60\x0b\xa7\xf3\x40\x13\xf7\xf6\x19\x5f\x5e\x84\x38" |
| "\xcc\xea\x52\x65\x65\x64\xdc\x2d\x05\xc0\x1b\x2c\x3d\xd4\x95\x11\xf4" |
| "\xc7\xc6\xae\x21\xe9\x1f\x74\x16\x2a\xeb\x27\x8c\x1f\x59\x09\xaa\xe9" |
| "\xdd\xd4\xfd\x65\xc7\xb0\x18\x0f\x0a\x1d\xb0\xa2\xf0\x55\x01\x0e\x44" |
| "\xe9\xbe\xb7\x86\x19\xd9\xe5\x13\x58\x43\x61\x68\x77\xca\xa3\xd5\x4e" |
| "\x1a\x9d\x28\x89\x59\xf4\x3a\x68\x2f\xdc\xa4\x44\xc2\x10\x1f\xf9\x33" |
| "\x08\xe5\x5d\xfe\xbe\x27\x6c\x53\x93\x0b\xba\x8f\x5d\x2d\x5e\x85\x55" |
| "\x5d\xac\x84\xef\x2e\xce\x17\x4f\xd6\x22\xbb\x72\x5e\x9d\x25\xfa\x2e" |
| "\x91\xf3\x9a\x6d\x4e\x47\xf5\x47\x52\x1e\x13\x59\x55\xba\x43\xdc\x8e" |
| "\x5a\xb0\x3f\xfc\x3a\x3d\xa4\xbe\x87\xb2\x9f\x3a\x6b\x8d\xff\x2c\x79" |
| "\x76\xe5\xd4\xb3\x5e\x7b\xee\xe3\x28\xad\xd8\xd9\x6c\xcd\x5f\x89\xee" |
| "\x15\x50\x74\xed\xa7\x7f\x7b\x80\xcb\x4a\x7b\x79\xd6\x69\x1d\xd4\x9b" |
| "\x7a\x5b\x31\xd5\xa8\x9c\xe8\x96\x6e\xf1\x36\xc7\x89\x62\xe6\x34\x46" |
| "\x7e\xd7\x2a\xf8\x8b\xe7\xdc\x6c\xc5\xa6\x1a\xa2\x26\x9f\xda\xfa\xbd" |
| "\x01\x7c\x80\xdb\x91\x26\xfc\x32\x58\x0c\x9a\xc6\x37\x18\xed\xfd\xec" |
| "\x40\xdb\x1f\xb4\x32\x19\xfb\xac\x0a\xa8\xc1\xa7\xc6\x72\x80\xbf\x17" |
| "\x84\x5e\xfa\x88\x93\x9d\x0e\x6a\x59\xad\xd3\x6e\x57\x04\xa2\x2e\x66" |
| "\x52\x79\xcf\x89\x2b\xc0\xf4\x66\x35\xbf\xa8\x38\xce\xbf\x9d\x78\x66" |
| "\x24\xee\x2c\x57\x3f\x4d\x9b\xe5\x51\x84\xc6\x3c\x44\x01\xfb\x3e\x3d" |
| "\xcf\x8b\x3d\x56\x0e\x37\x8d\xcf\x06\x58\xb1\x04\xb5\xf9\x01\xaa\xfd" |
| "\x3c\xd9\xbe\x3e\x3a\x04\x8c\xd1\x10\x1c\x3c\x2f\x1c\xf4\xc1\x45\x43" |
| "\xb2\x15\xa7\xe6\xae\x1c\xf7\xcd\xae\xd9\x75\x31\xac\xad\x28\x22\xdf" |
| "\xc2\x1b\x99\x03\xe7\x16\x29\x61\x66\x07\x5c\xf1\x73\xfe\x71\xe5\xc2" |
| "\x17\x5f\xb3\xd1\x1d\x95\xfe\x9e\xc1\xe7\x44\x84\xca\x07\x8c\x02\xd6" |
| "\x33\x17\x18\x30\x96\xab\x6a\x7e\xc9\xe4\x4c\xd6\x5b\x58\x71\x13\x2c" |
| "\x54\xbb\x06\xfd\xa1\x0c\x58\x71\xcd\xa0\xf0\xb3\xe7\x2c\x92\xa7\xb2" |
| "\x8e\x49\x01\x6e\xa8\x59\x8f\x48\x9d\xe6\x61\xa7\xc1\x76\xc5\x14\xd3" |
| "\x40\xee\x06\x42\x01\xec\xaf\x75\xca\x19\xf2\x61\x07\x0b\xab\xfc\x0a" |
| "\x6d\x6a\xe6\x66\x37\x30\x1c\x8e\x4f\xde\x90\x40\xa9\x28\x8f\xd2\xa0" |
| "\xfc\x99\x41\x61\x1e\xa6\x29\x05\x98\x63\x40\x36\x6e\xee\x51\x10\x9c" |
| "\x78\x97\x69\x8b\x84\xf1\x40\x54\xf3\x14\x66\x3a\xea\xb5\xfb\x2e\x40" |
| "\x4f\xf3\x25\xb2\x15\x4d\x12\xca\x6b\x9d\xe5\x59\xd2\x45\xdf\x03\x6a" |
| "\x27\x89\xa4\xd0\xda\x8a\xf1\xc7\x8b\x9e\xfe\x1a\xdc\x8d\x8b\x6c\x72" |
| "\x07\x68\x5c\x46\x52\xc2\x63\xaa\x13\x3a\x23\x81\xba\x37\x4a\xa2\x98" |
| "\xdd\xe6\x61\x0b\xcb\xd8\x31\xfd\x8f\x54\x11\xd7\xc9\x99\x7e\x42\x6b" |
| "\x2d\x02\x48\x59\x65\xc3\x0c\xb6\xc4\x11\xe5\x7d\xd4\x65\x34\xd3\x0b" |
| "\x09\xe4\xcd\xff\x51\x32\xfa\xa5\x31\x6e\xa1\x74\xfc\x06\x46\x27\xaa" |
| "\xa8\x8f\x42\xac\xa6\xca\x49\x35\xa1\x43\xeb\x6a\xf9\x73\x5b\x49\x0c" |
| "\xff\x36\x32\xc4\xee\x0f\xa3\x49\xbb\x70\xb1\x46\xcf\x47\xfc\xd7\xad" |
| "\x72\x2f\x6e\xbe\xef\xce\x38\xef\xf4\xc3\xf6\x88\x6d\x89\xbf\x12\x1c" |
| "\xb0\x18\x2a\x70\x73\xf8\x13\xe2\x48\x6c\xba\x9a\xf0\xf9\x80\xfb\x6c" |
| "\x20\x8f\x23\x35\xda\x46\x50\x1a\x81\xec\x99\x23\xbc\xcd\x8a\x91\x65" |
| "\xd9\xfa\x9c\x94\x7a\x62\xe9\xed\x76\xfb\x6b\xb6\x04\x6d\xfa\xb5\x43" |
| "\xa2\x58\x3d\xdc\x64\xbd\x5f\x0e\x12\xef\x14\x21\xf2\xfa\xa6\x18\x4a" |
| "\x52\x62\xb1\x39\x84\x4b\x89\x72\x49\x92\xbb\x1f\x9a\x5a\x67\x8b\x0c" |
| "\xdd\xa1\x57\xc9\x14\xbd\xe0\x94\x93\x98\x90\xba\xad\x53\xc3\x05\x6e" |
| "\x18\x66\x7a\x92\x38\x5c\xcb\xac\x22\x52\x9e\x55\x4f\x3b\x29\xe9\xd5" |
| "\xbf\xca\x74\xf0\xfd\x90\xc6\xe8\x33\x88\x72\x81\xd4\x2e\x77\xb4\xac" |
| "\x06\x10\x1f\x12\xc1\x10\x51\x7b\x29\x72\xd3\x44\x98\xb3\xb7\x84\xf7" |
| "\x5a\xe3\xd4\x21\xed\x6d\x65\x8a\x4a\xed\x35\xe1\x83\x37\xb8\x26\x33" |
| "\xbe\xd9\x18\xba\x18\x65\x9f\x69\x16\x7d\x52\xfd\x18\xa5\xb8\x33\x74" |
| "\x85\x29\xaf\x53\x02\x27\x6b\xd3\x28\x44\xd1\xfc\x02\x33\x60\xbd\x67" |
| "\xa8\x18\x4e\x27\xac\x25\xa0\x51\xa9\xd3\x9d\x07\xc7\x75\xd6\xd0\x52" |
| "\x6b\x9d\xf6\x77\x6c\x4f\x03\x18\xf5\x3e\xbb\x52\x8e\xe8\xa0\xb3\x88" |
| "\x5a\x9b\x1b\x83\x48\xb4\x4b\xe7\x4a\xb7\xae\xef\x16\x5a\x85\x52\xe6" |
| "\xe5\x00\xfe\x75\x16\xa1\xd2\xee\xe8\xf6\x6d\xf3\xc4\x47\x48\xfd\x4d" |
| "\x20\x3c\xea\x3b\x8c\xb0\x28\x30\xd6\x0a\xb1\xfe\x4d\x06\xa0\x67\xaa" |
| "\x88\x17\x5c\xd1\x0f\x4f\x78\xfd\xc8\xaa\x0f\x79\xe6\xd7\x66\x8e\x79" |
| "\x7c\x03\x5c\x03\x9c\xd7\x53\x5c\xec\xe8\xe1\x2d\xcd\x63\x21\xcc\xd3" |
| "\xd9\xa0\xf6\xff\xc4\xa8\x41\x2a\x16\x9e\xf2\xeb\x54\x0a\x12\xd6\xaf" |
| "\xf6\xbd\xe1\x7b\x1d\xd0\x21\xe5\xca\xba\xa5\xe7\x73\x56\x60\x64\x2d" |
| "\x19\x36\x12\x24\x69\x04\x70\xc7\xc1\x26\x3f\x42\x48\xf7\x54\x32\xae" |
| "\xc8\xa7\xaf\x17\x78\x99\x03\x8c\x22\xe8\x67\x72\x96\x3d\x41\x6b\xeb" |
| "\xc2\x6f\x40\x3e\x0a\xef\xf1\xcd\xf4\xdf\x85\x7d\xef\x3e\x14\xdd\xec" |
| "\xdc\x23\x9e\x6f\xf1\x52\x51\xfb\xa3\xb9\x45\x73\x40\x31\xf5\x19\xa2" |
| "\x9d\x83\xe9\x6d\x85\x2d\xa3\xd3\x78\x9b\xfe\xd2\x59\x1b\xa1\x44\xaa" |
| "\x25\xff\x2e\x0c\xce\x7e\x9f\x8a\x1e\x12\xac\x93\x4c\x0c\xca\x6b\x48" |
| "\xc1\x97\xf3\x1a\xf0\xe8\x80\x3d\x19\x07\x48\x3b\x24\x8b\xd7\x31\x98" |
| "\xf1\x9a\xdf\xd9\xc5\xab\x3f\x7d\xdf\x34\x3f\x0f\x0e\x2f\xd2\x1c\x22" |
| "\x15\xcf\x47\x09\xb2\x8f\xd1\xbe\x4f\x3f\xe0\x54\x2f\x75\x49\xab\x7f" |
| "\x61\x8b\x99\xab\xd8\x59\x8c\x15\x80\xc9\xf9\x1a\x1d\x18\xa3\xdf\xb8" |
| "\xa9\xf2\xb6\xc3\x87\xfc\x1e\xa7\x53\x1d\xca\x79\xfc\xa8\x14\x47\x4e" |
| "\x7f\x1a\xe1\x1b\xa9\x2d\x24\x24\x36\x1d\x31\x5c\xa6\xdc\x49\x4d\x0e" |
| "\x74\xd2\x4d\xfe\x15\xfa\xb9\x71\x71\x24\xf3\x1c\x79\x1d\x09\x2a\x7d" |
| "\x88\x1f\x4c\x17\x74\x4e\x1d\x22\xa4\xe8\xbf\x8e\xa0\xfc\xd2\xdf\xbc" |
| "\xa1\x12\x8f\xeb\xc2\xba\x30\xae\xb3\xd5\xb0\x0f\x9b\x6c\x34\x83\x4a" |
| "\xa7\x0a\xa0\x29\xe7\xd8\x6b\x12\xde\x4a\xb5\x12\x08\x03\x79\x96\x3f" |
| "\x73\x6a\x51\x94\x11\x02\x28\x2c\x94\x4b\xb7\xa5\x1b\x42\x94\xe9\xac" |
| "\x11\xb1\x94\x25\x13\xe4\x50\x07\xfa\x1d\x9d\xaa\x14\xee\x7b\x1e\xd0" |
| "\xa8\x21\x7e\x52\x2e\x1e\x10\xe4\xc8\x9a\xf7\xd0\xcf\x52\xf0\x4d\x62" |
| "\x37\x66\x95\xe8\x01\xad\x71\xeb\x56\x0a\x45\x52\x51\xe2\x89\xbe\x2e" |
| "\x60\x7e\x18\x7c\x05\x15\xe7\x50\x26\x3b\xa1\x6d\xea\xc0\x95\x33\x7c" |
| "\x06\xf0\xab\x50\x5f\x6c\xd4\xef\xc5\x48\xfc\x81\x52\x17\x80\xbb\x68" |
| "\xd9\x88\x7f\x27\xa2\x62\x69\x55\x6b\x90\xbc\xf4\x42\x34\xab\xea\xf2" |
| "\xa9\x43\x15\x09\x4c\x99\xef\xd8\x31\x96\xb8\x37\x6a\xf1\x04\xf4\x0a" |
| "\x90\x7a\x59\x91\xf6\xe8\x70\x54\xf5\x08\x66\x14\x13\x09\x8d\x03\xc3" |
| "\xe4\x01\xf5\xaf\x28\x2b\x57\xa5\xbb\x39\xfd\x6d\x9f\x46\xc7\xf6\xe1" |
| "\xdf\x14\xc5\xde\x08\x58\xf8\x21\xda\xb4\xdb\x31\x22\x14\xf6\x3b\xf4" |
| "\x74\x20\x6c\x8a\xee\x47\x34\xeb\x99\x0d\xed\x84\xc7\x43\xd2\xc1\xb9" |
| "\x5d\x78\xea\x42\x3c\xd1\x4c\x48\x5a\x11\xd7\x7c\x76\x14\x39\x8d\x73" |
| "\x32\xd4\x07\x97\xcf\x22\x3d\x33\x7d\x29\x3a\xa6\x73\xa0\xfb\x48\xf6" |
| "\x5d\x74\x00\x78\xe1\x30\xad\xf5\xf6\xfb\xd2\xfd\x30\xd7\x56\x70\x10" |
| "\xfa\xd0\x3a\x77\x34\x99\xd6\xb8\x18\x7e\xb1\x60\x9b\x1f\x60\x4b\xa5" |
| "\x8e\xeb\x67\x19\x3e\x21\x7b\x0e\x04\xfa\xda\x30\x21\x1e\x9e\x97\x85" |
| "\x84\x64\x0e\x81\x0e\xf4\x11\x1d\x6b\x1b\xea\x70\x84\xb5\xe4\x7b\xe2" |
| "\x78\xe9\x4b\x94\xf1\x21\x09\x64\xee\xda\x71\xa7\xc6\x8d\x33\x6c\x6b" |
| "\x33\x59\x4b\x60\xa2\xa7\x95\xe5\x41\xb6\x6f\x72\x6b\x87\xf4\xae\x27" |
| "\x32\xd1\x45\xd9\xa2\x45\x57\x30\x48\x7b\x6d\x50\x35\x92\x6f\xad\xac" |
| "\x16\x09\x7d\xce\x38\xc6\xdf\x6a\x2d\x07\xb4\xe7\x44\xc2\x58\xbf\xc5" |
| "\x57\xca\x56\x73\x06\x28\xdf\x59\x94\x80\x6e\xa8\xd1\x65\xd3\x1a\xdc" |
| "\x45\xfa\x3f\xb9\xc2\x91\x0c\x30\x0a\x26\xb0\x5b\xd5\xee\xdb\x71\x79" |
| "\x37\x33\x4d\xd1\x2d\xf5\xba\xca\x6f\x96\x4c\x10\x39\x12\x37\x9a\xd2" |
| "\x42\x84\x8b\x13\xc2\xd4\xbe\xa4\xb1\x86\xa4\x45\x2f\x37\x39\xe2\xe6" |
| "\xc9\x60\x52\xdf\xe6\x50\x94\x1d\xac\xb2\xe5\x73\x23\xbc\xf4\xd0\x01" |
| "\x9f\xb4\x9d\x4c\xbf\x2e\x57\x43\x1b\x6b\x29\x10\x99\x96\x8b\xdb\x73" |
| "\x48\x2e\x36\x3a\x82\x1d\x26\x7c\xbd\xa3\xbd\x56\xde\x02\xad\xe4\x65" |
| "\xcd\xbe\xea\x87\x60\xc8\x3d\x5b\x4c\x20\x08\xf3\x4f\x66\x56\xbe\xcf" |
| "\xf2\x7c\x1b\x54\x95\xab\xaa\xaa\x9d\x0a\x43\x21\x7d\x4b\xb9\x72\x1a" |
| "\x3e\x1f\xf4\x71\x95\x65\xf6\x7d\x94\x61\xcb\xc0\xd5\x6d\x6d\x5e\x61" |
| "\x9f\x48\x5d\xd8\x3d\x31\x3d\xf4\x2c\x0d\x25\x57\xb9\x40\x6a\xb6\x0c" |
| "\xd4\xa1\x87\xb2\x69\xce\x82\xb2\x1a\x3d\xfb\xa6\x12\x96\x45\xd0\x3e" |
| "\x9c\xa9\x98\xff\x69\xa1\x30\xa4\xd1\x23\x5e\xbc\x4f\xd0\x2d\x5c\x54" |
| "\x44\x9e\x6b\x29\xaa\x58\xb9\x9d\xe9\xbb\x4c\xae\xe6\xd5\xd8\x88\xbf" |
| "\x2a\x5a\xfd\xda\x25\x5a\xea\x73\x72\xdc\x64\x1a\x61\xe7\x27\x95\xc1" |
| "\x90\x66\x11\x78\xeb\xd6\x71\xf3\x58\xa8\x25\x84\x8f\x66\x40\xaa\xed" |
| "\xe4\x68\xaf\x1e\x0e\xfe\xf8\xaf\xab\x84\xce\xd0\xe0\x37\xfb\xbb\x1c" |
| "\x89\xb7\xe6\x95\xc3\x07\xe3\x5d\x12\x94\xe5\xde\xbb\x54\x06\x57\x77" |
| "\x8f\x1f\x84\x74\x0c\xcf\x62\xa4\x8a\x05\xca\xc8\x16\x29\xbd\x87\xf9" |
| "\x3f\x16\x74\x51\x5b\xbe\x56\x10\xbc\x31\x41\x0c\x1e\xb7\xb6\x60\x85" |
| "\x49\x33\xb5\xbe\x6f\xa3\x45\xd6\x52\x58\x9d\xd8\x1c\x66\xd2\xfd\x1c" |
| "\x9b\x8f\x8c\xce\xe3\x78\x66\xc1\x34\x1f\x60\x33\xa0\x14\xef\x1d\xd2" |
| "\x5c\xb9\x83\x2c\x42\xe8\x31\x39\x85\x4b\xa7\x81\x3b\xdf\xf7\x5d\x0d" |
| "\x91\x24\x63\xa6\xc1\x5d\x36\xdc\xa1\x14\x17\xea\xd2\x64\x2b\x35\xc6" |
| "\x28\xeb\x9d\xf6\x08\x70\xdc\xcc\xbf\x94\x46\x37\x95\x9d\xb8\x44\x61" |
| "\x61\x73\x0b\x8e\x7e\x83\xea\xbe\xc1\x67\x22\x85\x1d\x4d\x57\xaf\x9a" |
| "\x32\xec\x91\xb7\xea\x15\xae\xb4\x08\x65\x9b\x98\x89\x8e\x47\x01\x85" |
| "\x2f\x12\xd5\x05\xdc\xa4\x74\xf6\x52\x16\x85\xf1\x03\x87\x96\xbd\xb1" |
| "\x6f\x4a\x9e\x8e\xfa\x3b\x9f\x60\x7c\x28\x94\x6e\xb6\x1f\x0a\xa5\x90" |
| "\xed\x1a\x57\x84\xa8\x5c\xb8\x54\xbd\x49\x07\xf2\x3d\xd2\x3d\xf2\xc7" |
| "\xe0\xa6\x69\x02\xd5\xff\x8a\x0c\x91\x11\x73\xea\x9e\xc6\xf5\xa8\xa3" |
| "\xb5\xa2\x84\x7c\x94\xd6\x46\xf5\xa9\x3d\x23\x08\xfd\x79\xb1\xd4\x9c" |
| "\x0f\xed\xcc\x9e\xf9\x7f\xa5\xbe\x3c\xde\xf1\x3a\x03\x39\x82\x5b\x5e" |
| "\xc3\x1e\x9d\x28\x4b\x33\x7a\x4f\xe5\x07\x42\x0d\x11\x8c\x99\xe0\xfa" |
| "\xbc\xe7\x4f\xcc\xf0\x7a\x1f\x98\x36\xf9\xb3\x76\xdf\x20\xa7\x8b\xc0" |
| "\xbf\x1e\x81\xa1\x58\x0f\xa6\x9b\xd3\x14\xf1\x07\x64\xe9\x0e\x2a\x66" |
| "\xad\x29\x8c\x49\x3e\xdd\x4b\x17\x3c\x26\x72\x79\x1e\x16\xa5\x8b\xbf" |
| "\xae\xa7\xbf\x97\xf4\x93\xd3\x3b\xb0\x0f\x91\xd9\x6b\xd4\x62\xc1\x4b" |
| "\xc7\x16\x84\xf2\xc2\x8e\xf8\x6a\x4b\xbc\xe5\x7a\xc3\xc0\x6b\x0b\x1f" |
| "\xe2\x4f\xc8\x15\x2c\x66\xa3\x66\x13\xdb\xf6\xfe\xb4\x32\xb6\x0a\x1b" |
| "\x17\xbc\x08\x4a\xa8\xed\xe4\x00\x89\xb3\x65\x48\xd6\x49\x3a\x04\x03" |
| "\x8f\xb8\xb6\x26\xfa\xa7\x93\x83\x54\x4c\x42\x96\xce\x4c\x84\x91\x31" |
| "\xb8\x59\x68\x4f\x5b\xa7\x6b\x8c\xb6\xb6\x4a\x00\x65\x47\x78\xcf\x62" |
| "\x4e\x6c\x6d\x22\x26\xe5\x97\xc3\x5c\xa8\xd4\x55\xe3\x80\xa2\xea\x53" |
| "\x5d\x19\xf4\x3c\x99\x3e\x5d\x1c\xac\x36\x9a\xae\xac\xd6\x13\x7c\x3a" |
| "\xf6\xe4\x97\xec\xe6\x74\x1c\x8d\xc1\x2a\xa8\x68\x91\x85\x2f\x16\x30" |
| "\xf9\x1e\x9a\x95\x0f\xfa\x57\x44\x4c\xfc\xc8\x80\xbf\x40\x4e\xa8\x11" |
| "\x71\x38\x54\x9f\xba\x8f\x7c\x59\x8b\xee\x0d\x62\xa5\xa6\x11\xb1\x3e" |
| "\x3d\x3f\x92\x9d\xc2\x58\x3b\xf5\x8f\x6a\x3b\x45\x7e\xa2\xa5\xac\x06" |
| "\xb7\x7c\xbc\x87\xe3\x98\xe1\x60\x24\xbe\x90\x02\x37\x6c\x8a\x74\x06" |
| "\x55\xa7\x5a\xc2\xa8\x55\x94\x80\x7f\x5e\x8f\x74\x07\x46\x31\x1f\x77" |
| "\x96\x31\x12\xd9\x49\x7e\x94\x35\x01\x13\xbf\xdf\xeb\xcc\x99\x2c\x39" |
| "\x65\xa5\xd8\x37\xce\x0d\xae\x2b\x4e\x38\xe2\x8e\x03\xd5\xfc\x3a\x4f" |
| "\xc7\x92\x05\xd2\x2b\xd9\x72\x8f\x8f\xb6\x67\x08\x69\x8b\x59\xd7\xce" |
| "\x1a\x29\xbb\x0e\xf8\x8c\x57\x0e\x94\x09\x44\xde\xb9\xda\x34\xbc\x67" |
| "\xde\x39\x60\x85\x46\x6e\x73\xc2\x1e\xca\x3c\x7c\x47\xe7\xe7\x74\x7a" |
| "\xbf\x5d\x92\x5a\xa2\x45\xc6\x00\x66\x5b\xb0\x82\xe3\x65\xd6\x09\xe7" |
| "\x7b\xf5\x7a\xeb\x46\x5a\xdb\x34\x98\x44\x6a\x15\xf2\x87\xcf\xb0\xd3" |
| "\x19\xe9\x92\xed\x9b\x03\x29\xa7\x6c\xae\x13\x57\x92\x8a\xab\x1f\x91" |
| "\xc0\x85\x48\x0e\x36\x3d\xcf\x69\x28\x88\xde\x9b\x7d\xce\x1d\x99\xf3" |
| "\xc4\x3a\xe5\xb4\xd1\xe0\x75\xf2\xba\x64\x7a\xfb\x0f\x20\xe1\xa2\xfa" |
| "\xbd\xe0\xa2\x59\x53\x09\xf9\x3a\xdb\x19\xd9\x42\x9b\x7e\x17\xe7\x00" |
| "\x45\xa7\xd2\xa3\xfb\xaa\x92\xe0\xd2\x94\xfe\x4e\xaf\xd1\x15\x53\x84" |
| "\xb5\xe5\x2f\xa7\xb5\x40\x80\x80\xe0\x22\xac\xbf\xd1\xef\x45\xa0\xac" |
| "\x7a\xdd\xa0\x0f\xc5\x56\xc6\xf2\x14\x9a\x0f\xcb\x33\x99\xfa\x2a\x55" |
| "\x63\x70\xd0\x79\xd0\xea\x8a\x1f\x32\x62\xb0\x57\xe3\xdd\xd5\x8d\x49" |
| "\x06\xdf\xb3\xeb\xd4\x1c\x40\x33\x46\x75\x06\x32\x2a\xaa\xcb\xad\xb3" |
| "\x4d\xdd\x26\xbb\x17\x6d\x86\x91\xaf\xb3\xe8\x5b\xee\xd9\x99\x38\x26" |
| "\xb8\x0a\x64\x15\x16\xbf\x47\xb1\x65\xd1\x93\x40\x51\x22\x73\x24\x86" |
| "\x82\x42\xe1\xea\xd9\x6e\xe7\x83\x1c\x29\x97\x62\xc5\x50\xdb\x26\xc7" |
| "\x48\x3a\xc1\xf2\x08\xac\x03\x36\x2f\x3b\x95\x04\x9e\xd7\x5c\xd6\x15" |
| "\x77\x84\xd5\x33\x99\x37\x75\xd7\xac\x2c\xf5\xa3\x29\x70\x74\x30\xb3" |
| "\x57\x0a\x74\xcf\x80\x15\xbf\xe4\x17\x0c\xe7\x70\x30\x8b\x25\x6e\xfe" |
| "\x7a\x4f\x31\x2a\xfb\xd7\x33\x47\x09\xfa\x06\xb5\xdc\x09\x0b\xc2\x73" |
| "\x62\x11\x54\xde\xaa\x80\x7d\xec\x68\xd7\xba\x32\x3a\xe1\x53\xc0\x4b" |
| "\xf7\x64\xeb\x5c\xea\x2d\x3b\x83\x9b\xdf\x93\xfa\xb3\x39\xd6\x68\x42" |
| "\xe1\xa8\x3a\x6f\x68\x37\x29\x4c\x3c\xf5\x68\x7d\x8b\xc8\xd6\x08\x9c" |
| "\xa2\x51\x64\xf7\xa5\x96\xa0\xc7\x87\x5f\xaa\x0a\xfb\xf4\xe7\x66\x43" |
| "\xa8\xb1\x34\x89\x5a\x45\xab\xf8\x28\x4b\x64\x60\x9d\x1b\x3e\x37\x79" |
| "\x69\x4c\xa9\x8c\x4f\x8a\x95\x64\x00\x83\x0d\xff\x1c\xea\xe4\x82\x3a" |
| "\xea\xd7\xfa\x4c\x45\x60\x04\x73\xc8\x28\x16\x49\xc2\x17\x31\xe6\x10" |
| "\xca\x80\xfe\x92\xa3\x78\x53\x1c\xa4\x62\x78\xe0\x50\x01\x78\x6b\x9c" |
| "\x44\x5d\x23\x00\xe8\x9d\x9c\xff\x73\x94\x1d\x17\xa3\x63\xff\x6a\x67" |
| "\x42\xca\x36\xb2\xaa\x25\xcf\x2b\x38\xc0\x64\x26\x99\x2e\x6c\x36\xfa" |
| "\x7e\xf3\xff\xf3\x80\x51\x04\xc5\x54\x0b\x7e\x9a\xf8\xce\xde\xfa\x08" |
| "\x1f\x64\xa2\x06\xa8\x69\x70\x1e\xf0\xa6\x9e\x9e\xb7\x6d\xaa\x9d\xce" |
| "\x1c\xdd\xba\x41\x50\x97\x21\x0b\x7d\x60\x5b\x0d\x9a\xcf\xea\x36\x1f" |
| "\x93\x0b\xba\xd6\x47\x58\x17\x61\xa4\x45\x59\x2e\x08\xcf\x49\xac\xfe" |
| "\xc0\x05\x36\xc3\x07\x62\xa3\xc2\xba\x13\x47\x36\x38\xc2\x90\xf7\x9a" |
| "\xd8\xed\xde\xc1\xe1\x62\xe0\x9c\xd2\x62\xd1\xd4\xd0\x05\xc4\x1a\xbb" |
| "\x00\xb9\x20\xe8\xe8\xee\x5f\x36\xc7\x9d\x94\x21\x11\x74\x41\xd8\x07" |
| "\xba\x6a\x26\x09\x26\x26\xa9\x83\x6b\x83\x54\x0d\xb9\x10\xcc\x31\x0a" |
| "\x87\xa7\xa9\xa0\xcb\x19\xb9\x0c\xb1\x13\xfe\x4f\xf9\x81\x42\xc1\x4f" |
| "\xf6\x7d\x85\xfc\x3b\x0f\xab\x93\x4f\x56\x10\x7e\x24\xe4\x87\xd5\x01" |
| "\x46\xd1\x59\xa0\x37\x6d\x9d\x3d\x82\xd4\x6a\xf5\x21\x22\x64\x4d\x6e" |
| "\xb7\x39\xb6\xd1\x14\x2e\x26\x12\x32\x1e\x1c\x00\xc4\x57\xd0\x98\x53" |
| "\x1a\x5f\xca\xb5\xb1\xbf\x5c\x14\x93\xaa\xca\x10\x07\xa2\xb9\x8a", |
| 4096); |
| memcpy((void*)0x200018a9, |
| "\xba\xd9\xab\x7d\xbb\xee\x9b\xbb\x4a\x79\x26\xf8\xd3\x1c\x66\x47" |
| "\xd7\x3d\xf6\x95\xe6\xeb\x4c\xd0\x88\xe8\xa1\xcd\x89\x93\xa6\x20" |
| "\xa7\xc3\x4a\x17\xd5\x56\xe4\xa0\x1b\x7d\x61\x11\xa1\x76\xce\x7c" |
| "\xfc\x51\x45\xe5\x14\x8e\x8f\x1c\x37\x5e\x4e\x35\xd3\xfd\x69\x9f" |
| "\x58\xcb\xf3\xaa\x83\xd5\x68\x59\xc0\x53\xfc\xc6\x33\xe7\xa4\x97" |
| "\x20\x96\x72\xeb\x5c\x10\x01\xb6\x56\xc9\x4b\xb5\x48\x0d\x0e\x5b" |
| "\x78\xf6\xa6\x4d\x8d\x1a\x9c\x69\x8a\x2f\xb3\x05\x3b\x3d\x7e\x7f" |
| "\xe6\x13\x33\x5e\xc2\xbd\x07\xb7\x9c\x94\x9a\xa3\xf5\xe5\x2d\x38" |
| "\xce\xb9\x7a\xa4\x7b\xd1\x08\xbf\x71\xfa\xeb\x78\xc5\xa6\xed\xad" |
| "\x88\x98\x1d\x0a\xc7\xb6\x23\x67\x03\xf0\x4f\x24\x7d\xf3\xfe\x0e" |
| "\x24\x73\xa9\x98\x96\x49\x75\x71\x3f\x30\x42\xd3\x36\x1c\xc9\xd3" |
| "\xf3\xe0\xb4\x07\x65\xc3\x85\x9b\xb1\x1f\x47\x8b\xc0\xad\xb2\x89" |
| "\xea\x97\xd7", |
| 195); |
| sprintf((char*)0x2000196c, "0x%016llx", (long long)r[0]); |
| sprintf((char*)0x2000197e, "%023llo", (long long)r[0]); |
| *(uint64_t*)0x20001995 = 0; |
| sprintf((char*)0x2000066b, "%023llo", (long long)0); |
| *(uint64_t*)0x20000682 = 0; |
| sprintf((char*)0x2000068a, "0x%016llx", (long long)-1); |
| syscall(__NR_ioctl, r[1], 0x40085203, 0x20000640); |
| break; |
| case 3: |
| *(uint32_t*)0x20000040 = 0; |
| *(uint32_t*)0x20000044 = 0; |
| *(uint32_t*)0x20000048 = 0; |
| *(uint32_t*)0x2000004c = 0; |
| *(uint8_t*)0x20000050 = 0; |
| *(uint8_t*)0x20000051 = 0; |
| *(uint8_t*)0x20000052 = 0; |
| *(uint8_t*)0x20000053 = 0; |
| *(uint32_t*)0x20000054 = 0; |
| *(uint32_t*)0x20000058 = 0; |
| *(uint32_t*)0x2000005c = 0; |
| *(uint32_t*)0x20000060 = 0; |
| syscall(__NR_ioctl, r[0], 0x40045431, 0x20000040); |
| break; |
| case 4: |
| res = syz_open_pts(r[0], 0); |
| if (res != -1) |
| r[2] = res; |
| break; |
| case 5: |
| memcpy((void*)0x200000c0, "/dev/vcs#\x00", 10); |
| syz_open_dev(0x200000c0, 1, 0x200200); |
| break; |
| case 6: |
| syscall(__NR_bpf, 0x11, 0, 0); |
| break; |
| case 7: |
| *(uint32_t*)0x200001c0 = 7; |
| syscall(__NR_ioctl, r[2], 0x5423, 0x200001c0); |
| break; |
| case 8: |
| syscall(__NR_write, r[0], 0x200000c0, 0xffa8); |
| break; |
| case 9: |
| *(uint32_t*)0x20000000 = 0xfdfdffff; |
| *(uint32_t*)0x20000004 = 0; |
| *(uint32_t*)0x20000008 = 0; |
| *(uint32_t*)0x2000000c = 0; |
| *(uint8_t*)0x20000010 = 0; |
| *(uint8_t*)0x20000011 = 0; |
| *(uint8_t*)0x20000012 = 0; |
| *(uint8_t*)0x20000013 = 0; |
| *(uint32_t*)0x20000014 = 0; |
| *(uint32_t*)0x20000018 = 0; |
| *(uint32_t*)0x2000001c = 0; |
| *(uint32_t*)0x20000020 = 0; |
| syscall(__NR_ioctl, r[2], 0x5412, 0x20000000); |
| break; |
| } |
| } |
| int main(void) |
| { |
| syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); |
| do_sandbox_none(); |
| return 0; |
| } |
