sys/linux: update asset storage for new `syz_mount_image`

Asset storage is now significantly simpler: we just take the
Base64-encoded, compressed image and output it to a file. There is a
slight overhead in that we decompress from the `zlib` format and
re-compress to the `gzip` format.

This commit removes most of the logic from `init_images.go`,
and therefore most of the tests from `init_images_test.go`.
We could instead keep this logic around and use it to adapt old-style
`syz_mount_image` calls in existing corpuses to match the new format.

4 files changed, 50 insertions, 265 deletions

diff --git a/sys/linux/init_images.go b/sys/linux/init_images.go
index e160234d9..97175cb84 100644
--- a/sys/linux/init_images.go
+++ b/sys/linux/init_images.go
@@ -7,129 +7,28 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"sort"
 
 	"github.com/google/syzkaller/prog"
 )
 
 func (arch *arch) extractSyzMountImage(c *prog.Call) (io.Reader, error) {
-	// In order to reduce the size of syzlang programs, disk imags are de facto compressed.
-	// Here we do the uncompression.
+	// In order to reduce the size of syzlang programs, disk images are compressed.
+	// Here we extract the compressed image.
 	if c.Meta.CallName != "syz_mount_image" {
 		return nil, nil
 	}
-	ret, err := parseSyzMountImage(c)
+	data, _, err := parseSyzMountImage(c)
 	if err != nil {
 		// Parsing failed --> do not try to recover, just ignore.
 		return nil, err
-	} else if len(ret.segments) == 0 {
+	} else if len(data) == 0 {
 		return nil, fmt.Errorf("an empty image")
 	}
-	readers := []io.Reader{}
-	nextPos := 0
-	// Add fake zero readers between segments, so that we can combine them to read the whole image.
-	for _, segment := range ret.segments {
-		offset := int(segment.offset.Val)
-		if offset > nextPos {
-			readers = append(readers, &zeroReader{left: offset - nextPos})
-		}
-		size := int(segment.size.Val)
-		readers = append(readers, bytes.NewReader(segment.data.Data()[0:size]))
-		nextPos = offset + size
-	}
-	if int(ret.size.Val) > nextPos {
-		readers = append(readers, &zeroReader{left: int(ret.size.Val) - nextPos})
-	}
-	return io.MultiReader(readers...), nil
-}
-
-type zeroReader struct {
-	left int
-}
-
-func (zr *zeroReader) Read(p []byte) (n int, err error) {
-	if zr.left == 0 {
-		return 0, io.EOF
-	}
-	toRead := zr.left
-	if toRead > len(p) {
-		toRead = len(p)
-	}
-	for i := 0; i < toRead; i++ {
-		p[i] = 0
-	}
-	zr.left -= toRead
-	return toRead, nil
-}
-
-const imageMaxSize = 129 << 20
-
-func fixUpImageSegments(parsed *mountImageArgs, fixStructure bool) error {
-	const maxImageSegments = 16784
-	err := parsed.filterSegments(func(i int, segment *mountImageSegment) bool {
-		if i >= maxImageSegments {
-			// We don't want more than maxImageSegments segments.
-			return false
-		}
-		if segment.parseError != nil {
-			// Delete mangled segment structures.
-			return false
-		}
-		return segment.offset.Val < imageMaxSize && segment.size.Val < imageMaxSize
-	}, !fixStructure)
+	decompressedData, err := prog.Decompress(data)
 	if err != nil {
-		return err
-	}
-	// Overwriting of the image multiple times is not efficient and complicates image extraction in Go.
-	// So let's make segments non-overlapping.
-	if fixStructure {
-		sort.Stable(parsed)
-	} else if !sort.IsSorted(parsed) {
-		return fmt.Errorf("segments are not sorted")
-	}
-
-	newSize := parsed.size.Val
-	if newSize > imageMaxSize {
-		newSize = imageMaxSize
-	}
-
-	for idx, segment := range parsed.segments {
-		actualSize := uint64(len(segment.data.Data()))
-		if segment.size.Val != actualSize {
-			segment.size.Val = actualSize
-		}
-		if idx > 0 {
-			// Adjust the end of the previous segment.
-			prevSegment := parsed.segments[idx-1]
-			if prevSegment.offset.Val+prevSegment.size.Val > segment.offset.Val {
-				if fixStructure {
-					prevSegment.resize(segment.offset.Val - prevSegment.offset.Val)
-				} else {
-					return fmt.Errorf("segment %d has invalid size", idx-1)
-				}
-			}
-		}
-		if segment.offset.Val+segment.size.Val > imageMaxSize {
-			if fixStructure {
-				segment.resize(imageMaxSize - segment.offset.Val)
-			} else {
-				return fmt.Errorf("segment %d has invalid size", idx)
-			}
-		}
-		if segment.offset.Val+segment.size.Val > newSize {
-			newSize = segment.offset.Val + segment.size.Val
-		}
-	}
-	if newSize > imageMaxSize {
-		// Assert that the logic above is not broken.
-		panic("newSize > imageMaxSize")
+		return nil, err
 	}
-	parsed.size.Val = newSize
-
-	// Drop 0-size segments.
-	return parsed.filterSegments(func(i int, segment *mountImageSegment) bool {
-		return segment.size.Val > 0
-	}, !fixStructure)
+	return bytes.NewReader(decompressedData), nil
 }
 
 func (arch *arch) fixUpSyzMountImage(c *prog.Call, fixStructure bool) error {
@@ -138,7 +37,8 @@ func (arch *arch) fixUpSyzMountImage(c *prog.Call, fixStructure bool) error {
 	// 1) It further complicates the already complicated executor code.
 	// 2) We'd need to duplicate the logic in Go for raw image extraction.
 	// So now we do all the initialization in Go and let the C code only interpret the commands.
-	ret, err := parseSyzMountImage(c)
+	data, compressedSizeArg, err := parseSyzMountImage(c)
+	compressedSizeArg.Val = uint64(len(data))
 	if err != nil {
 		if fixStructure {
 			deactivateSyzMountImage(c)
@@ -146,124 +46,49 @@ func (arch *arch) fixUpSyzMountImage(c *prog.Call, fixStructure bool) error {
 		}
 		return err
 	}
-	return fixUpImageSegments(ret, fixStructure)
-}
-
-type mountImageArgs struct {
-	size          *prog.ConstArg
-	segmentsCount *prog.ConstArg
-	segmentsGroup *prog.GroupArg
-	segments      []*mountImageSegment
-}
-
-func (m *mountImageArgs) filterSegments(filter func(int, *mountImageSegment) bool, failOnRemove bool) error {
-	newArgs := []prog.Arg{}
-	newSegments := []*mountImageSegment{}
-	for i, segment := range m.segments {
-		if filter(i, segment) {
-			newSegments = append(newSegments, segment)
-			newArgs = append(newArgs, m.segmentsGroup.Inner[i])
-		} else if failOnRemove {
-			return fmt.Errorf("segment #%d got filtered out", i)
-		}
-	}
-	m.segments = newSegments
-	m.segmentsGroup.Inner = newArgs
-	m.segmentsCount.Val = uint64(len(newArgs))
 	return nil
 }
 
-// Methods for segment sorting.
-func (m *mountImageArgs) Len() int { return len(m.segments) }
-func (m *mountImageArgs) Swap(i, j int) {
-	inner := m.segmentsGroup.Inner
-	inner[i], inner[j] = inner[j], inner[i]
-	m.segments[i], m.segments[j] = m.segments[j], m.segments[i]
-}
-func (m *mountImageArgs) Less(i, j int) bool {
-	if m.segments[i].offset.Val != m.segments[j].offset.Val {
-		return m.segments[i].offset.Val < m.segments[j].offset.Val
-	}
-	return m.segments[i].size.Val < m.segments[j].size.Val
-}
-
-type mountImageSegment struct {
-	data       *prog.DataArg
-	offset     *prog.ConstArg
-	size       *prog.ConstArg
-	parseError error
-}
-
-func (s *mountImageSegment) resize(newSize uint64) {
-	s.size.Val = newSize
-	s.data.SetData(s.data.Data()[0:newSize])
-}
-
-func parseImageSegment(segmentArg prog.Arg) *mountImageSegment {
-	ret := &mountImageSegment{}
-	segmentFields, ok := segmentArg.(*prog.GroupArg)
-	if segmentFields == nil || !ok {
-		return &mountImageSegment{parseError: fmt.Errorf("it is not a group")}
-	}
-	if len(segmentFields.Inner) != 3 {
-		return &mountImageSegment{parseError: fmt.Errorf("invalid number of nested fields")}
-	}
-	dataPtr, ok := segmentFields.Inner[0].(*prog.PointerArg)
-	if dataPtr == nil || dataPtr.Res == nil || !ok {
-		return &mountImageSegment{parseError: fmt.Errorf("invalid data field ptr")}
-	}
-	ret.data, ok = dataPtr.Res.(*prog.DataArg)
-	if ret.data == nil || !ok {
-		return &mountImageSegment{parseError: fmt.Errorf("invalid data arg")}
-	}
-	ret.size, ok = segmentFields.Inner[1].(*prog.ConstArg)
-	if ret.size == nil || !ok {
-		return &mountImageSegment{parseError: fmt.Errorf("invalid size arg")}
-	}
-	ret.offset, ok = segmentFields.Inner[2].(*prog.ConstArg)
-	if ret.offset == nil || !ok {
-		return &mountImageSegment{parseError: fmt.Errorf("invalid offset arg")}
-	}
-	return ret
-}
-
 func deactivateSyzMountImage(c *prog.Call) {
-	groupArg := c.Args[4]
-	newArg := groupArg.Type().DefaultArg(groupArg.Dir())
-	prog.RemoveArg(groupArg)
-	c.Args[4] = newArg
-	// Also set the segments count field to 0.
+	dataPointer := c.Args[7]
+	newArg := dataPointer.Type().DefaultArg(dataPointer.Dir())
+	prog.RemoveArg(dataPointer)
+	c.Args[7] = newArg
+	// Also set the size fields to 0.
+	c.Args[2].(*prog.ConstArg).Val = 0
 	c.Args[3].(*prog.ConstArg).Val = 0
 }
 
-func parseSyzMountImage(c *prog.Call) (*mountImageArgs, error) {
-	if len(c.Args) < 5 {
+// Returns the compressed disk image and the corresponding length argument.
+func parseSyzMountImage(c *prog.Call) ([]byte, *prog.ConstArg, error) {
+	if len(c.Args) < 8 {
 		panic("invalid number of arguments in syz_mount_image")
 	}
-	segmentsCountArg, ok := c.Args[3].(*prog.ConstArg)
-	if !ok {
-		panic("syz_mount_image's segment count was expected to be const")
-	}
-	sizeArg, ok := c.Args[2].(*prog.ConstArg)
+
+	// Check `size` argument.
+	_, ok := c.Args[2].(*prog.ConstArg)
 	if !ok {
 		panic("syz_mount_image's size arg is not const")
 	}
-	segmentsPtrArg, ok := c.Args[4].(*prog.PointerArg)
+
+	// Check `size_compressed` argument.
+	compressedSizeArg, ok := c.Args[3].(*prog.ConstArg)
 	if !ok {
-		return nil, fmt.Errorf("invalid segments arg")
+		panic("syz_mount_image's compressed size arg is not const")
 	}
-	segmentsGroup, ok := segmentsPtrArg.Res.(*prog.GroupArg)
-	if segmentsGroup == nil || !ok {
-		return nil, fmt.Errorf("segments are not a group")
+
+	dataPointer, ok := c.Args[7].(*prog.PointerArg)
+	if !ok {
+		panic("syz_mount_image's data pointer is invalid")
 	}
-	ret := &mountImageArgs{
-		segmentsCount: segmentsCountArg,
-		segmentsGroup: segmentsGroup,
-		size:          sizeArg,
+
+	dataArg, ok := dataPointer.Res.(*prog.DataArg)
+	if !ok {
+		return nil, compressedSizeArg, fmt.Errorf("could not find raw image data")
 	}
-	for _, segmentArg := range segmentsGroup.Inner {
-		parsed := parseImageSegment(segmentArg)
-		ret.segments = append(ret.segments, parsed)
+	if dataArg == nil {
+		return nil, compressedSizeArg, fmt.Errorf("image argument contains no data")
 	}
-	return ret, nil
+
+	return dataArg.Data(), compressedSizeArg, nil
 }
diff --git a/sys/linux/init_images_test.go b/sys/linux/init_images_test.go
index 1da41276e..c5b93c4be 100644
--- a/sys/linux/init_images_test.go
+++ b/sys/linux/init_images_test.go
@@ -7,14 +7,12 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"reflect"
 	"sort"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/google/syzkaller/pkg/osutil"
 	"github.com/google/syzkaller/prog"
@@ -22,30 +20,24 @@ import (
 )
 
 // nolint: lll
+
 func TestSyzMountImageNeutralize(t *testing.T) {
 	prog.TestDeserializeHelper(t, targets.Linux, targets.AMD64, nil, []prog.DeserializeTest{
 		{
 			// A valid call, nothing should change.
-			In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40, 0x0}, {&(0x7f0000010040)="0200000011000000140000001f22000002000000ed4100000000000001000000020000005ffb19635ffb19635ffb196300"/64, 0x40, 0x200}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`,
+			In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', ` +
+				`0xdeadbeef, 0x15, 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0, ` +
+				`&(0x7f0000000200)="$eJwqrqzKTszJSS0CBAAA//8TyQPi")`,
 		},
 		{
-			// Invalid total size.
-			In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file1\x00', 0x20, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40, 0x0}, {&(0x7f0000010040)="0200000011000000140000001f22000002000000ed4100000000000001000000020000005ffb19635ffb19635ffb196300"/64, 0x40, 0x200}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`,
+			// Invalid compressed size.
+			In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', ` +
+				`0xdeadbeef, 0xdeadbeef, 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0, ` +
+				`&(0x7f0000000200)="$eJwqrqzKTszJSS0CBAAA//8TyQPi")`,
 			// It should be able to fix up the size.
-			Out: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file1\x00', 0x240, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40, 0x0}, {&(0x7f0000010040)="0200000011000000140000001f22000002000000ed4100000000000001000000020000005ffb19635ffb19635ffb196300"/64, 0x40, 0x200}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`,
-		},
-		{
-			// Invalid offset.
-			In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file1\x00', 0x20, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40, 0x0}, {&(0x7f0000010040)="0200000011000000140000001f22000002000000ed4100000000000001000000020000005ffb19635ffb19635ffb196300"/64, 0x40, 0x9100000}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`,
-			// The segment is deleted.
-			Out:       `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file1\x00', 0x40, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40, 0x0}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`,
-			StrictErr: `got filtered out`,
-		},
-		{
-			// Overlapping and unsorted segments.
-			In:        `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="cafef00d"/64, 0x50, 0x20}, {&(0x7f0000010040)="deadbeef"/64, 0x30, 0x10}, {&(0x7f0000010080)="abcdef"/64, 0x40, 0x20}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`,
-			Out:       `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x2, &(0x7f0000000200)=[{&(0x7f0000010040)="deadbeef00"/16, 0x10, 0x10}, {&(0x7f0000010000)="cafef00d00"/64, 0x40, 0x20}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`,
-			StrictErr: `segments are not sorted`,
+			Out: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', ` +
+				`0xdeadbeef, 0x15, 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0, ` +
+				`&(0x7f0000000200)="$eJwqrqzKTszJSS0CBAAA//8TyQPi")`,
 		},
 	})
 }
@@ -120,35 +112,3 @@ func TestExtractSyzMountImage(t *testing.T) {
 		t.Fatalf("all out files: %v\ntested files: %v", allOutFiles, testedOutFiles)
 	}
 }
-
-// nolint: lll
-func TestSyzMountImageMutation(t *testing.T) {
-	// We cannot unfortunately just import InitTest from prog.
-	rs := rand.NewSource(time.Now().UnixNano())
-	iters := 100
-	target, err := prog.GetTarget("linux", "amd64")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var p *prog.Prog
-	var ct *prog.ChoiceTable
-
-	const mutateCount = 1000
-	const baseProg = `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x2, &(0x7f0000000200)=[{&(0x7f0000010040)="deadbeef00"/16, 0x10, 0x10}, {&(0x7f0000010000)="cafef00d00"/64, 0x40, 0x20}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`
-
-	for i := 0; i < iters; i++ {
-		if i%mutateCount == 0 {
-			var err error
-			p, err = target.Deserialize([]byte(baseProg), prog.NonStrict)
-			if err != nil {
-				t.Fatal(err)
-			}
-			ct = target.DefaultChoiceTable()
-		}
-		p.Mutate(rs, 1, ct, nil, nil)
-		// We only call the extraction code and do mutations to catch possible panics.
-		// It is absolutely normal for syzkaller to mutate the call to the level when the image can no longer be extracted.
-		p.Target.ExtractMountedImage(p.Calls[0])
-	}
-}
diff --git a/sys/linux/testdata/fs_images/0.in b/sys/linux/testdata/fs_images/0.in
index 7080226a0..cf6583c43 100644
--- a/sys/linux/testdata/fs_images/0.in
+++ b/sys/linux/testdata/fs_images/0.in
@@ -1 +1 @@
-syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x2, &(0x7f0000000200)=[{&(0x7f0000010040)="deadbeef00"/16, 0x10, 0x10}, {&(0x7f0000010000)="cafef00d00"/64, 0x40, 0x20}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)
\ No newline at end of file
+syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x46, 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0, &(0x7f0000000200)="$eJzsykEJACAABEEL2D+FFQxgCCtoAvEr10CY+S1sCbP19fY4u+YDAAAAAAAAAMA/bgAAAP//84oF/g==")
diff --git a/sys/linux/testdata/fs_images/1.in b/sys/linux/testdata/fs_images/1.in
index 3d9d3e222..15ec4c2c8 100644
--- a/sys/linux/testdata/fs_images/1.in
+++ b/sys/linux/testdata/fs_images/1.in
@@ -1 +1 @@
-syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x2a, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000000100000c000000ce0000000f00000001000000000000000000000000200000002000002000000067fb196367fb19630100ffff53ef01000100000067fb1963000000000000000001000000000000000b000000800000000800000052470000620100000000000000000000000000000000000073797a6b616c6c6572000000000000002f746d702f73797a2d696d61676567656e333234303537373133330000000000000000000000000000000000000000000000000000000000", 0xc0, 0x400}, {&(0x7f00000100c0)="0000000000000000000000009bbd22de26804913867de6e04e8059bc010000000c0000000000000067fb19630000000000000000000000000000000000000000", 0x40, 0x4e0}, {&(0x7f0000010100)="0100000000000500110000000000000000000000040000003c00000000000000", 0x20, 0x560}, {&(0x7f0000010120)="0300000004000000090000000000000000000000000000000000000000000000", 0x20, 0x640}, {&(0x7f0000010140)="030000001300000023000000ce000f0003000400000000000000000000000000", 0x20, 0x800}, {&(0x7f0000010160)="fffffffffcff0700000000000000000000000000000000000000000000000080ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff020000000c0001022e000000020000000c0002022e2e00000b00000014000a026c6f73742b666f756e6400000c0000001000050266696c65300000000f0000001000050166696c6531000000100000001000050166696c6532000000100000001000050166696c6533000000110000009403090166696c652e636f6c64000000", 0x480, 0xc00}, {&(0x7f00000105e0)="0b0000000c0001022e00000002000000f40302022e2e00000000000000000000", 0x20, 0x1400}, {&(0x7f0000010600)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x1800}, {&(0x7f0000010620)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x1c00}, {&(0x7f0000010640)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x2000}, {&(0x7f0000010660)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x2400}, {&(0x7f0000010680)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x2800}, {&(0x7f00000106a0)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x2c00}, {&(0x7f00000106c0)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x3000}, {&(0x7f00000106e0)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x3400}, {&(0x7f0000010700)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x3800}, {&(0x7f0000010720)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x3c00}, {&(0x7f0000010740)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x4000}, {&(0x7f0000010760)="504d4d00504d4dff67fb1963000000006872757476696b2e632e676f6f676c6572732e636f6d0000000000000000000000000000000000000000000000000000000000000000000000000000000000006c6f6f7032310075782f746573742f73797a5f6d6f756e745f696d6167655f6505000000000000000000000000000000", 0x80, 0x4400}, {&(0x7f00000107e0)="111fc0d901000000803a0900803a090000000000060000000000000005000000", 0x20, 0x4800}, {&(0x7f0000010800)="ffff0100ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0300000000000000000000000000000000000000000000000000000000000000", 0x420, 0x4c00}, {&(0x7f0000010c20)="0400000000000000000000000000000000000000000000000000000000000000", 0x20, 0x5400}, {&(0x7f0000010c40)="0500000000000000000000000000000000000000000000000000000000000000", 0x20, 0x5800}, {&(0x7f0000010c60)="000000000000000001000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000", 0x60, 0x5c00}, {&(0x7f0000010cc0)="0200000000000000000000000000000000000000000000000000000000000000", 0x20, 0x6000}, {&(0x7f0000010ce0)="2719c0d901000000803a0900803a090000000000060000000000000005000000", 0x20, 0x6400}, {&(0x7f0000010d00)="0300000000000000000000000000000000000000000000000000000000000000", 0x20, 0x6800}, {&(0x7f0000010d20)="0400000000000000000000000000000000000000000000000000000000000000", 0x20, 0x6c00}, {&(0x7f0000010d40)="0500000000000000000000000000000000000000000000000000000000000000", 0x20, 0x7000}, {&(0x7f0000010d60)="000000000000000001000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000", 0x60, 0x7400}, {&(0x7f0000010dc0)="0200000000000000000000000000000000000000000000000000000000000000", 0x20, 0x7800}, {&(0x7f0000010de0)="0c0000000c0001022e000000020000000c0002022e2e00000d0000001000050166696c65300000000e000000d803050766696c65310000000000000000000000", 0x40, 0x7c00}, {&(0x7f0000010e20)="000002ea0100000001000000270f240c000000000000000000000000000000000601f8030000000006000000779b539778617474723100000601f003000000000600000074985397786174747232000000000000000000000000000000000000", 0x60, 0x8000}, {&(0x7f0000010e80)="0000000000000000000000000000000078617474723200007861747472310000", 0x20, 0x83e0}, {&(0x7f0000010ea0)="000000000000000067fb196367fb196367fb1963000000000000000000000000", 0x20, 0x8c00}, {&(0x7f0000010ec0)="ed4100000004000067fb196367fb196367fb196300000000000004000200000000000800050000000af301000400000000000000000000000100000004000000", 0x40, 0x8c80}, {&(0x7f0000010f00)="808100000018000067fb196367fb196367fb196300000000000001000c00000010000800000000000af30300040000000000000000000000010000001200000001000000010000001800000002000000040000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000808100000018000067fb196367fb196367fb196300000000000001000c00000010000800000000000af30300040000000000000000000000010000001900000001000000010000001e00000002000000040000001a0000000000000000000000", 0xe0, 0x8d00}, {&(0x7f0000010fe0)="c04100000030000067fb196367fb196367fb196300000000000002001800000000000800000000000af301000400000000000000000000000c00000005000000", 0x40, 0x9100}, {&(0x7f0000011020)="ed4100000004000067fb196367fb196367fb196300000000000002000200000000000800030000000af30100040000000000000000000000010000001f000000000000000000000000000000000000000000000000000000000000000000000000000000a6b0039d000000000000000000000000000000000000000000000000ed8100001a04000067fb196367fb196367fb196300000000000001000400000000000800010000000af3010004000000000000000000000002000000270000000000000000000000000000000000000000000000000000000000000000000000000000005109c476000000000000000000000000000000000000000000000000ffa100002700000067fb196367fb196367fb196300000000000001000000000000000000010000002f746d702f73797a2d696d61676567656e333234303537373133332f66696c65302f66696c653000000000000000000000000000000000000000000047fa2223000000000000000000000000000000000000000000000000ed8100000a00000067fb196367fb196367fb196300000000000001000400000000000800010000000af301000400000000000000000000000100000029000000000000000000000000000000000000000000000000000000000000000000000000000000d10ea931200000000000000000000000000000000000000000000000ed8100002823000067fb196367fb196367fb196300000000000002001200000000000800010000000af30100040000000000000000000000090000002a0000000000000000000000000000000000000000000000000000000000000000000000000000006077b616000000000000000000000000000000000000000000000000ed8100006400000067fb196367fb196367fb196300000000000001000200000000000800010000000af3010004000000000000000000000001000000330000000000000000000000000000000000000000000000000000000000000000000000000000003ffd7303000000000000000000000000000000000000000000000000", 0x300, 0x9180}, {&(0x7f0000011320)="73797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c000000000000", 0x420, 0x9c00}, {&(0x7f0000011740)="73797a6b616c6c65727300000000000000000000000000000000000000000000", 0x20, 0xa400}, {&(0x7f0000011760)="73797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c65727300000000000000000000000000000000000000000000000000000000", 0x80, 0xcc00}], 0x0, &(0x7f00000117e0))
\ No newline at end of file
+syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x4a0, 0x0, &(0x7f00000117e0), 0x0, &(0x7f0000000200)="$eJzs3c1rXFUbAPDnzjRtkubt54uYLmxpxfpBM/loCYggroqLitqVqxrTaSydZEJm0jYBId34FwgKxYUbwZ0rVwpduBbc6UZcuRBEoS7EKiP3zkyarwmjphnJ/f3gds69ZzrPORmew5lz78wNILdOpf8kEUMR8VVEHG7urn/CqebDzIPh6XRLotG4/HOSPS/dbz+1/f8ORsRKRPRHxOsXI95KNsetLS3fmKpUygut/VJ9dr5UW1o+d312aqY8U56bGD8/emFycmxiYsf6eveL0989tfLy8Xff+eH7V1be+Dxt1lCrbm0/dlKz631xdM2xfRHxwqMI1gPFVn8Get0Q/pH0/TseEWey/D8cxezdBPKg0Wg0/mgc6FS90gD2rEI2B04KIxHRLBcKIyPNOfz/Y7BQqdbqz12rLs5dbc6Vj0Rf4dr1Snm09VnhSPQl6f5YVn64P75hP53Fp3Pg94oD2f7IdLVydXeHOmCDgxvy/9diM/+BnPCRH/JL/kN+yX/IL/kP+SX/Ib/kP+SX/If8kv+QX/If8kv+Q37Jf8ilVy9dSrdG+/vvby8s1m9evzEyPTJTrc5Uygu1kenqbPevV6lW58fHYvF2qV6u1Uu1peUrs9XFufqV7Hv9V8p9j7AvwN9z9OS9b5OIWHl+INtS+1t1chX2tkYjiV5/BxnojWKvByCgZyz9QX75jA9s8RO96/R3qpjf+bYAu6PQ6wYAPXN22Pk/yCvr/5Bf1v8hv8zxAev/kD/W/yG/hjrc/+t/a+7dNRoRhyLim2Lfgfa9voC9oPBj0pr/nz385NDG2v3Jb9kpgv0Rcevu5fdvT9XrC2Pp8V9Wj9c/aB0f70X7gW6187SdxwBAfs08GJ5ub7sZ96eXmhchbI6/r7U22Z+doxy8n6y7ViHZoWsXVu5ExONbxU9a9ztvnvkYvF/cFP9Y6zFpvkTW3n3ZfdN3J/7wmvhPrIl/4l//VSAf7qXjz+hW+VfIcjpW82/9+DO0Q9dOdB7/CqvjX7HD+Heyyxgff1r8sGP8OxEntozfjtefxdoYP23b2S7jvzbw5c1OdY2Pmq+zVfy2tFSqz86XakvL57LfkZspz02Mnx+9MDk5NjFRytaoS+2V6s0u/n76zHb9H+wQf7v+p8ee6bL/Xx/6ZOzUNvGfPrP1+39sm/gDEfFsl/HfvPXZY53q0vhXO/S/sE389NhEl/Ff/LPmMmMA+A+pLS3fmKpUygsKCgoKq4Vej0zAo/Yw6XvdEgAAAAAAAAAAAKBbu3E5ca/7CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwF/wVAAD///5/rUY=")