From d3f75397b75a3bfed0cbb0f54b1c6c584b37c4c2 Mon Sep 17 00:00:00 2001 From: Hrutvik Kanabar Date: Thu, 27 Oct 2022 13:54:17 +0000 Subject: sys/linux: update asset storage for new `syz_mount_image` Asset storage is now significantly simpler: we just take the Base64-encoded, compressed image and output it to a file. There is a slight overhead in that we decompress from the `zlib` format and re-compress to the `gzip` format. This commit removes most of the logic from `init_images.go`, and therefore most of the tests from `init_images_test.go`. We could instead keep this logic around and use it to adapt old-style `syz_mount_image` calls in existing corpuses to match the new format. --- sys/linux/init_images.go | 249 ++++++-------------------------------- sys/linux/init_images_test.go | 62 ++-------- sys/linux/testdata/fs_images/0.in | 2 +- sys/linux/testdata/fs_images/1.in | 2 +- 4 files changed, 50 insertions(+), 265 deletions(-) (limited to 'sys') diff --git a/sys/linux/init_images.go b/sys/linux/init_images.go index e160234d9..97175cb84 100644 --- a/sys/linux/init_images.go +++ b/sys/linux/init_images.go @@ -7,129 +7,28 @@ import ( "bytes" "fmt" "io" - "sort" "github.com/google/syzkaller/prog" ) func (arch *arch) extractSyzMountImage(c *prog.Call) (io.Reader, error) { - // In order to reduce the size of syzlang programs, disk imags are de facto compressed. - // Here we do the uncompression. + // In order to reduce the size of syzlang programs, disk images are compressed. + // Here we extract the compressed image. if c.Meta.CallName != "syz_mount_image" { return nil, nil } - ret, err := parseSyzMountImage(c) + data, _, err := parseSyzMountImage(c) if err != nil { // Parsing failed --> do not try to recover, just ignore. return nil, err - } else if len(ret.segments) == 0 { + } else if len(data) == 0 { return nil, fmt.Errorf("an empty image") } - readers := []io.Reader{} - nextPos := 0 - // Add fake zero readers between segments, so that we can combine them to read the whole image. - for _, segment := range ret.segments { - offset := int(segment.offset.Val) - if offset > nextPos { - readers = append(readers, &zeroReader{left: offset - nextPos}) - } - size := int(segment.size.Val) - readers = append(readers, bytes.NewReader(segment.data.Data()[0:size])) - nextPos = offset + size - } - if int(ret.size.Val) > nextPos { - readers = append(readers, &zeroReader{left: int(ret.size.Val) - nextPos}) - } - return io.MultiReader(readers...), nil -} - -type zeroReader struct { - left int -} - -func (zr *zeroReader) Read(p []byte) (n int, err error) { - if zr.left == 0 { - return 0, io.EOF - } - toRead := zr.left - if toRead > len(p) { - toRead = len(p) - } - for i := 0; i < toRead; i++ { - p[i] = 0 - } - zr.left -= toRead - return toRead, nil -} - -const imageMaxSize = 129 << 20 - -func fixUpImageSegments(parsed *mountImageArgs, fixStructure bool) error { - const maxImageSegments = 16784 - err := parsed.filterSegments(func(i int, segment *mountImageSegment) bool { - if i >= maxImageSegments { - // We don't want more than maxImageSegments segments. - return false - } - if segment.parseError != nil { - // Delete mangled segment structures. - return false - } - return segment.offset.Val < imageMaxSize && segment.size.Val < imageMaxSize - }, !fixStructure) + decompressedData, err := prog.Decompress(data) if err != nil { - return err - } - // Overwriting of the image multiple times is not efficient and complicates image extraction in Go. - // So let's make segments non-overlapping. - if fixStructure { - sort.Stable(parsed) - } else if !sort.IsSorted(parsed) { - return fmt.Errorf("segments are not sorted") - } - - newSize := parsed.size.Val - if newSize > imageMaxSize { - newSize = imageMaxSize - } - - for idx, segment := range parsed.segments { - actualSize := uint64(len(segment.data.Data())) - if segment.size.Val != actualSize { - segment.size.Val = actualSize - } - if idx > 0 { - // Adjust the end of the previous segment. - prevSegment := parsed.segments[idx-1] - if prevSegment.offset.Val+prevSegment.size.Val > segment.offset.Val { - if fixStructure { - prevSegment.resize(segment.offset.Val - prevSegment.offset.Val) - } else { - return fmt.Errorf("segment %d has invalid size", idx-1) - } - } - } - if segment.offset.Val+segment.size.Val > imageMaxSize { - if fixStructure { - segment.resize(imageMaxSize - segment.offset.Val) - } else { - return fmt.Errorf("segment %d has invalid size", idx) - } - } - if segment.offset.Val+segment.size.Val > newSize { - newSize = segment.offset.Val + segment.size.Val - } - } - if newSize > imageMaxSize { - // Assert that the logic above is not broken. - panic("newSize > imageMaxSize") + return nil, err } - parsed.size.Val = newSize - - // Drop 0-size segments. - return parsed.filterSegments(func(i int, segment *mountImageSegment) bool { - return segment.size.Val > 0 - }, !fixStructure) + return bytes.NewReader(decompressedData), nil } func (arch *arch) fixUpSyzMountImage(c *prog.Call, fixStructure bool) error { @@ -138,7 +37,8 @@ func (arch *arch) fixUpSyzMountImage(c *prog.Call, fixStructure bool) error { // 1) It further complicates the already complicated executor code. // 2) We'd need to duplicate the logic in Go for raw image extraction. // So now we do all the initialization in Go and let the C code only interpret the commands. - ret, err := parseSyzMountImage(c) + data, compressedSizeArg, err := parseSyzMountImage(c) + compressedSizeArg.Val = uint64(len(data)) if err != nil { if fixStructure { deactivateSyzMountImage(c) @@ -146,124 +46,49 @@ func (arch *arch) fixUpSyzMountImage(c *prog.Call, fixStructure bool) error { } return err } - return fixUpImageSegments(ret, fixStructure) -} - -type mountImageArgs struct { - size *prog.ConstArg - segmentsCount *prog.ConstArg - segmentsGroup *prog.GroupArg - segments []*mountImageSegment -} - -func (m *mountImageArgs) filterSegments(filter func(int, *mountImageSegment) bool, failOnRemove bool) error { - newArgs := []prog.Arg{} - newSegments := []*mountImageSegment{} - for i, segment := range m.segments { - if filter(i, segment) { - newSegments = append(newSegments, segment) - newArgs = append(newArgs, m.segmentsGroup.Inner[i]) - } else if failOnRemove { - return fmt.Errorf("segment #%d got filtered out", i) - } - } - m.segments = newSegments - m.segmentsGroup.Inner = newArgs - m.segmentsCount.Val = uint64(len(newArgs)) return nil } -// Methods for segment sorting. -func (m *mountImageArgs) Len() int { return len(m.segments) } -func (m *mountImageArgs) Swap(i, j int) { - inner := m.segmentsGroup.Inner - inner[i], inner[j] = inner[j], inner[i] - m.segments[i], m.segments[j] = m.segments[j], m.segments[i] -} -func (m *mountImageArgs) Less(i, j int) bool { - if m.segments[i].offset.Val != m.segments[j].offset.Val { - return m.segments[i].offset.Val < m.segments[j].offset.Val - } - return m.segments[i].size.Val < m.segments[j].size.Val -} - -type mountImageSegment struct { - data *prog.DataArg - offset *prog.ConstArg - size *prog.ConstArg - parseError error -} - -func (s *mountImageSegment) resize(newSize uint64) { - s.size.Val = newSize - s.data.SetData(s.data.Data()[0:newSize]) -} - -func parseImageSegment(segmentArg prog.Arg) *mountImageSegment { - ret := &mountImageSegment{} - segmentFields, ok := segmentArg.(*prog.GroupArg) - if segmentFields == nil || !ok { - return &mountImageSegment{parseError: fmt.Errorf("it is not a group")} - } - if len(segmentFields.Inner) != 3 { - return &mountImageSegment{parseError: fmt.Errorf("invalid number of nested fields")} - } - dataPtr, ok := segmentFields.Inner[0].(*prog.PointerArg) - if dataPtr == nil || dataPtr.Res == nil || !ok { - return &mountImageSegment{parseError: fmt.Errorf("invalid data field ptr")} - } - ret.data, ok = dataPtr.Res.(*prog.DataArg) - if ret.data == nil || !ok { - return &mountImageSegment{parseError: fmt.Errorf("invalid data arg")} - } - ret.size, ok = segmentFields.Inner[1].(*prog.ConstArg) - if ret.size == nil || !ok { - return &mountImageSegment{parseError: fmt.Errorf("invalid size arg")} - } - ret.offset, ok = segmentFields.Inner[2].(*prog.ConstArg) - if ret.offset == nil || !ok { - return &mountImageSegment{parseError: fmt.Errorf("invalid offset arg")} - } - return ret -} - func deactivateSyzMountImage(c *prog.Call) { - groupArg := c.Args[4] - newArg := groupArg.Type().DefaultArg(groupArg.Dir()) - prog.RemoveArg(groupArg) - c.Args[4] = newArg - // Also set the segments count field to 0. + dataPointer := c.Args[7] + newArg := dataPointer.Type().DefaultArg(dataPointer.Dir()) + prog.RemoveArg(dataPointer) + c.Args[7] = newArg + // Also set the size fields to 0. + c.Args[2].(*prog.ConstArg).Val = 0 c.Args[3].(*prog.ConstArg).Val = 0 } -func parseSyzMountImage(c *prog.Call) (*mountImageArgs, error) { - if len(c.Args) < 5 { +// Returns the compressed disk image and the corresponding length argument. +func parseSyzMountImage(c *prog.Call) ([]byte, *prog.ConstArg, error) { + if len(c.Args) < 8 { panic("invalid number of arguments in syz_mount_image") } - segmentsCountArg, ok := c.Args[3].(*prog.ConstArg) - if !ok { - panic("syz_mount_image's segment count was expected to be const") - } - sizeArg, ok := c.Args[2].(*prog.ConstArg) + + // Check `size` argument. + _, ok := c.Args[2].(*prog.ConstArg) if !ok { panic("syz_mount_image's size arg is not const") } - segmentsPtrArg, ok := c.Args[4].(*prog.PointerArg) + + // Check `size_compressed` argument. + compressedSizeArg, ok := c.Args[3].(*prog.ConstArg) if !ok { - return nil, fmt.Errorf("invalid segments arg") + panic("syz_mount_image's compressed size arg is not const") } - segmentsGroup, ok := segmentsPtrArg.Res.(*prog.GroupArg) - if segmentsGroup == nil || !ok { - return nil, fmt.Errorf("segments are not a group") + + dataPointer, ok := c.Args[7].(*prog.PointerArg) + if !ok { + panic("syz_mount_image's data pointer is invalid") } - ret := &mountImageArgs{ - segmentsCount: segmentsCountArg, - segmentsGroup: segmentsGroup, - size: sizeArg, + + dataArg, ok := dataPointer.Res.(*prog.DataArg) + if !ok { + return nil, compressedSizeArg, fmt.Errorf("could not find raw image data") } - for _, segmentArg := range segmentsGroup.Inner { - parsed := parseImageSegment(segmentArg) - ret.segments = append(ret.segments, parsed) + if dataArg == nil { + return nil, compressedSizeArg, fmt.Errorf("image argument contains no data") } - return ret, nil + + return dataArg.Data(), compressedSizeArg, nil } diff --git a/sys/linux/init_images_test.go b/sys/linux/init_images_test.go index 1da41276e..c5b93c4be 100644 --- a/sys/linux/init_images_test.go +++ b/sys/linux/init_images_test.go @@ -7,14 +7,12 @@ import ( "flag" "fmt" "io" - "math/rand" "os" "path/filepath" "reflect" "sort" "strings" "testing" - "time" "github.com/google/syzkaller/pkg/osutil" "github.com/google/syzkaller/prog" @@ -22,30 +20,24 @@ import ( ) // nolint: lll + func TestSyzMountImageNeutralize(t *testing.T) { prog.TestDeserializeHelper(t, targets.Linux, targets.AMD64, nil, []prog.DeserializeTest{ { // A valid call, nothing should change. - In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40, 0x0}, {&(0x7f0000010040)="0200000011000000140000001f22000002000000ed4100000000000001000000020000005ffb19635ffb19635ffb196300"/64, 0x40, 0x200}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`, + In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', ` + + `0xdeadbeef, 0x15, 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0, ` + + `&(0x7f0000000200)="$eJwqrqzKTszJSS0CBAAA//8TyQPi")`, }, { - // Invalid total size. - In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file1\x00', 0x20, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40, 0x0}, {&(0x7f0000010040)="0200000011000000140000001f22000002000000ed4100000000000001000000020000005ffb19635ffb19635ffb196300"/64, 0x40, 0x200}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`, + // Invalid compressed size. + In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', ` + + `0xdeadbeef, 0xdeadbeef, 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0, ` + + `&(0x7f0000000200)="$eJwqrqzKTszJSS0CBAAA//8TyQPi")`, // It should be able to fix up the size. - Out: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file1\x00', 0x240, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40, 0x0}, {&(0x7f0000010040)="0200000011000000140000001f22000002000000ed4100000000000001000000020000005ffb19635ffb19635ffb196300"/64, 0x40, 0x200}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`, - }, - { - // Invalid offset. - In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file1\x00', 0x20, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40, 0x0}, {&(0x7f0000010040)="0200000011000000140000001f22000002000000ed4100000000000001000000020000005ffb19635ffb19635ffb196300"/64, 0x40, 0x9100000}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`, - // The segment is deleted. - Out: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file1\x00', 0x40, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="cefaad1bc0210000ff0f0000ffffffffffffffffffffffffffffffff73797a6b616c73797a6b616c00"/64, 0x40, 0x0}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`, - StrictErr: `got filtered out`, - }, - { - // Overlapping and unsorted segments. - In: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="cafef00d"/64, 0x50, 0x20}, {&(0x7f0000010040)="deadbeef"/64, 0x30, 0x10}, {&(0x7f0000010080)="abcdef"/64, 0x40, 0x20}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`, - Out: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x2, &(0x7f0000000200)=[{&(0x7f0000010040)="deadbeef00"/16, 0x10, 0x10}, {&(0x7f0000010000)="cafef00d00"/64, 0x40, 0x20}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)`, - StrictErr: `segments are not sorted`, + Out: `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', ` + + `0xdeadbeef, 0x15, 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0, ` + + `&(0x7f0000000200)="$eJwqrqzKTszJSS0CBAAA//8TyQPi")`, }, }) } @@ -120,35 +112,3 @@ func TestExtractSyzMountImage(t *testing.T) { t.Fatalf("all out files: %v\ntested files: %v", allOutFiles, testedOutFiles) } } - -// nolint: lll -func TestSyzMountImageMutation(t *testing.T) { - // We cannot unfortunately just import InitTest from prog. - rs := rand.NewSource(time.Now().UnixNano()) - iters := 100 - target, err := prog.GetTarget("linux", "amd64") - if err != nil { - t.Fatal(err) - } - - var p *prog.Prog - var ct *prog.ChoiceTable - - const mutateCount = 1000 - const baseProg = `syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x2, &(0x7f0000000200)=[{&(0x7f0000010040)="deadbeef00"/16, 0x10, 0x10}, {&(0x7f0000010000)="cafef00d00"/64, 0x40, 0x20}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0)` - - for i := 0; i < iters; i++ { - if i%mutateCount == 0 { - var err error - p, err = target.Deserialize([]byte(baseProg), prog.NonStrict) - if err != nil { - t.Fatal(err) - } - ct = target.DefaultChoiceTable() - } - p.Mutate(rs, 1, ct, nil, nil) - // We only call the extraction code and do mutations to catch possible panics. - // It is absolutely normal for syzkaller to mutate the call to the level when the image can no longer be extracted. - p.Target.ExtractMountedImage(p.Calls[0]) - } -} diff --git a/sys/linux/testdata/fs_images/0.in b/sys/linux/testdata/fs_images/0.in index 7080226a0..cf6583c43 100644 --- a/sys/linux/testdata/fs_images/0.in +++ b/sys/linux/testdata/fs_images/0.in @@ -1 +1 @@ -syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x2, &(0x7f0000000200)=[{&(0x7f0000010040)="deadbeef00"/16, 0x10, 0x10}, {&(0x7f0000010000)="cafef00d00"/64, 0x40, 0x20}], 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0) \ No newline at end of file +syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000100)='./file0\x00', 0x2220, 0x46, 0x0, &(0x7f00000100a0)={[], [], 0x0}, 0x0, &(0x7f0000000200)="$eJzsykEJACAABEEL2D+FFQxgCCtoAvEr10CY+S1sCbP19fY4u+YDAAAAAAAAAMA/bgAAAP//84oF/g==") diff --git a/sys/linux/testdata/fs_images/1.in b/sys/linux/testdata/fs_images/1.in index 3d9d3e222..15ec4c2c8 100644 --- a/sys/linux/testdata/fs_images/1.in +++ b/sys/linux/testdata/fs_images/1.in @@ -1 +1 @@ -syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x2a, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000000100000c000000ce0000000f00000001000000000000000000000000200000002000002000000067fb196367fb19630100ffff53ef01000100000067fb1963000000000000000001000000000000000b000000800000000800000052470000620100000000000000000000000000000000000073797a6b616c6c6572000000000000002f746d702f73797a2d696d61676567656e333234303537373133330000000000000000000000000000000000000000000000000000000000", 0xc0, 0x400}, {&(0x7f00000100c0)="0000000000000000000000009bbd22de26804913867de6e04e8059bc010000000c0000000000000067fb19630000000000000000000000000000000000000000", 0x40, 0x4e0}, {&(0x7f0000010100)="0100000000000500110000000000000000000000040000003c00000000000000", 0x20, 0x560}, {&(0x7f0000010120)="0300000004000000090000000000000000000000000000000000000000000000", 0x20, 0x640}, {&(0x7f0000010140)="030000001300000023000000ce000f0003000400000000000000000000000000", 0x20, 0x800}, {&(0x7f0000010160)="fffffffffcff0700000000000000000000000000000000000000000000000080ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff020000000c0001022e000000020000000c0002022e2e00000b00000014000a026c6f73742b666f756e6400000c0000001000050266696c65300000000f0000001000050166696c6531000000100000001000050166696c6532000000100000001000050166696c6533000000110000009403090166696c652e636f6c64000000", 0x480, 0xc00}, {&(0x7f00000105e0)="0b0000000c0001022e00000002000000f40302022e2e00000000000000000000", 0x20, 0x1400}, {&(0x7f0000010600)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x1800}, {&(0x7f0000010620)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x1c00}, {&(0x7f0000010640)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x2000}, {&(0x7f0000010660)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x2400}, {&(0x7f0000010680)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x2800}, {&(0x7f00000106a0)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x2c00}, {&(0x7f00000106c0)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x3000}, {&(0x7f00000106e0)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x3400}, {&(0x7f0000010700)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x3800}, {&(0x7f0000010720)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x3c00}, {&(0x7f0000010740)="0000000000040000000000000000000000000000000000000000000000000000", 0x20, 0x4000}, {&(0x7f0000010760)="504d4d00504d4dff67fb1963000000006872757476696b2e632e676f6f676c6572732e636f6d0000000000000000000000000000000000000000000000000000000000000000000000000000000000006c6f6f7032310075782f746573742f73797a5f6d6f756e745f696d6167655f6505000000000000000000000000000000", 0x80, 0x4400}, {&(0x7f00000107e0)="111fc0d901000000803a0900803a090000000000060000000000000005000000", 0x20, 0x4800}, {&(0x7f0000010800)="ffff0100ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0300000000000000000000000000000000000000000000000000000000000000", 0x420, 0x4c00}, {&(0x7f0000010c20)="0400000000000000000000000000000000000000000000000000000000000000", 0x20, 0x5400}, {&(0x7f0000010c40)="0500000000000000000000000000000000000000000000000000000000000000", 0x20, 0x5800}, {&(0x7f0000010c60)="000000000000000001000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000", 0x60, 0x5c00}, {&(0x7f0000010cc0)="0200000000000000000000000000000000000000000000000000000000000000", 0x20, 0x6000}, {&(0x7f0000010ce0)="2719c0d901000000803a0900803a090000000000060000000000000005000000", 0x20, 0x6400}, {&(0x7f0000010d00)="0300000000000000000000000000000000000000000000000000000000000000", 0x20, 0x6800}, {&(0x7f0000010d20)="0400000000000000000000000000000000000000000000000000000000000000", 0x20, 0x6c00}, {&(0x7f0000010d40)="0500000000000000000000000000000000000000000000000000000000000000", 0x20, 0x7000}, {&(0x7f0000010d60)="000000000000000001000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000", 0x60, 0x7400}, {&(0x7f0000010dc0)="0200000000000000000000000000000000000000000000000000000000000000", 0x20, 0x7800}, {&(0x7f0000010de0)="0c0000000c0001022e000000020000000c0002022e2e00000d0000001000050166696c65300000000e000000d803050766696c65310000000000000000000000", 0x40, 0x7c00}, {&(0x7f0000010e20)="000002ea0100000001000000270f240c000000000000000000000000000000000601f8030000000006000000779b539778617474723100000601f003000000000600000074985397786174747232000000000000000000000000000000000000", 0x60, 0x8000}, {&(0x7f0000010e80)="0000000000000000000000000000000078617474723200007861747472310000", 0x20, 0x83e0}, {&(0x7f0000010ea0)="000000000000000067fb196367fb196367fb1963000000000000000000000000", 0x20, 0x8c00}, {&(0x7f0000010ec0)="ed4100000004000067fb196367fb196367fb196300000000000004000200000000000800050000000af301000400000000000000000000000100000004000000", 0x40, 0x8c80}, {&(0x7f0000010f00)="808100000018000067fb196367fb196367fb196300000000000001000c00000010000800000000000af30300040000000000000000000000010000001200000001000000010000001800000002000000040000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000808100000018000067fb196367fb196367fb196300000000000001000c00000010000800000000000af30300040000000000000000000000010000001900000001000000010000001e00000002000000040000001a0000000000000000000000", 0xe0, 0x8d00}, {&(0x7f0000010fe0)="c04100000030000067fb196367fb196367fb196300000000000002001800000000000800000000000af301000400000000000000000000000c00000005000000", 0x40, 0x9100}, {&(0x7f0000011020)="ed4100000004000067fb196367fb196367fb196300000000000002000200000000000800030000000af30100040000000000000000000000010000001f000000000000000000000000000000000000000000000000000000000000000000000000000000a6b0039d000000000000000000000000000000000000000000000000ed8100001a04000067fb196367fb196367fb196300000000000001000400000000000800010000000af3010004000000000000000000000002000000270000000000000000000000000000000000000000000000000000000000000000000000000000005109c476000000000000000000000000000000000000000000000000ffa100002700000067fb196367fb196367fb196300000000000001000000000000000000010000002f746d702f73797a2d696d61676567656e333234303537373133332f66696c65302f66696c653000000000000000000000000000000000000000000047fa2223000000000000000000000000000000000000000000000000ed8100000a00000067fb196367fb196367fb196300000000000001000400000000000800010000000af301000400000000000000000000000100000029000000000000000000000000000000000000000000000000000000000000000000000000000000d10ea931200000000000000000000000000000000000000000000000ed8100002823000067fb196367fb196367fb196300000000000002001200000000000800010000000af30100040000000000000000000000090000002a0000000000000000000000000000000000000000000000000000000000000000000000000000006077b616000000000000000000000000000000000000000000000000ed8100006400000067fb196367fb196367fb196300000000000001000200000000000800010000000af3010004000000000000000000000001000000330000000000000000000000000000000000000000000000000000000000000000000000000000003ffd7303000000000000000000000000000000000000000000000000", 0x300, 0x9180}, {&(0x7f0000011320)="73797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c000000000000", 0x420, 0x9c00}, {&(0x7f0000011740)="73797a6b616c6c65727300000000000000000000000000000000000000000000", 0x20, 0xa400}, {&(0x7f0000011760)="73797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c657273797a6b616c6c65727300000000000000000000000000000000000000000000000000000000", 0x80, 0xcc00}], 0x0, &(0x7f00000117e0)) \ No newline at end of file +syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x4a0, 0x0, &(0x7f00000117e0), 0x0, &(0x7f0000000200)="$eJzs3c1rXFUbAPDnzjRtkubt54uYLmxpxfpBM/loCYggroqLitqVqxrTaSydZEJm0jYBId34FwgKxYUbwZ0rVwpduBbc6UZcuRBEoS7EKiP3zkyarwmjphnJ/f3gds69ZzrPORmew5lz78wNILdOpf8kEUMR8VVEHG7urn/CqebDzIPh6XRLotG4/HOSPS/dbz+1/f8ORsRKRPRHxOsXI95KNsetLS3fmKpUygut/VJ9dr5UW1o+d312aqY8U56bGD8/emFycmxiYsf6eveL0989tfLy8Xff+eH7V1be+Dxt1lCrbm0/dlKz631xdM2xfRHxwqMI1gPFVn8Get0Q/pH0/TseEWey/D8cxezdBPKg0Wg0/mgc6FS90gD2rEI2B04KIxHRLBcKIyPNOfz/Y7BQqdbqz12rLs5dbc6Vj0Rf4dr1Snm09VnhSPQl6f5YVn64P75hP53Fp3Pg94oD2f7IdLVydXeHOmCDgxvy/9diM/+BnPCRH/JL/kN+yX/IL/kP+SX/Ib/kP+SX/If8kv+QX/If8kv+Q37Jf8ilVy9dSrdG+/vvby8s1m9evzEyPTJTrc5Uygu1kenqbPevV6lW58fHYvF2qV6u1Uu1peUrs9XFufqV7Hv9V8p9j7AvwN9z9OS9b5OIWHl+INtS+1t1chX2tkYjiV5/BxnojWKvByCgZyz9QX75jA9s8RO96/R3qpjf+bYAu6PQ6wYAPXN22Pk/yCvr/5Bf1v8hv8zxAev/kD/W/yG/hjrc/+t/a+7dNRoRhyLim2Lfgfa9voC9oPBj0pr/nz385NDG2v3Jb9kpgv0Rcevu5fdvT9XrC2Pp8V9Wj9c/aB0f70X7gW6187SdxwBAfs08GJ5ub7sZ96eXmhchbI6/r7U22Z+doxy8n6y7ViHZoWsXVu5ExONbxU9a9ztvnvkYvF/cFP9Y6zFpvkTW3n3ZfdN3J/7wmvhPrIl/4l//VSAf7qXjz+hW+VfIcjpW82/9+DO0Q9dOdB7/CqvjX7HD+Heyyxgff1r8sGP8OxEntozfjtefxdoYP23b2S7jvzbw5c1OdY2Pmq+zVfy2tFSqz86XakvL57LfkZspz02Mnx+9MDk5NjFRytaoS+2V6s0u/n76zHb9H+wQf7v+p8ee6bL/Xx/6ZOzUNvGfPrP1+39sm/gDEfFsl/HfvPXZY53q0vhXO/S/sE389NhEl/Ff/LPmMmMA+A+pLS3fmKpUygsKCgoKq4Vej0zAo/Yw6XvdEgAAAAAAAAAAAKBbu3E5ca/7CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwF/wVAAD///5/rUY=") -- cgit mrf-deployment