Syzkaller hit 'WARNING in netlbl_cipsov4_add' bug.

cgroup: Unknown subsys name 'perf_event'
cgroup: Unknown subsys name 'net_cls'
------------[ cut here ]------------
WARNING: CPU: 1 PID: 847 at mm/page_alloc.c:4935 __alloc_pages_nodemask+0x560/0x680
Modules linked in:
CPU: 1 PID: 847 Comm: syz-executor.0 Not tainted 5.10.45 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:__alloc_pages_nodemask+0x560/0x680
Code: 00 00 0c 00 0f 85 86 00 00 00 4c 89 c2 44 89 e6 44 89 f7 c6 44 24 70 00 4c 89 6c 24 58 e8 98 d8 ff ff 49 89 c7 e9 41 fd ff ff <0f> 0b e9 00 fe ff ff 4c 89 44 24 18 4c 89 44 24 10 89 74 24 0c 4c
RSP: 0018:ffff8880219df3d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff1100433be7e RCX: 0000000000000000
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000040dc0
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000015
R13: 0000000000000015 R14: 0000000000000000 R15: ffff888017a67600
FS:  0000000001ccd400(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004cb7f0 CR3: 0000000021fb2004 CR4: 0000000000060ee0
Call Trace:
 alloc_pages_current+0x187/0x280
 kmalloc_order+0x35/0x160
 kmalloc_order_trace+0x14/0xf0
 netlbl_cipsov4_add+0x5a9/0x23e0
 genl_family_rcv_msg_doit+0x22d/0x330
 genl_rcv_msg+0x33c/0x5a0
 netlink_rcv_skb+0x14b/0x430
 genl_rcv+0x24/0x40
 netlink_unicast+0x53a/0x7e0
 netlink_sendmsg+0x860/0xda0
 sock_sendmsg+0x150/0x190
 ____sys_sendmsg+0x709/0x870
 ___sys_sendmsg+0xf3/0x170
 __sys_sendmsg+0xe5/0x1b0
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x466609
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff6bcffd08 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 0000000000466609
RDX: 0000000000040000 RSI: 0000000020000380 RDI: 0000000000000004
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007fff6bcffea0 R14: 000000000056bf80 R15: 000000000005bfef
irq event stamp: 2589
hardirqs last  enabled at (2599): [<ffffffff81290989>] console_unlock+0x929/0xb30
hardirqs last disabled at (2608): [<ffffffff81290895>] console_unlock+0x835/0xb30
softirqs last  enabled at (2534): [<ffffffff83e00f92>] asm_call_irq_on_stack+0x12/0x20
softirqs last disabled at (2527): [<ffffffff83e00f92>] asm_call_irq_on_stack+0x12/0x20
---[ end trace e08f6c14dd401eeb ]---


Syzkaller reproducer:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r0)
sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x188, r1, 0x513, 0x70bd27, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0xd0, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xcf}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2367a756}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x71}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70907b7b}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1c45570f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3d8430d8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdb}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3d443e1e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7a241380}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6b}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x75}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x2a}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x771778d8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1b8c79f4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xfd}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x193da777}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71fa2b6f}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x78, 0xc, 0x0, 0x1, [{0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa80a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb357}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6559307a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x60053d6a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x29bb}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5d642751}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6b30c2fd}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4e9097fc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa070}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6b7c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x69ef}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbba0}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4a6d794c}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x1}]}]}, 0x188}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000)


C reproducer:
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/genetlink.h>
#include <linux/if_addr.h>
#include <linux/if_link.h>
#include <linux/in6.h>
#include <linux/neighbour.h>
#include <linux/net.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/veth.h>

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
	struct timespec ts;
	if (clock_gettime(CLOCK_MONOTONIC, &ts))
	exit(1);
	return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))

static bool write_file(const char* file, const char* what, ...)
{
	char buf[1024];
	va_list args;
	va_start(args, what);
	vsnprintf(buf, sizeof(buf), what, args);
	va_end(args);
	buf[sizeof(buf) - 1] = 0;
	int len = strlen(buf);
	int fd = open(file, O_WRONLY | O_CLOEXEC);
	if (fd == -1)
		return false;
	if (write(fd, buf, len) != len) {
		int err = errno;
		close(fd);
		errno = err;
		return false;
	}
	close(fd);
	return true;
}

struct nlmsg {
	char* pos;
	int nesting;
	struct nlattr* nested[8];
	char buf[4096];
};

static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
			 const void* data, int size)
{
	memset(nlmsg, 0, sizeof(*nlmsg));
	struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
	hdr->nlmsg_type = typ;
	hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
	memcpy(hdr + 1, data, size);
	nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
}

static void netlink_attr(struct nlmsg* nlmsg, int typ,
			 const void* data, int size)
{
	struct nlattr* attr = (struct nlattr*)nlmsg->pos;
	attr->nla_len = sizeof(*attr) + size;
	attr->nla_type = typ;
	if (size > 0)
		memcpy(attr + 1, data, size);
	nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
}

static int netlink_send_ext(struct nlmsg* nlmsg, int sock,
			    uint16_t reply_type, int* reply_len, bool dofail)
{
	if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
	exit(1);
	struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
	hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
	struct sockaddr_nl addr;
	memset(&addr, 0, sizeof(addr));
	addr.nl_family = AF_NETLINK;
	ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr));
	if (n != (ssize_t)hdr->nlmsg_len) {
		if (dofail)
	exit(1);
		return -1;
	}
	n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
	if (reply_len)
		*reply_len = 0;
	if (n < 0) {
		if (dofail)
	exit(1);
		return -1;
	}
	if (n < (ssize_t)sizeof(struct nlmsghdr)) {
		errno = EINVAL;
		if (dofail)
	exit(1);
		return -1;
	}
	if (hdr->nlmsg_type == NLMSG_DONE)
		return 0;
	if (reply_len && hdr->nlmsg_type == reply_type) {
		*reply_len = n;
		return 0;
	}
	if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
		errno = EINVAL;
		if (dofail)
	exit(1);
		return -1;
	}
	if (hdr->nlmsg_type != NLMSG_ERROR) {
		errno = EINVAL;
		if (dofail)
	exit(1);
		return -1;
	}
	errno = -((struct nlmsgerr*)(hdr + 1))->error;
	return -errno;
}

static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail)
{
	struct genlmsghdr genlhdr;
	memset(&genlhdr, 0, sizeof(genlhdr));
	genlhdr.cmd = CTRL_CMD_GETFAMILY;
	netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr));
	netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1);
	int n = 0;
	int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
	if (err < 0) {
		return -1;
	}
	uint16_t id = 0;
	struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr)));
	for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
		if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
			id = *(uint16_t*)(attr + 1);
			break;
		}
	}
	if (!id) {
		errno = EINVAL;
		return -1;
	}
	recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
	return id;
}

const int kInitNetNsFd = 239;

static long syz_init_net_socket(volatile long domain, volatile long type, volatile long proto)
{
	return syscall(__NR_socket, domain, type, proto);
}

static long syz_genetlink_get_family_id(volatile long name, volatile long sock_arg)
{
	bool dofail = false;
	int fd = sock_arg;
	if (fd < 0) {
		dofail = true;
		fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
		if (fd == -1) {
			return -1;
		}
	}
	struct nlmsg nlmsg_tmp;
	int ret = netlink_query_family_id(&nlmsg_tmp, fd, (char*)name, dofail);
	if ((int)sock_arg < 0)
		close(fd);
	if (ret < 0) {
		return -1;
	}
	return ret;
}

static void kill_and_wait(int pid, int* status)
{
	kill(-pid, SIGKILL);
	kill(pid, SIGKILL);
	for (int i = 0; i < 100; i++) {
		if (waitpid(-1, status, WNOHANG | __WALL) == pid)
			return;
		usleep(1000);
	}
	DIR* dir = opendir("/sys/fs/fuse/connections");
	if (dir) {
		for (;;) {
			struct dirent* ent = readdir(dir);
			if (!ent)
				break;
			if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
				continue;
			char abort[300];
			snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
			int fd = open(abort, O_WRONLY);
			if (fd == -1) {
				continue;
			}
			if (write(fd, abort, 1) < 0) {
			}
			close(fd);
		}
		closedir(dir);
	} else {
	}
	while (waitpid(-1, status, __WALL) != pid) {
	}
}

static void setup_test()
{
	prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
	setpgrp();
	write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
	int iter = 0;
	for (;; iter++) {
		int pid = fork();
		if (pid < 0)
	exit(1);
		if (pid == 0) {
			setup_test();
			execute_one();
			exit(0);
		}
		int status = 0;
		uint64_t start = current_time_ms();
		for (;;) {
			if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
				break;
			sleep_ms(1);
		if (current_time_ms() - start < 5000) {
			continue;
		}
			kill_and_wait(pid, &status);
			break;
		}
	}
}

uint64_t r[2] = {0xffffffffffffffff, 0x0};

void execute_one(void)
{
		intptr_t res = 0;
	res = -1;
res = syz_init_net_socket(0x10, 3, 0x10);
	if (res != -1)
		r[0] = res;
memcpy((void*)0x20000100, "NLBL_CIPSOv4\000", 13);
	res = -1;
res = syz_genetlink_get_family_id(0x20000100, r[0]);
	if (res != -1)
		r[1] = res;
*(uint64_t*)0x20000380 = 0;
*(uint32_t*)0x20000388 = 0;
*(uint64_t*)0x20000390 = 0x20000340;
*(uint64_t*)0x20000340 = 0x20000180;
*(uint32_t*)0x20000180 = 0x188;
*(uint16_t*)0x20000184 = r[1];
*(uint16_t*)0x20000186 = 0x513;
*(uint32_t*)0x20000188 = 0x70bd27;
*(uint32_t*)0x2000018c = 0x25dfdbff;
*(uint8_t*)0x20000190 = 1;
*(uint8_t*)0x20000191 = 0;
*(uint16_t*)0x20000192 = 0;
*(uint16_t*)0x20000194 = 8;
*(uint16_t*)0x20000196 = 1;
*(uint32_t*)0x20000198 = 2;
*(uint16_t*)0x2000019c = 8;
*(uint16_t*)0x2000019e = 2;
*(uint32_t*)0x200001a0 = 1;
*(uint16_t*)0x200001a4 = 0xd0;
STORE_BY_BITMASK(uint16_t, , 0x200001a6, 8, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200001a7, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200001a7, 1, 7, 1);
*(uint16_t*)0x200001a8 = 0x24;
STORE_BY_BITMASK(uint16_t, , 0x200001aa, 7, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200001ab, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200001ab, 1, 7, 1);
*(uint16_t*)0x200001ac = 8;
*(uint16_t*)0x200001ae = 6;
*(uint32_t*)0x200001b0 = 0xcf;
*(uint16_t*)0x200001b4 = 8;
*(uint16_t*)0x200001b6 = 5;
*(uint32_t*)0x200001b8 = 0x2367a756;
*(uint16_t*)0x200001bc = 8;
*(uint16_t*)0x200001be = 6;
*(uint32_t*)0x200001c0 = 0x71;
*(uint16_t*)0x200001c4 = 8;
*(uint16_t*)0x200001c6 = 5;
*(uint32_t*)0x200001c8 = 0x70907b7b;
*(uint16_t*)0x200001cc = 0x3c;
STORE_BY_BITMASK(uint16_t, , 0x200001ce, 7, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200001cf, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200001cf, 1, 7, 1);
*(uint16_t*)0x200001d0 = 8;
*(uint16_t*)0x200001d2 = 5;
*(uint32_t*)0x200001d4 = 0x1c45570f;
*(uint16_t*)0x200001d8 = 8;
*(uint16_t*)0x200001da = 5;
*(uint32_t*)0x200001dc = 0x3d8430d8;
*(uint16_t*)0x200001e0 = 8;
*(uint16_t*)0x200001e2 = 6;
*(uint32_t*)0x200001e4 = 0xdb;
*(uint16_t*)0x200001e8 = 8;
*(uint16_t*)0x200001ea = 6;
*(uint32_t*)0x200001ec = 0xdb;
*(uint16_t*)0x200001f0 = 8;
*(uint16_t*)0x200001f2 = 5;
*(uint32_t*)0x200001f4 = 0x3d443e1e;
*(uint16_t*)0x200001f8 = 8;
*(uint16_t*)0x200001fa = 5;
*(uint32_t*)0x200001fc = 0x7a241380;
*(uint16_t*)0x20000200 = 8;
*(uint16_t*)0x20000202 = 6;
*(uint32_t*)0x20000204 = 0x6b;
*(uint16_t*)0x20000208 = 0x34;
STORE_BY_BITMASK(uint16_t, , 0x2000020a, 7, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000020b, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000020b, 1, 7, 1);
*(uint16_t*)0x2000020c = 8;
*(uint16_t*)0x2000020e = 6;
*(uint32_t*)0x20000210 = 0x8c;
*(uint16_t*)0x20000214 = 8;
*(uint16_t*)0x20000216 = 6;
*(uint32_t*)0x20000218 = 7;
*(uint16_t*)0x2000021c = 8;
*(uint16_t*)0x2000021e = 6;
*(uint32_t*)0x20000220 = 0x75;
*(uint16_t*)0x20000224 = 8;
*(uint16_t*)0x20000226 = 6;
*(uint32_t*)0x20000228 = 0x2a;
*(uint16_t*)0x2000022c = 8;
*(uint16_t*)0x2000022e = 5;
*(uint32_t*)0x20000230 = 0x771778d8;
*(uint16_t*)0x20000234 = 8;
*(uint16_t*)0x20000236 = 6;
*(uint32_t*)0x20000238 = 0xb1;
*(uint16_t*)0x2000023c = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x2000023e, 7, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000023f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000023f, 1, 7, 1);
*(uint16_t*)0x20000240 = 8;
*(uint16_t*)0x20000242 = 5;
*(uint32_t*)0x20000244 = 0x1b8c79f4;
*(uint16_t*)0x20000248 = 8;
*(uint16_t*)0x2000024a = 6;
*(uint32_t*)0x2000024c = 0xc4;
*(uint16_t*)0x20000250 = 8;
*(uint16_t*)0x20000252 = 6;
*(uint32_t*)0x20000254 = 0xfd;
*(uint16_t*)0x20000258 = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x2000025a, 7, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000025b, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000025b, 1, 7, 1);
*(uint16_t*)0x2000025c = 8;
*(uint16_t*)0x2000025e = 5;
*(uint32_t*)0x20000260 = 0x193da777;
*(uint16_t*)0x20000264 = 8;
*(uint16_t*)0x20000266 = 6;
*(uint32_t*)0x20000268 = 0xde;
*(uint16_t*)0x2000026c = 8;
*(uint16_t*)0x2000026e = 5;
*(uint32_t*)0x20000270 = 0x71fa2b6f;
*(uint16_t*)0x20000274 = 0x78;
STORE_BY_BITMASK(uint16_t, , 0x20000276, 0xc, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000277, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000277, 1, 7, 1);
*(uint16_t*)0x20000278 = 0x3c;
STORE_BY_BITMASK(uint16_t, , 0x2000027a, 0xb, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000027b, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000027b, 1, 7, 1);
*(uint16_t*)0x2000027c = 8;
*(uint16_t*)0x2000027e = 0xa;
*(uint32_t*)0x20000280 = 0xa80a;
*(uint16_t*)0x20000284 = 8;
*(uint16_t*)0x20000286 = 0xa;
*(uint32_t*)0x20000288 = 0xb357;
*(uint16_t*)0x2000028c = 8;
*(uint16_t*)0x2000028e = 9;
*(uint32_t*)0x20000290 = 0x6559307a;
*(uint16_t*)0x20000294 = 8;
*(uint16_t*)0x20000296 = 9;
*(uint32_t*)0x20000298 = 0x60053d6a;
*(uint16_t*)0x2000029c = 8;
*(uint16_t*)0x2000029e = 0xa;
*(uint32_t*)0x200002a0 = 0x29bb;
*(uint16_t*)0x200002a4 = 8;
*(uint16_t*)0x200002a6 = 9;
*(uint32_t*)0x200002a8 = 0x5d642751;
*(uint16_t*)0x200002ac = 8;
*(uint16_t*)0x200002ae = 9;
*(uint32_t*)0x200002b0 = 0x6b30c2fd;
*(uint16_t*)0x200002b4 = 0x2c;
STORE_BY_BITMASK(uint16_t, , 0x200002b6, 0xb, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200002b7, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200002b7, 1, 7, 1);
*(uint16_t*)0x200002b8 = 8;
*(uint16_t*)0x200002ba = 9;
*(uint32_t*)0x200002bc = 0x4e9097fc;
*(uint16_t*)0x200002c0 = 8;
*(uint16_t*)0x200002c2 = 0xa;
*(uint32_t*)0x200002c4 = 0xa070;
*(uint16_t*)0x200002c8 = 8;
*(uint16_t*)0x200002ca = 0xa;
*(uint32_t*)0x200002cc = 0x6b7c;
*(uint16_t*)0x200002d0 = 8;
*(uint16_t*)0x200002d2 = 0xa;
*(uint32_t*)0x200002d4 = 0x69ef;
*(uint16_t*)0x200002d8 = 8;
*(uint16_t*)0x200002da = 0xa;
*(uint32_t*)0x200002dc = 0xbba0;
*(uint16_t*)0x200002e0 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x200002e2, 0xb, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200002e3, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200002e3, 1, 7, 1);
*(uint16_t*)0x200002e4 = 8;
*(uint16_t*)0x200002e6 = 9;
*(uint32_t*)0x200002e8 = 0x4a6d794c;
*(uint16_t*)0x200002ec = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x200002ee, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200002ef, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200002ef, 1, 7, 1);
*(uint16_t*)0x200002f0 = 5;
*(uint16_t*)0x200002f2 = 3;
*(uint8_t*)0x200002f4 = 5;
*(uint16_t*)0x200002f8 = 5;
*(uint16_t*)0x200002fa = 3;
*(uint8_t*)0x200002fc = 6;
*(uint16_t*)0x20000300 = 5;
*(uint16_t*)0x20000302 = 3;
*(uint8_t*)0x20000304 = 1;
*(uint64_t*)0x20000348 = 0x188;
*(uint64_t*)0x20000398 = 1;
*(uint64_t*)0x200003a0 = 0;
*(uint64_t*)0x200003a8 = 0;
*(uint32_t*)0x200003b0 = 0x20000000;
	syscall(__NR_sendmsg, r[0], 0x20000380ul, 0x40000ul);

}
int main(void)
{
		syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
	syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
	syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
			loop();
	return 0;
}