#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ check_whitelist_module(char *, int, char **);
int /*<<< orphan*/ check_whitelist_module_path(char *, int, char **);
int /*<<< orphan*/ error(int, char **);
int /*<<< orphan*/ execve(char *, char **, int /*<<< orphan*/ *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *);
scalar_t__ geteuid();
int /*<<< orphan*/ getuid();
char **malloc(int);
int /*<<< orphan*/ perror(char *);
int seteuid(int /*<<< orphan*/);
int /*<<< orphan*/ stderr;
scalar_t__ strcmp(char *, char *);
int main(int argc, char **argv) {
  char *mod;
  int i;
  int inserting = 0;
  int res;
  char **exec_argv;
  if (geteuid() != 0) {
    fprintf(stderr, "module_helper is not setuid root\n");
    return 1;
  }
  res = seteuid(getuid());
  if (res != 0) {
    perror("seteuid");
    return 1;
  }
  if (argc < 3)
    error(argc, argv);
  if (strcmp(argv[1], "insert") && strcmp(argv[1], "remove"))
    error(argc, argv);
  exec_argv = malloc(argc * sizeof(char *));
  if (!strcmp(argv[1], "insert"))
    inserting = 1;
  mod = argv[2];
  if (inserting) {
    check_whitelist_module_path(mod, argc, argv);
    exec_argv[0] = "/sbin/insmod";
    exec_argv[1] = mod;
    for (i = 3; i < argc; i++) {
      exec_argv[i - 1] = argv[i];
    }
    exec_argv[argc - 1] = NULL;
  } else {
    check_whitelist_module(mod, argc, argv);
    exec_argv[0] = "/sbin/rmmod";
    exec_argv[1] = mod;
    exec_argv[2] = NULL;
  }
  res = seteuid(0);
  if (res != 0) {
    perror("seteuid");
    return 1;
  }
  execve(exec_argv[0], exec_argv, NULL);
  perror("execv failed");
  return 1;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x20(%rbp)
mov    $0x0,%al
call   1050 <geteuid@plt>
cmp    $0x0,%rax
je     11ff <main+0x4f>
mov    0x2dfb(%rip),%rax
mov    (%rax),%edi
lea    0xe12(%rip),%rsi
call   1080 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    13e9 <main+0x239>
mov    $0x0,%al
call   1040 <getuid@plt>
mov    %eax,%edi
call   10d0 <seteuid@plt>
mov    %eax,-0x24(%rbp)
cmpl   $0x0,-0x24(%rbp)
je     1232 <main+0x82>
lea    0xe01(%rip),%rdi
call   10b0 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    13e9 <main+0x239>
cmpl   $0x3,-0x8(%rbp)
jge    1248 <main+0x98>
mov    -0x8(%rbp),%edi
mov    -0x10(%rbp),%rsi
call   10a0 <error@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xdd3(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
je     1290 <main+0xe0>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xdbc(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
je     1290 <main+0xe0>
mov    -0x8(%rbp),%edi
mov    -0x10(%rbp),%rsi
call   10a0 <error@plt>
movslq -0x8(%rbp),%rax
shl    $0x3,%rax
mov    %eax,%edi
call   1090 <malloc@plt>
mov    %rax,-0x30(%rbp)
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xd78(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    12c8 <main+0x118>
movl   $0x1,-0x20(%rbp)
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rax
mov    %rax,-0x18(%rbp)
cmpl   $0x0,-0x20(%rbp)
je     1360 <main+0x1b0>
mov    -0x18(%rbp),%rdi
mov    -0x8(%rbp),%esi
mov    -0x10(%rbp),%rdx
call   10c0 <check_whitelist_module_path@plt>
mov    -0x30(%rbp),%rax
lea    0xd3f(%rip),%rcx
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x30(%rbp),%rax
mov    %rcx,0x8(%rax)
movl   $0x3,-0x1c(%rbp)
mov    -0x1c(%rbp),%eax
cmp    -0x8(%rbp),%eax
jge    1346 <main+0x196>
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
mov    (%rax,%rcx,8),%rdx
mov    -0x30(%rbp),%rax
mov    -0x1c(%rbp),%ecx
sub    $0x1,%ecx
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    130f <main+0x15f>
mov    -0x30(%rbp),%rax
mov    -0x8(%rbp),%ecx
sub    $0x1,%ecx
movslq %ecx,%rcx
movq   $0x0,(%rax,%rcx,8)
jmp    1396 <main+0x1e6>
mov    -0x18(%rbp),%rdi
mov    -0x8(%rbp),%esi
mov    -0x10(%rbp),%rdx
call   1030 <check_whitelist_module@plt>
mov    -0x30(%rbp),%rax
lea    0xcca(%rip),%rcx
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x30(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x30(%rbp),%rax
movq   $0x0,0x10(%rax)
xor    %edi,%edi
call   10d0 <seteuid@plt>
mov    %eax,-0x24(%rbp)
cmpl   $0x0,-0x24(%rbp)
je     13c2 <main+0x212>
lea    0xc71(%rip),%rdi
call   10b0 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    13e9 <main+0x239>
mov    -0x30(%rbp),%rax
mov    (%rax),%rdi
mov    -0x30(%rbp),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   1060 <execve@plt>
lea    0xc74(%rip),%rdi
call   10b0 <perror@plt>
movl   $0x1,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r12
push   %rbx
push   %rax
mov    %rsi,%rbx
mov    %edi,%r14d
xor    %eax,%eax
call   1050 <geteuid@plt>
test   %rax,%rax
je     1200 <main+0x40>
mov    0x2dff(%rip),%rax
mov    (%rax),%edi
lea    0xe16(%rip),%rsi
call   1080 <fprintf@plt>
mov    $0x1,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret
xor    %eax,%eax
call   1040 <getuid@plt>
mov    %eax,%edi
call   10e0 <seteuid@plt>
test   %eax,%eax
jne    1312 <main+0x152>
cmp    $0x2,%r14d
jg     1227 <main+0x67>
mov    %r14d,%edi
mov    %rbx,%rsi
call   10b0 <error@plt>
mov    0x8(%rbx),%rdi
lea    0xdf8(%rip),%rsi
call   1070 <strcmp@plt>
test   %rax,%rax
je     125c <main+0x9c>
mov    0x8(%rbx),%rdi
lea    0xdea(%rip),%rsi
call   1070 <strcmp@plt>
test   %rax,%rax
je     125c <main+0x9c>
mov    %r14d,%edi
mov    %rbx,%rsi
call   10b0 <error@plt>
lea    0x0(,%r14,8),%edi
call   10a0 <malloc@plt>
mov    %rax,%r15
mov    0x8(%rbx),%rdi
lea    0xdb3(%rip),%rsi
call   1070 <strcmp@plt>
mov    0x10(%rbx),%r12
mov    %r12,%rdi
test   %rax,%rax
jne    12cb <main+0x10b>
mov    %r14d,%esi
mov    %rbx,%rdx
call   10d0 <check_whitelist_module_path@plt>
lea    0xd9e(%rip),%rax
mov    %rax,(%r15)
mov    %r12,0x8(%r15)
cmp    $0x4,%r14d
jl     12c2 <main+0x102>
mov    %r15,%rdi
add    $0x10,%rdi
add    $0x18,%rbx
lea    -0x3(%r14),%edx
shl    $0x3,%rdx
mov    %rbx,%rsi
call   1090 <memcpy@plt>
add    $0xffffffff,%r14d
movslq %r14d,%rax
jmp    12e9 <main+0x129>
mov    %r14d,%esi
mov    %rbx,%rdx
call   1030 <check_whitelist_module@plt>
lea    0xd68(%rip),%rax
mov    %rax,(%r15)
mov    %r12,0x8(%r15)
mov    $0x2,%eax
movq   $0x0,(%r15,%rax,8)
xor    %edi,%edi
call   10e0 <seteuid@plt>
test   %eax,%eax
jne    1312 <main+0x152>
mov    (%r15),%rdi
mov    %r15,%rsi
xor    %edx,%edx
call   1060 <execve@plt>
lea    0xd41(%rip),%rdi
jmp    1319 <main+0x159>
lea    0xd09(%rip),%rdi
call   10c0 <perror@plt>
jmp    11ef <main+0x2f>

LLVM IR (-O0):
@stderr = global i32 0
@.str = [34 x i8] c"module_helper is not setuid root\0A\00"
@.str.1 = [8 x i8] c"seteuid\00"
@.str.2 = [7 x i8] c"insert\00"
@.str.3 = [7 x i8] c"remove\00"
@.str.4 = [13 x i8] c"/sbin/insmod\00"
@.str.5 = [12 x i8] c"/sbin/rmmod\00"
@.str.6 = [13 x i8] c"execv failed\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i8**
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %8
%11 = call i64 (...) @geteuid()
%12 = icmp ne i64 %11, 0
br i1 %12, label %13, label %16
13: ; preds = %2
%14 = load i32, i32* @stderr
%15 = call i32 @fprintf(i32 %14, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str, i64 0, i64 0))
store i32 1, i32* %3
br label %123
16: ; preds = %2
%17 = call i32 (...) @getuid()
%18 = call i32 @seteuid(i32 %17)
store i32 %18, i32* %9
%19 = load i32, i32* %9
%20 = icmp ne i32 %19, 0
br i1 %20, label %21, label %23
21: ; preds = %16
%22 = call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
store i32 1, i32* %3
br label %123
23: ; preds = %16
%24 = load i32, i32* %4
%25 = icmp slt i32 %24, 3
br i1 %25, label %26, label %30
26: ; preds = %23
%27 = load i32, i32* %4
%28 = load i8**, i8*** %5
%29 = call i32 @error(i32 %27, i8** %28)
br label %30
30: ; preds = %26, %23
%31 = load i8**, i8*** %5
%32 = getelementptr inbounds i8*, i8** %31, i64 1
%33 = load i8*, i8** %32
%34 = call i64 @strcmp(i8* %33, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
%35 = icmp ne i64 %34, 0
br i1 %35, label %36, label %46
36: ; preds = %30
%37 = load i8**, i8*** %5
%38 = getelementptr inbounds i8*, i8** %37, i64 1
%39 = load i8*, i8** %38
%40 = call i64 @strcmp(i8* %39, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.3, i64 0, i64 0))
%41 = icmp ne i64 %40, 0
br i1 %41, label %42, label %46
42: ; preds = %36
%43 = load i32, i32* %4
%44 = load i8**, i8*** %5
%45 = call i32 @error(i32 %43, i8** %44)
br label %46
46: ; preds = %42, %36, %30
%47 = load i32, i32* %4
%48 = sext i32 %47 to i64
%49 = mul i64 %48, 8
%50 = trunc i64 %49 to i32
%51 = call i8** @malloc(i32 %50)
store i8** %51, i8*** %10
%52 = load i8**, i8*** %5
%53 = getelementptr inbounds i8*, i8** %52, i64 1
%54 = load i8*, i8** %53
%55 = call i64 @strcmp(i8* %54, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
%56 = icmp ne i64 %55, 0
br i1 %56, label %58, label %57
57: ; preds = %46
store i32 1, i32* %8
br label %58
58: ; preds = %57, %46
%59 = load i8**, i8*** %5
%60 = getelementptr inbounds i8*, i8** %59, i64 2
%61 = load i8*, i8** %60
store i8* %61, i8** %6
%62 = load i32, i32* %8
%63 = icmp ne i32 %62, 0
br i1 %63, label %64, label %98
64: ; preds = %58
%65 = load i8*, i8** %6
%66 = load i32, i32* %4
%67 = load i8**, i8*** %5
%68 = call i32 @check_whitelist_module_path(i8* %65, i32 %66, i8** %67)
%69 = load i8**, i8*** %10
%70 = getelementptr inbounds i8*, i8** %69, i64 0
store i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.4, i64 0, i64 0), i8** %70
%71 = load i8*, i8** %6
%72 = load i8**, i8*** %10
%73 = getelementptr inbounds i8*, i8** %72, i64 1
store i8* %71, i8** %73
store i32 3, i32* %7
br label %74
74: ; preds = %89, %64
%75 = load i32, i32* %7
%76 = load i32, i32* %4
%77 = icmp slt i32 %75, %76
br i1 %77, label %78, label %92
78: ; preds = %74
%79 = load i8**, i8*** %5
%80 = load i32, i32* %7
%81 = sext i32 %80 to i64
%82 = getelementptr inbounds i8*, i8** %79, i64 %81
%83 = load i8*, i8** %82
%84 = load i8**, i8*** %10
%85 = load i32, i32* %7
%86 = sub nsw i32 %85, 1
%87 = sext i32 %86 to i64
%88 = getelementptr inbounds i8*, i8** %84, i64 %87
store i8* %83, i8** %88
br label %89
89: ; preds = %78
%90 = load i32, i32* %7
%91 = add nsw i32 %90, 1
store i32 %91, i32* %7
br label %74
92: ; preds = %74
%93 = load i8**, i8*** %10
%94 = load i32, i32* %4
%95 = sub nsw i32 %94, 1
%96 = sext i32 %95 to i64
%97 = getelementptr inbounds i8*, i8** %93, i64 %96
store i8* null, i8** %97
br label %110
98: ; preds = %58
%99 = load i8*, i8** %6
%100 = load i32, i32* %4
%101 = load i8**, i8*** %5
%102 = call i32 @check_whitelist_module(i8* %99, i32 %100, i8** %101)
%103 = load i8**, i8*** %10
%104 = getelementptr inbounds i8*, i8** %103, i64 0
store i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0), i8** %104
%105 = load i8*, i8** %6
%106 = load i8**, i8*** %10
%107 = getelementptr inbounds i8*, i8** %106, i64 1
store i8* %105, i8** %107
%108 = load i8**, i8*** %10
%109 = getelementptr inbounds i8*, i8** %108, i64 2
store i8* null, i8** %109
br label %110
110: ; preds = %98, %92
%111 = call i32 @seteuid(i32 0)
store i32 %111, i32* %9
%112 = load i32, i32* %9
%113 = icmp ne i32 %112, 0
br i1 %113, label %114, label %116
114: ; preds = %110
%115 = call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
store i32 1, i32* %3
br label %123
116: ; preds = %110
%117 = load i8**, i8*** %10
%118 = getelementptr inbounds i8*, i8** %117, i64 0
%119 = load i8*, i8** %118
%120 = load i8**, i8*** %10
%121 = call i32 @execve(i8* %119, i8** %120, i32* null)
%122 = call i32 @perror(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0))
store i32 1, i32* %3
br label %123
123: ; preds = %116, %114, %21, %13
%124 = load i32, i32* %3
ret i32 %124
}

LLVM IR (-O2):
@stderr = global i32 0
@.str = [34 x i8] c"module_helper is not setuid root\0A\00"
@.str.1 = [8 x i8] c"seteuid\00"
@.str.2 = [7 x i8] c"insert\00"
@.str.3 = [7 x i8] c"remove\00"
@.str.4 = [13 x i8] c"/sbin/insmod\00"
@.str.5 = [12 x i8] c"/sbin/rmmod\00"
@.str.6 = [13 x i8] c"execv failed\00"
define i32 @main(i32 %0, i8** %1) {
%3 = tail call i64 (...) @geteuid()
%4 = icmp eq i64 %3, 0
br i1 %4, label %8, label %5
5: ; preds = %2
%6 = load i32, i32* @stderr
%7 = tail call i32 @fprintf(i32 %6, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str, i64 0, i64 0))
br label %66
8: ; preds = %2
%9 = tail call i32 (...) @getuid()
%10 = tail call i32 @seteuid(i32 %9)
%11 = icmp eq i32 %10, 0
br i1 %11, label %14, label %12
12: ; preds = %8
%13 = tail call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
br label %66
14: ; preds = %8
%15 = icmp slt i32 %0, 3
br i1 %15, label %16, label %18
16: ; preds = %14
%17 = tail call i32 @error(i32 %0, i8** %1)
br label %18
18: ; preds = %16, %14
%19 = getelementptr inbounds i8*, i8** %1, i64 1
%20 = load i8*, i8** %19
%21 = tail call i64 @strcmp(i8* %20, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
%22 = icmp eq i64 %21, 0
br i1 %22, label %29, label %23
23: ; preds = %18
%24 = load i8*, i8** %19
%25 = tail call i64 @strcmp(i8* %24, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.3, i64 0, i64 0))
%26 = icmp eq i64 %25, 0
br i1 %26, label %29, label %27
27: ; preds = %23
%28 = tail call i32 @error(i32 %0, i8** %1)
br label %29
29: ; preds = %27, %23, %18
%30 = shl i32 %0, 3
%31 = tail call i8** @malloc(i32 %30)
%32 = load i8*, i8** %19
%33 = tail call i64 @strcmp(i8* %32, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
%34 = icmp eq i64 %33, 0
%35 = getelementptr inbounds i8*, i8** %1, i64 2
%36 = load i8*, i8** %35
br i1 %34, label %37, label %52
37: ; preds = %29
%38 = tail call i32 @check_whitelist_module_path(i8* %36, i32 %0, i8** %1)
store i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.4, i64 0, i64 0), i8** %31
%39 = getelementptr inbounds i8*, i8** %31, i64 1
store i8* %36, i8** %39
%40 = icmp sgt i32 %0, 3
br i1 %40, label %41, label %49
41: ; preds = %37
%42 = getelementptr i8*, i8** %31, i64 2
%43 = bitcast i8** %42 to i8*
%44 = getelementptr i8*, i8** %1, i64 3
%45 = bitcast i8** %44 to i8*
%46 = add nsw i32 %0, -3
%47 = zext i32 %46 to i64
%48 = shl nuw nsw i64 %47, 3
br label %49
49: ; preds = %41, %37
%50 = add nsw i32 %0, -1
%51 = sext i32 %50 to i64
br label %55
52: ; preds = %29
%53 = tail call i32 @check_whitelist_module(i8* %36, i32 %0, i8** %1)
store i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0), i8** %31
%54 = getelementptr inbounds i8*, i8** %31, i64 1
store i8* %36, i8** %54
br label %55
55: ; preds = %52, %49
%56 = phi i64 [ 2, %52 ], [ %51, %49 ]
%57 = getelementptr inbounds i8*, i8** %31, i64 %56
store i8* null, i8** %57
%58 = tail call i32 @seteuid(i32 0)
%59 = icmp eq i32 %58, 0
br i1 %59, label %62, label %60
60: ; preds = %55
%61 = tail call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
br label %66
62: ; preds = %55
%63 = load i8*, i8** %31
%64 = tail call i32 @execve(i8* %63, i8** %31, i32* null)
%65 = tail call i32 @perror(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0))
br label %66
66: ; preds = %62, %60, %12, %5
ret i32 1
}