#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ uint64_t;

/* Variables and functions */
int /*<<< orphan*/ AT_FDCWD;
int /*<<< orphan*/ O_RDWR;
int /*<<< orphan*/ SYS_mknodat;
int /*<<< orphan*/ SYS_mount;
int /*<<< orphan*/ S_IFBLK;
int /*<<< orphan*/ makedev(int, int);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ sprintf(char *, char *, long, ...);
int /*<<< orphan*/ strcat(char *, char *);
int strlen(char *);
int /*<<< orphan*/ syscall(int /*<<< orphan*/, scalar_t__, scalar_t__, char *,
                           scalar_t__, ...);
uintptr_t syz_fuseblk_mount(uintptr_t a0, uintptr_t a1, uintptr_t a2,
                            uintptr_t a3, uintptr_t a4, uintptr_t a5,
                            uintptr_t a6, uintptr_t a7) {
  uint64_t target = a0;
  uint64_t blkdev = a1;
  uint64_t mode = a2;
  uint64_t uid = a3;
  uint64_t gid = a4;
  uint64_t maxread = a5;
  uint64_t blksize = a6;
  uint64_t flags = a7;
  int fd = open("/dev/fuse", O_RDWR);
  if (fd == -1)
    return fd;
  if (syscall(SYS_mknodat, AT_FDCWD, blkdev, S_IFBLK, makedev(7, 199)))
    return fd;
  char buf[256];
  sprintf(buf, "fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o", fd, (long)uid,
          (long)gid, (unsigned)mode & ~3u);
  if (maxread != 0)
    sprintf(buf + strlen(buf), ",max_read=%ld", (long)maxread);
  if (blksize != 0)
    sprintf(buf + strlen(buf), ",blksize=%ld", (long)blksize);
  if (mode & 1)
    strcat(buf, ",default_permissions");
  if (mode & 2)
    strcat(buf, ",allow_other");
  syscall(SYS_mount, blkdev, target, "fuseblk", flags, buf);
  return fd;
}


x86 assembly (clang, -O0):
<syz_fuseblk_mount>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1b0,%rsp
mov    0x18(%rbp),%rax
mov    0x10(%rbp),%rax
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9,-0x38(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0x58(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x60(%rbp)
mov    -0x38(%rbp),%rax
mov    %rax,-0x68(%rbp)
mov    0x10(%rbp),%rax
mov    %rax,-0x70(%rbp)
mov    0x18(%rbp),%rax
mov    %rax,-0x78(%rbp)
mov    0x2e16(%rip),%rax
mov    (%rax),%esi
lea    0xe25(%rip),%rdi
call   1050 <open@plt>
mov    %eax,-0x7c(%rbp)
cmpl   $0xffffffff,-0x7c(%rbp)
jne    11fa <syz_fuseblk_mount+0x9a>
movslq -0x7c(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    13ae <syz_fuseblk_mount+0x24e>
mov    0x2dc7(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x19c(%rbp)
mov    0x2da8(%rip),%rax
movslq (%rax),%rax
mov    %rax,-0x198(%rbp)
mov    -0x48(%rbp),%rax
mov    %rax,-0x190(%rbp)
mov    0x2da4(%rip),%rax
movslq (%rax),%rax
mov    %rax,-0x188(%rbp)
mov    $0x7,%edi
mov    $0xc7,%esi
call   1060 <makedev@plt>
mov    -0x19c(%rbp),%edi
mov    -0x198(%rbp),%rsi
mov    -0x190(%rbp),%rdx
mov    -0x188(%rbp),%rcx
movslq %eax,%r8
mov    $0x0,%al
call   1040 <syscall@plt>
cmp    $0x0,%eax
je     1280 <syz_fuseblk_mount+0x120>
movslq -0x7c(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    13ae <syz_fuseblk_mount+0x24e>
lea    -0x180(%rbp),%rdi
movslq -0x7c(%rbp),%rdx
mov    -0x58(%rbp),%rcx
mov    -0x60(%rbp),%r8
mov    -0x50(%rbp),%rax
mov    %eax,%r9d
and    $0xfffffffc,%r9d
lea    0xd65(%rip),%rsi
mov    $0x0,%al
call   1080 <sprintf@plt>
cmpq   $0x0,-0x68(%rbp)
je     12ef <syz_fuseblk_mount+0x18f>
lea    -0x180(%rbp),%rax
mov    %rax,-0x1a8(%rbp)
lea    -0x180(%rbp),%rdi
call   1030 <strlen@plt>
mov    -0x1a8(%rbp),%rdi
cltq
add    %rax,%rdi
mov    -0x68(%rbp),%rdx
lea    0xd4e(%rip),%rsi
mov    $0x0,%al
call   1080 <sprintf@plt>
cmpq   $0x0,-0x70(%rbp)
je     1332 <syz_fuseblk_mount+0x1d2>
lea    -0x180(%rbp),%rax
mov    %rax,-0x1b0(%rbp)
lea    -0x180(%rbp),%rdi
call   1030 <strlen@plt>
mov    -0x1b0(%rbp),%rdi
cltq
add    %rax,%rdi
mov    -0x70(%rbp),%rdx
lea    0xd19(%rip),%rsi
mov    $0x0,%al
call   1080 <sprintf@plt>
mov    -0x50(%rbp),%rax
and    $0x1,%rax
cmp    $0x0,%rax
je     1357 <syz_fuseblk_mount+0x1f7>
lea    -0x180(%rbp),%rdi
lea    0xcff(%rip),%rsi
call   1070 <strcat@plt>
mov    -0x50(%rbp),%rax
and    $0x2,%rax
cmp    $0x0,%rax
je     137c <syz_fuseblk_mount+0x21c>
lea    -0x180(%rbp),%rdi
lea    0xcef(%rip),%rsi
call   1070 <strcat@plt>
mov    0x2c5d(%rip),%rax
mov    (%rax),%edi
mov    -0x48(%rbp),%rsi
mov    -0x40(%rbp),%rdx
mov    -0x78(%rbp),%r8
lea    -0x180(%rbp),%r9
lea    0xcd4(%rip),%rcx
mov    $0x0,%al
call   1040 <syscall@plt>
movslq -0x7c(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x1b0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<syz_fuseblk_mount>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x128,%rsp
mov    %r9,%r12
mov    %r8,%r13
mov    %rcx,0x18(%rsp)
mov    %rdx,%r14
mov    %rsi,%r15
mov    %rdi,%rbp
mov    0x2e5c(%rip),%rax
mov    (%rax),%esi
lea    0xe6b(%rip),%rdi
call   1050 <open@plt>
cmp    $0xffffffff,%eax
je     1204 <syz_fuseblk_mount+0xa4>
mov    %eax,%ebx
mov    %r13,(%rsp)
mov    %r12,0x8(%rsp)
mov    %r14,0x10(%rsp)
mov    0x2e12(%rip),%rax
mov    %r15,%r14
mov    (%rax),%r15d
mov    0x2df5(%rip),%rax
movslq (%rax),%r12
mov    0x2e03(%rip),%rax
movslq (%rax),%r13
mov    $0x7,%edi
mov    $0xc7,%esi
call   1060 <makedev@plt>
movslq %eax,%r8
mov    %r15d,%edi
mov    %r14,%r15
mov    %r12,%rsi
mov    %r14,%rdx
mov    %r13,%rcx
xor    %eax,%eax
call   1040 <syscall@plt>
test   %eax,%eax
je     1210 <syz_fuseblk_mount+0xb0>
movslq %ebx,%rbx
jmp    12fa <syz_fuseblk_mount+0x19a>
mov    $0xffffffffffffffff,%rbx
jmp    12fa <syz_fuseblk_mount+0x19a>
mov    0x160(%rsp),%r13
movslq %ebx,%rbx
mov    0x10(%rsp),%r12
mov    %r12d,%r9d
and    $0xfffffffc,%r9d
lea    0xddc(%rip),%rsi
lea    0x20(%rsp),%rdi
mov    %rbx,%rdx
mov    0x18(%rsp),%rcx
mov    (%rsp),%r8
xor    %eax,%eax
call   1080 <sprintf@plt>
mov    0x8(%rsp),%r14
test   %r14,%r14
je     1275 <syz_fuseblk_mount+0x115>
lea    0x20(%rsp),%rdi
call   1030 <strlen@plt>
cltq
lea    (%rsp,%rax,1),%rdi
add    $0x20,%rdi
lea    0xdcb(%rip),%rsi
mov    %r14,%rdx
xor    %eax,%eax
call   1080 <sprintf@plt>
test   %r13,%r13
je     129f <syz_fuseblk_mount+0x13f>
lea    0x20(%rsp),%rdi
call   1030 <strlen@plt>
cltq
lea    (%rsp,%rax,1),%rdi
add    $0x20,%rdi
lea    0xdaf(%rip),%rsi
mov    %r13,%rdx
xor    %eax,%eax
call   1080 <sprintf@plt>
test   $0x1,%r12b
je     12b6 <syz_fuseblk_mount+0x156>
lea    0xda5(%rip),%rsi
lea    0x20(%rsp),%rdi
call   1070 <strcat@plt>
mov    0x168(%rsp),%r14
test   $0x2,%r12b
je     12d5 <syz_fuseblk_mount+0x175>
lea    0xd9b(%rip),%rsi
lea    0x20(%rsp),%rdi
call   1070 <strcat@plt>
mov    0x2d04(%rip),%rax
mov    (%rax),%edi
lea    0xd8e(%rip),%rcx
lea    0x20(%rsp),%r9
mov    %r15,%rsi
mov    %rbp,%rdx
mov    %r14,%r8
xor    %eax,%eax
call   1040 <syscall@plt>
mov    %rbx,%rax
add    $0x128,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [10 x i8] c"/dev/fuse\00"
@O_RDWR = global i32 0
@SYS_mknodat = global i32 0
@AT_FDCWD = global i32 0
@S_IFBLK = global i32 0
@.str.1 = [44 x i8] c"fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o\00"
@.str.2 = [14 x i8] c",max_read=%ld\00"
@.str.3 = [13 x i8] c",blksize=%ld\00"
@.str.4 = [21 x i8] c",default_permissions\00"
@.str.5 = [13 x i8] c",allow_other\00"
@SYS_mount = global i32 0
@.str.6 = [8 x i8] c"fuseblk\00"
define i64 @syz_fuseblk_mount(i64 %0, i64 %1, i64 %2, i64 %3, i64 %4, i64 %5, i64 %6, i64 %7) {
%9 = alloca i64
%10 = alloca i64
%11 = alloca i64
%12 = alloca i64
%13 = alloca i64
%14 = alloca i64
%15 = alloca i64
%16 = alloca i64
%17 = alloca i64
%18 = alloca i64
%19 = alloca i64
%20 = alloca i64
%21 = alloca i64
%22 = alloca i64
%23 = alloca i64
%24 = alloca i64
%25 = alloca i64
%26 = alloca i32
%27 = alloca [256 x i8]
store i64 %0, i64* %10
store i64 %1, i64* %11
store i64 %2, i64* %12
store i64 %3, i64* %13
store i64 %4, i64* %14
store i64 %5, i64* %15
store i64 %6, i64* %16
store i64 %7, i64* %17
%28 = load i64, i64* %10
store i64 %28, i64* %18
%29 = load i64, i64* %11
store i64 %29, i64* %19
%30 = load i64, i64* %12
store i64 %30, i64* %20
%31 = load i64, i64* %13
store i64 %31, i64* %21
%32 = load i64, i64* %14
store i64 %32, i64* %22
%33 = load i64, i64* %15
store i64 %33, i64* %23
%34 = load i64, i64* %16
store i64 %34, i64* %24
%35 = load i64, i64* %17
store i64 %35, i64* %25
%36 = load i32, i32* @O_RDWR
%37 = call i32 @open(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 %36)
store i32 %37, i32* %26
%38 = load i32, i32* %26
%39 = icmp eq i32 %38, -1
br i1 %39, label %40, label %43
40: ; preds = %8
%41 = load i32, i32* %26
%42 = sext i32 %41 to i64
store i64 %42, i64* %9
br label %112
43: ; preds = %8
%44 = load i32, i32* @SYS_mknodat
%45 = load i32, i32* @AT_FDCWD
%46 = sext i32 %45 to i64
%47 = load i64, i64* %19
%48 = load i32, i32* @S_IFBLK
%49 = sext i32 %48 to i64
%50 = inttoptr i64 %49 to i8*
%51 = call i32 @makedev(i32 7, i32 199)
%52 = sext i32 %51 to i64
%53 = call i32 (i32, i64, i64, i8*, i64, ...) @syscall(i32 %44, i64 %46, i64 %47, i8* %50, i64 %52)
%54 = icmp ne i32 %53, 0
br i1 %54, label %55, label %58
55: ; preds = %43
%56 = load i32, i32* %26
%57 = sext i32 %56 to i64
store i64 %57, i64* %9
br label %112
58: ; preds = %43
%59 = getelementptr inbounds [256 x i8], [256 x i8]* %27, i64 0, i64 0
%60 = load i32, i32* %26
%61 = sext i32 %60 to i64
%62 = load i64, i64* %21
%63 = load i64, i64* %22
%64 = load i64, i64* %20
%65 = trunc i64 %64 to i32
%66 = and i32 %65, -4
%67 = call i32 (i8*, i8*, i64, ...) @sprintf(i8* %59, i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.1, i64 0, i64 0), i64 %61, i64 %62, i64 %63, i32 %66)
%68 = load i64, i64* %23
%69 = icmp ne i64 %68, 0
br i1 %69, label %70, label %78
70: ; preds = %58
%71 = getelementptr inbounds [256 x i8], [256 x i8]* %27, i64 0, i64 0
%72 = getelementptr inbounds [256 x i8], [256 x i8]* %27, i64 0, i64 0
%73 = call i32 @strlen(i8* %72)
%74 = sext i32 %73 to i64
%75 = getelementptr inbounds i8, i8* %71, i64 %74
%76 = load i64, i64* %23
%77 = call i32 (i8*, i8*, i64, ...) @sprintf(i8* %75, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0), i64 %76)
br label %78
78: ; preds = %70, %58
%79 = load i64, i64* %24
%80 = icmp ne i64 %79, 0
br i1 %80, label %81, label %89
81: ; preds = %78
%82 = getelementptr inbounds [256 x i8], [256 x i8]* %27, i64 0, i64 0
%83 = getelementptr inbounds [256 x i8], [256 x i8]* %27, i64 0, i64 0
%84 = call i32 @strlen(i8* %83)
%85 = sext i32 %84 to i64
%86 = getelementptr inbounds i8, i8* %82, i64 %85
%87 = load i64, i64* %24
%88 = call i32 (i8*, i8*, i64, ...) @sprintf(i8* %86, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.3, i64 0, i64 0), i64 %87)
br label %89
89: ; preds = %81, %78
%90 = load i64, i64* %20
%91 = and i64 %90, 1
%92 = icmp ne i64 %91, 0
br i1 %92, label %93, label %96
93: ; preds = %89
%94 = getelementptr inbounds [256 x i8], [256 x i8]* %27, i64 0, i64 0
%95 = call i32 @strcat(i8* %94, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.4, i64 0, i64 0))
br label %96
96: ; preds = %93, %89
%97 = load i64, i64* %20
%98 = and i64 %97, 2
%99 = icmp ne i64 %98, 0
br i1 %99, label %100, label %103
100: ; preds = %96
%101 = getelementptr inbounds [256 x i8], [256 x i8]* %27, i64 0, i64 0
%102 = call i32 @strcat(i8* %101, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.5, i64 0, i64 0))
br label %103
103: ; preds = %100, %96
%104 = load i32, i32* @SYS_mount
%105 = load i64, i64* %19
%106 = load i64, i64* %18
%107 = load i64, i64* %25
%108 = getelementptr inbounds [256 x i8], [256 x i8]* %27, i64 0, i64 0
%109 = call i32 (i32, i64, i64, i8*, i64, ...) @syscall(i32 %104, i64 %105, i64 %106, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i64 %107, i8* %108)
%110 = load i32, i32* %26
%111 = sext i32 %110 to i64
store i64 %111, i64* %9
br label %112
112: ; preds = %103, %55, %40
%113 = load i64, i64* %9
ret i64 %113
}

LLVM IR (-O2):
@.str = [10 x i8] c"/dev/fuse\00"
@O_RDWR = global i32 0
@SYS_mknodat = global i32 0
@AT_FDCWD = global i32 0
@S_IFBLK = global i32 0
@.str.1 = [44 x i8] c"fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o\00"
@.str.2 = [14 x i8] c",max_read=%ld\00"
@.str.3 = [13 x i8] c",blksize=%ld\00"
@.str.4 = [21 x i8] c",default_permissions\00"
@.str.5 = [13 x i8] c",allow_other\00"
@SYS_mount = global i32 0
@.str.6 = [8 x i8] c"fuseblk\00"
define i64 @syz_fuseblk_mount(i64 %0, i64 %1, i64 %2, i64 %3, i64 %4, i64 %5, i64 %6, i64 %7) {
%9 = alloca [256 x i8]
%10 = load i32, i32* @O_RDWR
%11 = tail call i32 @open(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 %10)
%12 = icmp eq i32 %11, -1
br i1 %12, label %58, label %13
13: ; preds = %8
%14 = load i32, i32* @SYS_mknodat
%15 = load i32, i32* @AT_FDCWD
%16 = sext i32 %15 to i64
%17 = load i32, i32* @S_IFBLK
%18 = sext i32 %17 to i64
%19 = inttoptr i64 %18 to i8*
%20 = tail call i32 @makedev(i32 7, i32 199)
%21 = sext i32 %20 to i64
%22 = tail call i32 (i32, i64, i64, i8*, i64, ...) @syscall(i32 %14, i64 %16, i64 %1, i8* %19, i64 %21)
%23 = icmp eq i32 %22, 0
br i1 %23, label %26, label %24
24: ; preds = %13
%25 = sext i32 %11 to i64
br label %58
26: ; preds = %13
%27 = getelementptr inbounds [256 x i8], [256 x i8]* %9, i64 0, i64 0
%28 = sext i32 %11 to i64
%29 = trunc i64 %2 to i32
%30 = and i32 %29, -4
%31 = call i32 (i8*, i8*, i64, ...) @sprintf(i8* %27, i8* dereferenceable(1) getelementptr inbounds ([44 x i8], [44 x i8]* @.str.1, i64 0, i64 0), i64 %28, i64 %3, i64 %4, i32 %30)
%32 = icmp eq i64 %5, 0
br i1 %32, label %38, label %33
33: ; preds = %26
%34 = call i32 @strlen(i8* %27)
%35 = sext i32 %34 to i64
%36 = getelementptr inbounds [256 x i8], [256 x i8]* %9, i64 0, i64 %35
%37 = call i32 (i8*, i8*, i64, ...) @sprintf(i8* %36, i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0), i64 %5)
br label %38
38: ; preds = %33, %26
%39 = icmp eq i64 %6, 0
br i1 %39, label %45, label %40
40: ; preds = %38
%41 = call i32 @strlen(i8* %27)
%42 = sext i32 %41 to i64
%43 = getelementptr inbounds [256 x i8], [256 x i8]* %9, i64 0, i64 %42
%44 = call i32 (i8*, i8*, i64, ...) @sprintf(i8* %43, i8* dereferenceable(1) getelementptr inbounds ([13 x i8], [13 x i8]* @.str.3, i64 0, i64 0), i64 %6)
br label %45
45: ; preds = %40, %38
%46 = and i64 %2, 1
%47 = icmp eq i64 %46, 0
br i1 %47, label %50, label %48
48: ; preds = %45
%49 = call i32 @strcat(i8* %27, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.4, i64 0, i64 0))
br label %50
50: ; preds = %48, %45
%51 = and i64 %2, 2
%52 = icmp eq i64 %51, 0
br i1 %52, label %55, label %53
53: ; preds = %50
%54 = call i32 @strcat(i8* %27, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.5, i64 0, i64 0))
br label %55
55: ; preds = %53, %50
%56 = load i32, i32* @SYS_mount
%57 = call i32 (i32, i64, i64, i8*, i64, ...) @syscall(i32 %56, i64 %1, i64 %0, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.6, i64 0, i64 0), i64 %7, i8* %27)
br label %58
58: ; preds = %8, %55, %24
%59 = phi i64 [ %25, %24 ], [ %28, %55 ], [ -1, %8 ]
ret i64 %59
}