#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct passwd {
  int pw_uid;
};
typedef int pid_t;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ EXIT_FAILURE;
int F_OK;
int /*<<< orphan*/ SIGKILL;
int W_OK;
scalar_t__ access(char *, int);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int fork();
int /*<<< orphan*/ fprintf(int /*<<< orphan*/ *, char *, ...);
int fscanf(int /*<<< orphan*/ *, char *, int *);
struct passwd *getpwnam(char const *);
scalar_t__ getuid();
int kill(int, int /*<<< orphan*/);
int mkdir(char *, int);
int /*<<< orphan*/ perror(char *);
scalar_t__ pipe(int *);
int read(int, char *, int);
int /*<<< orphan*/ setuid(int);
int /*<<< orphan*/ sleep(int);
int /*<<< orphan*/ sprintf(char *, char *, int);
int /*<<< orphan*/ *stderr;
int /*<<< orphan*/ strcpy(char *, char *);
int write(int, char *, int);
int main(int argc, char const *argv[]) {
  if (getuid() != 0) {
    fprintf(stderr, "run me as root.\n");
    return 1;
  }
  if (argc != 3) {
    fprintf(stderr, "give one user and his sched_rt_runtime.\n");
    return 2;
  }
  if (access("/sys/kernel/uids/0/cpu_rt_runtime", F_OK | W_OK) != 0) {
    fprintf(stderr,
            "please set \"CONFIG_USER_SCHED=y\" in your kernel config first\n");
    return 3;
  }
  struct passwd *pw;
  int fork_res;
  pw = getpwnam(argv[1]);
  if (pw == NULL)
    return 4;
  int pipefd[2];
  if (pipe(pipefd) != 0) {
    perror("fail create pipe");
    exit(EXIT_FAILURE);
  }
  fork_res = fork();
  switch (fork_res) {
  case (pid_t)-1: {
    return 5;
  } break;
  case (pid_t)0: {
    close(pipefd[0]);
    if (setuid(pw->pw_uid)) {
      if (write(pipefd[1], "1", 1) == -1) {
        perror("child write");
        exit(EXIT_FAILURE);
      };
    } else {
      if (write(pipefd[1], "0", 1) == -1) {
        perror("child write");
        exit(EXIT_FAILURE);
      };
    }
    close(pipefd[1]);
    while (1) {
      sleep(600000);
    }
  } break;
  default: {
    close(pipefd[1]);
    char buf;
    if (read(pipefd[0], &buf, 1) == -1) {
      perror("parent read");
      exit(EXIT_FAILURE);
    };
    close(pipefd[0]);
    if (buf != '0') {
      fprintf(stderr, "Fail to setuid in child process...\n");
      exit(EXIT_FAILURE);
    }
    char pid_file[50];
    strcpy(pid_file, "/var/run/userdaemon/");
    if (access(pid_file, F_OK) == -1) {
      if (mkdir(pid_file, 00755) == -1) {
        perror("mkdir");
        exit(EXIT_FAILURE);
      }
    }
    sprintf(pid_file, "/var/run/userdaemon/%u", pw->pw_uid);
    FILE *ptr_f;
    if (access(pid_file, F_OK) == 0) {
      ptr_f = fopen(pid_file, "r");
      int r_pid = 0;
      if (fscanf(ptr_f, "%d", &r_pid) == 1) {
        if (kill((pid_t)r_pid, SIGKILL) == -1) {
          perror("kill");
          exit(EXIT_FAILURE);
        }
      }
      fclose(ptr_f);
    }
    ptr_f = fopen(pid_file, "w");
    fprintf(ptr_f, "%d\n", fork_res);
    fclose(ptr_f);
    char rt_file[50];
    sprintf(rt_file, "/sys/kernel/uids/%d/cpu_rt_runtime", pw->pw_uid);
    if (access(rt_file, F_OK | W_OK) != 0) {
      fprintf(stderr, "fail to acess:\"%s\"\n", rt_file);
      return 6;
    }
    ptr_f = fopen(rt_file, "w");
    fprintf(ptr_f, "%s", argv[2]);
    fclose(ptr_f);
    return 0;
  }
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0xb0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    $0x0,%al
call   1070 <getuid@plt>
cmp    $0x0,%rax
je     128e <main+0x4e>
mov    0x2d67(%rip),%rax
mov    (%rax),%rdi
lea    0xd85(%rip),%rsi
mov    $0x0,%al
call   10d0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    16ac <main+0x46c>
cmpl   $0x3,-0x8(%rbp)
je     12bc <main+0x7c>
mov    0x2d39(%rip),%rax
mov    (%rax),%rdi
lea    0xd68(%rip),%rsi
mov    $0x0,%al
call   10d0 <fprintf@plt>
movl   $0x2,-0x4(%rbp)
jmp    16ac <main+0x46c>
mov    0x2cf5(%rip),%rax
mov    (%rax),%esi
mov    0x2d1c(%rip),%rax
or     (%rax),%esi
lea    0xd65(%rip),%rdi
call   10f0 <access@plt>
cmp    $0x0,%rax
je     1308 <main+0xc8>
mov    0x2ced(%rip),%rax
mov    (%rax),%rdi
lea    0xd67(%rip),%rsi
mov    $0x0,%al
call   10d0 <fprintf@plt>
movl   $0x3,-0x4(%rbp)
jmp    16ac <main+0x46c>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   10c0 <getpwnam@plt>
mov    %rax,-0x18(%rbp)
cmpq   $0x0,-0x18(%rbp)
jne    1330 <main+0xf0>
movl   $0x4,-0x4(%rbp)
jmp    16ac <main+0x46c>
lea    -0x24(%rbp),%rdi
call   10a0 <pipe@plt>
cmp    $0x0,%rax
je     135d <main+0x11d>
lea    0xd50(%rip),%rdi
call   1110 <perror@plt>
mov    0x2c7a(%rip),%rax
mov    (%rax),%edi
call   1130 <exit@plt>
xor    %eax,%eax
call   1160 <fork@plt>
mov    %eax,-0x1c(%rbp)
mov    -0x1c(%rbp),%eax
mov    %eax,-0xa4(%rbp)
sub    $0xffffffff,%eax
je     1391 <main+0x151>
jmp    137e <main+0x13e>
mov    -0xa4(%rbp),%eax
test   %eax,%eax
je     139d <main+0x15d>
jmp    1448 <main+0x208>
movl   $0x5,-0x4(%rbp)
jmp    16ac <main+0x46c>
mov    -0x24(%rbp),%edi
call   1090 <close@plt>
mov    -0x18(%rbp),%rax
mov    (%rax),%edi
call   1140 <setuid@plt>
cmp    $0x0,%eax
je     13f5 <main+0x1b5>
mov    -0x20(%rbp),%edi
lea    0xce8(%rip),%rsi
mov    $0x1,%edx
call   1050 <write@plt>
cmp    $0xffffffff,%eax
jne    13f0 <main+0x1b0>
lea    0xcd0(%rip),%rdi
call   1110 <perror@plt>
mov    0x2be7(%rip),%rax
mov    (%rax),%edi
call   1130 <exit@plt>
jmp    1431 <main+0x1f1>
mov    -0x20(%rbp),%edi
lea    0xcba(%rip),%rsi
mov    $0x1,%edx
call   1050 <write@plt>
cmp    $0xffffffff,%eax
jne    142c <main+0x1ec>
lea    0xc94(%rip),%rdi
call   1110 <perror@plt>
mov    0x2bab(%rip),%rax
mov    (%rax),%edi
call   1130 <exit@plt>
jmp    1431 <main+0x1f1>
mov    -0x20(%rbp),%edi
call   1090 <close@plt>
mov    $0x927c0,%edi
call   1150 <sleep@plt>
jmp    1439 <main+0x1f9>
mov    -0x20(%rbp),%edi
call   1090 <close@plt>
mov    -0x24(%rbp),%edi
lea    -0x25(%rbp),%rsi
mov    $0x1,%edx
call   10b0 <read@plt>
cmp    $0xffffffff,%eax
jne    1484 <main+0x244>
lea    0xc4a(%rip),%rdi
call   1110 <perror@plt>
mov    0x2b53(%rip),%rax
mov    (%rax),%edi
call   1130 <exit@plt>
mov    -0x24(%rbp),%edi
call   1090 <close@plt>
movsbl -0x25(%rbp),%eax
cmp    $0x30,%eax
je     14bf <main+0x27f>
mov    0x2b38(%rip),%rax
mov    (%rax),%rdi
lea    0xc1d(%rip),%rsi
mov    $0x0,%al
call   10d0 <fprintf@plt>
mov    0x2b18(%rip),%rax
mov    (%rax),%edi
call   1130 <exit@plt>
lea    -0x60(%rbp),%rdi
lea    0xc21(%rip),%rsi
call   1030 <strcpy@plt>
lea    -0x60(%rbp),%rdi
mov    0x2ade(%rip),%rax
mov    (%rax),%esi
call   10f0 <access@plt>
cmp    $0xffffffffffffffff,%rax
jne    1521 <main+0x2e1>
lea    -0x60(%rbp),%rdi
mov    $0x1ed,%esi
call   1040 <mkdir@plt>
cmp    $0xffffffff,%eax
jne    151c <main+0x2dc>
lea    0xbf7(%rip),%rdi
call   1110 <perror@plt>
mov    0x2abb(%rip),%rax
mov    (%rax),%edi
call   1130 <exit@plt>
jmp    1521 <main+0x2e1>
lea    -0x60(%rbp),%rdi
mov    -0x18(%rbp),%rax
mov    (%rax),%edx
lea    0xbd4(%rip),%rsi
call   1120 <sprintf@plt>
lea    -0x60(%rbp),%rdi
mov    0x2a76(%rip),%rax
mov    (%rax),%esi
call   10f0 <access@plt>
cmp    $0x0,%rax
jne    15cd <main+0x38d>
lea    -0x60(%rbp),%rdi
lea    0xba6(%rip),%rsi
call   1100 <fopen@plt>
mov    %rax,-0x68(%rbp)
movl   $0x0,-0x6c(%rbp)
mov    -0x68(%rbp),%rdi
lea    0xba4(%rip),%rsi
lea    -0x6c(%rbp),%rdx
call   1080 <fscanf@plt>
cmp    $0x1,%eax
jne    15c4 <main+0x384>
mov    -0x6c(%rbp),%edi
mov    0x2a33(%rip),%rax
mov    (%rax),%esi
call   10e0 <kill@plt>
cmp    $0xffffffff,%eax
jne    15bf <main+0x37f>
lea    0xb74(%rip),%rdi
call   1110 <perror@plt>
mov    0x2a18(%rip),%rax
mov    (%rax),%edi
call   1130 <exit@plt>
jmp    15c4 <main+0x384>
mov    -0x68(%rbp),%rdi
call   1060 <fclose@plt>
lea    -0x60(%rbp),%rdi
lea    0xb4d(%rip),%rsi
call   1100 <fopen@plt>
mov    %rax,-0x68(%rbp)
mov    -0x68(%rbp),%rdi
mov    -0x1c(%rbp),%edx
lea    0xb38(%rip),%rsi
mov    $0x0,%al
call   10d0 <fprintf@plt>
mov    -0x68(%rbp),%rdi
call   1060 <fclose@plt>
lea    -0xa0(%rbp),%rdi
mov    -0x18(%rbp),%rax
mov    (%rax),%edx
lea    0xb18(%rip),%rsi
call   1120 <sprintf@plt>
lea    -0xa0(%rbp),%rdi
mov    0x2992(%rip),%rax
mov    (%rax),%esi
mov    0x29b9(%rip),%rax
or     (%rax),%esi
call   10f0 <access@plt>
cmp    $0x0,%rax
je     166b <main+0x42b>
mov    0x2991(%rip),%rax
mov    (%rax),%rdi
lea    -0xa0(%rbp),%rdx
lea    0xaf6(%rip),%rsi
mov    $0x0,%al
call   10d0 <fprintf@plt>
movl   $0x6,-0x4(%rbp)
jmp    16ac <main+0x46c>
lea    -0xa0(%rbp),%rdi
lea    0xaac(%rip),%rsi
call   1100 <fopen@plt>
mov    %rax,-0x68(%rbp)
mov    -0x68(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdx
lea    0xacd(%rip),%rsi
mov    $0x0,%al
call   10d0 <fprintf@plt>
mov    -0x68(%rbp),%rdi
call   1060 <fclose@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0xb0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x88,%rsp
mov    %rsi,%rbx
mov    %edi,%ebp
xor    %eax,%eax
call   1070 <getuid@plt>
test   %rax,%rax
je     12a9 <main+0x49>
mov    0x2d4f(%rip),%rax
mov    (%rax),%rcx
lea    0xd6d(%rip),%rdi
mov    $0x10,%esi
mov    $0x1,%edx
call   1150 <fwrite@plt>
mov    $0x1,%ebp
jmp    1320 <main+0xc0>
cmp    $0x3,%ebp
jne    12fb <main+0x9b>
mov    0x2d03(%rip),%r13
mov    0x2d2c(%rip),%r15
mov    (%r15),%esi
or     0x0(%r13),%esi
lea    0xd70(%rip),%rdi
call   1100 <access@plt>
test   %rax,%rax
je     1334 <main+0xd4>
mov    0x2cfd(%rip),%rax
mov    (%rax),%rcx
lea    0xd77(%rip),%rdi
mov    $0x3d,%esi
mov    $0x1,%edx
call   1150 <fwrite@plt>
mov    $0x3,%ebp
jmp    1320 <main+0xc0>
mov    0x2cd6(%rip),%rax
mov    (%rax),%rcx
lea    0xd05(%rip),%rdi
mov    $0x28,%esi
mov    $0x1,%edx
call   1150 <fwrite@plt>
mov    $0x2,%ebp
mov    %ebp,%eax
add    $0x88,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x8(%rbx),%rdi
call   10d0 <getpwnam@plt>
test   %rax,%rax
je     1393 <main+0x133>
mov    %rax,%r14
lea    0x4(%rsp),%rdi
call   10b0 <pipe@plt>
test   %rax,%rax
jne    1589 <main+0x329>
xor    %eax,%eax
call   1180 <fork@plt>
cmp    $0xffffffff,%eax
je     139a <main+0x13a>
mov    %eax,%ebp
test   %eax,%eax
jne    13a4 <main+0x144>
mov    0x4(%rsp),%edi
call   10a0 <close@plt>
mov    (%r14),%edi
call   1160 <setuid@plt>
mov    0x8(%rsp),%edi
test   %eax,%eax
je     1524 <main+0x2c4>
lea    0xd1d(%rip),%rsi
jmp    152b <main+0x2cb>
mov    $0x4,%ebp
jmp    1320 <main+0xc0>
mov    $0x5,%ebp
jmp    1320 <main+0xc0>
mov    0x8(%rsp),%edi
call   10a0 <close@plt>
mov    0x4(%rsp),%edi
lea    0x3(%rsp),%rsi
mov    $0x1,%edx
call   10c0 <read@plt>
cmp    $0xffffffff,%eax
je     1592 <main+0x332>
mov    0x4(%rsp),%edi
call   10a0 <close@plt>
cmpb   $0x30,0x3(%rsp)
jne    159b <main+0x33b>
lea    0xd07(%rip),%rsi
lea    0x50(%rsp),%r12
mov    %r12,%rdi
call   1030 <strcpy@plt>
mov    0x0(%r13),%esi
mov    %r12,%rdi
call   1100 <access@plt>
cmp    $0xffffffffffffffff,%rax
jne    141b <main+0x1bb>
lea    0x50(%rsp),%rdi
mov    $0x1ed,%esi
call   1040 <mkdir@plt>
cmp    $0xffffffff,%eax
je     15c6 <main+0x366>
mov    %ebp,0xc(%rsp)
mov    (%r14),%edx
lea    0xcdd(%rip),%rsi
lea    0x50(%rsp),%rbp
mov    %rbp,%rdi
call   1130 <sprintf@plt>
mov    0x0(%r13),%esi
mov    %rbp,%rdi
call   1100 <access@plt>
test   %rax,%rax
jne    149f <main+0x23f>
lea    0xcb6(%rip),%rsi
lea    0x50(%rsp),%rdi
call   1110 <fopen@plt>
mov    %rax,%rbp
movl   $0x0,0x10(%rsp)
lea    0xcb3(%rip),%rsi
lea    0x10(%rsp),%rdx
mov    %rax,%rdi
call   1090 <fscanf@plt>
cmp    $0x1,%eax
jne    1497 <main+0x237>
mov    0x10(%rsp),%edi
mov    0x2b41(%rip),%rax
mov    (%rax),%esi
call   10f0 <kill@plt>
cmp    $0xffffffff,%eax
je     15cf <main+0x36f>
mov    %rbp,%rdi
call   1060 <fclose@plt>
lea    0xc7f(%rip),%rsi
lea    0x50(%rsp),%rdi
call   1110 <fopen@plt>
mov    %rax,%r12
lea    0xc6d(%rip),%rsi
xor    %ebp,%ebp
mov    %rax,%rdi
mov    0xc(%rsp),%edx
xor    %eax,%eax
call   10e0 <fprintf@plt>
mov    %r12,%rdi
call   1060 <fclose@plt>
mov    (%r14),%edx
lea    0xc4f(%rip),%rsi
lea    0x10(%rsp),%r14
mov    %r14,%rdi
call   1130 <sprintf@plt>
mov    (%r15),%esi
or     0x0(%r13),%esi
mov    %r14,%rdi
call   1100 <access@plt>
test   %rax,%rax
je     155c <main+0x2fc>
mov    0x2ad4(%rip),%rax
mov    (%rax),%rdi
lea    0xc40(%rip),%rsi
lea    0x10(%rsp),%rdx
xor    %eax,%eax
call   10e0 <fprintf@plt>
mov    $0x6,%ebp
jmp    1320 <main+0xc0>
lea    0xb8e(%rip),%rsi
mov    $0x1,%edx
call   1050 <write@plt>
cmp    $0xffffffff,%eax
je     15bd <main+0x35d>
mov    0x8(%rsp),%edi
call   10a0 <close@plt>
nopw   0x0(%rax,%rax,1)
mov    $0x927c0,%edi
call   1170 <sleep@plt>
jmp    1550 <main+0x2f0>
lea    0xbc2(%rip),%rsi
lea    0x10(%rsp),%rdi
call   1110 <fopen@plt>
mov    %rax,%r14
mov    0x10(%rbx),%rdi
mov    %rax,%rsi
call   1080 <fputs@plt>
mov    %r14,%rdi
call   1060 <fclose@plt>
jmp    1320 <main+0xc0>
lea    0xb0a(%rip),%rdi
jmp    15d6 <main+0x376>
lea    0xb22(%rip),%rdi
jmp    15d6 <main+0x376>
mov    0x2a36(%rip),%rax
mov    (%rax),%rcx
lea    0xb1b(%rip),%rdi
mov    $0x23,%esi
mov    $0x1,%edx
call   1150 <fwrite@plt>
jmp    15db <main+0x37b>
lea    0xae9(%rip),%rdi
jmp    15d6 <main+0x376>
lea    0xb33(%rip),%rdi
jmp    15d6 <main+0x376>
lea    0xb4a(%rip),%rdi
call   1120 <perror@plt>
mov    0x29ee(%rip),%rax
mov    (%rax),%edi
call   1140 <exit@plt>

LLVM IR (-O0):
%struct.passwd = type { i32 }
@stderr = global i32* null
@.str = [17 x i8] c"run me as root.\0A\00"
@.str.1 = [41 x i8] c"give one user and his sched_rt_runtime.\0A\00"
@.str.2 = [34 x i8] c"/sys/kernel/uids/0/cpu_rt_runtime\00"
@F_OK = global i32 0
@W_OK = global i32 0
@.str.3 = [62 x i8] c"please set \22CONFIG_USER_SCHED=y\22 in your kernel config first\0A\00"
@.str.4 = [17 x i8] c"fail create pipe\00"
@EXIT_FAILURE = global i32 0
@.str.5 = [2 x i8] c"1\00"
@.str.6 = [12 x i8] c"child write\00"
@.str.7 = [2 x i8] c"0\00"
@.str.8 = [12 x i8] c"parent read\00"
@.str.9 = [36 x i8] c"Fail to setuid in child process...\0A\00"
@.str.10 = [21 x i8] c"/var/run/userdaemon/\00"
@.str.11 = [6 x i8] c"mkdir\00"
@.str.12 = [23 x i8] c"/var/run/userdaemon/%u\00"
@.str.13 = [2 x i8] c"r\00"
@.str.14 = [3 x i8] c"%d\00"
@SIGKILL = global i32 0
@.str.15 = [5 x i8] c"kill\00"
@.str.16 = [2 x i8] c"w\00"
@.str.17 = [4 x i8] c"%d\0A\00"
@.str.18 = [35 x i8] c"/sys/kernel/uids/%d/cpu_rt_runtime\00"
@.str.19 = [20 x i8] c"fail to acess:\22%s\22\0A\00"
@.str.20 = [3 x i8] c"%s\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca %struct.passwd*
%7 = alloca i32
%8 = alloca [2 x i32]
%9 = alloca i8
%10 = alloca [50 x i8]
%11 = alloca i32*
%12 = alloca i32
%13 = alloca [50 x i8]
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%14 = call i64 (...) @getuid()
%15 = icmp ne i64 %14, 0
br i1 %15, label %16, label %19
16: ; preds = %2
%17 = load i32*, i32** @stderr
%18 = call i32 (i32*, i8*, ...) @fprintf(i32* %17, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str, i64 0, i64 0))
store i32 1, i32* %3
br label %191
19: ; preds = %2
%20 = load i32, i32* %4
%21 = icmp ne i32 %20, 3
br i1 %21, label %22, label %25
22: ; preds = %19
%23 = load i32*, i32** @stderr
%24 = call i32 (i32*, i8*, ...) @fprintf(i32* %23, i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.1, i64 0, i64 0))
store i32 2, i32* %3
br label %191
25: ; preds = %19
%26 = load i32, i32* @F_OK
%27 = load i32, i32* @W_OK
%28 = or i32 %26, %27
%29 = call i64 @access(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.2, i64 0, i64 0), i32 %28)
%30 = icmp ne i64 %29, 0
br i1 %30, label %31, label %34
31: ; preds = %25
%32 = load i32*, i32** @stderr
%33 = call i32 (i32*, i8*, ...) @fprintf(i32* %32, i8* getelementptr inbounds ([62 x i8], [62 x i8]* @.str.3, i64 0, i64 0))
store i32 3, i32* %3
br label %191
34: ; preds = %25
%35 = load i8**, i8*** %5
%36 = getelementptr inbounds i8*, i8** %35, i64 1
%37 = load i8*, i8** %36
%38 = call %struct.passwd* @getpwnam(i8* %37)
store %struct.passwd* %38, %struct.passwd** %6
%39 = load %struct.passwd*, %struct.passwd** %6
%40 = icmp eq %struct.passwd* %39, null
br i1 %40, label %41, label %42
41: ; preds = %34
store i32 4, i32* %3
br label %191
42: ; preds = %34
%43 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 0
%44 = call i64 @pipe(i32* %43)
%45 = icmp ne i64 %44, 0
br i1 %45, label %46, label %50
46: ; preds = %42
%47 = call i32 @perror(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0))
%48 = load i32, i32* @EXIT_FAILURE
%49 = call i32 @exit(i32 %48)
unreachable
50: ; preds = %42
%51 = call i32 (...) @fork()
store i32 %51, i32* %7
%52 = load i32, i32* %7
switch i32 %52, label %89 [
i32 -1, label %53
i32 0, label %54
]
53: ; preds = %50
store i32 5, i32* %3
br label %191
54: ; preds = %50
%55 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 0
%56 = load i32, i32* %55
%57 = call i32 @close(i32 %56)
%58 = load %struct.passwd*, %struct.passwd** %6
%59 = getelementptr inbounds %struct.passwd, %struct.passwd* %58, i32 0, i32 0
%60 = load i32, i32* %59
%61 = call i32 @setuid(i32 %60)
%62 = icmp ne i32 %61, 0
br i1 %62, label %63, label %73
63: ; preds = %54
%64 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 1
%65 = load i32, i32* %64
%66 = call i32 @write(i32 %65, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0), i32 1)
%67 = icmp eq i32 %66, -1
br i1 %67, label %68, label %72
68: ; preds = %63
%69 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0))
%70 = load i32, i32* @EXIT_FAILURE
%71 = call i32 @exit(i32 %70)
unreachable
72: ; preds = %63
br label %83
73: ; preds = %54
%74 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 1
%75 = load i32, i32* %74
%76 = call i32 @write(i32 %75, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0), i32 1)
%77 = icmp eq i32 %76, -1
br i1 %77, label %78, label %82
78: ; preds = %73
%79 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0))
%80 = load i32, i32* @EXIT_FAILURE
%81 = call i32 @exit(i32 %80)
unreachable
82: ; preds = %73
br label %83
83: ; preds = %82, %72
%84 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 1
%85 = load i32, i32* %84
%86 = call i32 @close(i32 %85)
br label %87
87: ; preds = %83, %87
%88 = call i32 @sleep(i32 600000)
br label %87
89: ; preds = %50
%90 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 1
%91 = load i32, i32* %90
%92 = call i32 @close(i32 %91)
%93 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 0
%94 = load i32, i32* %93
%95 = call i32 @read(i32 %94, i8* %9, i32 1)
%96 = icmp eq i32 %95, -1
br i1 %96, label %97, label %101
97: ; preds = %89
%98 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.8, i64 0, i64 0))
%99 = load i32, i32* @EXIT_FAILURE
%100 = call i32 @exit(i32 %99)
unreachable
101: ; preds = %89
%102 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 0
%103 = load i32, i32* %102
%104 = call i32 @close(i32 %103)
%105 = load i8, i8* %9
%106 = sext i8 %105 to i32
%107 = icmp ne i32 %106, 48
br i1 %107, label %108, label %113
108: ; preds = %101
%109 = load i32*, i32** @stderr
%110 = call i32 (i32*, i8*, ...) @fprintf(i32* %109, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.9, i64 0, i64 0))
%111 = load i32, i32* @EXIT_FAILURE
%112 = call i32 @exit(i32 %111)
unreachable
113: ; preds = %101
%114 = getelementptr inbounds [50 x i8], [50 x i8]* %10, i64 0, i64 0
%115 = call i32 @strcpy(i8* %114, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.10, i64 0, i64 0))
%116 = getelementptr inbounds [50 x i8], [50 x i8]* %10, i64 0, i64 0
%117 = load i32, i32* @F_OK
%118 = call i64 @access(i8* %116, i32 %117)
%119 = icmp eq i64 %118, -1
br i1 %119, label %120, label %129
120: ; preds = %113
%121 = getelementptr inbounds [50 x i8], [50 x i8]* %10, i64 0, i64 0
%122 = call i32 @mkdir(i8* %121, i32 493)
%123 = icmp eq i32 %122, -1
br i1 %123, label %124, label %128
124: ; preds = %120
%125 = call i32 @perror(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.11, i64 0, i64 0))
%126 = load i32, i32* @EXIT_FAILURE
%127 = call i32 @exit(i32 %126)
unreachable
128: ; preds = %120
br label %129
129: ; preds = %128, %113
%130 = getelementptr inbounds [50 x i8], [50 x i8]* %10, i64 0, i64 0
%131 = load %struct.passwd*, %struct.passwd** %6
%132 = getelementptr inbounds %struct.passwd, %struct.passwd* %131, i32 0, i32 0
%133 = load i32, i32* %132
%134 = call i32 @sprintf(i8* %130, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.12, i64 0, i64 0), i32 %133)
%135 = getelementptr inbounds [50 x i8], [50 x i8]* %10, i64 0, i64 0
%136 = load i32, i32* @F_OK
%137 = call i64 @access(i8* %135, i32 %136)
%138 = icmp eq i64 %137, 0
br i1 %138, label %139, label %158
139: ; preds = %129
%140 = getelementptr inbounds [50 x i8], [50 x i8]* %10, i64 0, i64 0
%141 = call i32* @fopen(i8* %140, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.13, i64 0, i64 0))
store i32* %141, i32** %11
store i32 0, i32* %12
%142 = load i32*, i32** %11
%143 = call i32 @fscanf(i32* %142, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.14, i64 0, i64 0), i32* %12)
%144 = icmp eq i32 %143, 1
br i1 %144, label %145, label %155
145: ; preds = %139
%146 = load i32, i32* %12
%147 = load i32, i32* @SIGKILL
%148 = call i32 @kill(i32 %146, i32 %147)
%149 = icmp eq i32 %148, -1
br i1 %149, label %150, label %154
150: ; preds = %145
%151 = call i32 @perror(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.15, i64 0, i64 0))
%152 = load i32, i32* @EXIT_FAILURE
%153 = call i32 @exit(i32 %152)
unreachable
154: ; preds = %145
br label %155
155: ; preds = %154, %139
%156 = load i32*, i32** %11
%157 = call i32 @fclose(i32* %156)
br label %158
158: ; preds = %155, %129
%159 = getelementptr inbounds [50 x i8], [50 x i8]* %10, i64 0, i64 0
%160 = call i32* @fopen(i8* %159, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.16, i64 0, i64 0))
store i32* %160, i32** %11
%161 = load i32*, i32** %11
%162 = load i32, i32* %7
%163 = call i32 (i32*, i8*, ...) @fprintf(i32* %161, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.17, i64 0, i64 0), i32 %162)
%164 = load i32*, i32** %11
%165 = call i32 @fclose(i32* %164)
%166 = getelementptr inbounds [50 x i8], [50 x i8]* %13, i64 0, i64 0
%167 = load %struct.passwd*, %struct.passwd** %6
%168 = getelementptr inbounds %struct.passwd, %struct.passwd* %167, i32 0, i32 0
%169 = load i32, i32* %168
%170 = call i32 @sprintf(i8* %166, i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.18, i64 0, i64 0), i32 %169)
%171 = getelementptr inbounds [50 x i8], [50 x i8]* %13, i64 0, i64 0
%172 = load i32, i32* @F_OK
%173 = load i32, i32* @W_OK
%174 = or i32 %172, %173
%175 = call i64 @access(i8* %171, i32 %174)
%176 = icmp ne i64 %175, 0
br i1 %176, label %177, label %181
177: ; preds = %158
%178 = load i32*, i32** @stderr
%179 = getelementptr inbounds [50 x i8], [50 x i8]* %13, i64 0, i64 0
%180 = call i32 (i32*, i8*, ...) @fprintf(i32* %178, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.19, i64 0, i64 0), i8* %179)
store i32 6, i32* %3
br label %191
181: ; preds = %158
%182 = getelementptr inbounds [50 x i8], [50 x i8]* %13, i64 0, i64 0
%183 = call i32* @fopen(i8* %182, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.16, i64 0, i64 0))
store i32* %183, i32** %11
%184 = load i32*, i32** %11
%185 = load i8**, i8*** %5
%186 = getelementptr inbounds i8*, i8** %185, i64 2
%187 = load i8*, i8** %186
%188 = call i32 (i32*, i8*, ...) @fprintf(i32* %184, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.20, i64 0, i64 0), i8* %187)
%189 = load i32*, i32** %11
%190 = call i32 @fclose(i32* %189)
store i32 0, i32* %3
br label %191
191: ; preds = %181, %177, %53, %41, %31, %22, %16
%192 = load i32, i32* %3
ret i32 %192
}

LLVM IR (-O2):
%struct.passwd = type { i32 }
@stderr = global i32* null
@.str = [17 x i8] c"run me as root.\0A\00"
@.str.1 = [41 x i8] c"give one user and his sched_rt_runtime.\0A\00"
@.str.2 = [34 x i8] c"/sys/kernel/uids/0/cpu_rt_runtime\00"
@F_OK = global i32 0
@W_OK = global i32 0
@.str.3 = [62 x i8] c"please set \22CONFIG_USER_SCHED=y\22 in your kernel config first\0A\00"
@.str.4 = [17 x i8] c"fail create pipe\00"
@EXIT_FAILURE = global i32 0
@.str.5 = [2 x i8] c"1\00"
@.str.6 = [12 x i8] c"child write\00"
@.str.7 = [2 x i8] c"0\00"
@.str.8 = [12 x i8] c"parent read\00"
@.str.9 = [36 x i8] c"Fail to setuid in child process...\0A\00"
@.str.10 = [21 x i8] c"/var/run/userdaemon/\00"
@.str.11 = [6 x i8] c"mkdir\00"
@.str.12 = [23 x i8] c"/var/run/userdaemon/%u\00"
@.str.13 = [2 x i8] c"r\00"
@.str.14 = [3 x i8] c"%d\00"
@SIGKILL = global i32 0
@.str.15 = [5 x i8] c"kill\00"
@.str.16 = [2 x i8] c"w\00"
@.str.17 = [4 x i8] c"%d\0A\00"
@.str.18 = [35 x i8] c"/sys/kernel/uids/%d/cpu_rt_runtime\00"
@.str.19 = [20 x i8] c"fail to acess:\22%s\22\0A\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [2 x i32]
%4 = alloca i8
%5 = alloca [50 x i8]
%6 = alloca i32
%7 = alloca [50 x i8]
%8 = tail call i64 (...) @getuid()
%9 = icmp eq i64 %8, 0
br i1 %9, label %13, label %10
10: ; preds = %2
%11 = load i32*, i32** @stderr
%12 = tail call i64 @fwrite(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str, i64 0, i64 0), i64 16, i64 1, i32* %11)
br label %154
13: ; preds = %2
%14 = icmp eq i32 %0, 3
br i1 %14, label %18, label %15
15: ; preds = %13
%16 = load i32*, i32** @stderr
%17 = tail call i64 @fwrite(i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.1, i64 0, i64 0), i64 40, i64 1, i32* %16)
br label %154
18: ; preds = %13
%19 = load i32, i32* @F_OK
%20 = load i32, i32* @W_OK
%21 = or i32 %20, %19
%22 = tail call i64 @access(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.2, i64 0, i64 0), i32 %21)
%23 = icmp eq i64 %22, 0
br i1 %23, label %27, label %24
24: ; preds = %18
%25 = load i32*, i32** @stderr
%26 = tail call i64 @fwrite(i8* getelementptr inbounds ([62 x i8], [62 x i8]* @.str.3, i64 0, i64 0), i64 61, i64 1, i32* %25)
br label %154
27: ; preds = %18
%28 = getelementptr inbounds i8*, i8** %1, i64 1
%29 = load i8*, i8** %28
%30 = tail call %struct.passwd* @getpwnam(i8* %29)
%31 = icmp eq %struct.passwd* %30, null
br i1 %31, label %154, label %32
32: ; preds = %27
%33 = bitcast [2 x i32]* %3 to i8*
%34 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 0
%35 = call i64 @pipe(i32* %34)
%36 = icmp eq i64 %35, 0
br i1 %36, label %41, label %37
37: ; preds = %32
%38 = call i32 @perror(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.4, i64 0, i64 0))
%39 = load i32, i32* @EXIT_FAILURE
%40 = call i32 @exit(i32 %39)
unreachable
41: ; preds = %32
%42 = call i32 (...) @fork()
switch i32 %42, label %72 [
i32 -1, label %152
i32 0, label %43
]
43: ; preds = %41
%44 = load i32, i32* %34
%45 = call i32 @close(i32 %44)
%46 = getelementptr inbounds %struct.passwd, %struct.passwd* %30, i64 0, i32 0
%47 = load i32, i32* %46
%48 = call i32 @setuid(i32 %47)
%49 = icmp eq i32 %48, 0
%50 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%51 = load i32, i32* %50
br i1 %49, label %59, label %52
52: ; preds = %43
%53 = call i32 @write(i32 %51, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0), i32 1)
%54 = icmp eq i32 %53, -1
br i1 %54, label %55, label %66
55: ; preds = %52
%56 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0))
%57 = load i32, i32* @EXIT_FAILURE
%58 = call i32 @exit(i32 %57)
unreachable
59: ; preds = %43
%60 = call i32 @write(i32 %51, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0), i32 1)
%61 = icmp eq i32 %60, -1
br i1 %61, label %62, label %66
62: ; preds = %59
%63 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0))
%64 = load i32, i32* @EXIT_FAILURE
%65 = call i32 @exit(i32 %64)
unreachable
66: ; preds = %59, %52
%67 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%68 = load i32, i32* %67
%69 = call i32 @close(i32 %68)
br label %70
70: ; preds = %70, %66
%71 = call i32 @sleep(i32 600000)
br label %70
72: ; preds = %41
%73 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%74 = load i32, i32* %73
%75 = call i32 @close(i32 %74)
%76 = load i32, i32* %34
%77 = call i32 @read(i32 %76, i8* %4, i32 1)
%78 = icmp eq i32 %77, -1
br i1 %78, label %79, label %83
79: ; preds = %72
%80 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.8, i64 0, i64 0))
%81 = load i32, i32* @EXIT_FAILURE
%82 = call i32 @exit(i32 %81)
unreachable
83: ; preds = %72
%84 = load i32, i32* %34
%85 = call i32 @close(i32 %84)
%86 = load i8, i8* %4
%87 = icmp eq i8 %86, 48
br i1 %87, label %93, label %88
88: ; preds = %83
%89 = load i32*, i32** @stderr
%90 = call i64 @fwrite(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.9, i64 0, i64 0), i64 35, i64 1, i32* %89)
%91 = load i32, i32* @EXIT_FAILURE
%92 = call i32 @exit(i32 %91)
unreachable
93: ; preds = %83
%94 = getelementptr inbounds [50 x i8], [50 x i8]* %5, i64 0, i64 0
%95 = call i32 @strcpy(i8* %94, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.10, i64 0, i64 0))
%96 = load i32, i32* @F_OK
%97 = call i64 @access(i8* %94, i32 %96)
%98 = icmp eq i64 %97, -1
br i1 %98, label %99, label %106
99: ; preds = %93
%100 = call i32 @mkdir(i8* %94, i32 493)
%101 = icmp eq i32 %100, -1
br i1 %101, label %102, label %106
102: ; preds = %99
%103 = call i32 @perror(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.11, i64 0, i64 0))
%104 = load i32, i32* @EXIT_FAILURE
%105 = call i32 @exit(i32 %104)
unreachable
106: ; preds = %99, %93
%107 = getelementptr inbounds %struct.passwd, %struct.passwd* %30, i64 0, i32 0
%108 = load i32, i32* %107
%109 = call i32 @sprintf(i8* %94, i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.12, i64 0, i64 0), i32 %108)
%110 = load i32, i32* @F_OK
%111 = call i64 @access(i8* %94, i32 %110)
%112 = icmp eq i64 %111, 0
br i1 %112, label %113, label %129
113: ; preds = %106
%114 = call i32* @fopen(i8* %94, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.13, i64 0, i64 0))
%115 = bitcast i32* %6 to i8*
store i32 0, i32* %6
%116 = call i32 @fscanf(i32* %114, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.14, i64 0, i64 0), i32* %6)
%117 = icmp eq i32 %116, 1
br i1 %117, label %118, label %127
118: ; preds = %113
%119 = load i32, i32* %6
%120 = load i32, i32* @SIGKILL
%121 = call i32 @kill(i32 %119, i32 %120)
%122 = icmp eq i32 %121, -1
br i1 %122, label %123, label %127
123: ; preds = %118
%124 = call i32 @perror(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.15, i64 0, i64 0))
%125 = load i32, i32* @EXIT_FAILURE
%126 = call i32 @exit(i32 %125)
unreachable
127: ; preds = %118, %113
%128 = call i32 @fclose(i32* %114)
br label %129
129: ; preds = %127, %106
%130 = call i32* @fopen(i8* %94, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.16, i64 0, i64 0))
%131 = call i32 (i32*, i8*, ...) @fprintf(i32* %130, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.17, i64 0, i64 0), i32 %42)
%132 = call i32 @fclose(i32* %130)
%133 = getelementptr inbounds [50 x i8], [50 x i8]* %7, i64 0, i64 0
%134 = load i32, i32* %107
%135 = call i32 @sprintf(i8* %133, i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @.str.18, i64 0, i64 0), i32 %134)
%136 = load i32, i32* @F_OK
%137 = load i32, i32* @W_OK
%138 = or i32 %137, %136
%139 = call i64 @access(i8* %133, i32 %138)
%140 = icmp eq i64 %139, 0
br i1 %140, label %144, label %141
141: ; preds = %129
%142 = load i32*, i32** @stderr
%143 = call i32 (i32*, i8*, ...) @fprintf(i32* %142, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.19, i64 0, i64 0), i8* %133)
br label %150
144: ; preds = %129
%145 = call i32* @fopen(i8* %133, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.16, i64 0, i64 0))
%146 = getelementptr inbounds i8*, i8** %1, i64 2
%147 = load i8*, i8** %146
%148 = call i32 @fputs(i8* %147, i32* %145)
%149 = call i32 @fclose(i32* %145)
br label %150
150: ; preds = %144, %141
%151 = phi i32 [ 6, %141 ], [ 0, %144 ]
br label %152
152: ; preds = %41, %150
%153 = phi i32 [ %151, %150 ], [ 5, %41 ]
br label %154
154: ; preds = %152, %27, %24, %15, %10
%155 = phi i32 [ 1, %10 ], [ 2, %15 ], [ 3, %24 ], [ %153, %152 ], [ 4, %27 ]
ret i32 %155
}