#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ tuple;
struct bpf_sock_tuple {
  int dummy;
};
struct bpf_sock {
  int family;
};
struct __sk_buff {
  int dummy;
};
typedef int __u32;

/* Variables and functions */
int /*<<< orphan*/ BPF_F_CURRENT_NETNS;
struct bpf_sock *bpf_sk_lookup_tcp(struct __sk_buff *, struct bpf_sock_tuple *,
                                   int, int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ bpf_sk_release(struct bpf_sock *);
__attribute__((section("fail_use_after_free"), used)) int
bpf_sk_lookup_uaf(struct __sk_buff *skb) {
  struct bpf_sock_tuple tuple = {};
  struct bpf_sock *sk;
  __u32 family = 0;
  sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), BPF_F_CURRENT_NETNS, 0);
  if (sk) {
    bpf_sk_release(sk);
    family = sk->family;
  }
  return family;
}


x86 assembly (clang, -O0):
<bpf_sk_lookup_uaf>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x8(%rbp)
lea    -0x10(%rbp),%rdi
xor    %esi,%esi
mov    $0x4,%edx
call   1040 <memset@plt>
movl   $0x0,-0x1c(%rbp)
mov    -0x8(%rbp),%rdi
mov    0x2e9a(%rip),%rax
mov    (%rax),%ecx
lea    -0x10(%rbp),%rsi
mov    $0x4,%edx
xor    %r8d,%r8d
call   1050 <bpf_sk_lookup_tcp@plt>
mov    %rax,-0x18(%rbp)
cmpq   $0x0,-0x18(%rbp)
je     1192 <bpf_sk_lookup_uaf+0x62>
mov    -0x18(%rbp),%rdi
call   1030 <bpf_sk_release@plt>
mov    -0x18(%rbp),%rax
mov    (%rax),%eax
mov    %eax,-0x1c(%rbp)
mov    -0x1c(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<bpf_sk_lookup_uaf>:
push   %rbp
push   %rbx
push   %rax
movl   $0x0,(%rsp)
mov    0x2ec7(%rip),%rax
mov    (%rax),%ecx
mov    %rsp,%rsi
xor    %ebp,%ebp
mov    $0x4,%edx
xor    %r8d,%r8d
call   1040 <bpf_sk_lookup_tcp@plt>
test   %rax,%rax
je     1157 <bpf_sk_lookup_uaf+0x37>
mov    %rax,%rbx
mov    %rax,%rdi
call   1030 <bpf_sk_release@plt>
mov    (%rbx),%ebp
mov    %ebp,%eax
add    $0x8,%rsp
pop    %rbx
pop    %rbp
ret

LLVM IR (-O0):
%struct.__sk_buff = type { i32 }
%struct.bpf_sock_tuple = type { i32 }
%struct.bpf_sock = type { i32 }
@BPF_F_CURRENT_NETNS = global i32 0
@llvm.compiler.used = appending global [1 x i8*] [i8* bitcast (i32 (%struct.__sk_buff*)* @bpf_sk_lookup_uaf to i8*)], section "llvm.metadata"
define i32 @bpf_sk_lookup_uaf(%struct.__sk_buff* %0) section "fail_use_after_free" {
%2 = alloca %struct.__sk_buff*
%3 = alloca %struct.bpf_sock_tuple
%4 = alloca %struct.bpf_sock*
%5 = alloca i32
store %struct.__sk_buff* %0, %struct.__sk_buff** %2
%6 = bitcast %struct.bpf_sock_tuple* %3 to i8*
store i32 0, i32* %5
%7 = load %struct.__sk_buff*, %struct.__sk_buff** %2
%8 = load i32, i32* @BPF_F_CURRENT_NETNS
%9 = call %struct.bpf_sock* @bpf_sk_lookup_tcp(%struct.__sk_buff* %7, %struct.bpf_sock_tuple* %3, i32 4, i32 %8, i32 0)
store %struct.bpf_sock* %9, %struct.bpf_sock** %4
%10 = load %struct.bpf_sock*, %struct.bpf_sock** %4
%11 = icmp ne %struct.bpf_sock* %10, null
br i1 %11, label %12, label %18
12: ; preds = %1
%13 = load %struct.bpf_sock*, %struct.bpf_sock** %4
%14 = call i32 @bpf_sk_release(%struct.bpf_sock* %13)
%15 = load %struct.bpf_sock*, %struct.bpf_sock** %4
%16 = getelementptr inbounds %struct.bpf_sock, %struct.bpf_sock* %15, i32 0, i32 0
%17 = load i32, i32* %16
store i32 %17, i32* %5
br label %18
18: ; preds = %12, %1
%19 = load i32, i32* %5
ret i32 %19
}

LLVM IR (-O2):
%struct.__sk_buff = type { i32 }
%struct.bpf_sock_tuple = type { i32 }
%struct.bpf_sock = type { i32 }
@BPF_F_CURRENT_NETNS = global i32 0
@llvm.compiler.used = appending global [1 x i8*] [i8* bitcast (i32 (%struct.__sk_buff*)* @bpf_sk_lookup_uaf to i8*)], section "llvm.metadata"
define i32 @bpf_sk_lookup_uaf(%struct.__sk_buff* %0) section "fail_use_after_free" {
%2 = alloca %struct.bpf_sock_tuple
%3 = bitcast %struct.bpf_sock_tuple* %2 to i8*
%4 = getelementptr inbounds %struct.bpf_sock_tuple, %struct.bpf_sock_tuple* %2, i64 0, i32 0
store i32 0, i32* %4
%5 = load i32, i32* @BPF_F_CURRENT_NETNS
%6 = call %struct.bpf_sock* @bpf_sk_lookup_tcp(%struct.__sk_buff* %0, %struct.bpf_sock_tuple* %2, i32 4, i32 %5, i32 0)
%7 = icmp eq %struct.bpf_sock* %6, null
br i1 %7, label %12, label %8
8: ; preds = %1
%9 = call i32 @bpf_sk_release(%struct.bpf_sock* %6)
%10 = getelementptr inbounds %struct.bpf_sock, %struct.bpf_sock* %6, i64 0, i32 0
%11 = load i32, i32* %10
br label %12
12: ; preds = %8, %1
%13 = phi i32 [ %11, %8 ], [ 0, %1 ]
ret i32 %13
}