#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint64_t;
struct utsname {
  int dummy;
};
typedef scalar_t__ ptr;

/* Variables and functions */
int /*<<< orphan*/ PR_SET_TAGGED_ADDR_CTRL;
int /*<<< orphan*/ PR_TAGGED_ADDR_ENABLE;
int /*<<< orphan*/ free(struct utsname *);
scalar_t__ malloc(int);
scalar_t__ prctl(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/,
                 int /*<<< orphan*/, int /*<<< orphan*/);
int uname(struct utsname *);
int main(void) {
  static int tbi_enabled = 0;
  unsigned long tag = 0;
  struct utsname *ptr;
  int err;
  if (prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0) == 0)
    tbi_enabled = 1;
  ptr = (struct utsname *)malloc(sizeof(*ptr));
  if (tbi_enabled)
    tag = 0x42;
  ptr = (struct utsname *)(((uint64_t)(ptr) & ~((uint64_t)(0xff) << 56)) |
                           ((uint64_t)(tag) << 56));
  err = uname(ptr);
  free(ptr);
  return err;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
mov    0x2e82(%rip),%rax
mov    (%rax),%edi
mov    0x2e81(%rip),%rax
mov    (%rax),%esi
xor    %r8d,%r8d
mov    %r8d,%edx
mov    %r8d,%ecx
call   1050 <prctl@plt>
cmp    $0x0,%rax
jne    118b <main+0x4b>
movl   $0x1,0x2eb9(%rip)
mov    $0x4,%edi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
cmpl   $0x0,0x2ea4(%rip)
je     11ae <main+0x6e>
movq   $0x42,-0x10(%rbp)
mov    -0x18(%rbp),%rax
and    %ecx,%eax
mov    -0x10(%rbp),%rcx
mov    %ecx,%edx
mov    $0x38,%ecx
shl    %cl,%edx
mov    %edx,%ecx
or     %ecx,%eax
cltq
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
call   1040 <uname@plt>
mov    %eax,-0x1c(%rbp)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
mov    -0x1c(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
mov    0x2e98(%rip),%rax
mov    (%rax),%edi
mov    0x2e97(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
xor    %ecx,%ecx
xor    %r8d,%r8d
call   1050 <prctl@plt>
mov    $0x4,%edi
call   1060 <malloc@plt>
call   1040 <uname@plt>
mov    %eax,%ebx
call   1030 <free@plt>
mov    %ebx,%eax
pop    %rbx
ret

LLVM IR (-O0):
%struct.utsname = type { i32 }
@main.tbi_enabled = internal global i32 0
@PR_SET_TAGGED_ADDR_CTRL = global i32 0
@PR_TAGGED_ADDR_ENABLE = global i32 0
define i32 @main() {
%1 = alloca i32
%2 = alloca i64
%3 = alloca %struct.utsname*
%4 = alloca i32
store i32 0, i32* %1
store i64 0, i64* %2
%5 = load i32, i32* @PR_SET_TAGGED_ADDR_CTRL
%6 = load i32, i32* @PR_TAGGED_ADDR_ENABLE
%7 = call i64 @prctl(i32 %5, i32 %6, i32 0, i32 0, i32 0)
%8 = icmp eq i64 %7, 0
br i1 %8, label %9, label %10
9: ; preds = %0
store i32 1, i32* @main.tbi_enabled
br label %10
10: ; preds = %9, %0
%11 = call i64 @malloc(i32 4)
%12 = inttoptr i64 %11 to %struct.utsname*
store %struct.utsname* %12, %struct.utsname** %3
%13 = load i32, i32* @main.tbi_enabled
%14 = icmp ne i32 %13, 0
br i1 %14, label %15, label %16
15: ; preds = %10
store i64 66, i64* %2
br label %16
16: ; preds = %15, %10
%17 = load %struct.utsname*, %struct.utsname** %3
%18 = ptrtoint %struct.utsname* %17 to i32
%19 = and i32 %18, poison
%20 = load i64, i64* %2
%21 = trunc i64 %20 to i32
%22 = shl i32 %21, 56
%23 = or i32 %19, %22
%24 = sext i32 %23 to i64
%25 = inttoptr i64 %24 to %struct.utsname*
store %struct.utsname* %25, %struct.utsname** %3
%26 = load %struct.utsname*, %struct.utsname** %3
%27 = call i32 @uname(%struct.utsname* %26)
store i32 %27, i32* %4
%28 = load %struct.utsname*, %struct.utsname** %3
%29 = call i32 @free(%struct.utsname* %28)
%30 = load i32, i32* %4
ret i32 %30
}

LLVM IR (-O2):
%struct.utsname = type { i32 }
@PR_SET_TAGGED_ADDR_CTRL = global i32 0
@PR_TAGGED_ADDR_ENABLE = global i32 0
define i32 @main() {
%1 = load i32, i32* @PR_SET_TAGGED_ADDR_CTRL
%2 = load i32, i32* @PR_TAGGED_ADDR_ENABLE
%3 = tail call i64 @prctl(i32 %1, i32 %2, i32 0, i32 0, i32 0)
%4 = tail call i64 @malloc(i32 4)
%5 = tail call i32 @uname(%struct.utsname* poison)
%6 = tail call i32 @free(%struct.utsname* poison)
ret i32 %5
}