map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/loop.h>
#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif
static unsigned long long procid;
//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:
//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty. In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//% claim that you wrote the original software. If you use this software
//% in a product, an acknowledgment in the product documentation would be
//% appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//% misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler madler@alumni.caltech.edu
//% BEGIN CODE DERIVED FROM puff.{c,h}
#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288
struct puff_state {
unsigned char* out;
unsigned long outlen;
unsigned long outcnt;
const unsigned char* in;
unsigned long inlen;
unsigned long incnt;
int bitbuf;
int bitcnt;
jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
long val = s->bitbuf;
while (s->bitcnt < need) {
if (s->incnt == s->inlen)
longjmp(s->env, 1);
val |= (long)(s->in[s->incnt++]) << s->bitcnt;
s->bitcnt += 8;
}
s->bitbuf = (int)(val >> need);
s->bitcnt -= need;
return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
s->bitbuf = 0;
s->bitcnt = 0;
if (s->incnt + 4 > s->inlen)
return 2;
unsigned len = s->in[s->incnt++];
len |= s->in[s->incnt++] << 8;
if (s->in[s->incnt++] != (~len & 0xff) ||
s->in[s->incnt++] != ((~len >> 8) & 0xff))
return -2;
if (s->incnt + len > s->inlen)
return 2;
if (s->outcnt + len > s->outlen)
return 1;
for (; len--; s->outcnt++, s->incnt++) {
if (s->in[s->incnt])
s->out[s->outcnt] = s->in[s->incnt];
}
return 0;
}
struct puff_huffman {
short* count;
short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
int first = 0;
int index = 0;
int bitbuf = s->bitbuf;
int left = s->bitcnt;
int code = first = index = 0;
int len = 1;
short* next = h->count + 1;
while (1) {
while (left--) {
code |= bitbuf & 1;
bitbuf >>= 1;
int count = *next++;
if (code - count < first) {
s->bitbuf = bitbuf;
s->bitcnt = (s->bitcnt - len) & 7;
return h->symbol[index + (code - first)];
}
index += count;
first += count;
first <<= 1;
code <<= 1;
len++;
}
left = (MAXBITS + 1) - len;
if (left == 0)
break;
if (s->incnt == s->inlen)
longjmp(s->env, 1);
bitbuf = s->in[s->incnt++];
if (left > 8)
left = 8;
}
return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
int len;
for (len = 0; len <= MAXBITS; len++)
h->count[len] = 0;
int symbol;
for (symbol = 0; symbol < n; symbol++)
(h->count[length[symbol]])++;
if (h->count[0] == n)
return 0;
int left = 1;
for (len = 1; len <= MAXBITS; len++) {
left <<= 1;
left -= h->count[len];
if (left < 0)
return left;
}
short offs[MAXBITS + 1];
offs[1] = 0;
for (len = 1; len < MAXBITS; len++)
offs[len + 1] = offs[len] + h->count[len];
for (symbol = 0; symbol < n; symbol++)
if (length[symbol] != 0)
h->symbol[offs[length[symbol]]++] = symbol;
return left;
}
static int puff_codes(struct puff_state* s,
const struct puff_huffman* lencode,
const struct puff_huffman* distcode)
{
static const short lens[29] = {
3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
static const short lext[29] = {
0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
static const short dists[30] = {
1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
8193, 12289, 16385, 24577};
static const short dext[30] = {
0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
12, 12, 13, 13};
int symbol;
do {
symbol = puff_decode(s, lencode);
if (symbol < 0)
return symbol;
if (symbol < 256) {
if (s->outcnt == s->outlen)
return 1;
if (symbol)
s->out[s->outcnt] = symbol;
s->outcnt++;
} else if (symbol > 256) {
symbol -= 257;
if (symbol >= 29)
return -10;
int len = lens[symbol] + puff_bits(s, lext[symbol]);
symbol = puff_decode(s, distcode);
if (symbol < 0)
return symbol;
unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
if (dist > s->outcnt)
return -11;
if (s->outcnt + len > s->outlen)
return 1;
while (len--) {
if (dist <= s->outcnt && s->out[s->outcnt - dist])
s->out[s->outcnt] = s->out[s->outcnt - dist];
s->outcnt++;
}
}
} while (symbol != 256);
return 0;
}
static int puff_fixed(struct puff_state* s)
{
static int virgin = 1;
static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
static struct puff_huffman lencode, distcode;
if (virgin) {
lencode.count = lencnt;
lencode.symbol = lensym;
distcode.count = distcnt;
distcode.symbol = distsym;
short lengths[FIXLCODES];
int symbol;
for (symbol = 0; symbol < 144; symbol++)
lengths[symbol] = 8;
for (; symbol < 256; symbol++)
lengths[symbol] = 9;
for (; symbol < 280; symbol++)
lengths[symbol] = 7;
for (; symbol < FIXLCODES; symbol++)
lengths[symbol] = 8;
puff_construct(&lencode, lengths, FIXLCODES);
for (symbol = 0; symbol < MAXDCODES; symbol++)
lengths[symbol] = 5;
puff_construct(&distcode, lengths, MAXDCODES);
virgin = 0;
}
return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
static const short order[19] =
{16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
int nlen = puff_bits(s, 5) + 257;
int ndist = puff_bits(s, 5) + 1;
int ncode = puff_bits(s, 4) + 4;
if (nlen > MAXLCODES || ndist > MAXDCODES)
return -3;
short lengths[MAXCODES];
int index;
for (index = 0; index < ncode; index++)
lengths[order[index]] = puff_bits(s, 3);
for (; index < 19; index++)
lengths[order[index]] = 0;
short lencnt[MAXBITS + 1], lensym[MAXLCODES];
struct puff_huffman lencode = {lencnt, lensym};
int err = puff_construct(&lencode, lengths, 19);
if (err != 0)
return -4;
index = 0;
while (index < nlen + ndist) {
int symbol;
int len;
symbol = puff_decode(s, &lencode);
if (symbol < 0)
return symbol;
if (symbol < 16)
lengths[index++] = symbol;
else {
len = 0;
if (symbol == 16) {
if (index == 0)
return -5;
len = lengths[index - 1];
symbol = 3 + puff_bits(s, 2);
} else if (symbol == 17)
symbol = 3 + puff_bits(s, 3);
else
symbol = 11 + puff_bits(s, 7);
if (index + symbol > nlen + ndist)
return -6;
while (symbol--)
lengths[index++] = len;
}
}
if (lengths[256] == 0)
return -9;
err = puff_construct(&lencode, lengths, nlen);
if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
return -7;
short distcnt[MAXBITS + 1], distsym[MAXDCODES];
struct puff_huffman distcode = {distcnt, distsym};
err = puff_construct(&distcode, lengths + nlen, ndist);
if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
return -8;
return puff_codes(s, &lencode, &distcode);
}
static int puff(
unsigned char* dest,
unsigned long* destlen,
const unsigned char* source,
unsigned long sourcelen)
{
struct puff_state s = {
.out = dest,
.outlen = *destlen,
.outcnt = 0,
.in = source,
.inlen = sourcelen,
.incnt = 0,
.bitbuf = 0,
.bitcnt = 0,
};
int err;
if (setjmp(s.env) != 0)
err = 2;
else {
int last;
do {
last = puff_bits(&s, 1);
int type = puff_bits(&s, 2);
err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1));
if (err != 0)
break;
} while (!last);
}
*destlen = s.outcnt;
return err;
}
//% END CODE DERIVED FROM puff.{c,h}
#define ZLIB_HEADER_WIDTH 2
static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd)
{
if (sourcelen < ZLIB_HEADER_WIDTH)
return 0;
source += ZLIB_HEADER_WIDTH;
sourcelen -= ZLIB_HEADER_WIDTH;
const unsigned long max_destlen = 132 << 20;
void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
if (ret == MAP_FAILED)
return -1;
unsigned char* dest = (unsigned char*)ret;
unsigned long destlen = max_destlen;
int err = puff(dest, &destlen, source, sourcelen);
if (err) {
munmap(dest, max_destlen);
errno = -err;
return -1;
}
if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
munmap(dest, max_destlen);
return -1;
}
return munmap(dest, max_destlen);
}
static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p)
{
int err = 0, loopfd = -1;
int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
if (memfd == -1) {
err = errno;
goto error;
}
if (puff_zlib_to_file(data, size, memfd)) {
err = errno;
goto error_close_memfd;
}
loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
err = errno;
goto error_close_memfd;
}
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
if (errno != EBUSY) {
err = errno;
goto error_close_loop;
}
ioctl(loopfd, LOOP_CLR_FD, 0);
usleep(1000);
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
err = errno;
goto error_close_loop;
}
}
close(memfd);
*loopfd_p = loopfd;
return 0;
error_close_loop:
close(loopfd);
error_close_memfd:
close(memfd);
error:
errno = err;
return -1;
}
static void reset_loop_device(const char* loopname)
{
int loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
return;
}
if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
}
close(loopfd);
}
static long syz_mount_image(
volatile long fsarg,
volatile long dir,
volatile long flags,
volatile long optsarg,
volatile long change_dir,
volatile unsigned long size,
volatile long image)
{
unsigned char* data = (unsigned char*)image;
int res = -1, err = 0, need_loop_device = !!size;
char* mount_opts = (char*)optsarg;
char* target = (char*)dir;
char* fs = (char*)fsarg;
char* source = NULL;
char loopname[64];
if (need_loop_device) {
int loopfd;
memset(loopname, 0, sizeof(loopname));
snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
if (setup_loop_device(data, size, loopname, &loopfd) == -1)
return -1;
close(loopfd);
source = loopname;
}
mkdir(target, 0777);
char opts[256];
memset(opts, 0, sizeof(opts));
if (strlen(mount_opts) > (sizeof(opts) - 32)) {
}
strncpy(opts, mount_opts, sizeof(opts) - 32);
if (strcmp(fs, "iso9660") == 0) {
flags |= MS_RDONLY;
} else if (strncmp(fs, "ext", 3) == 0) {
bool has_remount_ro = false;
char* remount_ro_start = strstr(opts, "errors=remount-ro");
if (remount_ro_start != NULL) {
char after = *(remount_ro_start + strlen("errors=remount-ro"));
char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ','));
}
if (strstr(opts, "errors=panic") || !has_remount_ro)
strcat(opts, ",errors=continue");
} else if (strcmp(fs, "xfs") == 0) {
strcat(opts, ",nouuid");
} else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) {
strcat(opts, ",errors=withdraw");
}
res = mount(source, target, fs, flags, opts);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
res = open(target, O_RDONLY | O_DIRECTORY);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
if (change_dir) {
res = chdir(target);
if (res == -1) {
err = errno;
}
}
error_clear_loop:
if (need_loop_device)
reset_loop_device(loopname);
errno = err;
return res;
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// syz_mount_image$f2fs arguments: [
// fs: ptr[in, buffer] {
// buffer: {66 32 66 73 00} (length 0x5)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 62 75 73 00} (length 0x6)
// }
// flags: mount_flags = 0x10 (8 bytes)
// opts: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {61 6c 6c 6f 63 5f 6d 6f 64 65 3d 72 65 75 73 65 2c 6d 6f 64 65 3d 6c 66 73 2c 69 6e 6c 69 6e 65 5f 78 61 74 74 72 5f 73 69 7a 65 3d 30 78 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 2c 6e 6f 69 6e 6c 69 6e 65 5f 78 61 74 74 72 2c 00 76 ad 5d 87 d4 51 ff bc 28 92 43 29 f3 da 58 24 e7 b5 63 db ef d5 1e 4f 3f 77 84 c0 be 70 75 3e 03 c6 fc 86 a2 43 7b df f7 37 4c 13 d9 81 43 70 05 02 44 0f 0e 86 eb 3b c6 6a 42 17 0d 05 69 a5 e3 2b 86 51 cd ea 3c 1c e9 27 a1 40 5e 2f 14 da c6 43 98 e5 3a bb de 30 cf 9d c6 92 69 f5 b0 27 af 05 d9 4f 70 5d 8b 9f cf f9 80 c5 b9 76 ce 66 39 de 03 c9 5f 8e ed 35 a3 07 a1 f1 7c e3 2c 62 25 e0 cd 2e 49 7c 99 53 7b 4b 13 c9 ee d9 73 87 3c 61 92 80 4f 90 9d 30 c2 c2 73 f9 90 26 1a 32 a3 1c 17 df 61 14 e0 c5 75 da 61 a9 c5 55 96 da e2 8b 5c 68 73 90 55 c3 2a 69 78 46 63 cf c4 1d 4e 0a aa 44 ac f0 01 e8 13 25 dc c0 89 69 b0 0c cd bd 04 ab d6 fe f1 55 e6 e1 83 96 53 3a df 85 67 40 f0 2d d0 17 4a df 1a ab fe d2 67 7e 35 b3 5b be 1f fc 32 59 26 73 77 eb e5 29 7a ac 78 b5 fc 5a 5d 83 77 56 cf 1a f7 04 24 c2 52 84 5e 1f dc fe 40 f0 59 1d 4f fd 81 07 0b be fc f0 9f c4 78 5d 14 9a 91 17 c2 be 71} (length 0x178)
// }
// }
// }
// chdir: int8 = 0x1 (1 bytes)
// size: len = 0x105bf (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x105bf)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000000100, "f2fs\000", 5);
memcpy((void*)0x200000000000, "./bus\000", 6);
memcpy((void*)0x200000010780, "... [truncated large byte array] ...", 376);
memcpy((void*)0x2000000001c0, "... [truncated large byte array] ...", 67007);
syz_mount_image(/*fs=*/0x200000000100, /*dir=*/0x200000000000, /*flags=MS_SYNCHRONOUS*/0x10, /*opts=*/0x200000010780, /*chdir=*/1, /*size=*/0x105bf, /*img=*/0x2000000001c0);
// sched_setscheduler arguments: [
// pid: pid (resource)
// policy: sched_policy = 0x2 (8 bytes)
// prio: nil
// ]
syscall(__NR_sched_setscheduler, /*pid=*/0, /*policy=SCHED_RR*/2ul, /*prio=*/0ul);
// mmap arguments: [
// addr: VMA[0xb36000]
// len: len = 0xb36000 (8 bytes)
// prot: mmap_prot = 0xb635773f06ebbeee (8 bytes)
// flags: mmap_flags = 0x8031 (8 bytes)
// fd: fd (resource)
// offset: intptr = 0x0 (8 bytes)
// ]
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul, /*prot=PROT_GROWSUP|PROT_SEM|PROT_WRITE|PROT_EXEC|0xb635773f04ebbee0*/0xb635773f06ebbeeeul, /*flags=MAP_POPULATE|MAP_FIXED|MAP_ANONYMOUS|MAP_SHARED*/0x8031ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
// connect$unix arguments: [
// fd: sock_unix (resource)
// addr: nil
// addrlen: len = 0x0 (8 bytes)
// ]
syscall(__NR_connect, /*fd=*/(intptr_t)-1, /*addr=*/0ul, /*addrlen=*/0ul);
// sendmmsg$unix arguments: [
// fd: sock_unix (resource)
// mmsg: nil
// vlen: len = 0x0 (8 bytes)
// f: send_flags = 0x0 (8 bytes)
// ]
syscall(__NR_sendmmsg, /*fd=*/(intptr_t)-1, /*mmsg=*/0ul, /*vlen=*/0ul, /*f=*/0ul);
// lseek arguments: [
// fd: fd (resource)
// offset: intptr = 0x10 (8 bytes)
// whence: seek_whence = 0x0 (8 bytes)
// ]
syscall(__NR_lseek, /*fd=*/(intptr_t)-1, /*offset=*/0x10ul, /*whence=*/0ul);
// syz_mount_image$xfs arguments: [
// fs: ptr[in, buffer] {
// buffer: {78 66 73 00} (length 0x4)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// flags: mount_flags = 0x200800 (8 bytes)
// opts: ptr[in, fs_options[xfs_options]] {
// fs_options[xfs_options] {
// elems: array[fs_opt_elem[xfs_options]] {
// fs_opt_elem[xfs_options] {
// elem: union xfs_options {
// bsdgroups: buffer: {62 73 64 67 72 6f 75 70 73} (length 0x9)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[xfs_options] {
// elem: union xfs_options {
// lazytime: buffer: {6c 61 7a 79 74 69 6d 65} (length 0x8)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[xfs_options] {
// elem: union xfs_options {
// swalloc: buffer: {73 77 61 6c 6c 6f 63} (length 0x7)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[xfs_options] {
// elem: union xfs_options {
// filestreams: buffer: {66 69 6c 65 73 74 72 65 61 6d 73} (length 0xb)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[xfs_options] {
// elem: union xfs_options {
// grpquota: buffer: {67 72 70 71 75 6f 74 61} (length 0x8)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[xfs_options] {
// elem: union xfs_options {
// allocsize: fs_opt["allocsize", array[flags[fs_opt_digits_suffix, int8]]] {
// name: buffer: {61 6c 6c 6f 63 73 69 7a 65} (length 0x9)
// eq: const = 0x3d (1 bytes)
// val: array[fs_opt_digits_suffix] {
// fs_opt_digits_suffix = 0x30 (1 bytes)
// fs_opt_digits_suffix = 0x39 (1 bytes)
// fs_opt_digits_suffix = 0x6d (1 bytes)
// }
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[xfs_options] {
// elem: union xfs_options {
// gquota: buffer: {67 71 75 6f 74 61} (length 0x6)
// }
// comma: const = 0x2c (1 bytes)
// }
// }
// common: array[fs_opt_elem[fs_options_common]] {
// fs_opt_elem[fs_options_common] {
// elem: union fs_options_common {
// flag: buffer: {6e 6f 6d 61 6e 64} (length 0x6)
// }
// comma: const = 0x2c (1 bytes)
// }
// }
// null: const = 0x0 (1 bytes)
// }
// }
// chdir: int8 = 0x4 (1 bytes)
// size: len = 0x9606 (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x9606)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000009600, "xfs\000", 4);
memcpy((void*)0x200000009640, "./file0\000", 8);
memcpy((void*)0x2000000000c0, "bsdgroups", 9);
*(uint8_t*)0x2000000000c9 = 0x2c;
memcpy((void*)0x2000000000ca, "lazytime", 8);
*(uint8_t*)0x2000000000d2 = 0x2c;
memcpy((void*)0x2000000000d3, "swalloc", 7);
*(uint8_t*)0x2000000000da = 0x2c;
memcpy((void*)0x2000000000db, "filestreams", 11);
*(uint8_t*)0x2000000000e6 = 0x2c;
memcpy((void*)0x2000000000e7, "grpquota", 8);
*(uint8_t*)0x2000000000ef = 0x2c;
memcpy((void*)0x2000000000f0, "allocsize", 9);
*(uint8_t*)0x2000000000f9 = 0x3d;
*(uint8_t*)0x2000000000fa = 0x30;
*(uint8_t*)0x2000000000fb = 0x39;
*(uint8_t*)0x2000000000fc = 0x6d;
*(uint8_t*)0x2000000000fd = 0x2c;
memcpy((void*)0x2000000000fe, "gquota", 6);
*(uint8_t*)0x200000000104 = 0x2c;
memcpy((void*)0x200000000105, "nomand", 6);
*(uint8_t*)0x20000000010b = 0x2c;
*(uint8_t*)0x20000000010c = 0;
memcpy((void*)0x200000012cc0, "... [truncated large byte array] ...", 38406);
syz_mount_image(/*fs=*/0x200000009600, /*dir=*/0x200000009640, /*flags=MS_RELATIME|MS_NODIRATIME*/0x200800, /*opts=*/0x2000000000c0, /*chdir=*/4, /*size=*/0x9606, /*img=*/0x200000012cc0);
// openat arguments: [
// fd: fd_dir (resource)
// file: nil
// flags: open_flags = 0x101142 (4 bytes)
// mode: open_mode = 0x0 (2 bytes)
// ]
// returns fd
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0ul, /*flags=O_SYNC|O_NOCTTY|O_CREAT|O_RDWR*/0x101142, /*mode=*/0);
if (res != -1)
r[0] = res;
// ioctl$FICLONERANGE arguments: [
// fd: fd (resource)
// cmd: const = 0x4020940d (4 bytes)
// arg: nil
// ]
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x4020940d, /*arg=*/0ul);
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
// }
// flags: open_flags = 0x10142 (4 bytes)
// mode: open_mode = 0x0 (2 bytes)
// ]
// returns fd
memcpy((void*)0x200000000180, "./file1\000", 8);
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000180ul, /*flags=O_NOCTTY|O_DIRECTORY|O_CREAT|O_RDWR*/0x10142, /*mode=*/0);
if (res != -1)
r[1] = res;
// write$UHID_INPUT arguments: [
// fd: fd_uhid (resource)
// data: ptr[in, uhid_req[UHID_INPUT, uhid_input_req]] {
// uhid_req[UHID_INPUT, uhid_input_req] {
// type: const = 0x8 (4 bytes)
// data: uhid_input_req {
// data: buffer: {94 0d e3 12 c9 be 10 5c 33 39 43 90 ce 36 0a dc b8 44 3d 1c a2 46 4a d2 9f e4 6c 87 17 a8 23 e2 9b 12 01 1e 86 75 16 a9 c1 b6 33 94 e6 b4 92 25 49 ac 2f 98 b0 ba fc 01 37 57 37 1b 57 62 e5 b0 3b 4c 8c fc c5 d3 43 68 b2 19 17 74 09 55 f8 0e 80 fa 98 a6 8c b0 52 b1 02 c0 3e 72 a4 c6 70 27 78 df cc 5b b7 4c e2 3d 91 4f 8b 14 3b d9 4d 73 82 a3 85 be 93 f6 1e ef 50 9d 6c bf fa 81 af ee 0e 35 24 b8 b7 68 a0 ef 0a e0 0a d2 a2 37 28 72 24 36 d1 c1 50 b5 12 b6 c6 42 cb 2e ea ec b0 85 71 90 14 33 20 15 47 4a 4d df 70 98 bb 5a c3 98 c0 ce 25 6e 4d cf d4 61 3d be 9a 34 b9 64 39 54 6a 28 db 9c e9 7b 34 4b 6c 97 28 9b 38 54 e1 27 b4 f5 33 f5 64 39 a7 4f cf fc 41 df ef fc 5d 7a 99 c0 1a 0f ed fd 93 7a f5 95 c0 5a 94 22 16 58 1f 8e fd 1f fa 1c 23 c6 f0 8d 69 87 be 16 bb 52 42 0c 80 bd a5 da 46 98 7f bf 72 09 48 7d ef e0 37 42 26 a5 26 d3 58 86 60 19 2d 92 1b fe 40 7f 1d 18 33 f3 90 dd 8b 41 b3 0c 53 b4 de ba 5a 08 6c 51 6d 9b c8 ca 57 2d 8f 0f 87 53 03 c8 5b d1 65 70 e8 9f 74 d7 c4 ef 54 7a 07 dd 62 f3 34 fe e7 6e 2e 0c a3 1c ca 1a d0 52 8d 74 48 ce ec d4 c9 78 5c 30 2a 40 bc 11 43 35 de a8 77 59 58 a3 be ff 8e eb 31 af cb 9a 2c 75 61 98 0f 85 54 22 07 69 e5 e9 0f df b2 f5 a9 05 51 8e f1 66 7a 91 e2 dd 47 43 83 e4 31 2e a2 19 fe 65 d4 21 00 67 34 fe 04 66 1f 75 e6 9a e8 25 12 0b 33 fb 74 29 3e 3b 83 e7 f7 f5 63 b4 75 cd 6e 08 fd 68 78 ee 42 4f a1 41 d3 ae e8 6d 95 2c 21 2c 2e 77 30 79 65 10 a4 63 a8 da 48 68 52 b2 3a 1d 62 b7 14 a1 13 01 49 90 29 d9 ef b7 15 a1 1b 64 f2 4c d2 66 0c 9a 47 57 3c e4 dd 04 2e 33 3e 43 3e e2 8b 2b ce 54 5c f0 67 04 01 93 05 7d e2 90 96 5c 1d 54 7f ed 13 7e 5e b2 2f 5c 0a 06 ad 4d e6 b7 82 04 bf 05 3f 37 c5 d9 6b 80 53 ea 44 5b 64 03 60 da 8f ce 33 91 51 4d c3 d1 f4 e4 b3 50 47 13 8c d8 c2 71 7b cb a2 78 a4 f8 c2 7b ac 01 b4 69 ee 3f d0 40 04 f5 82 87 a1 83 07 b0 ad 41 20 f2 c2 6b 08 c3 26 72 49 bf be 10 64 a3 f1 71 e0 cf e5 95 f7 ab 14 6f 31 48 c7 32 28 ed f6 94 dc 0c 40 0c 36 e3 49 3b 1a ca 5f 85 97 2d ad b8 d0 2b dd b6 07 b7 a4 31 75 0c a4 86 38 12 b8 02 00 00 00 00 00 00 00 42 db 29 71 e2 80 54 1c bf a4 46 c6 c6 d8 5b 77 e3 32 7a 2d 32 7c 25 b7 61 96 47 37 4e 76 b1 be 26 6c b6 89 59 d2 65 1d 0c 74 38 cb 1b 53 98 21 91 85 8c 66 50 0d 85 36 01 37 01 19 4a 9f 02 dd 77 21 6f 93 2e 07 a4 c4 b4 55 8b 2a 38 d7 e5 c3 9a 45 3c 8f b5 fa e0 d0 05 50 a2 d1 43 f7 21 cd 67 6d 84 2f 2a e3 9e cb f9 9e 02 7b 4c f9 f3 c2 a9 bf 3b 66 3e 51 a0 b2 9c f4 cf b0 87 7d 5b 89 fd fa 93 fd 9b f3 33 92 e6 a2 c8 df 36 f9 f2 fa a3 71 6d 29 3b 7d 94 c9 34 58 c1 7d f9 9a aa dd 21 8f e4 c7 b9 67 b4 3f 48 72 5e 6b ac 67 bf 91 76 e8 c6 3f 94 86 2b 03 6b 18 70 bc 31 4b 51 fe a9 d0 c9 20 20 42 7a ba f5 be 10 d3 fa ad 2f 68 4d 46 a2 46 1f 2a 92 35 0d 6f 20 4f 03 ad 2a 9f a5 4c bd 8a 7a 3e 7b a2 d5 4f 36 15 ac 5e a4 7f 12 05 72 f8 ef 94 1e 81 b0 81 2b fc 42 27 ef 57 19 09 3a fb f9 00 40 ef 1a 5e da 64 56 3e b7 fd 01 5e a5 43 42 34 0e c8 64 8d 91 1a 8f 3f 35 8c a1 24 ef 8c 70 68 5b ce 2f ba ee eb f5 4d 05 9c ef d5 37 51 b5 cf 33 fe 2d 92 c9 df 6a 63 82 1b 6d b5 18 82 10 56 5e 13 27 68 b1 92 fb 27 e7 45 60 5c 52 9e 36 48 06 0a 98 d6 56 f3 5e 36 dc 4b e3 10 2b d6 78 db 0c eb 03 01 c5 cb 0f 7f 7a 08 c5 5c d0 38 a5 f7 51 a7 c9 61 16 f0 bd 9c 9a 34 95 58 a7 a8 fc 6a 73 cc e1 13 25 49 16 98 22 bf 32 d7 42 fc 4f 4e 2e 50 f5 9e b6 69 f2 38 42 82 24 7c 60 25 3e dc 98 f9 bc 80 2a 28 8a 94 e1 01 1a 06 6c e9 f6 ec a5 f8 7d 2a fd 89 39 00 c3 af f8 7b e9 59 45 12 69 bc 9a c7 35 c4 3c 1e 5e cf 5d 5b ff 26 2a 27 f0 c8 a1 ad 40 14 92 ff ec 66 2e 27 b1 23 99 09 6f ee 99 10 d0 fa df d1 e1 bc f1 f2 0f 8f 7e 5f f1 cc e9 e8 db 0f d7 1d da 6f 22 8a a9 6b ba 6b 41 20 36 1a 6f 6a cc 83 2b e5 da a1 aa bd 03 a9 ae 81 0f 0d 21 46 6c 1a 65 2a 47 c1 1d b6 a8 e5 25 80 a8 34 73 26 11 3b 54 a4 be ea eb 21 b4 5e 5e f0 aa 3c fb fb 22 d9 96 40 b7 b9 35 bc e8 e3 7c eb ce 58 6f 7f e7 22 08 b4 91 79 5a 9f bb 22 0e c9 b9 8d d7 81 1c ed 86 29 21 89 ce 35 1e 8a 64 c6 af de 9c 1d cc ba ae bf 7e 5e 3d 5e 52 9e 92 6e 81 4b 38 13 42 c1 3e a0 75 7c e5 2a 0b 0a 15 5d 1c 85 c4 10 8d ef fa 71 9a 22 be f7 b6 81 a1 75 04 e2 2d 6f e9 19 76 99 e0 a1 6a 71 04 f4 12 e3 a6 81 c8 ee 41 d8 fb dd c8 61 0c 16 1f 1f ad 9e 4a 5e 52 6e 20 ac 61 49 6e 9f 35 96 cc 94 b7 9e 96 80 a6 4a 83 2d c2 6d 6e 33 e1 27 ab e5 c4 05 b1 69 78 bc 42 97 a8 5c ca f1 59 9b 19 5d b9 d6 6b 69 8c 77 0d 84 fa 90 d8 9b 51 ec a0 2e d3 a3 46 5b 8e ca 95 89 af 03 4b d6 b9 c8 f6 32 9e 39 3e 47 53 88 76 96 ae 51 58 e8 ca 3e f2 e6 6f ac 38 a6 d6 a1 b6 1e 81 d5 b6 a3 c1 cb 00 7d 64 a3 3f 1f e0 1c f3 9b 82 b2 70 e9 08 3c e1 3b 1a 32 f0 c9 83 76 d4 3c db f9 f1 7b 74 65 5f 30 00 34 3f e0 51 a7 5a c6 58 a8 46 29 b1 24 51 07 65 2d 6d fa 54 b1 a7 d7 79 22 be cb 74 53 9f fb 11 29 27 94 f1 2e bf d3 ea 88 88 c7 cd 10 69 2d 52 c8 53 40 f9 2c 5d 01 46 4f e3 6d ea ae c6 ad 6c c2 28 70 37 2d 61 48 5e 2d 76 ac cd 9b f9 3e 08 42 ef e5 65 2e 73 10 0a 66 27 b3 a4 ce 4d 15 94 c8 dd b5 74 28 97 d0 5f d6 f6 33 3f a1 b9 0a fe aa b9 fc 74 26 25 1d 24 de ee f4 37 84 f1 2c 0b b0 9f 10 29 62 ee 9a b4 27 a5 3f d8 da 8e 1e 3c 80 00 ac 71 64 e6 1d 62 58 c5 15 dc dd 91 1f b1 a5 19 d7 b3 8e 55 64 57 da 33 0c ed a8 e9 48 ae af 74 21 d3 7f af 50 07 1f 0d 38 c0 8f c9 38 27 8f 24 70 84 19 5e 77 8a c9 0a b7 bf af b5 9c 2a 1c 64 3c d1 8d 88 3a 46 a6 cc 41 41 0f 50 5b a2 09 74 6d 6b 12 c0 15 ed df 31 b6 c9 eb f2 f0 46 05 51 80 33 72 1c df 02 b1 da 21 0c a1 46 51 29 b4 43 c0 c4 62 47 b5 f8 cc eb 00 0a f2 c5 51 fc ea 1c 1b ef 29 c5 85 9e 95 bc f0 95 6b 90 92 27 9b 47 dc 65 21 34 d2 bc 54 c3 68 89 78 fd 4d 7c 20 37 49 da 5e 48 24 fe 31 4a a5 7e 76 f5 8f ad fa fc c7 66 0b 68 b1 a6 04 3a cf 8f 9f 0c 25 9d 16 fe 23 6b 59 06 f8 88 16 e7 ab 69 b6 7f 76 2a d7 9a 5f 65 4c 50 7c c4 9b e1 81 52 5f f0 5c de 4d 56 b5 37 90 15 1e fa 80 60 c4 68 5e 2b 1d d0 ad 89 55 1a 41 e0 d3 dd a3 3c 2b 52 89 22 84 9a 8d fc d7 24 6c 24 2c 3b 2a a3 8a 69 e3 e5 a3 7c 58 06 c4 bc ff 53 e0 8f fc 7a 83 0d 92 5e 33 94 b6 88 ff ff ff ff cb fe 38 7c 9e 7d f1 9c fb 2b 54 30 3c 10 15 57 aa 2e d0 80 19 4f e0 af 76 d6 72 ed 77 df a4 c5 c0 c0 f9 69 3f 4e 8c 44 6d 3b c1 9c 0a 86 54 bb 4b a8 b4 da ae 69 ed f4 14 61 54 73 ec 2a ad aa 68 71 b7 d0 8a 51 e3 49 ac c7 b1 6f dd f7 41 f7 16 70 da 4c 2b 0e ad cf 19 f4 6f 0f d1 8b 59 ec f7 b9 43 a2 a5 c9 01 25 63 8a 3b 32 70 a3 66 c0 74 86 8e 62 fe 2e 87 51 ff 3e 60 41 1d 7e 1b 3f b6 a8 73 f7 84 34 89 f6 61 f1 bc 40 17 65 cd fa cb d7 6e 1b 52 e1 5f b1 0f c1 9d c4 80 3d 3a 47 43 ab 97 7f ae 35 ee d0 0d 59 dd f6 4f cb c6 1f 5f a0 cf 40 98 d0 ba bd e4 a3 97 d2 ef 10 0c 23 ca 9f 83 66 56 d5 f2 5b 01 86 06 e1 48 e3 f6 64 00 a6 82 47 2e d5 d2 8b 7d e6 24 ed 83 82 77 43 26 23 c1 10 27 da 18 37 8e 46 c3 fd 34 05 85 b4 83 5a b1 d7 71 26 63 22 ee e5 6c 3e 6b f3 30 0f 5d 48 b6 b0 1f 51 5b a7 f3 fb 72 6c fc 6f df 6c 07 a2 f4 6b bc 3f 36 fc 9b a6 e5 51 a4 63 35 33 7c 88 1c c4 a7 3e 79 e7 66 38 41 1a dc aa 81 ee 3b 6d 0e 6e 6c 72 1d a3 6d ca b6 8b fb 0c a6 ba 7b 2c 26 7b 80 12 01 43 a5 c4 be 33 3b 2c f8 5b 3b d2 42 5c a6 91 ff 36 7d 13 0d bb d8 e5 f6 a8 33 e0 93 ea e9 d1 76 c1 c3 fb 61 55 7f 9e 50 80 ee 77 03 fe 2c a1 06 1b 52 d0 a4 0d 7e e2 f4 08 b3 ce ac 30 3e 30 2d 96 d9 29 c1 70 26 79 3c 66 42 3d 74 8a 81 ad fd 7c b2 90 27 f3 27 b0 da c4 05 5e 88 e3 85 f0 40 0f 97 98 8a a1 fa 40 cd f7 76 f9 f0 79 91 fb 55 d9 d4 bf 62 eb ef ce d2 40 d8 21 bd 4f bb a6 2c 1b 62 32 02 28 c6 a4 ca 61 38 78 e3 eb 53 8e ea 28 e9 2b 5d 90 9f c7 e6 3e d5 a5 44 e7 69 8d 0b 7d 3d 99 41 5d 40 28 a5 da 4c c6 7f cb a3 b7 44 ac d4 f9 29 38 02 7f 42 b7 85 40 52 28 a3 8d 85 fd 67 87 03 b9 d4 1a 6a 54 cd 48 30 3a 6b e6 44 08 10 1f c5 47 16 41 c1 c5 a7 47 24 4d a6 84 fe f9 7a a4 8b f1 a2 25 00 7f 26 d9 f4 00 2a 0d c1 4d 01 19 1e f1 d7 49 ea 2e a0 5c 42 c1 73 c3 24 4c 10 39 c0 43 41 b0 cf 37 57 4d 8b 78 e3 57 b4 51 bf cf b7 97 62 ed 6a 4f bc 68 96 90 bf 37 af aa 92 70 2a 03 49 ed 9a ec d9 11 1d f9 fd 57 b9 77 49 bb f5 00 39 91 02 93 44 49 7c 9f f8 5a da a7 a2 e5 66 64 7b a5 ba d3 41 ee d6 20 34 b5 81 98 1d d7 c9 de 9f d4 c2 41 a5 4a d4 d6 e9 e1 cf 7c a9 84 b1 3c 62 8c c6 5e ca 08 29 e6 9d 4d 39 05 81 e4 3c d2 ed 5c 56 60 8b 45 c1 09 f3 53 50 fb 87 53 16 e7 1f 79 c4 33 31 94 62 d4 b5 89 a1 f7 f2 d1 4d 43 09 26 55 da 23 d6 3c 63 29 8e d6 2d d4 81 ab 0b c5 8e 97 f3 97 b3 9c 94 b3 2f ad 6a 1e 0c d9 da 2d fb e6 89 7e e4 98 6f db af db 0e 4b 57 5f 80 0d f5 da 43 cf 31 8e a7 a5 e8 3a 01 36 b3 bd e3 29 6b 2b d2 30 ed 21 2f 79 50 0c 6a 44 58 52 2c 38 81 53 2b 7b fd 17 06 47 ee 65 93 17 60 f3 5a 1c 1f 95 b8 c9 3e 42 33 f0 de 2a 13 c8 3f 31 52 2f 2b ee 05 a5 7c 83 78 ac 6b dd 3c 9e 30 dc 18 8b 30 da db 93 6f 35 a3 fa 24 77 32 eb ae 6a 8d 76 29 92 f8 a9 6c 1d 26 98 1b da 15 7f 2b 67 6a c9 d6 1b b7 86 ac 8c 34 9d a9 4d bf 75 a2 1b 78 6c dc eb 47 a9 25 97 b6 d2 b2 2f 7d c1 18 7c db 46 81 ce 9b eb d6 99 77 ba b9 ea bf 2a 68 c1 d3 b3 46 3d 6c 7f 13 92 e1 2a 17 de b9 7f 2c e5 c9 ef 40 21 d3 b4 e0 df 6b 3f 4b 69 3e 13 6e 39 31 83 7e 91 61 7c d8 58 46 f3 01 9a 74 d2 d6 5f 36 36 9e 73 a4 61 75 36 31 d7 2f 9e 28 34 c4 46 ae 7e 17 3d 6b 19 35 ad c0 ce 65 eb 0e ac 83 0d 44 2a 03 44 f2 cb ae df 8d 48 cb 0a 69 59 d0 7f 20 8f bb 2d ae 43 4f 4f df 35 b2 65 fb db de 41 38 b4 55 b7 94 10 96 d5 58 08 de 60 1d dd 8a 41 a7 0b 12 96 88 62 d0 b4 08 6d 4f f5 51 52 ae e6 5e aa 76 1a 95 88 bb 25 bc e1 93 b4 e5 5e bb 18 38 07 f1 18 bf f0 cc bd 85 ea 76 1e 7c 3b 6c cc b6 4f 97 b3 f1 bf 7a 96 ee cc 7a b4 0e 77 0a 16 20 20 9b 50 ba 23 aa b0 f7 69 a1 6c 9b 80 92 32 69 87 f0 cd 1d e9 4b 91 1e a6 be f5 cf 15 a9 38 29 b7 cb f0 3a a8 5e f5 77 63 3e 05 8f 81 e9 65 3f c4 7d 15 ab 8b ea d5 67 ed 2a ff bb f5 a4 70 30 2c 06 50 86 32 4d c3 04 c7 77 22 80 50 ea 9f 71 7e 45 b6 67 6f c9 00 2c cd 04 28 fc b2 7d 83 9e 41 39 fb 17 d4 ee 72 e2 fe 83 94 e5 de 0c c8 14 d9 26 63 f8 c5 f8 7e 13 1a 34 ef 70 94 07 8b e0 cf 54 76 3c 82 00 4a f9 72 7c 79 72 ff 1e a6 16 2b 27 9b ee a8 7b c2 74 1e 99 6d 14 f5 49 d0 47 4a ab e7 80 c5 b8 0a 35 ee d3 11 cb 73 4c 23 d0 1c 16 0e 43 96 62 c8 13 12 67 47 c7 d0 90 68 e3 2f a7 26 05 d7 1a bc 2a 33 2c b5 9d 81 07 18 18 d5 e0 94 41 94 28 5f 4c fc 05 03 92 e5 05 dd 93 c8 c8 82 f4 6f b6 b7 0b 46 60 78 4d 54 3a 6b f3 46 53 48 78 40 fd c2 98 c8 28 02 41 17 48 05 bf 3c f3 80 83 22 4d 21 3c d6 07 6b ea c1 35 ed 3f 01 00 00 80 00 00 00 00 47 75 0c b0 f4 d2 be 6b ea da 1c 48 1a 01 52 d8 0c 0b 52 0d 2f 09 04 55 49 4c 83 ba 78 eb 91 e6 55 8d 52 ce ce b2 3c 95 6b b3 82 bb 28 0e 63 82 d2 cb 67 9e ec d2 bc fb 61 07 e2 e4 f5 68 f1 be 29 3e aa 0d 2e bb 77 16 9b 10 3d 5f e7 4d 74 5c f0 82 c3 60 22 10 8b 4c 43 0a 87 fa 85 35 f1 c5 6d 0c 1d 5d ae 50 c5 49 b1 b0 89 11 e2 d2 61 9e ef 61 13 1c 78 04 b3 5c 3c a4 da c1 f2 59 5c 68 94 1b 01 3b 5d ed 8b fd 52 ed 41 da 13 c0 88 6b 7f 9c 61 a5 24 4a 81 57 11 25 3a ad 7e a7 4e ae 78 8b 1b ee a9 bc 15 ad db 19 9d 2f c7 9e 81 a3 4b 88 7a 0e 4b 93 5a d1 54 e9 61 c8 b6 97 2f 12 4c ae 77 42 e8 2d b1 e7 14 af 15 f3 49 08 96 0d bb 4e a2 4e 44 ff d7 50 c9 d1 1d d4 5b fa ae 73 02 8b c8 8f dd f7 4b 2d 24 de 20 59 80 ba 14 f4 88 91 19 f8 a6 29 1b 37 24 49 75 03 dd f9 52 22 d5 d0 50 41 4e 48 7a 3d c6 5e 5e da 31 69 e1 05 70 a5 04 40 be 34 6c c1 f1 b0 c8 48 41 0b 46 61 0c 73 86 36 70 7c 5d 74 0a 8e 3a 9b 68 8c 2c 1e a5 41 35 bf fd 2f fd 87 d9 df a9 02 f3 dd 97 b2 a6 07 8f a6 5f 5a 5f 95 da 2b 9f 61 24 fe 07 68 2e 27 ab 65 ab 96 57 3e 76 2f 50 60 43 9e 18 64 97 98 e0 b9 d7 86 4f 91 db c4 f4 ed 3a 4a b3 06 71 f8 f7 f3 c4 9c 7a c5 04 a7 55 f9 42 0f d9 b2 24 21 af d7 20 3f 7c d6 dd 8c 8e 7a 33 70 9e 12 d0 04 e4 02 67 2a f2 b3 f9 04 6b c5 78 54 f9 84 82 53 8a d4 87 23 cd 15 3c f0 31 03 c1 57 cd b1 a6 3e 83 9a 02 c3 f0 04 1d 70 20 28 0f 96 f3 f7 e0 ce 89 c4 08 be 10 d3 44 54 08 08 de e1 bf cb 01 f5 29 3a b6 06 c7 1f fc 09 f9 e6 3b 93 b3 7e 8d 80 07 ad 84 32 d2 e8 1c 3d 1d 40 a5 77 11 bd b7 98 ee 91 a3 f0 5f 93 f4 f4 6f 88 3d b0 61 3b f9 5f ab d5 23 d9 55 d0 d4 a5 51 8e 1b b3 da e7 64 6a f8 af 8d 4a 4d 7d cf ac 63 3c 6e fa 31 64 f9 e0 5b bb 4b 05 94 7a c0 e6 c4 ed d9 9a 76 8e da 4c 71 49 cf 38 a4 60 b5 22 d6 40 5a a4 7f ad a1 c7 8f 56 fb d3 36 69 71 9b 14 96 42 7f 29 05 32 33 4b 69 d0 a7 cf 6c 46 ce fe 5e cd 0f d9 23 b1 49 29 fd 3d b8 a1 a9 4b a6 39 54 b5 8c eb 9b 1e 0f 84 71 a0 2c 13 a1 60 aa 76 30 83 a5 fd 36 c1 99 07 5a 76 97 68 e1 64 f1 79 11 f5 a4 16 bb 96 19 8a a0 95 4a 7d 27 e3 0c 48 06 91 ce 80 dc 71 a4 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x1000)
// size: len = 0x1000 (2 bytes)
// }
// }
// }
// len: len = 0xfffffe69 (8 bytes)
// ]
*(uint32_t*)0x200000000400 = 8;
memcpy((void*)0x200000000404, "... [truncated large byte array] ...", 4096);
*(uint16_t*)0x200000001404 = 0x1000;
syscall(__NR_write, /*fd=*/r[1], /*data=*/0x200000000400ul, /*len=*/0xfffffe69ul);
// syz_mount_image$btrfs arguments: [
// fs: ptr[in, buffer] {
// buffer: {62 74 72 66 73 00} (length 0x6)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// flags: mount_flags = 0x0 (8 bytes)
// opts: ptr[in, fs_options[btrfs_options]] {
// fs_options[btrfs_options] {
// elems: array[fs_opt_elem[btrfs_options]] {
// }
// common: array[fs_opt_elem[fs_options_common]] {
// }
// null: const = 0x0 (1 bytes)
// }
// }
// chdir: int8 = 0x0 (1 bytes)
// size: len = 0x559e (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x559e)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000000000, "btrfs\000", 6);
memcpy((void*)0x2000000015c0, "./file0\000", 8);
*(uint8_t*)0x200000001600 = 0;
memcpy((void*)0x200000005680, "... [truncated large byte array] ...", 21918);
syz_mount_image(/*fs=*/0x200000000000, /*dir=*/0x2000000015c0, /*flags=*/0, /*opts=*/0x200000001600, /*chdir=*/0, /*size=*/0x559e, /*img=*/0x200000005680);
// mount$bind arguments: [
// src: nil
// dst: nil
// type: nil
// flags: mount_flags = 0x20000 (8 bytes)
// data: const = 0x0 (8 bytes)
// ]
syscall(__NR_mount, /*src=*/0ul, /*dst=*/0ul, /*type=*/0ul, /*flags=MS_UNBINDABLE*/0x20000ul, /*data=*/0ul);
// mount$bind arguments: [
// src: nil
// dst: nil
// type: nil
// flags: mount_flags = 0x98d491 (8 bytes)
// data: const = 0x0 (8 bytes)
// ]
syscall(__NR_mount, /*src=*/0ul, /*dst=*/0ul, /*type=*/0ul, /*flags=MS_I_VERSION|MS_SHARED|MS_SLAVE|MS_REC|MS_SYNCHRONOUS|MS_SILENT|0x1481*/0x98d491ul, /*data=*/0ul);
// write$FUSE_STATFS arguments: [
// fd: fd_fuse (resource)
// arg: nil
// len: bytesize = 0x0 (8 bytes)
// ]
syscall(__NR_write, /*fd=*/r[0], /*arg=*/0ul, /*len=*/0ul);
return 0;
}
]