map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_clock_adjtime
#define __NR_clock_adjtime 266
#endif
#ifndef __NR_ioctl
#define __NR_ioctl 29
#endif
#ifndef __NR_mmap
#define __NR_mmap 222
#endif
#ifndef __NR_sendmsg
#define __NR_sendmsg 211
#endif
#ifndef __NR_socket
#define __NR_socket 198
#endif
#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
uint64_t r[3] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// socket arguments: [
// domain: socket_domain = 0x11 (8 bytes)
// type: socket_type = 0x800000003 (8 bytes)
// proto: int32 = 0x0 (4 bytes)
// ]
// returns sock
res = syscall(__NR_socket, /*domain=AF_PACKET*/0x11ul, /*type=SOCK_RAW|0x800000000*/0x800000003ul, /*proto=*/0);
if (res != -1)
r[0] = res;
// ioctl$ifreq_SIOCGIFINDEX_team arguments: [
// fd: sock (resource)
// cmd: const = 0x8933 (4 bytes)
// arg: ptr[out, ifreq_dev_t["team0", ifindex_team]] {
// ifreq_dev_t["team0", ifindex_team] {
// ifr_ifrn: buffer: {74 65 61 6d 30 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// elem: ifindex_team (resource)
// pad = 0x0 (20 bytes)
// }
// }
// ]
memcpy((void*)0x20000600, "team0\000\000\000\000\000\000\000\000\000\000\000", 16);
res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x20000600ul);
if (res != -1)
r[1] = *(uint32_t*)0x20000610;
// socket$netlink arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: netlink_proto = 0x0 (4 bytes)
// ]
// returns sock_netlink
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[2] = res;
// sendmsg$nl_route_sched arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] {
// msghdr_netlink[netlink_msg_route_sched] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route_sched]] {
// iovec[in, netlink_msg_route_sched] {
// addr: ptr[in, netlink_msg_route_sched] {
// union netlink_msg_route_sched {
// newqdisc: netlink_msg_t[const[RTM_NEWQDISC, int16], tcmsg[AF_UNSPEC], rtm_tca_policy] {
// len: len = 0xb0 (4 bytes)
// type: const = 0x24 (2 bytes)
// flags: netlink_msg_flags = 0xf0b (2 bytes)
// seq: int32 = 0x0 (4 bytes)
// pid: int32 = 0x0 (4 bytes)
// payload: tcmsg[AF_UNSPEC] {
// family: const = 0x0 (1 bytes)
// tcm__pad1: const = 0x0 (1 bytes)
// tcm__pad2: const = 0x12 (2 bytes)
// ifindex: ifindex (resource)
// tcm_handle: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x0 (2 bytes)
// }
// tcm_parent: tcm_handle {
// minor: tcm_handle_offsets = 0xffff (2 bytes)
// major: tcm_handle_offsets = 0xffff (2 bytes)
// }
// tcm_info: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x0 (2 bytes)
// }
// }
// attrs: array[rtm_tca_policy] {
// union rtm_tca_policy {
// qdisc_kind_options: union qdisc_kind_options {
// q_taprio: tca_kind_options_t["taprio", array[taprio_policy]] {
// TCA_KIND: nlattr_t[const[TCA_KIND, int16], string["taprio"]] {
// nla_len: offsetof = 0xb (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {74 61 70 72 69 6f 00} (length 0x7)
// size: buffer: {} (length 0x0)
// pad = 0x0 (1 bytes)
// }
// TCA_OPTIONS: nlattr_t[const[TCA_OPTIONS, int16], array[taprio_policy]] {
// nla_len: offsetof = 0x80 (2 bytes)
// nla_type: const = 0x2 (2 bytes)
// payload: array[taprio_policy] {
// union taprio_policy {
// TCA_TAPRIO_ATTR_PRIOMAP: nlattr_t[const[TCA_TAPRIO_ATTR_PRIOMAP, int16], tc_mqprio_qopt] {
// nla_len: offsetof = 0x56 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: tc_mqprio_qopt {
// num_tc: int8 = 0x2 (1 bytes)
// prio_tc_map: array[int8] {
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// }
// hw: int8 = 0x0 (1 bytes)
// count: array[int16] {
// int16 = 0x8 (2 bytes)
// int16 = 0x4 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0xfffc (2 bytes)
// int16 = 0x0 (2 bytes)
// }
// offset: array[int16] {
// int16 = 0x0 (2 bytes)
// int16 = 0x8 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// }
// }
// size: buffer: {} (length 0x0)
// pad = 0x0 (2 bytes)
// }
// }
// union taprio_policy {
// TCA_TAPRIO_ATTR_SCHED_CLOCKID: nlattr_t[const[TCA_TAPRIO_ATTR_SCHED_CLOCKID, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x5 (2 bytes)
// payload: int32 = 0x0 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// union taprio_policy {
// TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST: nlattr_tt[const[TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST, int16:14], 0, 1, array[nlnest[TCA_TAPRIO_SCHED_ENTRY, array[entry_policy$taprio]]]] {
// nla_len: offsetof = 0x10 (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nlattr_tt[const[TCA_TAPRIO_SCHED_ENTRY, int16:14], 0, 1, array[entry_policy$taprio]]] {
// nlattr_tt[const[TCA_TAPRIO_SCHED_ENTRY, int16:14], 0, 1, array[entry_policy$taprio]] {
// nla_len: offsetof = 0xc (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[entry_policy$taprio] {
// union entry_policy$taprio {
// TCA_TAPRIO_SCHED_ENTRY_INTERVAL: nlattr_t[const[TCA_TAPRIO_SCHED_ENTRY_INTERVAL, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x4 (2 bytes)
// payload: int32 = 0x4000000 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// union taprio_policy {
// TCA_TAPRIO_ATTR_SCHED_BASE_TIME: nlattr_t[const[TCA_TAPRIO_ATTR_SCHED_BASE_TIME, int16], int64] {
// nla_len: offsetof = 0xc (2 bytes)
// nla_type: const = 0x3 (2 bytes)
// payload: int64 = 0x8 (8 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// }
// }
// len: len = 0xb0 (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x200007c0 = 0;
*(uint32_t*)0x200007c8 = 0;
*(uint64_t*)0x200007d0 = 0x20000780;
*(uint64_t*)0x20000780 = 0x20000140;
*(uint32_t*)0x20000140 = 0xb0;
*(uint16_t*)0x20000144 = 0x24;
*(uint16_t*)0x20000146 = 0xf0b;
*(uint32_t*)0x20000148 = 0;
*(uint32_t*)0x2000014c = 0;
*(uint8_t*)0x20000150 = 0;
*(uint8_t*)0x20000151 = 0;
*(uint16_t*)0x20000152 = 0x12;
*(uint32_t*)0x20000154 = r[1];
*(uint16_t*)0x20000158 = 0;
*(uint16_t*)0x2000015a = 0;
*(uint16_t*)0x2000015c = -1;
*(uint16_t*)0x2000015e = -1;
*(uint16_t*)0x20000160 = 0;
*(uint16_t*)0x20000162 = 0;
*(uint16_t*)0x20000164 = 0xb;
*(uint16_t*)0x20000166 = 1;
memcpy((void*)0x20000168, "taprio\000", 7);
*(uint16_t*)0x20000170 = 0x80;
*(uint16_t*)0x20000172 = 2;
*(uint16_t*)0x20000174 = 0x56;
*(uint16_t*)0x20000176 = 1;
*(uint8_t*)0x20000178 = 2;
*(uint8_t*)0x20000179 = 0;
*(uint8_t*)0x2000017a = 0;
*(uint8_t*)0x2000017b = 0;
*(uint8_t*)0x2000017c = 0;
*(uint8_t*)0x2000017d = 0;
*(uint8_t*)0x2000017e = 0;
*(uint8_t*)0x2000017f = 0;
*(uint8_t*)0x20000180 = 0;
*(uint8_t*)0x20000181 = 0;
*(uint8_t*)0x20000182 = 0;
*(uint8_t*)0x20000183 = 0;
*(uint8_t*)0x20000184 = 0;
*(uint8_t*)0x20000185 = 0;
*(uint8_t*)0x20000186 = 0;
*(uint8_t*)0x20000187 = 0;
*(uint8_t*)0x20000188 = 0;
*(uint8_t*)0x20000189 = 0;
*(uint16_t*)0x2000018a = 8;
*(uint16_t*)0x2000018c = 4;
*(uint16_t*)0x2000018e = 0;
*(uint16_t*)0x20000190 = 0;
*(uint16_t*)0x20000192 = 0;
*(uint16_t*)0x20000194 = 0;
*(uint16_t*)0x20000196 = 0;
*(uint16_t*)0x20000198 = 0;
*(uint16_t*)0x2000019a = 0;
*(uint16_t*)0x2000019c = 0;
*(uint16_t*)0x2000019e = 0;
*(uint16_t*)0x200001a0 = 0;
*(uint16_t*)0x200001a2 = 0;
*(uint16_t*)0x200001a4 = 0;
*(uint16_t*)0x200001a6 = 0xfffc;
*(uint16_t*)0x200001a8 = 0;
*(uint16_t*)0x200001aa = 0;
*(uint16_t*)0x200001ac = 8;
*(uint16_t*)0x200001ae = 0;
*(uint16_t*)0x200001b0 = 0;
*(uint16_t*)0x200001b2 = 0;
*(uint16_t*)0x200001b4 = 0;
*(uint16_t*)0x200001b6 = 0;
*(uint16_t*)0x200001b8 = 0;
*(uint16_t*)0x200001ba = 0;
*(uint16_t*)0x200001bc = 0;
*(uint16_t*)0x200001be = 0;
*(uint16_t*)0x200001c0 = 0;
*(uint16_t*)0x200001c2 = 0;
*(uint16_t*)0x200001c4 = 0;
*(uint16_t*)0x200001c6 = 0;
*(uint16_t*)0x200001c8 = 0;
*(uint16_t*)0x200001cc = 8;
*(uint16_t*)0x200001ce = 5;
*(uint32_t*)0x200001d0 = 0;
*(uint16_t*)0x200001d4 = 0x10;
STORE_BY_BITMASK(uint16_t, , 0x200001d6, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200001d7, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200001d7, 1, 7, 1);
*(uint16_t*)0x200001d8 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x200001da, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200001db, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200001db, 1, 7, 1);
*(uint16_t*)0x200001dc = 8;
*(uint16_t*)0x200001de = 4;
*(uint32_t*)0x200001e0 = 0x4000000;
*(uint16_t*)0x200001e4 = 0xc;
*(uint16_t*)0x200001e6 = 3;
*(uint64_t*)0x200001e8 = 8;
*(uint64_t*)0x20000788 = 0xb0;
*(uint64_t*)0x200007d8 = 1;
*(uint64_t*)0x200007e0 = 0;
*(uint64_t*)0x200007e8 = 0;
*(uint32_t*)0x200007f0 = 0;
syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x200007c0ul, /*f=*/0ul);
// clock_adjtime arguments: [
// id: clock_id = 0x0 (8 bytes)
// tx: ptr[in, timex] {
// timex {
// stuff0: intptr = 0x3ff (8 bytes)
// stuff1: intptr = 0x1 (8 bytes)
// stuff2: intptr = 0x5 (8 bytes)
// stuff3: intptr = 0x0 (8 bytes)
// stuff4: intptr = 0x0 (8 bytes)
// stuff5: intptr = 0x0 (8 bytes)
// stuff6: intptr = 0x0 (8 bytes)
// stuff7: intptr = 0x0 (8 bytes)
// stuff8: intptr = 0x0 (8 bytes)
// stuff9: intptr = 0x100 (8 bytes)
// stuff10: intptr = 0x0 (8 bytes)
// stuff11: intptr = 0x0 (8 bytes)
// stuff12: intptr = 0x81 (8 bytes)
// stuff13: intptr = 0x0 (8 bytes)
// stuff14: intptr = 0x7 (8 bytes)
// stuff15: intptr = 0x400000000000000 (8 bytes)
// stuff16: intptr = 0x0 (8 bytes)
// stuff17: intptr = 0x0 (8 bytes)
// stuff18: intptr = 0x0 (8 bytes)
// stuff19: intptr = 0x0 (8 bytes)
// stuff20: intptr = 0x5 (8 bytes)
// stuff21: intptr = 0x0 (8 bytes)
// stuff22: intptr = 0x0 (8 bytes)
// stuff23: intptr = 0x0 (8 bytes)
// stuff24: intptr = 0x0 (8 bytes)
// stuff25: intptr = 0x0 (8 bytes)
// }
// }
// ]
*(uint64_t*)0x20000000 = 0x3ff;
*(uint64_t*)0x20000008 = 1;
*(uint64_t*)0x20000010 = 5;
*(uint64_t*)0x20000018 = 0;
*(uint64_t*)0x20000020 = 0;
*(uint64_t*)0x20000028 = 0;
*(uint64_t*)0x20000030 = 0;
*(uint64_t*)0x20000038 = 0;
*(uint64_t*)0x20000040 = 0;
*(uint64_t*)0x20000048 = 0x100;
*(uint64_t*)0x20000050 = 0;
*(uint64_t*)0x20000058 = 0;
*(uint64_t*)0x20000060 = 0x81;
*(uint64_t*)0x20000068 = 0;
*(uint64_t*)0x20000070 = 7;
*(uint64_t*)0x20000078 = 0x400000000000000;
*(uint64_t*)0x20000080 = 0;
*(uint64_t*)0x20000088 = 0;
*(uint64_t*)0x20000090 = 0;
*(uint64_t*)0x20000098 = 0;
*(uint64_t*)0x200000a0 = 5;
*(uint64_t*)0x200000a8 = 0;
*(uint64_t*)0x200000b0 = 0;
*(uint64_t*)0x200000b8 = 0;
*(uint64_t*)0x200000c0 = 0;
*(uint64_t*)0x200000c8 = 0;
syscall(__NR_clock_adjtime, /*id=*/0ul, /*tx=*/0x20000000ul);
// clock_adjtime arguments: [
// id: clock_id = 0x0 (8 bytes)
// tx: ptr[in, timex] {
// timex {
// stuff0: intptr = 0x3ff (8 bytes)
// stuff1: intptr = 0x1 (8 bytes)
// stuff2: intptr = 0x5 (8 bytes)
// stuff3: intptr = 0x0 (8 bytes)
// stuff4: intptr = 0x0 (8 bytes)
// stuff5: intptr = 0x0 (8 bytes)
// stuff6: intptr = 0x0 (8 bytes)
// stuff7: intptr = 0x0 (8 bytes)
// stuff8: intptr = 0x0 (8 bytes)
// stuff9: intptr = 0x100 (8 bytes)
// stuff10: intptr = 0x0 (8 bytes)
// stuff11: intptr = 0x0 (8 bytes)
// stuff12: intptr = 0x81 (8 bytes)
// stuff13: intptr = 0x0 (8 bytes)
// stuff14: intptr = 0x7 (8 bytes)
// stuff15: intptr = 0x400000000000000 (8 bytes)
// stuff16: intptr = 0x0 (8 bytes)
// stuff17: intptr = 0x0 (8 bytes)
// stuff18: intptr = 0x0 (8 bytes)
// stuff19: intptr = 0x0 (8 bytes)
// stuff20: intptr = 0x5 (8 bytes)
// stuff21: intptr = 0x0 (8 bytes)
// stuff22: intptr = 0x0 (8 bytes)
// stuff23: intptr = 0x0 (8 bytes)
// stuff24: intptr = 0x0 (8 bytes)
// stuff25: intptr = 0x0 (8 bytes)
// }
// }
// ]
*(uint64_t*)0x20000000 = 0x3ff;
*(uint64_t*)0x20000008 = 1;
*(uint64_t*)0x20000010 = 5;
*(uint64_t*)0x20000018 = 0;
*(uint64_t*)0x20000020 = 0;
*(uint64_t*)0x20000028 = 0;
*(uint64_t*)0x20000030 = 0;
*(uint64_t*)0x20000038 = 0;
*(uint64_t*)0x20000040 = 0;
*(uint64_t*)0x20000048 = 0x100;
*(uint64_t*)0x20000050 = 0;
*(uint64_t*)0x20000058 = 0;
*(uint64_t*)0x20000060 = 0x81;
*(uint64_t*)0x20000068 = 0;
*(uint64_t*)0x20000070 = 7;
*(uint64_t*)0x20000078 = 0x400000000000000;
*(uint64_t*)0x20000080 = 0;
*(uint64_t*)0x20000088 = 0;
*(uint64_t*)0x20000090 = 0;
*(uint64_t*)0x20000098 = 0;
*(uint64_t*)0x200000a0 = 5;
*(uint64_t*)0x200000a8 = 0;
*(uint64_t*)0x200000b0 = 0;
*(uint64_t*)0x200000b8 = 0;
*(uint64_t*)0x200000c0 = 0;
*(uint64_t*)0x200000c8 = 0;
syscall(__NR_clock_adjtime, /*id=*/0ul, /*tx=*/0x20000000ul);
return 0;
}
]