map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_fsconfig
#define __NR_fsconfig 431
#endif
#ifndef __NR_mkdir
#define __NR_mkdir 39
#endif
#ifndef __NR_mmap
#define __NR_mmap 192
#endif
#ifndef __NR_mount
#define __NR_mount 21
#endif
#ifndef __NR_openat
#define __NR_openat 322
#endif
#ifndef __NR_read
#define __NR_read 3
#endif
#undef __NR_mmap
#define __NR_mmap __NR_mmap2
static long syz_open_procfs(volatile long a0, volatile long a1)
{
char buf[128];
memset(buf, 0, sizeof(buf));
if (a0 == 0) {
snprintf(buf, sizeof(buf), "/proc/self/%s", (char*)a1);
} else if (a0 == -1) {
snprintf(buf, sizeof(buf), "/proc/thread-self/%s", (char*)a1);
} else {
snprintf(buf, sizeof(buf), "/proc/self/task/%d/%s", (int)a0, (char*)a1);
}
int fd = open(buf, O_RDWR);
if (fd == -1)
fd = open(buf, O_RDONLY);
return fd;
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000, /*len=*/0x1000, /*prot=*/0, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32, /*fd=*/(intptr_t)-1, /*offset=*/0);
syscall(__NR_mmap, /*addr=*/0x20000000, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32, /*fd=*/(intptr_t)-1, /*offset=*/0);
syscall(__NR_mmap, /*addr=*/0x21000000, /*len=*/0x1000, /*prot=*/0, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32, /*fd=*/(intptr_t)-1, /*offset=*/0);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// mkdir arguments: [
// path: ptr[in, buffer] {
// buffer: {6d 79 5f 73 79 73 00} (length 0x7)
// }
// mode: open_mode = 0x1ff (4 bytes)
// ]
memcpy((void*)0x20000000, "my_sys\000", 7);
syscall(__NR_mkdir, /*path=*/0x20000000, /*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|S_IXUSR|S_IWUSR|0x100*/0x1ff);
// mount arguments: [
// src: nil
// dst: ptr[in, buffer] {
// buffer: {6d 79 5f 73 79 73 00} (length 0x7)
// }
// type: ptr[in, buffer] {
// buffer: {73 79 73 66 73 00} (length 0x6)
// }
// flags: mount_flags = 0x0 (4 bytes)
// data: nil
// ]
memcpy((void*)0x20000200, "my_sys\000", 7);
memcpy((void*)0x20000300, "sysfs\000", 6);
syscall(__NR_mount, /*src=*/0, /*dst=*/0x20000200, /*type=*/0x20000300, /*flags=*/0, /*data=*/0);
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {6d 79 5f 73 79 73 2f 62 75 73 2f 70 63 69 2f 64 65 76 69 63 65 73 2f 30 30 30 30 3a 30 30 3a 30 33 2e 30 2f 72 65 73 6f 75 72 63 65 31 00} (length 0x2e)
// }
// flags: open_flags = 0x2 (4 bytes)
// mode: open_mode = 0x0 (2 bytes)
// ]
// returns fd
memcpy((void*)0x20000500, "my_sys/bus/pci/devices/0000:00:03.0/resource1\000", 46);
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000500, /*flags=O_RDWR*/2, /*mode=*/0);
if (res != -1)
r[0] = res;
// mmap$IORING_OFF_SQ_RING arguments: [
// addr: const = 0x0 (4 bytes)
// len: int32 = 0xff (4 bytes)
// prot: mmap_prot = 0x0 (4 bytes)
// flags: mmap_flags = 0x12 (4 bytes)
// fd: fd_io_uring (resource)
// offset: const = 0x0 (4 bytes)
// ]
// returns ring_ptr
syscall(__NR_mmap, /*addr=*/0, /*len=*/0xff, /*prot=*/0, /*flags=MAP_FIXED|MAP_PRIVATE*/0x12, /*fd=*/(intptr_t)r[0], /*offset=*/0);
// fsconfig$FSCONFIG_SET_BINARY arguments: [
// fd: fd_fscontext (resource)
// cmd: const = 0x2 (4 bytes)
// key: ptr[in, buffer] {
// buffer: {6d 65 6d 00 ff 45 65 76 f2 72 f1 18 1d b9 00 79 5f 68 75 67 24 08 6f 2d 03 51 60 5d 6f 8c 72 9d 5f 65 74 6c f9 dd 07 ad 5c 48 e9 34 08 2c 48 bf} (length 0x30)
// }
// value: nil
// aux: bytesize = 0x0 (4 bytes)
// ]
memcpy((void*)0x20000040, "mem\000\377Eev\362r\361\030\035\271\000y_hug$\bo-\003Q`]o\214r\235_etl\371\335\a\255\\H\3514\b,H\277", 48);
syscall(__NR_fsconfig, /*fd=*/(intptr_t)-1, /*cmd=*/2, /*key=*/0x20000040, /*value=*/0, /*aux=*/0);
// syz_open_procfs arguments: [
// pid: pid (resource)
// file: ptr[in, buffer] {
// buffer: {} (length 0x0)
// }
// ]
// returns fd
res = -1;
res = syz_open_procfs(/*pid=*/0, /*file=*/0x20000040);
if (res != -1)
r[1] = res;
// read$FUSE arguments: [
// fd: fd_fuse (resource)
// buf: ptr[out, fuse_in[read_buffer]] {
// fuse_in[read_buffer] {
// len: len = 0x2020 (4 bytes)
// opcode: int32 = 0x0 (4 bytes)
// unique: fuse_unique (resource)
// uid: uid (resource)
// gid: gid (resource)
// pid: pid (resource)
// padding: int32 = 0x0 (4 bytes)
// payload: buffer: (DirOut)
// }
// }
// len: bytesize = 0x2020 (4 bytes)
// ]
syscall(__NR_read, /*fd=*/(intptr_t)r[1], /*buf=*/0x200034c0, /*len=*/0x2020);
return 0;
}
]