map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_fsconfig
#define __NR_fsconfig 431
#endif
#ifndef __NR_fspick
#define __NR_fspick 433
#endif
uint64_t r[1] = {0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// mkdirat arguments: [
// fd: fd_dir (resource)
// path: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// mode: open_mode = 0x0 (8 bytes)
// ]
memcpy((void*)0x2000000000c0, "./file0\000", 8);
syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x2000000000c0ul, /*mode=*/0ul);
// mount arguments: [
// src: ptr[in, blockdev_filename] {
// union blockdev_filename {
// filename: buffer: {} (length 0x0)
// }
// }
// dst: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// type: ptr[in, buffer] {
// buffer: {6a 66 66 73 32 00} (length 0x6)
// }
// flags: mount_flags = 0x3 (8 bytes)
// data: nil
// ]
memcpy((void*)0x2000000000c0, "./file0\000", 8);
memcpy((void*)0x200000001200, "jffs2\000", 6);
syscall(__NR_mount, /*src=*/0x200000000040ul, /*dst=*/0x2000000000c0ul, /*type=*/0x200000001200ul, /*flags=MS_RDONLY|MS_NOSUID*/3ul, /*data=*/0ul);
// fspick arguments: [
// dfd: fd_dir (resource)
// path: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 2f 2e 2e 2f 66 69 6c 65 30 00} (length 0x11)
// }
// flags: fspick_flags = 0x0 (8 bytes)
// ]
// returns fd_fscontext
memcpy((void*)0x200000000380, "./file0/../file0\000", 17);
res = syscall(__NR_fspick, /*dfd=*/0xffffff9c, /*path=*/0x200000000380ul, /*flags=*/0ul);
if (res != -1)
r[0] = res;
// fsconfig$FSCONFIG_CMD_RECONFIGURE arguments: [
// fd: fd_fscontext (resource)
// cmd: const = 0x7 (8 bytes)
// key: const = 0x0 (8 bytes)
// value: const = 0x0 (8 bytes)
// aux: const = 0x0 (8 bytes)
// ]
syscall(__NR_fsconfig, /*fd=*/r[0], /*cmd=*/7ul, /*key=*/0ul, /*value=*/0ul, /*aux=*/0ul);
return 0;
}
]