map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
uint64_t r[1] = {0x0};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// madvise arguments: [
// addr: VMA[0x4000]
// len: len = 0x4000 (8 bytes)
// advice: madvise_flags = 0xe (8 bytes)
// ]
syscall(__NR_madvise, /*addr=*/0x200000a93000ul, /*len=*/0x4000ul, /*advice=MADV_HUGEPAGE*/0xeul);
// mremap arguments: [
// addr: VMA[0x1000]
// len: len = 0x1000 (8 bytes)
// newlen: len = 0x800000 (8 bytes)
// flags: mremap_flags = 0x3 (8 bytes)
// newaddr: VMA[0x800000]
// ]
syscall(__NR_mremap, /*addr=*/0x200000a96000ul, /*len=*/0x1000ul, /*newlen=*/0x800000ul, /*flags=MREMAP_FIXED|MREMAP_MAYMOVE*/3ul, /*newaddr=*/0x200000130000ul);
// gettid arguments: [
// ]
// returns pid
res = syscall(__NR_gettid);
if (res != -1)
r[0] = res;
// process_vm_writev arguments: [
// pid: pid (resource)
// loc_vec: ptr[in, array[iovec[out, array[int8]]]] {
// array[iovec[out, array[int8]]] {
// iovec[out, array[int8]] {
// addr: ptr[out, buffer] {
// buffer: (DirOut)
// }
// len: len = 0xf7 (8 bytes)
// }
// }
// }
// loc_vlen: len = 0x1 (8 bytes)
// rem_vec: ptr[in, array[iovec[out, array[int8]]]] {
// array[iovec[out, array[int8]]] {
// iovec[out, array[int8]] {
// addr: ptr[out, buffer] {
// buffer: (DirOut)
// }
// len: len = 0xffffff4e (8 bytes)
// }
// }
// }
// rem_vlen: len = 0x23a (8 bytes)
// flags: const = 0x0 (8 bytes)
// ]
*(uint64_t*)0x200000000000 = 0x2000008f9f09;
*(uint64_t*)0x200000000008 = 0xf7;
*(uint64_t*)0x200000121000 = 0x200000217f28;
*(uint64_t*)0x200000121008 = 0xffffff4e;
syscall(__NR_process_vm_writev, /*pid=*/r[0], /*loc_vec=*/0x200000000000ul, /*loc_vlen=*/1ul, /*rem_vec=*/0x200000121000ul, /*rem_vlen=*/0x23aul, /*flags=*/0ul);
// mremap arguments: [
// addr: VMA[0x1000]
// len: len = 0x1000 (8 bytes)
// newlen: len = 0x4000 (8 bytes)
// flags: mremap_flags = 0x3 (8 bytes)
// newaddr: VMA[0x4000]
// ]
syscall(__NR_mremap, /*addr=*/0x200000f18000ul, /*len=*/0x1000ul, /*newlen=*/0x4000ul, /*flags=MREMAP_FIXED|MREMAP_MAYMOVE*/3ul, /*newaddr=*/0x20000052f000ul);
return 0;
}
]