map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// mkdir arguments: [
// path: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// mode: open_mode = 0x0 (8 bytes)
// ]
memcpy((void*)0x2000001c6000, "./file0\000", 8);
syscall(__NR_mkdir, /*path=*/0x2000001c6000ul, /*mode=*/0ul);
// mount arguments: [
// src: ptr[in, blockdev_filename] {
// union blockdev_filename {
// filename: buffer: {} (length 0x0)
// }
// }
// dst: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// type: ptr[in, buffer] {
// buffer: {70 72 6f 63 00} (length 0x5)
// }
// flags: mount_flags = 0x0 (8 bytes)
// data: ptr[in, buffer] {
// buffer: {} (length 0x0)
// }
// ]
memcpy((void*)0x200000a1c000, "./file0\000", 8);
memcpy((void*)0x200000014000, "proc\000", 5);
syscall(__NR_mount, /*src=*/0x20000000a000ul, /*dst=*/0x200000a1c000ul, /*type=*/0x200000014000ul, /*flags=*/0ul, /*data=*/0x200000fc9000ul);
// socket$inet6 arguments: [
// domain: const = 0xa (8 bytes)
// type: socket_type = 0x2100000000000002 (8 bytes)
// proto: int32 = 0x0 (4 bytes)
// ]
// returns sock_in6
res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_DGRAM|0x2100000000000000*/0x2100000000000002ul, /*proto=*/0);
if (res != -1)
r[0] = res;
// socket$nl_xfrm arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x6 (4 bytes)
// ]
// returns sock_nl_xfrm
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/6);
if (res != -1)
r[1] = res;
// bind$netlink arguments: [
// fd: sock_netlink (resource)
// addr: ptr[in, sockaddr_nl_t[AF_NETLINK, netlink_port_id, flags[netlink_group_bitmap, int32]]] {
// sockaddr_nl_t[AF_NETLINK, netlink_port_id, flags[netlink_group_bitmap, int32]] {
// nl_family: const = 0x10 (2 bytes)
// nl_pad: const = 0x0 (2 bytes)
// nl_pid: int32 = 0x0 (4 bytes)
// nl_groups: netlink_group_bitmap = 0x1 (4 bytes)
// }
// }
// addrlen: len = 0xc (8 bytes)
// ]
*(uint16_t*)0x200000000080 = 0x10;
*(uint16_t*)0x200000000082 = 0;
*(uint32_t*)0x200000000084 = 0;
*(uint32_t*)0x200000000088 = 1;
syscall(__NR_bind, /*fd=*/r[1], /*addr=*/0x200000000080ul, /*addrlen=*/0xcul);
// connect$inet6 arguments: [
// fd: sock_in6 (resource)
// addr: ptr[in, sockaddr_in6] {
// sockaddr_in6 {
// family: const = 0xa (2 bytes)
// port: int16be = 0x4e20 (2 bytes)
// flow: int32be = 0x0 (4 bytes)
// addr: union ipv6_addr {
// ipv4: ipv6_addr_ipv4 {
// a0: buffer: {00 00 00 00 00 00 00 00 00 00} (length 0xa)
// a1: buffer: {ff ff} (length 0x2)
// a3: union ipv4_addr {
// loopback: const = 0x7f000001 (4 bytes)
// }
// }
// }
// scope: int32 = 0x0 (4 bytes)
// }
// }
// addrlen: len = 0x1c (8 bytes)
// ]
*(uint16_t*)0x200000000000 = 0xa;
*(uint16_t*)0x200000000002 = htobe16(0x4e20);
*(uint32_t*)0x200000000004 = htobe32(0);
memset((void*)0x200000000008, 0, 10);
memset((void*)0x200000000012, 255, 2);
*(uint32_t*)0x200000000014 = htobe32(0x7f000001);
*(uint32_t*)0x200000000018 = 0;
syscall(__NR_connect, /*fd=*/r[0], /*addr=*/0x200000000000ul, /*addrlen=*/0x1cul);
// setsockopt$inet6_IPV6_XFRM_POLICY arguments: [
// fd: sock_in6 (resource)
// level: const = 0x29 (4 bytes)
// optname: const = 0x23 (4 bytes)
// optval: ptr[in, xfrm_filter] {
// xfrm_filter {
// info: xfrm_userpolicy_info {
// sel: xfrm_selector {
// daddr: union xfrm_address_t {
// in6: union ipv6_addr {
// remote: ipv6_addr_t[const[0xbb, int8]] {
// a0: const = 0xfe (1 bytes)
// a1: const = 0x80 (1 bytes)
// a2: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0xd)
// a3: const = 0xbb (1 bytes)
// }
// }
// }
// saddr: union xfrm_address_t {
// in6: union ipv6_addr {
// loopback: ipv6_addr_loopback {
// a0: const = 0x0 (8 bytes)
// a1: const = 0x1 (8 bytes)
// }
// }
// }
// dport: int16be = 0x4e20 (2 bytes)
// dport_mask: int16be = 0x0 (2 bytes)
// sport: int16be = 0x4e20 (2 bytes)
// sport_mask: int16be = 0x0 (2 bytes)
// family: xfrm_family = 0x2 (2 bytes)
// prefixlen_d: xfrm_prefixlens = 0x0 (1 bytes)
// prefixlen_s: xfrm_prefixlens = 0x0 (1 bytes)
// proto: ipv6_types = 0x0 (1 bytes)
// pad = 0x0 (3 bytes)
// ifindex: ifindex (resource)
// user: uid (resource)
// }
// lft: xfrm_lifetime_cfg {
// soft_byte_limit: int64 = 0x0 (8 bytes)
// hard_byte_limit: int64 = 0x0 (8 bytes)
// soft_packet_limit: int64 = 0x0 (8 bytes)
// hard_packet_limit: int64 = 0x0 (8 bytes)
// soft_add_expires_seconds: int64 = 0x0 (8 bytes)
// hard_add_expires_seconds: int64 = 0x0 (8 bytes)
// soft_use_expires_seconds: int64 = 0x0 (8 bytes)
// hard_use_expires_seconds: int64 = 0x0 (8 bytes)
// }
// curlft: xfrm_lifetime_cur {
// bytes: int64 = 0x0 (8 bytes)
// packets: int64 = 0x0 (8 bytes)
// add_time: int64 = 0x0 (8 bytes)
// use_time: int64 = 0x0 (8 bytes)
// }
// priority: int32 = 0x0 (4 bytes)
// index: int32 = 0x0 (4 bytes)
// dir: xfrm_policy_dir = 0x1 (1 bytes)
// action: xfrm_policy_actions = 0x0 (1 bytes)
// flags: xfrm_policy_flags = 0x0 (1 bytes)
// share: xfrm_policy_shares = 0x0 (1 bytes)
// pad = 0x0 (4 bytes)
// }
// tmpl: xfrm_user_tmpl {
// id: xfrm_id {
// daddr: union xfrm_address_t {
// in: union ipv4_addr {
// dev: ipv4_addr_t[netdev_addr_id] {
// a0: const = 0xac (1 bytes)
// a1: const = 0x14 (1 bytes)
// a2: const = 0x14 (1 bytes)
// a3: int8 = 0x0 (1 bytes)
// }
// }
// }
// spi: int32be = 0xfffffffffffffffc (4 bytes)
// proto: xfrm_proto = 0x2b (1 bytes)
// pad = 0x0 (3 bytes)
// }
// family: xfrm_family = 0x0 (2 bytes)
// pad = 0x0 (2 bytes)
// saddr: union xfrm_address_t {
// in6: union ipv6_addr {
// loopback: ipv6_addr_loopback {
// a0: const = 0x0 (8 bytes)
// a1: const = 0x1 (8 bytes)
// }
// }
// }
// reqid: int32 = 0x0 (4 bytes)
// mode: xfrm_mode = 0x0 (1 bytes)
// share: xfrm_policy_shares = 0x0 (1 bytes)
// optional: int8 = 0x90 (1 bytes)
// pad = 0x0 (1 bytes)
// aalgos: int32 = 0x0 (4 bytes)
// ealgos: int32 = 0x0 (4 bytes)
// calgos: int32 = 0x0 (4 bytes)
// }
// }
// }
// optlen: len = 0xe8 (8 bytes)
// ]
*(uint8_t*)0x2000000001c0 = 0xfe;
*(uint8_t*)0x2000000001c1 = 0x80;
memset((void*)0x2000000001c2, 0, 13);
*(uint8_t*)0x2000000001cf = 0xbb;
*(uint64_t*)0x2000000001d0 = htobe64(0);
*(uint64_t*)0x2000000001d8 = htobe64(1);
*(uint16_t*)0x2000000001e0 = htobe16(0x4e20);
*(uint16_t*)0x2000000001e2 = htobe16(0);
*(uint16_t*)0x2000000001e4 = htobe16(0x4e20);
*(uint16_t*)0x2000000001e6 = htobe16(0);
*(uint16_t*)0x2000000001e8 = 2;
*(uint8_t*)0x2000000001ea = 0;
*(uint8_t*)0x2000000001eb = 0;
*(uint8_t*)0x2000000001ec = 0;
*(uint32_t*)0x2000000001f0 = 0;
*(uint32_t*)0x2000000001f4 = 0;
*(uint64_t*)0x2000000001f8 = 0;
*(uint64_t*)0x200000000200 = 0;
*(uint64_t*)0x200000000208 = 0;
*(uint64_t*)0x200000000210 = 0;
*(uint64_t*)0x200000000218 = 0;
*(uint64_t*)0x200000000220 = 0;
*(uint64_t*)0x200000000228 = 0;
*(uint64_t*)0x200000000230 = 0;
*(uint64_t*)0x200000000238 = 0;
*(uint64_t*)0x200000000240 = 0;
*(uint64_t*)0x200000000248 = 0;
*(uint64_t*)0x200000000250 = 0;
*(uint32_t*)0x200000000258 = 0;
*(uint32_t*)0x20000000025c = 0;
*(uint8_t*)0x200000000260 = 1;
*(uint8_t*)0x200000000261 = 0;
*(uint8_t*)0x200000000262 = 0;
*(uint8_t*)0x200000000263 = 0;
*(uint8_t*)0x200000000268 = 0xac;
*(uint8_t*)0x200000000269 = 0x14;
*(uint8_t*)0x20000000026a = 0x14;
*(uint8_t*)0x20000000026b = 0;
*(uint32_t*)0x200000000278 = htobe32(0xfffffffc);
*(uint8_t*)0x20000000027c = 0x2b;
*(uint16_t*)0x200000000280 = 0;
*(uint64_t*)0x200000000284 = htobe64(0);
*(uint64_t*)0x20000000028c = htobe64(1);
*(uint32_t*)0x200000000294 = 0;
*(uint8_t*)0x200000000298 = 0;
*(uint8_t*)0x200000000299 = 0;
*(uint8_t*)0x20000000029a = 0x90;
*(uint32_t*)0x20000000029c = 0;
*(uint32_t*)0x2000000002a0 = 0;
*(uint32_t*)0x2000000002a4 = 0;
syscall(__NR_setsockopt, /*fd=*/r[0], /*level=*/0x29, /*optname=*/0x23, /*optval=*/0x2000000001c0ul, /*optlen=*/0xe8ul);
// connect$inet6 arguments: [
// fd: sock_in6 (resource)
// addr: ptr[in, sockaddr_in6] {
// sockaddr_in6 {
// family: const = 0xa (2 bytes)
// port: int16be = 0x4e20 (2 bytes)
// flow: int32be = 0x0 (4 bytes)
// addr: union ipv6_addr {
// empty: ipv6_addr_empty {
// a0: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// }
// }
// scope: int32 = 0x0 (4 bytes)
// }
// }
// addrlen: len = 0x1c (8 bytes)
// ]
*(uint16_t*)0x200000000180 = 0xa;
*(uint16_t*)0x200000000182 = htobe16(0x4e20);
*(uint32_t*)0x200000000184 = htobe32(0);
memset((void*)0x200000000188, 0, 16);
*(uint32_t*)0x200000000198 = 0;
syscall(__NR_connect, /*fd=*/r[0], /*addr=*/0x200000000180ul, /*addrlen=*/0x1cul);
return 0;
}
]