map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/loop.h>
#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif
static unsigned long long procid;
//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:
//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty. In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//% claim that you wrote the original software. If you use this software
//% in a product, an acknowledgment in the product documentation would be
//% appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//% misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler madler@alumni.caltech.edu
//% BEGIN CODE DERIVED FROM puff.{c,h}
#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288
struct puff_state {
unsigned char* out;
unsigned long outlen;
unsigned long outcnt;
const unsigned char* in;
unsigned long inlen;
unsigned long incnt;
int bitbuf;
int bitcnt;
jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
long val = s->bitbuf;
while (s->bitcnt < need) {
if (s->incnt == s->inlen)
longjmp(s->env, 1);
val |= (long)(s->in[s->incnt++]) << s->bitcnt;
s->bitcnt += 8;
}
s->bitbuf = (int)(val >> need);
s->bitcnt -= need;
return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
s->bitbuf = 0;
s->bitcnt = 0;
if (s->incnt + 4 > s->inlen)
return 2;
unsigned len = s->in[s->incnt++];
len |= s->in[s->incnt++] << 8;
if (s->in[s->incnt++] != (~len & 0xff) ||
s->in[s->incnt++] != ((~len >> 8) & 0xff))
return -2;
if (s->incnt + len > s->inlen)
return 2;
if (s->outcnt + len > s->outlen)
return 1;
for (; len--; s->outcnt++, s->incnt++) {
if (s->in[s->incnt])
s->out[s->outcnt] = s->in[s->incnt];
}
return 0;
}
struct puff_huffman {
short* count;
short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
int first = 0;
int index = 0;
int bitbuf = s->bitbuf;
int left = s->bitcnt;
int code = first = index = 0;
int len = 1;
short* next = h->count + 1;
while (1) {
while (left--) {
code |= bitbuf & 1;
bitbuf >>= 1;
int count = *next++;
if (code - count < first) {
s->bitbuf = bitbuf;
s->bitcnt = (s->bitcnt - len) & 7;
return h->symbol[index + (code - first)];
}
index += count;
first += count;
first <<= 1;
code <<= 1;
len++;
}
left = (MAXBITS + 1) - len;
if (left == 0)
break;
if (s->incnt == s->inlen)
longjmp(s->env, 1);
bitbuf = s->in[s->incnt++];
if (left > 8)
left = 8;
}
return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
int len;
for (len = 0; len <= MAXBITS; len++)
h->count[len] = 0;
int symbol;
for (symbol = 0; symbol < n; symbol++)
(h->count[length[symbol]])++;
if (h->count[0] == n)
return 0;
int left = 1;
for (len = 1; len <= MAXBITS; len++) {
left <<= 1;
left -= h->count[len];
if (left < 0)
return left;
}
short offs[MAXBITS + 1];
offs[1] = 0;
for (len = 1; len < MAXBITS; len++)
offs[len + 1] = offs[len] + h->count[len];
for (symbol = 0; symbol < n; symbol++)
if (length[symbol] != 0)
h->symbol[offs[length[symbol]]++] = symbol;
return left;
}
static int puff_codes(struct puff_state* s,
const struct puff_huffman* lencode,
const struct puff_huffman* distcode)
{
static const short lens[29] = {
3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
static const short lext[29] = {
0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
static const short dists[30] = {
1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
8193, 12289, 16385, 24577};
static const short dext[30] = {
0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
12, 12, 13, 13};
int symbol;
do {
symbol = puff_decode(s, lencode);
if (symbol < 0)
return symbol;
if (symbol < 256) {
if (s->outcnt == s->outlen)
return 1;
if (symbol)
s->out[s->outcnt] = symbol;
s->outcnt++;
} else if (symbol > 256) {
symbol -= 257;
if (symbol >= 29)
return -10;
int len = lens[symbol] + puff_bits(s, lext[symbol]);
symbol = puff_decode(s, distcode);
if (symbol < 0)
return symbol;
unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
if (dist > s->outcnt)
return -11;
if (s->outcnt + len > s->outlen)
return 1;
while (len--) {
if (dist <= s->outcnt && s->out[s->outcnt - dist])
s->out[s->outcnt] = s->out[s->outcnt - dist];
s->outcnt++;
}
}
} while (symbol != 256);
return 0;
}
static int puff_fixed(struct puff_state* s)
{
static int virgin = 1;
static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
static struct puff_huffman lencode, distcode;
if (virgin) {
lencode.count = lencnt;
lencode.symbol = lensym;
distcode.count = distcnt;
distcode.symbol = distsym;
short lengths[FIXLCODES];
int symbol;
for (symbol = 0; symbol < 144; symbol++)
lengths[symbol] = 8;
for (; symbol < 256; symbol++)
lengths[symbol] = 9;
for (; symbol < 280; symbol++)
lengths[symbol] = 7;
for (; symbol < FIXLCODES; symbol++)
lengths[symbol] = 8;
puff_construct(&lencode, lengths, FIXLCODES);
for (symbol = 0; symbol < MAXDCODES; symbol++)
lengths[symbol] = 5;
puff_construct(&distcode, lengths, MAXDCODES);
virgin = 0;
}
return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
static const short order[19] =
{16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
int nlen = puff_bits(s, 5) + 257;
int ndist = puff_bits(s, 5) + 1;
int ncode = puff_bits(s, 4) + 4;
if (nlen > MAXLCODES || ndist > MAXDCODES)
return -3;
short lengths[MAXCODES];
int index;
for (index = 0; index < ncode; index++)
lengths[order[index]] = puff_bits(s, 3);
for (; index < 19; index++)
lengths[order[index]] = 0;
short lencnt[MAXBITS + 1], lensym[MAXLCODES];
struct puff_huffman lencode = {lencnt, lensym};
int err = puff_construct(&lencode, lengths, 19);
if (err != 0)
return -4;
index = 0;
while (index < nlen + ndist) {
int symbol;
int len;
symbol = puff_decode(s, &lencode);
if (symbol < 0)
return symbol;
if (symbol < 16)
lengths[index++] = symbol;
else {
len = 0;
if (symbol == 16) {
if (index == 0)
return -5;
len = lengths[index - 1];
symbol = 3 + puff_bits(s, 2);
} else if (symbol == 17)
symbol = 3 + puff_bits(s, 3);
else
symbol = 11 + puff_bits(s, 7);
if (index + symbol > nlen + ndist)
return -6;
while (symbol--)
lengths[index++] = len;
}
}
if (lengths[256] == 0)
return -9;
err = puff_construct(&lencode, lengths, nlen);
if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
return -7;
short distcnt[MAXBITS + 1], distsym[MAXDCODES];
struct puff_huffman distcode = {distcnt, distsym};
err = puff_construct(&distcode, lengths + nlen, ndist);
if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
return -8;
return puff_codes(s, &lencode, &distcode);
}
static int puff(
unsigned char* dest,
unsigned long* destlen,
const unsigned char* source,
unsigned long sourcelen)
{
struct puff_state s = {
.out = dest,
.outlen = *destlen,
.outcnt = 0,
.in = source,
.inlen = sourcelen,
.incnt = 0,
.bitbuf = 0,
.bitcnt = 0,
};
int err;
if (setjmp(s.env) != 0)
err = 2;
else {
int last;
do {
last = puff_bits(&s, 1);
int type = puff_bits(&s, 2);
err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1));
if (err != 0)
break;
} while (!last);
}
*destlen = s.outcnt;
return err;
}
//% END CODE DERIVED FROM puff.{c,h}
#define ZLIB_HEADER_WIDTH 2
static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd)
{
if (sourcelen < ZLIB_HEADER_WIDTH)
return 0;
source += ZLIB_HEADER_WIDTH;
sourcelen -= ZLIB_HEADER_WIDTH;
const unsigned long max_destlen = 132 << 20;
void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
if (ret == MAP_FAILED)
return -1;
unsigned char* dest = (unsigned char*)ret;
unsigned long destlen = max_destlen;
int err = puff(dest, &destlen, source, sourcelen);
if (err) {
munmap(dest, max_destlen);
errno = -err;
return -1;
}
if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
munmap(dest, max_destlen);
return -1;
}
return munmap(dest, max_destlen);
}
static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p)
{
int err = 0, loopfd = -1;
int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
if (memfd == -1) {
err = errno;
goto error;
}
if (puff_zlib_to_file(data, size, memfd)) {
err = errno;
goto error_close_memfd;
}
loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
err = errno;
goto error_close_memfd;
}
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
if (errno != EBUSY) {
err = errno;
goto error_close_loop;
}
ioctl(loopfd, LOOP_CLR_FD, 0);
usleep(1000);
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
err = errno;
goto error_close_loop;
}
}
close(memfd);
*loopfd_p = loopfd;
return 0;
error_close_loop:
close(loopfd);
error_close_memfd:
close(memfd);
error:
errno = err;
return -1;
}
static void reset_loop_device(const char* loopname)
{
int loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
return;
}
if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
}
close(loopfd);
}
static long syz_mount_image(
volatile long fsarg,
volatile long dir,
volatile long flags,
volatile long optsarg,
volatile long change_dir,
volatile unsigned long size,
volatile long image)
{
unsigned char* data = (unsigned char*)image;
int res = -1, err = 0, need_loop_device = !!size;
char* mount_opts = (char*)optsarg;
char* target = (char*)dir;
char* fs = (char*)fsarg;
char* source = NULL;
char loopname[64];
if (need_loop_device) {
int loopfd;
memset(loopname, 0, sizeof(loopname));
snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
if (setup_loop_device(data, size, loopname, &loopfd) == -1)
return -1;
close(loopfd);
source = loopname;
}
mkdir(target, 0777);
char opts[256];
memset(opts, 0, sizeof(opts));
if (strlen(mount_opts) > (sizeof(opts) - 32)) {
}
strncpy(opts, mount_opts, sizeof(opts) - 32);
if (strcmp(fs, "iso9660") == 0) {
flags |= MS_RDONLY;
} else if (strncmp(fs, "ext", 3) == 0) {
bool has_remount_ro = false;
char* remount_ro_start = strstr(opts, "errors=remount-ro");
if (remount_ro_start != NULL) {
char after = *(remount_ro_start + strlen("errors=remount-ro"));
char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ','));
}
if (strstr(opts, "errors=panic") || !has_remount_ro)
strcat(opts, ",errors=continue");
} else if (strcmp(fs, "xfs") == 0) {
strcat(opts, ",nouuid");
} else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) {
strcat(opts, ",errors=withdraw");
}
res = mount(source, target, fs, flags, opts);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
res = open(target, O_RDONLY | O_DIRECTORY);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
if (change_dir) {
res = chdir(target);
if (res == -1) {
err = errno;
}
}
error_clear_loop:
if (need_loop_device)
reset_loop_device(loopname);
errno = err;
return res;
}
uint64_t r[1] = {0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// syz_mount_image$jfs arguments: [
// fs: ptr[in, buffer] {
// buffer: {6a 66 73 00} (length 0x4)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// flags: mount_flags = 0x1c802 (8 bytes)
// opts: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {71 75 6f 74 61 2c 64 69 73 63 61 72 64 2c 64 69 73 63 61 72 64 2c 69 6f 63 68 61 72 73 65 74 3d 6b 6f 69 38 2d 72 75 2c 64 69 73 63 61 72 64 2c 00 f4 19 3e b3 ba 2a 0d 5f d0 cd 73 74 28 8f f8 9e c5 13 a5 3e 00 73 45 de cb 72 09 00 f8 31 2d a2 46 3e b0 ed f5 2f ad 1a 00 eb d4 1c 14 b3 ce 75 d0 cf fe fd 37 96 24 b1 6f 72 60 c8 35 71 3b 26 33 52 e0 3b 5c b8 fa 0c 04 2b d1 22 5e d4 de d2 b6 2e 12 fe a4 d7 e6 1b 73 8e 40 78 1e 58 d5 ff f1 12 36 4a c1 40 f4 19 e5 da fe cd 28 3b 3f ab 6b 14 2d db c8 93 b3 5a 81 fe 92 65 59 1e f3 5f a2 92 8e 09 5f ee 4c 10 b2 2e 42 12 37 8d e5 9b ca 03 07 cc 64 4b 96 20 b6 3f 00 00 00 7b bb d4 22 d8 78 56 b7 13 48 b8 f4 53 98 b9 66 0b 6b 3e 8e e8 a8 c3 2f 32 34 cb 46 e2 cd 82 7e c2 5c 1c a4 d0 46 bc 00 4f 8d f7 b1 ee 69 0a 5e 50 51 07 00 d8 0c 7f a6 5f a7 24 d0 e1 b4 36 9f 1b 64 fe 24 9a 03 12 01 00 00 00 4a c9 83 de 92 5f 52 d7 35 b0 3f ea 94 1b 1e 94 8a d8 d1 9c fd a5 b7 99 32 5f d6 9d 14 fc f6 cd de 77 00 a6 31 50 eb 36 99 e5 31 4e 08 27 75 0e 24 41 50 ec 19 f3 f3 f1 d8 be 54 2c 08 4b 5e 40 bf aa 8a d2 06 d2 a3 3b 0d db d7 f8 e0 7d c7 d1 71 74 a4 54 9f fa f5 97 69 49 cb 6d 65 8c 42 ec 7c d9 fe 8a d8 28 52 ce fb 04 64 6e db 3a 41 eb 51 4e b6 a7 72 b3 ee 9f 21 e2 58 22 b5 4e c3 3e 59 2d 5c 04 09 46 72 11 01 d5 3a ff 21 f9 03 51 c9 5a a0 f7 3f 18 53 d6 af cb f9 44 8b 22 0e 98 84 66 06 6f a5 c0 9e 61 98 fc 45 20 d1 99 b9 3b de de e8 7c 40 43 81 5a a0 56 68 a0 6f 8d a9 66 80 cc c1 a1 39 ad e9 0f 5c 79 af 46 20 8f 97 62 f5 4e 7c 29 08 8d 9d e6 9b d2 d5 1c 6b 9c 42 20 9d dc 38 80 05 13 03 b8 55 85 34 07 d9 59 a5 77 7d ce 25 20 1c 5e a1 fa a0 84 c3 6e 3e 34 99 15 eb ec 53 43 5e b2 91 0c 59 39 4e e8 4b a3 ba f9 c4 40 ae 58 33 c2 3f 46 b0 ea ac 54 3c e0 c8 0b a0 60 32 13 e5 3e a5 97 55 07 0b 18 bc 10 b9 22 4a a0 82 d9 67 20 61 15 b4 92 d8 25 75 1f cc 00 00 00 00 00 00 00 e6 3d 51 c5 bf fa 4f 71 2c 2d 7f af b9 cf 50 6c 06 e1 dd ad 4f c1 90 38 40 77 86 fe db 9a fd fb 11 a5 f1 82 67 6d d8 4c 91 9f 71 d5 ee e2 f3 b7 40 b6 8e e7 f6 51 8e b9 d8 ba a2 6f 1c 38 71 f8 63 b1 34 ee 94 2e b3 af 92 d1 9e 70 d8 26 88 39 cd 7b 46 37 f0 62 72 99 f9 9b 18 73 ca 16 5e 41 0f 8b d4 21 e1 a4 85 9f d9 bd 6b b3 4d 25 c0 7e 1a 52 b9 66 8a 53 0b 10 b8 58 5d 79 71 24 a6 97 5a 71 ae db e5 57 a1 7b 06 bb fe 54 7a a5 53 c3 d0 8b 89 21 a4 b0 d9 38 c0 36 87 bd 48 a9 a3 87 b4 c0 66 c0 56 f4 57 fb a5 73 87 75 b9 00 a1 e8 2a 89 aa e1 49 4b 05 c4 bb 0f c8 ed 1a 93 68 8b f8 50 a4 f7 b0 94 2e da 1f 16 ec f0 43 ef a6 b8 c1 f9 e0 fb a3 1f 4a 58 ed 00 31 18 0f b1 b8 a0 0e 4a 86 82 6b 03 00 00 00 2d d1 27 2a 3d 16 09 be bb 74 9d ae f2 02 e0 41 2a 73 d5 45 b8 6c a7 a6 bf 56 9e d3 5d 00 00 ca 23 b0 de 74 2f 60 08 fd f2 09 28 37 0d 88 f8 c0 4b c3 b9 7b 9a 9e 00 62 e8 fc 5f d2 33 7d 85 a6 6b d2 07 30 f3 15 3d b2 45 9f b3 4c 13 4c 06 c1 93 64 e9 64 5e 83 04 0d d1 6e e0 8f 18 f0 ba 69 ac 9c a3 e2 5e 15 44 2b 07 00 00 00 d3 0d 38 a6 46 13 b5 35 fa 80 8a 9b 3b ae 00 bc 37 12 71 d4 5d b2 00 a5 cb f4 33 e2 f6 dd 03 b7 c7 fc c0 40 78 1e 51 51 c9 ba db 78 7e 7e 1e 2f 39 d6 09 98 91 9a a8 db d1 56 f3 1a 5b 7f a5 f9 e5 ec 01 e8 c7 99 ed c3 22 70 3c 7f c4 a8 1a b9 bc 02 dd 96 71 4e e9 d7 e7 5d 28 d0 40 ff 35 66 40 4f d6 db 54 7a 4b 55 31 97 c1 f3 16 d2 0e a5 4f 94 59 cd 81 35 1a 51 0d 10 1e 90 ea be 6d c6 c6 ac 3f fa 18 9c 07 3a 5f b3 fc 38 2d f6 20 bf 5a f9 e6 38 81 9c 77 a0 51 e6 87 58 66 a8 49 f6 f5 78 c0 68 c0 e4 c7 cf bc 15 03 39 97 ef a8 53 c9 62 97 b3 20 1d d3 0e a4 0d c9 4d 01 0a 0c 33 da 9f 63 a1 0b 8f 81 3d c7 89 b8 0b e3 bb 3f 00 ee 58 b3 0d 5c 03 a6 dd bf 41 8a c1 b3 d4 a1 38 39 e4 b2 73 c4 f9 14 be d1 3f 88 06 29 54 95 d4 16 09 47 87 98 39 6a ee c0 6e 8d 34 2e fd 8a c6 b4 22 f6 c2 3a 01 1b 14 00 00 00 00 00 00 00 bc 2a 02 09 4e 19 a1 ee 8b b3 c3 c0 c0 88 ae 8e fa f6 8c 85 00 1f af 7c f5 42 6f b7 c5 c3 67 ed 93 eb 25 c4 8a 29 35 49 d1 5b 91 b5 9f 1b 57 4b 3f 61 71 f8 e5 6a 40 2e c5 6b df 51 d9 03 12 b3 ca 53 98 f4 05 00 00 00 75 04 be 21 45 6e c9 53 bf 06 f1 2f ff 20 c3 1e 7c 8b 55 fe e5 c4 9a a9 39 83 0b 09 99 5f f1 49 25 81 18 f9 aa e2 92 06 f9 73 12 88 b5 6b 10 de 51 52 56 65 fd b4 e2 89 b1 c1 77 de 97 af 30 85 f8 20 45 fb d0 12 f1 dd e9 4f fe cd 90 b7 b6 3d 81 97 d9 c2 4a 6f e5 91 5a c7 d7 24 08 47 f6 d0 bf 90 99 ee 11 7c 83 e3 63 f2 ad 36 a4 a9 f4 fa a5 73 4a fe 97 70 c3 8c 56 5c ae 87 a4 08 d0 ac bb 2d b7 db 91 74 ac ab 60 a3 44 81 4e e6 43 fa 82 ba 41 70 6d 23 60 26 9e d2 76 e1 3d d8 3a bb c2 58 f0 7b 0d 58 ab 0b 65 20 0b 18 b7 f9 f8 71 bc b4 3f ec 5a 2e 37 89 ec d0 c1 06 9d 2d a8 0b 93 c8 6d ff 89 33 e7 0c 21 08 34 60 03 dd f6 b6 03 79 ee e6 3b 66 e7 34 1c dd 8f 87 ed 9f 11 89 4c 9a e0 40 97 63 21 d8 74 05 b4 92 f4 19 eb fa 77 eb 36 7c a6 e3 60 b8 f8 45 11 02 f5 48 93 d7 d1 69 5c 24 bc c1 84 b1 e7 d1 99 40 a2 b6 93 1a de 86 38 dd 2b 85 a8 6d c5 11 db b9 7f 50 52 0f 91 fb f7 20 1f c9 62 1d 0a ee 97 35 d0 7c a0 24 07 6e 85 81 db 33 2b 1c 5f 13 5f e6 b2 e9 d2 c1 8c 9d 5d 5a 52 4d 3d 5b 26 57 e4 b2 8f 1a 09 69 6b d5 b0 76 a1 47 1c 8b 2a b2 ca 3b a5 78 43 af 1d 03 59 0f 4e 89 85 e1 c4 63 c7 81 bb 03 ad 7e c8 16 ea 70 bb e0 64 11 aa e0 01 e0 ca 72 ee 7e 82 8a d1 4b b7 a0 92 d8 83 ad 00 05 54 bf 7f 00 00 00 00 00 00 75 cc 01 f8 a2 e1 80 21 92 f0 9e 77 bc 48 8b 3b d3 f0 8a 9c e8 8b a2 e2 bc c2 3c f5 d7 37 2b 33 9c e1 f5 00 3d b0 ad 70 fa 6e 93 aa 90 8a 2c ed 81 f5 51 4e 23 e2 f9 4f f0 3c 1c 02 f5 a9 19 5f 47 35 56 3e fd 0a 1f c7 da fc fb 3d ae 04 3f e0 c1 72 ec 3a 12 74 7d 7a bf 43 82 bf 74 53 c1 3d f9 94 64 10 17 a0 f4 61 ad d9 56 ef 8f 83 4b 76 2a f3 04 08 af 6a 61 f3 17 fd 3c 7b 08 16 23 6a 76 86 01 b7 c6 60 6b a5 2f f1 26 eb 13 d3 3c 91 5c 5d a9 9d 11 8d b4 88 da 3f 3d 77 83 a6 08 28 2a 93 fc be 09 10 f0 38 9c 3e f9 1d e7 c8 4e 23 da a6 55 4c 42 b2 b3 e9 f7 0a 9f 79 0f 29 01 1a 0b 51 01 b2 3b fe ba 6e 52 87 7e d8 a1 88 95 8e 39 37 5d d2 03 d4 34 be f4 dc 82 cc 8a 21 fc 40 c6 e6 e6 a2 47 5f 70 bf 15 03 be b9 55 50 36 e6 3b dc 93 7f 8a 4d 61 b2 1d 06 a9 d3 23 9d 1d f6 f2 e9 ef 16 de e5 90 b1 5a c0 28 c6 d8 73 bb 29 65 37 4b 73 3d 8e 11 ba 76 3a b1 57 ed 91 dd 87 1b 09 8c 05 43 dc bb a4 cf 67 db 8c 83 c8 43 69 dc 67 73 5f a4 fa a0 fd cf 34 b1 c6 a8 62 cc ae 9f e4 fa 28 74 65 04 64 3b 57 f0 26 23 a2 ef 34 ea 90 f2 e7 f7 dd 77 1f 8f 75 21 7c 79 9d 97 8a 35 33 fc fa b6 c6 f5 39 1b 62 6d 61 b4 00 f0 81 72 fc 67 5e 2a 06 2d 06 c3 1b 85 45 28 04 f7 b1 25 c2 91 f6 0a 02 a5 d6 22 71 e9 6f e7 0d 64 ba e3 6e 28 b4 2e 19 72 59 16 9e be e8 f6 43 55 54 4f ba d8 b8 3c 1c 8f ad 02 cd 1a 2e 56 a6 f6 e8 2e c7 71 9a 48 a1 be a8 03 54 6b 8a f7 a8 9f af 7c ef 94 d8 ad a4 5f c0 a9 8a 79 ba 90 c9 52 62 f0 11 07 25 c6 bf 7c 81 23 75 34 dc d6 a8 a1 13 bd 8a c4 8b 7d b5 52 6a b7 62 ce c1 03 67 47 42 47 6c d6 b9 2b 8c 7a bc fb 1f 8e 08 f0 a0 5c 1b 20 91 87 04 9f 32 06 bd 54 5e 8c 20 f8 db 6d 8a 7c dd 0c 9e cb b9 01 1b 61 1a 01 3c d5 81 52 1d fc b0 28 d5 9d 5c 69 d2 86 fb 93 e4 c4 98 b3 aa ff 7e 0c dc f1 f4 1f ec 65 eb db e4 c2 bf 45 31 40 25 1c dd 94 c3 2b 87 c4 63 4d 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 81 6e 6c 33 f9 2d ca 3e 03 c4 00 00 00 5e 53 8c 77 b2 b1 4f 63 d2 53 70 53 63 84 6b c4 e9 cd 32 84 ff 32 93 30 81 2d 22 11 ae 34 10 6e 03 06 37 6a 2b 1c fe 60 a0 9b ec ae 2b 05 ec 9a dc ac 47 61 2a f8 5f 59 8a 88 0f a9 78 91 a7 a2 90 b6 e7 30 80 05 42 ae a7 61 ae b4 63 f5 ff 5b df 50 99 ae 8a d4 af e9 9d b9 e9 c4 e7 03 cb 90 0e 9a e2 72 74 2f e2 ff 81 d1 a4 f1 56 68 39 2c da fd 2e 17 57 70 6f 47 f9 f8 4e 53 2f 25 e2 73 7c b6 f6 e8 93 78 f8 d7 9a b8 50 7b 10 9c 7f 1f 36 53 a5 bc 9d 54 cc c6 33 de 62 63 52 6e ac 10 51 92 74} (length 0x9ac)
// }
// }
// }
// chdir: int8 = 0x1 (1 bytes)
// size: len = 0x5f16 (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x5f16)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000000400, "jfs\000", 4);
memcpy((void*)0x2000000000c0, "./file0\000", 8);
memcpy((void*)0x200000002740, "... [truncated large byte array] ...", 2476);
memcpy((void*)0x200000003100, "... [truncated large byte array] ...", 24342);
syz_mount_image(/*fs=*/0x200000000400, /*dir=*/0x2000000000c0, /*flags=MS_POSIXACL|MS_REC|MS_SILENT|MS_NOSUID|MS_NODIRATIME*/0x1c802, /*opts=*/0x200000002740, /*chdir=*/1, /*size=*/0x5f16, /*img=*/0x200000003100);
// open arguments: [
// file: ptr[in, buffer] {
// buffer: {2e 2f 62 75 73 00} (length 0x6)
// }
// flags: open_flags = 0x64842 (8 bytes)
// mode: open_mode = 0x0 (8 bytes)
// ]
// returns fd
memcpy((void*)0x2000000005c0, "./bus\000", 6);
syscall(__NR_open, /*file=*/0x2000000005c0ul, /*flags=O_NONBLOCK|O_NOFOLLOW|O_NOATIME|O_DIRECT|O_CREAT|0x2*/0x64842ul, /*mode=*/0ul);
// mount arguments: [
// src: ptr[in, blockdev_filename] {
// union blockdev_filename {
// loop: loop_filename {
// prefix: buffer: {2f 64 65 76 2f 6c 6f 6f 70} (length 0x9)
// id: proc = 0x0 (1 bytes)
// z: const = 0x0 (1 bytes)
// }
// }
// }
// dst: ptr[in, buffer] {
// buffer: {2e 2f 62 75 73 00} (length 0x6)
// }
// type: nil
// flags: mount_flags = 0x881000 (8 bytes)
// data: nil
// ]
memcpy((void*)0x200000000380, "/dev/loop", 9);
*(uint8_t*)0x200000000389 = 0x30;
*(uint8_t*)0x20000000038a = 0;
memcpy((void*)0x200000000340, "./bus\000", 6);
syscall(__NR_mount, /*src=*/0x200000000380ul, /*dst=*/0x200000000340ul, /*type=*/0ul, /*flags=MS_I_VERSION|MS_SLAVE|MS_BIND*/0x881000ul, /*data=*/0ul);
// syz_mount_image$msdos arguments: [
// fs: ptr[in, buffer] {
// buffer: {6d 73 64 6f 73 00} (length 0x6)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 00} (length 0x2)
// }
// flags: mount_flags = 0x1a4a438 (8 bytes)
// opts: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// }
// }
// chdir: int8 = 0xb (1 bytes)
// size: len = 0x0 (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x0)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000000f40, "msdos\000", 6);
memcpy((void*)0x200000000140, ".\000", 2);
syz_mount_image(/*fs=*/0x200000000f40, /*dir=*/0x200000000140, /*flags=MS_I_VERSION|MS_PRIVATE|MS_SYNCHRONOUS|MS_STRICTATIME|MS_SILENT|MS_REMOUNT|0x202408*/0x1a4a438, /*opts=*/0x2000000008c0, /*chdir=*/0xb, /*size=*/0, /*img=*/0x200000000000);
// syz_mount_image$vfat arguments: [
// fs: ptr[in, buffer] {
// buffer: {76 66 61 74 00} (length 0x5)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// flags: mount_flags = 0x14812 (8 bytes)
// opts: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {69 6f 63 68 61 72 73 65 74 3d 69 73 6f 38 38 35 39 2d 25 2c 75 74 66 38 3d 31 2c 73 68 6f 72 74 6e 61 6d 65 3d 6c 6f 77 65 72 2c 75 6e 69 5f 78 6c 61 74 65 3d 31 2c 73 68 6f 72 74 6e 61 6d 65 3d 77 69 6e 39 35 2c 69 6f 63 68 61 72 73 65 74 3d 63 70 37 37 35 2c 75 6e 69 5f 78 6c 61 74 65 3d 31 2c 72 6f 64 69 72 2c 75 74 66 38 3d 31 2c 75 6e 69 5f 78 6c 61 74 65 3d 30 2c 74 7a 3d 55 54 43 2c 72 6f 64 69 72 2c 75 6e 69 5f 78 6c 61 74 65 3d 30 2c 75 74 66 38 3d 30 2c 63 6f 64 65 70 61 67 65 3d 31 32 35 35 2c 6e 6f 6e 75 6d 74 61 69 6c 3d 30 2c 00} (length 0xb7)
// }
// }
// }
// chdir: int8 = 0x25 (1 bytes)
// size: len = 0x2a1 (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x2a1)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000003880, "vfat\000", 5);
memcpy((void*)0x200000000000, "./file0\000", 8);
memcpy((void*)0x2000000000c0, "... [truncated large byte array] ...", 183);
memcpy((void*)0x200000002300, "... [truncated large byte array] ...", 673);
syz_mount_image(/*fs=*/0x200000003880, /*dir=*/0x200000000000, /*flags=MS_POSIXACL|MS_REC|MS_SYNCHRONOUS|MS_NOSUID|MS_NODIRATIME*/0x14812, /*opts=*/0x2000000000c0, /*chdir=*/0x25, /*size=*/0x2a1, /*img=*/0x200000002300);
// open arguments: [
// file: ptr[in, buffer] {
// buffer: {2e 2f 62 75 73 00} (length 0x6)
// }
// flags: open_flags = 0x0 (8 bytes)
// mode: open_mode = 0x0 (8 bytes)
// ]
// returns fd
memcpy((void*)0x2000000005c0, "./bus\000", 6);
res = syscall(__NR_open, /*file=*/0x2000000005c0ul, /*flags=*/0ul, /*mode=*/0ul);
if (res != -1)
r[0] = res;
// ioctl$FS_IOC_SETFLAGS arguments: [
// fd: fd (resource)
// cmd: const = 0x4c02 (4 bytes)
// arg: ptr[in, fs_flags] {
// fs_flags = 0x0 (4 bytes)
// }
// ]
*(uint32_t*)0x200000000140 = 0;
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x4c02, /*arg=*/0x200000000140ul);
// mkdirat arguments: [
// fd: fd_dir (resource)
// path: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
// }
// mode: open_mode = 0x135 (8 bytes)
// ]
memcpy((void*)0x200000000140, "./file1\000", 8);
syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000140ul, /*mode=S_IXOTH|S_IROTH|S_IWGRP|S_IRGRP|S_IRUSR*/0x135ul);
// syz_mount_image$ext4 arguments: [
// fs: ptr[in, buffer] {
// buffer: {65 78 74 34 00} (length 0x5)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 62 75 73 00} (length 0x6)
// }
// flags: mount_flags = 0x1400c (8 bytes)
// opts: ptr[in, fs_options[ext4_options]] {
// fs_options[ext4_options] {
// elems: array[fs_opt_elem[ext4_options]] {
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// stripe: fs_opt["stripe", fmt[hex, int32]] {
// name: buffer: {73 74 72 69 70 65} (length 0x6)
// eq: const = 0x3d (1 bytes)
// val: int32 = 0x3d (18 bytes)
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// init_itable: buffer: {69 6e 69 74 5f 69 74 61 62 6c 65} (length 0xb)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// mb_optimize_scan: fs_opt["mb_optimize_scan", fmt[hex, int32[0:1]]] {
// name: buffer: {6d 62 5f 6f 70 74 69 6d 69 7a 65 5f 73 63 61 6e} (length 0x10)
// eq: const = 0x3d (1 bytes)
// val: int32 = 0x1 (18 bytes)
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// }
// common: array[fs_opt_elem[fs_options_common]] {
// }
// null: const = 0x0 (1 bytes)
// }
// }
// chdir: int8 = 0x3 (1 bytes)
// size: len = 0x44d (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x44d)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000000040, "ext4\000", 5);
memcpy((void*)0x200000000180, "./bus\000", 6);
memcpy((void*)0x200000000840, "stripe", 6);
*(uint8_t*)0x200000000846 = 0x3d;
sprintf((char*)0x200000000847, "0x%016llx", (long long)0x3d);
*(uint8_t*)0x200000000859 = 0x2c;
memcpy((void*)0x20000000085a, "init_itable", 11);
*(uint8_t*)0x200000000865 = 0x2c;
memcpy((void*)0x200000000866, "mb_optimize_scan", 16);
*(uint8_t*)0x200000000876 = 0x3d;
sprintf((char*)0x200000000877, "0x%016llx", (long long)1);
*(uint8_t*)0x200000000889 = 0x2c;
*(uint8_t*)0x20000000088a = 0;
memcpy((void*)0x200000000340, "... [truncated large byte array] ...", 1101);
syz_mount_image(/*fs=*/0x200000000040, /*dir=*/0x200000000180, /*flags=MS_POSIXACL|MS_REC|MS_NOEXEC|MS_NODEV*/0x1400c, /*opts=*/0x200000000840, /*chdir=*/3, /*size=*/0x44d, /*img=*/0x200000000340);
// syz_mount_image$msdos arguments: [
// fs: ptr[in, buffer] {
// buffer: {6d 73 64 6f 73 00} (length 0x6)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 00} (length 0x2)
// }
// flags: mount_flags = 0x1a4a438 (8 bytes)
// opts: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYRES64: ANYRES64 (resource)
// }
// union ANYUNION {
// ANYRES64: ANYRES64 (resource)
// }
// union ANYUNION {
// ANYRES8: ANYRES8 (resource)
// }
// union ANYUNION {
// ANYRES64: ANYRES64 (resource)
// }
// }
// }
// chdir: int8 = 0xb (1 bytes)
// size: len = 0x0 (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x0)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000000f40, "msdos\000", 6);
memcpy((void*)0x200000000f00, ".\000", 2);
*(uint64_t*)0x2000000007c0 = 0;
*(uint64_t*)0x2000000007c8 = -1;
*(uint8_t*)0x2000000007d0 = 0;
*(uint64_t*)0x2000000007d1 = -1;
syz_mount_image(/*fs=*/0x200000000f40, /*dir=*/0x200000000f00, /*flags=MS_I_VERSION|MS_PRIVATE|MS_SYNCHRONOUS|MS_STRICTATIME|MS_SILENT|MS_REMOUNT|0x202408*/0x1a4a438, /*opts=*/0x2000000007c0, /*chdir=*/0xb, /*size=*/0, /*img=*/0x200000000000);
return 0;
}
]