map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// socket$nl_route arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_nl_route
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[0] = res;
// socket$can_bcm arguments: [
// domain: const = 0x1d (8 bytes)
// type: const = 0x2 (8 bytes)
// proto: const = 0x2 (4 bytes)
// ]
// returns sock_can_bcm
res = syscall(__NR_socket, /*domain=*/0x1dul, /*type=*/2ul, /*proto=*/2);
if (res != -1)
r[1] = res;
// ioctl$ifreq_SIOCGIFINDEX_vcan arguments: [
// fd: sock (resource)
// cmd: const = 0x8933 (4 bytes)
// arg: ptr[out, ifreq_dev_t[vcan_device_names, ifindex_vcan]] {
// ifreq_dev_t[vcan_device_names, ifindex_vcan] {
// ifr_ifrn: buffer: {76 78 63 61 6e 30 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// elem: ifindex_vcan (resource)
// pad = 0x0 (20 bytes)
// }
// }
// ]
memcpy((void*)0x200000000000, "vxcan0\000\000\000\000\000\000\000\000\000\000", 16);
res = syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x8933, /*arg=*/0x200000000000ul);
if (res != -1)
r[2] = *(uint32_t*)0x200000000010;
// connect$can_bcm arguments: [
// fd: sock_can_bcm (resource)
// addr: ptr[in, sockaddr_can] {
// sockaddr_can {
// can_family: const = 0x1d (2 bytes)
// pad = 0x0 (2 bytes)
// can_ifindex: ifindex_vcan (resource)
// rx_id: const = 0x0 (4 bytes)
// tx_id: const = 0x0 (4 bytes)
// }
// }
// len: bytesize = 0x10 (8 bytes)
// ]
*(uint16_t*)0x200000000040 = 0x1d;
*(uint32_t*)0x200000000044 = r[2];
*(uint32_t*)0x200000000048 = 0;
*(uint32_t*)0x20000000004c = 0;
syscall(__NR_connect, /*fd=*/r[1], /*addr=*/0x200000000040ul, /*len=*/0x10ul);
// sendmsg$nl_route_sched arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] {
// msghdr_netlink[netlink_msg_route_sched] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route_sched]] {
// iovec[in, netlink_msg_route_sched] {
// addr: ptr[in, netlink_msg_route_sched] {
// union netlink_msg_route_sched {
// getchain: netlink_msg_t[const[RTM_GETCHAIN, int16], tcmsg[AF_UNSPEC], nlattr[TCA_CHAIN, int32]] {
// len: len = 0x24 (4 bytes)
// type: const = 0x11 (2 bytes)
// flags: netlink_msg_flags = 0x839 (2 bytes)
// seq: int32 = 0x0 (4 bytes)
// pid: int32 = 0x0 (4 bytes)
// payload: tcmsg[AF_UNSPEC] {
// family: const = 0x0 (1 bytes)
// tcm__pad1: const = 0x0 (1 bytes)
// tcm__pad2: const = 0x0 (2 bytes)
// ifindex: ifindex (resource)
// tcm_handle: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x0 (2 bytes)
// }
// tcm_parent: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x0 (2 bytes)
// }
// tcm_info: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x0 (2 bytes)
// }
// }
// attrs: array[nlattr_t[const[TCA_CHAIN, int16], int32]] {
// }
// }
// }
// }
// len: len = 0x24 (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x200000000200 = 0;
*(uint32_t*)0x200000000208 = 0;
*(uint64_t*)0x200000000210 = 0x2000000001c0;
*(uint64_t*)0x2000000001c0 = 0x2000000000c0;
*(uint32_t*)0x2000000000c0 = 0x24;
*(uint16_t*)0x2000000000c4 = 0x11;
*(uint16_t*)0x2000000000c6 = 0x839;
*(uint32_t*)0x2000000000c8 = 0;
*(uint32_t*)0x2000000000cc = 0;
*(uint8_t*)0x2000000000d0 = 0;
*(uint8_t*)0x2000000000d1 = 0;
*(uint16_t*)0x2000000000d2 = 0;
*(uint32_t*)0x2000000000d4 = r[2];
*(uint16_t*)0x2000000000d8 = 0;
*(uint16_t*)0x2000000000da = 0;
*(uint16_t*)0x2000000000dc = 0;
*(uint16_t*)0x2000000000de = 0;
*(uint16_t*)0x2000000000e0 = 0;
*(uint16_t*)0x2000000000e2 = 0;
*(uint64_t*)0x2000000001c8 = 0x24;
*(uint64_t*)0x200000000218 = 1;
*(uint64_t*)0x200000000220 = 0;
*(uint64_t*)0x200000000228 = 0;
*(uint32_t*)0x200000000230 = 0;
syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x200000000200ul, /*f=*/0ul);
// connect$can_bcm arguments: [
// fd: sock_can_bcm (resource)
// addr: ptr[in, sockaddr_can] {
// sockaddr_can {
// can_family: const = 0x1d (2 bytes)
// pad = 0x0 (2 bytes)
// can_ifindex: ifindex_vcan (resource)
// rx_id: const = 0x0 (4 bytes)
// tx_id: const = 0x0 (4 bytes)
// }
// }
// len: bytesize = 0x10 (8 bytes)
// ]
*(uint16_t*)0x2000000002c0 = 0x1d;
*(uint32_t*)0x2000000002c4 = 0;
*(uint32_t*)0x2000000002c8 = 0;
*(uint32_t*)0x2000000002cc = 0;
syscall(__NR_connect, /*fd=*/r[1], /*addr=*/0x2000000002c0ul, /*len=*/0x10ul);
return 0;
}
]