map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_close_range
#define __NR_close_range 436
#endif
#ifndef __NR_seccomp
#define __NR_seccomp 317
#endif
uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// socket$inet6_tcp arguments: [
// domain: const = 0xa (8 bytes)
// type: const = 0x1 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_tcp6
res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0);
if (res != -1)
r[0] = res;
// close arguments: [
// fd: fd (resource)
// ]
syscall(__NR_close, /*fd=*/r[0]);
// socket arguments: [
// domain: socket_domain = 0x2b (8 bytes)
// type: socket_type = 0x1 (8 bytes)
// proto: int32 = 0x1 (4 bytes)
// ]
// returns sock
syscall(__NR_socket, /*domain=AF_SMC*/0x2bul, /*type=SOCK_STREAM*/1ul, /*proto=*/1);
// bind$inet6 arguments: [
// fd: sock_in6 (resource)
// addr: ptr[in, sockaddr_in6] {
// sockaddr_in6 {
// family: const = 0xa (2 bytes)
// port: int16be = 0x4e22 (2 bytes)
// flow: int32be = 0x0 (4 bytes)
// addr: union ipv6_addr {
// empty: ipv6_addr_empty {
// a0: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// }
// }
// scope: int32 = 0x0 (4 bytes)
// }
// }
// addrlen: len = 0x1c (8 bytes)
// ]
*(uint16_t*)0x200000000040 = 0xa;
*(uint16_t*)0x200000000042 = htobe16(0x4e22);
*(uint32_t*)0x200000000044 = htobe32(0);
memset((void*)0x200000000048, 0, 16);
*(uint32_t*)0x200000000058 = 0;
syscall(__NR_bind, /*fd=*/r[0], /*addr=*/0x200000000040ul, /*addrlen=*/0x1cul);
// listen arguments: [
// fd: sock (resource)
// backlog: int32 = 0x5 (4 bytes)
// ]
syscall(__NR_listen, /*fd=*/r[0], /*backlog=*/5);
// seccomp$SECCOMP_SET_MODE_FILTER_LISTENER arguments: [
// op: const = 0x1 (8 bytes)
// flags: seccomp_flags_listener = 0x0 (8 bytes)
// arg: ptr[in, sock_fprog] {
// sock_fprog {
// len: len = 0x1 (2 bytes)
// pad = 0x0 (6 bytes)
// filter: ptr[in, array[sock_filter]] {
// array[sock_filter] {
// sock_filter {
// code: int16 = 0x6 (2 bytes)
// jt: int8 = 0x0 (1 bytes)
// jf: int8 = 0x0 (1 bytes)
// k: int32 = 0x7fff0000 (4 bytes)
// }
// }
// }
// }
// }
// ]
// returns fd_seccomp
*(uint16_t*)0x200000000000 = 1;
*(uint64_t*)0x200000000008 = 0x200000000100;
*(uint16_t*)0x200000000100 = 6;
*(uint8_t*)0x200000000102 = 0;
*(uint8_t*)0x200000000103 = 0;
*(uint32_t*)0x200000000104 = 0x7fff0000;
res = syscall(__NR_seccomp, /*op=*/1ul, /*flags=*/0ul, /*arg=*/0x200000000000ul);
if (res != -1)
r[1] = res;
// socket$inet6_tcp arguments: [
// domain: const = 0xa (8 bytes)
// type: const = 0x1 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_tcp6
res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0);
if (res != -1)
r[2] = res;
// sendto$inet6 arguments: [
// fd: sock_in6 (resource)
// buf: nil
// len: len = 0x0 (8 bytes)
// f: send_flags = 0x20004000 (8 bytes)
// addr: ptr[in, sockaddr_in6] {
// sockaddr_in6 {
// family: const = 0xa (2 bytes)
// port: int16be = 0x4e22 (2 bytes)
// flow: int32be = 0x40000000 (4 bytes)
// addr: union ipv6_addr {
// empty: ipv6_addr_empty {
// a0: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// }
// }
// scope: int32 = 0x1 (4 bytes)
// }
// }
// addrlen: len = 0x1c (8 bytes)
// ]
*(uint16_t*)0x2000000001c0 = 0xa;
*(uint16_t*)0x2000000001c2 = htobe16(0x4e22);
*(uint32_t*)0x2000000001c4 = htobe32(0x40000000);
memset((void*)0x2000000001c8, 0, 16);
*(uint32_t*)0x2000000001d8 = 1;
syscall(__NR_sendto, /*fd=*/r[2], /*buf=*/0ul, /*len=*/0ul, /*f=MSG_FASTOPEN|MSG_NOSIGNAL*/0x20004000ul, /*addr=*/0x2000000001c0ul, /*addrlen=*/0x1cul);
// close_range arguments: [
// fd: fd (resource)
// max_fd: fd (resource)
// flags: close_range_flags = 0x0 (8 bytes)
// ]
syscall(__NR_close_range, /*fd=*/r[1], /*max_fd=*/(intptr_t)-1, /*flags=*/0ul);
// socket arguments: [
// domain: socket_domain = 0x10 (8 bytes)
// type: socket_type = 0x3 (8 bytes)
// proto: int32 = 0x0 (4 bytes)
// ]
// returns sock
syscall(__NR_socket, /*domain=AF_NETLINK*/0x10ul, /*type=SOCK_RAW*/3ul, /*proto=*/0);
return 0;
}
]