map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_bpf
#define __NR_bpf 321
#endif
uint64_t r[4] = {0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// openat$cuse arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: nil
// flags: const = 0x2 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_fuse
syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0ul, /*flags=*/2, /*mode=*/0);
// prlimit64 arguments: [
// pid: pid (resource)
// res: rlimit_type = 0xe (8 bytes)
// new: ptr[in, rlimit] {
// rlimit {
// soft: intptr = 0x8 (8 bytes)
// hard: intptr = 0x8b (8 bytes)
// }
// }
// old: nil
// ]
*(uint64_t*)0x200000000140 = 8;
*(uint64_t*)0x200000000148 = 0x8b;
syscall(__NR_prlimit64, /*pid=*/0, /*res=RLIMIT_RTPRIO*/0xeul, /*new=*/0x200000000140ul, /*old=*/0ul);
// sched_setscheduler arguments: [
// pid: pid (resource)
// policy: sched_policy = 0x2 (8 bytes)
// prio: ptr[in, int32] {
// int32 = 0x6 (4 bytes)
// }
// ]
*(uint32_t*)0x200000000640 = 6;
syscall(__NR_sched_setscheduler, /*pid=*/0, /*policy=SCHED_RR*/2ul, /*prio=*/0x200000000640ul);
// getpid arguments: [
// ]
// returns pid
res = syscall(__NR_getpid);
if (res != -1)
r[0] = res;
// sched_setscheduler arguments: [
// pid: pid (resource)
// policy: sched_policy = 0x2 (8 bytes)
// prio: ptr[in, int32] {
// int32 = 0x4 (4 bytes)
// }
// ]
*(uint32_t*)0x200000000200 = 4;
syscall(__NR_sched_setscheduler, /*pid=*/r[0], /*policy=SCHED_RR*/2ul, /*prio=*/0x200000000200ul);
// connect$unix arguments: [
// fd: sock_unix (resource)
// addr: nil
// addrlen: len = 0x0 (8 bytes)
// ]
syscall(__NR_connect, /*fd=*/(intptr_t)-1, /*addr=*/0ul, /*addrlen=*/0ul);
// sendmmsg$unix arguments: [
// fd: sock_unix (resource)
// mmsg: nil
// vlen: len = 0x0 (8 bytes)
// f: send_flags = 0x0 (8 bytes)
// ]
syscall(__NR_sendmmsg, /*fd=*/(intptr_t)-1, /*mmsg=*/0ul, /*vlen=*/0ul, /*f=*/0ul);
// socket$inet6_tcp arguments: [
// domain: const = 0xa (8 bytes)
// type: const = 0x1 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_tcp6
res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0);
if (res != -1)
r[1] = res;
// listen arguments: [
// fd: sock (resource)
// backlog: int32 = 0x0 (4 bytes)
// ]
syscall(__NR_listen, /*fd=*/r[1], /*backlog=*/0);
// bpf$PROG_LOAD arguments: [
// cmd: const = 0x5 (8 bytes)
// arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] {
// bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]] {
// type: bpf_prog_type = 0xe (4 bytes)
// ninsn: bytesize8 = 0x4 (4 bytes)
// insns: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {b4 05 00 00 20 00 80 00 61 10 60 00 00 00 00 00 c6 00 00 00 00 00 00 00 95 00 00 00 00 00 00 00 9f 33 ef 60 91 6e 6e 89 3f 1e eb 0b e2 00 00 d0 72 f5 b8 9c 30 43 c4 7c 89 6c e0 bc 87 31 fa 59 5b 6b 4d 45 ef 26 dc ca 55 82 05 4d 54 d5 3c d2 b6 85 b4 31 c7 0e a9 48 25 9c 4c 86 9b 4f c8 db 71 4e 4b 94 bd ae 21 4f a6 8a 05 1d 4d ca 7d 26 47 be c1 fc 89 39 8d 2b 90 00 f2 24 89 10 60 01 7c 47 00 de 60 be ac 67 1e 8e 8f 00 cb 03 58 8a a6 00 7e 71 f8 71 ab 5c 2f f8 8a fc 60 02 08 4e 5b 52 71 0a ee e8 35 cf 0d 78 e4 5f 70 98 38 26 fb 85 79 c1 fb 47 d2 c5 90 05 cf f4 14 ed 55 b0 d1 8a 9d 44 69 35 fb 33 2b b5 93 ee 34 1a b5 90 16 f8 18 60 32 4b 80 0c 00 00 00 00 00 00 92 d9 c5 fe 34 cc b8 0a 61 ff cb 33 63 07 3f d8 96 28 23 ee 45 f5 d7 39 4e 95 10 f4 ac 6c 70 2c fa be 8a 9c 55 c8 da fc db 11 00 36 e1 4c 10 35 ca fd fe f6 a3 58 cb fa db 35 79 a2 85 58 0a 3c 08 0d 4e 0a 48 d7 bd c3 8a 04 37 c8 c1 b3 aa 40 8a 00 00 00 00 00 00 22 48 95 0b 00 00 00} (length 0x13c)
// }
// }
// }
// license: ptr[in, buffer] {
// buffer: {47 50 4c 00} (length 0x4)
// }
// loglev: int32 = 0x4 (4 bytes)
// logsize: len = 0xfd90 (4 bytes)
// log: ptr[out, buffer] {
// buffer: (DirOut)
// }
// kern_version: bpf_kern_version = 0x0 (4 bytes)
// flags: bpf_prog_load_flags = 0x0 (4 bytes)
// prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// prog_ifindex: ifindex (resource)
// expected_attach_type: union bpf_prog_attach_types {
// sk_skb: sk_skb_attach_types = 0x0 (4 bytes)
// }
// btf_fd: fd_btf (resource)
// func_info_rec_size: const = 0x8 (4 bytes)
// func_info: ptr[in, bpf_func_info] {
// bpf_func_info {
// insn_off: int32 = 0x0 (4 bytes)
// type_id: int32 = 0x0 (4 bytes)
// }
// }
// func_info_cnt: len = 0x366 (4 bytes)
// line_info_rec_size: const = 0x10 (4 bytes)
// line_info: ptr[in, bpf_line_info] {
// bpf_line_info {
// insn_off: int32 = 0x0 (4 bytes)
// file_name_off: int32 = 0x0 (4 bytes)
// line_off: int32 = 0x0 (4 bytes)
// line_col: int32 = 0x0 (4 bytes)
// }
// }
// line_info_cnt: len = 0x1dd (4 bytes)
// attach_btf_id: bpf_btf_id (resource)
// attach_prog_fd: fd_bpf_prog (resource)
// core_relo_cnt: len = 0x0 (4 bytes)
// fd_array: nil
// core_relos: nil
// core_relo_rec_size: const = 0x10 (4 bytes)
// log_true_size: int32 = 0x0 (4 bytes)
// prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]_prog_token_fd_wrapper {
// void: buffer: {} (length 0x0)
// }
// pad: union _bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]_pad_wrapper {
// value: const = 0x0 (4 bytes)
// }
// }
// }
// size: len = 0x48 (8 bytes)
// ]
// returns fd_bpf_prog
*(uint32_t*)0x20000000e000 = 0xe;
*(uint32_t*)0x20000000e004 = 4;
*(uint64_t*)0x20000000e008 = 0x200000000700;
memcpy((void*)0x200000000700, "... [truncated large byte array] ...", 316);
*(uint64_t*)0x20000000e010 = 0x200000003ff6;
memcpy((void*)0x200000003ff6, "GPL\000", 4);
*(uint32_t*)0x20000000e018 = 4;
*(uint32_t*)0x20000000e01c = 0xfd90;
*(uint64_t*)0x20000000e020 = 0x20000000cf3d;
*(uint32_t*)0x20000000e028 = 0;
*(uint32_t*)0x20000000e02c = 0;
memset((void*)0x20000000e030, 0, 16);
*(uint32_t*)0x20000000e040 = 0;
*(uint32_t*)0x20000000e044 = 0;
*(uint32_t*)0x20000000e048 = -1;
*(uint32_t*)0x20000000e04c = 8;
*(uint64_t*)0x20000000e050 = 0x200000000000;
*(uint32_t*)0x200000000000 = 0;
*(uint32_t*)0x200000000004 = 0;
*(uint32_t*)0x20000000e058 = 0x366;
*(uint32_t*)0x20000000e05c = 0x10;
*(uint64_t*)0x20000000e060 = 0x200000000000;
*(uint32_t*)0x200000000000 = 0;
*(uint32_t*)0x200000000004 = 0;
*(uint32_t*)0x200000000008 = 0;
*(uint32_t*)0x20000000000c = 0;
*(uint32_t*)0x20000000e068 = 0x1dd;
*(uint32_t*)0x20000000e06c = 0;
*(uint32_t*)0x20000000e070 = -1;
*(uint32_t*)0x20000000e074 = 0;
*(uint64_t*)0x20000000e078 = 0;
*(uint64_t*)0x20000000e080 = 0;
*(uint32_t*)0x20000000e088 = 0x10;
*(uint32_t*)0x20000000e08c = 0;
*(uint32_t*)0x20000000e090 = 0;
res = syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x20000000e000ul, /*size=*/0x48ul);
if (res != -1)
r[2] = res;
// bpf$MAP_CREATE arguments: [
// cmd: const = 0x0 (8 bytes)
// arg: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {12 00 00 00 04 00 00 00 04 00 00 00 12} (length 0xd)
// }
// }
// }
// size: len = 0x48 (8 bytes)
// ]
// returns fd_bpf_map
memcpy((void*)0x200000000200, "\x12\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x12", 13);
res = syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x200000000200ul, /*size=*/0x48ul);
if (res != -1)
r[3] = res;
// bpf$BPF_PROG_DETACH arguments: [
// cmd: const = 0x8 (8 bytes)
// arg: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYRES32: ANYRES32 (resource)
// }
// union ANYUNION {
// ANYRES32: ANYRES32 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {26} (length 0x1)
// }
// }
// }
// size: len = 0x10 (8 bytes)
// ]
*(uint32_t*)0x200000000ac0 = r[3];
*(uint32_t*)0x200000000ac4 = r[2];
memset((void*)0x200000000ac8, 38, 1);
syscall(__NR_bpf, /*cmd=*/8ul, /*arg=*/0x200000000ac0ul, /*size=*/0x10ul);
// bpf$MAP_UPDATE_ELEM arguments: [
// cmd: const = 0x2 (8 bytes)
// arg: ptr[in, bpf_map_update_arg] {
// bpf_map_update_arg {
// map: fd_bpf_map (resource)
// pad = 0x0 (4 bytes)
// key: ptr[in, buffer] {
// buffer: {} (length 0x0)
// }
// val: ptr[in, bpf_map_update_val] {
// union bpf_map_update_val {
// udp: sock_udp (resource)
// }
// }
// flags: bpf_map_flags = 0x0 (8 bytes)
// }
// }
// size: len = 0x20 (8 bytes)
// ]
*(uint32_t*)0x2000000048c0 = r[3];
*(uint64_t*)0x2000000048c8 = 0x2000000047c0;
*(uint64_t*)0x2000000048d0 = 0x200000004880;
*(uint32_t*)0x200000004880 = r[1];
*(uint64_t*)0x2000000048d8 = 0;
syscall(__NR_bpf, /*cmd=*/2ul, /*arg=*/0x2000000048c0ul, /*size=*/0x20ul);
// setsockopt$inet6_tcp_int arguments: [
// fd: sock_tcp6 (resource)
// level: const = 0x6 (4 bytes)
// optname: tcp_option_types_int = 0x19 (4 bytes)
// optval: ptr[in, int32] {
// int32 = 0x0 (4 bytes)
// }
// optlen: len = 0x4 (8 bytes)
// ]
*(uint32_t*)0x200000000080 = 0;
syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/6, /*optname=TCP_NOTSENT_LOWAT*/0x19, /*optval=*/0x200000000080ul, /*optlen=*/4ul);
return 0;
}
]