map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
uint64_t r[3] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// socket arguments: [
// domain: socket_domain = 0x11 (8 bytes)
// type: socket_type = 0x800000003 (8 bytes)
// proto: int32 = 0x0 (4 bytes)
// ]
// returns sock
res = syscall(__NR_socket, /*domain=AF_PACKET*/0x11ul, /*type=SOCK_RAW|0x800000000*/0x800000003ul, /*proto=*/0);
if (res != -1)
r[0] = res;
// ioctl$ifreq_SIOCGIFINDEX_team arguments: [
// fd: sock (resource)
// cmd: const = 0x8933 (4 bytes)
// arg: ptr[out, ifreq_dev_t["team0", ifindex_team]] {
// ifreq_dev_t["team0", ifindex_team] {
// ifr_ifrn: buffer: {74 65 61 6d 30 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// elem: ifindex_team (resource)
// pad = 0x0 (20 bytes)
// }
// }
// ]
memcpy((void*)0x200000000600, "team0\000\000\000\000\000\000\000\000\000\000\000", 16);
res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x200000000600ul);
if (res != -1)
r[1] = *(uint32_t*)0x200000000610;
// socket$netlink arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: netlink_proto = 0x0 (4 bytes)
// ]
// returns sock_netlink
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[2] = res;
// sendmsg$nl_route_sched arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] {
// msghdr_netlink[netlink_msg_route_sched] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route_sched]] {
// iovec[in, netlink_msg_route_sched] {
// addr: ptr[in, netlink_msg_route_sched] {
// union netlink_msg_route_sched {
// newqdisc: netlink_msg_t[const[RTM_NEWQDISC, int16], tcmsg[AF_UNSPEC], rtm_tca_policy] {
// len: len = 0xbc (4 bytes)
// type: const = 0x24 (2 bytes)
// flags: netlink_msg_flags = 0xf0b (2 bytes)
// seq: int32 = 0x0 (4 bytes)
// pid: int32 = 0x0 (4 bytes)
// payload: tcmsg[AF_UNSPEC] {
// family: const = 0x0 (1 bytes)
// tcm__pad1: const = 0x0 (1 bytes)
// tcm__pad2: const = 0x12 (2 bytes)
// ifindex: ifindex (resource)
// tcm_handle: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x0 (2 bytes)
// }
// tcm_parent: tcm_handle {
// minor: tcm_handle_offsets = 0xffff (2 bytes)
// major: tcm_handle_offsets = 0xffff (2 bytes)
// }
// tcm_info: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x5 (2 bytes)
// }
// }
// attrs: array[rtm_tca_policy] {
// union rtm_tca_policy {
// qdisc_kind_options: union qdisc_kind_options {
// q_taprio: tca_kind_options_t["taprio", array[taprio_policy]] {
// TCA_KIND: nlattr_t[const[TCA_KIND, int16], string["taprio"]] {
// nla_len: offsetof = 0xb (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {74 61 70 72 69 6f 00} (length 0x7)
// size: buffer: {} (length 0x0)
// pad = 0x0 (1 bytes)
// }
// TCA_OPTIONS: nlattr_t[const[TCA_OPTIONS, int16], array[taprio_policy]] {
// nla_len: offsetof = 0x8c (2 bytes)
// nla_type: const = 0x2 (2 bytes)
// payload: array[taprio_policy] {
// union taprio_policy {
// TCA_TAPRIO_ATTR_PRIOMAP: nlattr_t[const[TCA_TAPRIO_ATTR_PRIOMAP, int16], tc_mqprio_qopt] {
// nla_len: offsetof = 0x56 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: tc_mqprio_qopt {
// num_tc: int8 = 0x1 (1 bytes)
// prio_tc_map: array[int8] {
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// }
// hw: int8 = 0x0 (1 bytes)
// count: array[int16] {
// int16 = 0x8 (2 bytes)
// int16 = 0x4 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// }
// offset: array[int16] {
// int16 = 0x0 (2 bytes)
// int16 = 0x8 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// }
// }
// size: buffer: {} (length 0x0)
// pad = 0x0 (2 bytes)
// }
// }
// union taprio_policy {
// TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST: nlattr_tt[const[TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST, int16:14], 0, 1, array[nlnest[TCA_TAPRIO_SCHED_ENTRY, array[entry_policy$taprio]]]] {
// nla_len: offsetof = 0x28 (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nlattr_tt[const[TCA_TAPRIO_SCHED_ENTRY, int16:14], 0, 1, array[entry_policy$taprio]]] {
// nlattr_tt[const[TCA_TAPRIO_SCHED_ENTRY, int16:14], 0, 1, array[entry_policy$taprio]] {
// nla_len: offsetof = 0x24 (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[entry_policy$taprio] {
// union entry_policy$taprio {
// TCA_TAPRIO_SCHED_ENTRY_INTERVAL: nlattr_t[const[TCA_TAPRIO_SCHED_ENTRY_INTERVAL, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x4 (2 bytes)
// payload: int32 = 0x1000 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// union entry_policy$taprio {
// TCA_TAPRIO_SCHED_ENTRY_GATE_MASK: nlattr_t[const[TCA_TAPRIO_SCHED_ENTRY_GATE_MASK, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x3 (2 bytes)
// payload: int32 = 0xffff24cb (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// union entry_policy$taprio {
// TCA_TAPRIO_SCHED_ENTRY_INTERVAL: nlattr_t[const[TCA_TAPRIO_SCHED_ENTRY_INTERVAL, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x4 (2 bytes)
// payload: int32 = 0x91 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// union entry_policy$taprio {
// TCA_TAPRIO_SCHED_ENTRY_INTERVAL: nlattr_t[const[TCA_TAPRIO_SCHED_ENTRY_INTERVAL, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x4 (2 bytes)
// payload: int32 = 0x100 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// union taprio_policy {
// TCA_TAPRIO_ATTR_SCHED_CLOCKID: nlattr_t[const[TCA_TAPRIO_ATTR_SCHED_CLOCKID, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x5 (2 bytes)
// payload: int32 = 0x0 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// }
// }
// len: len = 0xbc (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x2000000007c0 = 0;
*(uint32_t*)0x2000000007c8 = 0;
*(uint64_t*)0x2000000007d0 = 0x200000000780;
*(uint64_t*)0x200000000780 = 0x200000000280;
*(uint32_t*)0x200000000280 = 0xbc;
*(uint16_t*)0x200000000284 = 0x24;
*(uint16_t*)0x200000000286 = 0xf0b;
*(uint32_t*)0x200000000288 = 0;
*(uint32_t*)0x20000000028c = 0;
*(uint8_t*)0x200000000290 = 0;
*(uint8_t*)0x200000000291 = 0;
*(uint16_t*)0x200000000292 = 0x12;
*(uint32_t*)0x200000000294 = r[1];
*(uint16_t*)0x200000000298 = 0;
*(uint16_t*)0x20000000029a = 0;
*(uint16_t*)0x20000000029c = -1;
*(uint16_t*)0x20000000029e = -1;
*(uint16_t*)0x2000000002a0 = 0;
*(uint16_t*)0x2000000002a2 = 5;
*(uint16_t*)0x2000000002a4 = 0xb;
*(uint16_t*)0x2000000002a6 = 1;
memcpy((void*)0x2000000002a8, "taprio\000", 7);
*(uint16_t*)0x2000000002b0 = 0x8c;
*(uint16_t*)0x2000000002b2 = 2;
*(uint16_t*)0x2000000002b4 = 0x56;
*(uint16_t*)0x2000000002b6 = 1;
*(uint8_t*)0x2000000002b8 = 1;
*(uint8_t*)0x2000000002b9 = 0;
*(uint8_t*)0x2000000002ba = 0;
*(uint8_t*)0x2000000002bb = 0;
*(uint8_t*)0x2000000002bc = 0;
*(uint8_t*)0x2000000002bd = 0;
*(uint8_t*)0x2000000002be = 0;
*(uint8_t*)0x2000000002bf = 0;
*(uint8_t*)0x2000000002c0 = 0;
*(uint8_t*)0x2000000002c1 = 0;
*(uint8_t*)0x2000000002c2 = 0;
*(uint8_t*)0x2000000002c3 = 0;
*(uint8_t*)0x2000000002c4 = 0;
*(uint8_t*)0x2000000002c5 = 0;
*(uint8_t*)0x2000000002c6 = 0;
*(uint8_t*)0x2000000002c7 = 0;
*(uint8_t*)0x2000000002c8 = 0;
*(uint8_t*)0x2000000002c9 = 0;
*(uint16_t*)0x2000000002ca = 8;
*(uint16_t*)0x2000000002cc = 4;
*(uint16_t*)0x2000000002ce = 0;
*(uint16_t*)0x2000000002d0 = 0;
*(uint16_t*)0x2000000002d2 = 0;
*(uint16_t*)0x2000000002d4 = 0;
*(uint16_t*)0x2000000002d6 = 0;
*(uint16_t*)0x2000000002d8 = 0;
*(uint16_t*)0x2000000002da = 0;
*(uint16_t*)0x2000000002dc = 0;
*(uint16_t*)0x2000000002de = 0;
*(uint16_t*)0x2000000002e0 = 0;
*(uint16_t*)0x2000000002e2 = 0;
*(uint16_t*)0x2000000002e4 = 0;
*(uint16_t*)0x2000000002e6 = 0;
*(uint16_t*)0x2000000002e8 = 0;
*(uint16_t*)0x2000000002ea = 0;
*(uint16_t*)0x2000000002ec = 8;
*(uint16_t*)0x2000000002ee = 0;
*(uint16_t*)0x2000000002f0 = 0;
*(uint16_t*)0x2000000002f2 = 0;
*(uint16_t*)0x2000000002f4 = 0;
*(uint16_t*)0x2000000002f6 = 0;
*(uint16_t*)0x2000000002f8 = 0;
*(uint16_t*)0x2000000002fa = 0;
*(uint16_t*)0x2000000002fc = 0;
*(uint16_t*)0x2000000002fe = 0;
*(uint16_t*)0x200000000300 = 0;
*(uint16_t*)0x200000000302 = 0;
*(uint16_t*)0x200000000304 = 0;
*(uint16_t*)0x200000000306 = 0;
*(uint16_t*)0x200000000308 = 0;
*(uint16_t*)0x20000000030c = 0x28;
STORE_BY_BITMASK(uint16_t, , 0x20000000030e, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000030f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000030f, 1, 7, 1);
*(uint16_t*)0x200000000310 = 0x24;
STORE_BY_BITMASK(uint16_t, , 0x200000000312, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000313, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000313, 1, 7, 1);
*(uint16_t*)0x200000000314 = 8;
*(uint16_t*)0x200000000316 = 4;
*(uint32_t*)0x200000000318 = 0x1000;
*(uint16_t*)0x20000000031c = 8;
*(uint16_t*)0x20000000031e = 3;
*(uint32_t*)0x200000000320 = 0xffff24cb;
*(uint16_t*)0x200000000324 = 8;
*(uint16_t*)0x200000000326 = 4;
*(uint32_t*)0x200000000328 = 0x91;
*(uint16_t*)0x20000000032c = 8;
*(uint16_t*)0x20000000032e = 4;
*(uint32_t*)0x200000000330 = 0x100;
*(uint16_t*)0x200000000334 = 8;
*(uint16_t*)0x200000000336 = 5;
*(uint32_t*)0x200000000338 = 0;
*(uint64_t*)0x200000000788 = 0xbc;
*(uint64_t*)0x2000000007d8 = 1;
*(uint64_t*)0x2000000007e0 = 0;
*(uint64_t*)0x2000000007e8 = 0;
*(uint32_t*)0x2000000007f0 = 0;
syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x2000000007c0ul, /*f=*/0ul);
return 0;
}
]