map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// mkdir arguments: [
// path: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// mode: open_mode = 0x0 (8 bytes)
// ]
memcpy((void*)0x200000000400, "./file0\000", 8);
syscall(__NR_mkdir, /*path=*/0x200000000400ul, /*mode=*/0ul);
// pipe2$9p arguments: [
// pipefd: ptr[out, pipe_9p] {
// pipe_9p {
// rfd: rfd9p (resource)
// wfd: wfd9p (resource)
// }
// }
// flags: pipe_flags = 0x0 (8 bytes)
// ]
res = syscall(__NR_pipe2, /*pipefd=*/0x200000000180ul, /*flags=*/0ul);
if (res != -1) {
r[0] = *(uint32_t*)0x200000000180;
r[1] = *(uint32_t*)0x200000000184;
}
// dup arguments: [
// oldfd: fd (resource)
// ]
// returns fd
res = syscall(__NR_dup, /*oldfd=*/r[1]);
if (res != -1)
r[2] = res;
// mount$9p_fd arguments: [
// src: const = 0x0 (8 bytes)
// dst: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// type: ptr[in, buffer] {
// buffer: {39 70 00} (length 0x3)
// }
// flags: mount_flags = 0x0 (8 bytes)
// opts: ptr[in, p9_options_fd] {
// p9_options_fd {
// trans: buffer: {74 72 61 6e 73 3d 66 64 2c} (length 0x9)
// rfdno: fs_opt["rfdno", fmt[hex, rfd9p]] {
// name: buffer: {72 66 64 6e 6f} (length 0x5)
// eq: const = 0x3d (1 bytes)
// val: rfd9p (resource)
// }
// comma0: const = 0x2c (1 bytes)
// wfdno: fs_opt["wfdno", fmt[hex, fd]] {
// name: buffer: {77 66 64 6e 6f} (length 0x5)
// eq: const = 0x3d (1 bytes)
// val: fd (resource)
// }
// comma1: const = 0x2c (1 bytes)
// opts: fs_options[p9_options] {
// elems: array[fs_opt_elem[p9_options]] {
// }
// common: array[fs_opt_elem[fs_options_common]] {
// }
// null: const = 0x0 (1 bytes)
// }
// }
// }
// ]
memcpy((void*)0x200000000040, "./file0\000", 8);
memcpy((void*)0x2000000001c0, "9p\000", 3);
memcpy((void*)0x200000000300, "trans=fd,", 9);
memcpy((void*)0x200000000309, "rfdno", 5);
*(uint8_t*)0x20000000030e = 0x3d;
sprintf((char*)0x20000000030f, "0x%016llx", (long long)r[0]);
*(uint8_t*)0x200000000321 = 0x2c;
memcpy((void*)0x200000000322, "wfdno", 5);
*(uint8_t*)0x200000000327 = 0x3d;
sprintf((char*)0x200000000328, "0x%016llx", (long long)r[2]);
*(uint8_t*)0x20000000033a = 0x2c;
*(uint8_t*)0x20000000033b = 0;
syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000040ul, /*type=*/0x2000000001c0ul, /*flags=*/0ul, /*opts=*/0x200000000300ul);
// write$FUSE_BMAP arguments: [
// fd: fd_fuse (resource)
// arg: nil
// len: bytesize = 0x0 (8 bytes)
// ]
syscall(__NR_write, /*fd=*/r[2], /*arg=*/0ul, /*len=*/0ul);
// write$FUSE_DIRENTPLUS arguments: [
// fd: fd_fuse (resource)
// arg: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {7f 0b 00 00 00 00 00 00} (length 0x8)
// }
// union ANYUNION {
// ANYRES64: ANYRES64 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {} (length 0x0)
// }
// union ANYUNION {
// ANYRES32: ANYRES32 (resource)
// }
// union ANYUNION {
// ANYRES32: ANYRES32 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {} (length 0x0)
// }
// }
// }
// len: bytesize = 0xb0 (8 bytes)
// ]
memcpy((void*)0x200000000800, "\x7f\x0b\x00\x00\x00\x00\x00\x00", 8);
*(uint64_t*)0x200000000808 = 0;
*(uint32_t*)0x200000000810 = 0;
*(uint32_t*)0x200000000814 = 0;
syscall(__NR_write, /*fd=*/r[2], /*arg=*/0x200000000800ul, /*len=*/0xb0ul);
// mount$9p_fd arguments: [
// src: const = 0x0 (8 bytes)
// dst: nil
// type: nil
// flags: mount_flags = 0x0 (8 bytes)
// opts: nil
// ]
syscall(__NR_mount, /*src=*/0ul, /*dst=*/0ul, /*type=*/0ul, /*flags=*/0ul, /*opts=*/0ul);
// sync arguments: [
// ]
syscall(__NR_sync);
return 0;
}
]