map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_bpf
#define __NR_bpf 321
#endif
#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
uint64_t r[3] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// socket arguments: [
// domain: socket_domain = 0x11 (8 bytes)
// type: socket_type = 0x800000003 (8 bytes)
// proto: int32 = 0x0 (4 bytes)
// ]
// returns sock
res = syscall(__NR_socket, /*domain=AF_PACKET*/0x11ul, /*type=SOCK_RAW|0x800000000*/0x800000003ul, /*proto=*/0);
if (res != -1)
r[0] = res;
// ioctl$ifreq_SIOCGIFINDEX_team arguments: [
// fd: sock (resource)
// cmd: const = 0x8933 (4 bytes)
// arg: ptr[out, ifreq_dev_t["team0", ifindex_team]] {
// ifreq_dev_t["team0", ifindex_team] {
// ifr_ifrn: buffer: {74 65 61 6d 30 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// elem: ifindex_team (resource)
// pad = 0x0 (20 bytes)
// }
// }
// ]
memcpy((void*)0x200000000600, "team0\000\000\000\000\000\000\000\000\000\000\000", 16);
res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x200000000600ul);
if (res != -1)
r[1] = *(uint32_t*)0x200000000610;
// socket$netlink arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: netlink_proto = 0x0 (4 bytes)
// ]
// returns sock_netlink
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[2] = res;
// sendmsg$nl_route_sched arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] {
// msghdr_netlink[netlink_msg_route_sched] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route_sched]] {
// iovec[in, netlink_msg_route_sched] {
// addr: ptr[in, netlink_msg_route_sched] {
// union netlink_msg_route_sched {
// newqdisc: netlink_msg_t[const[RTM_NEWQDISC, int16], tcmsg[AF_UNSPEC], rtm_tca_policy] {
// len: len = 0xac (4 bytes)
// type: const = 0x24 (2 bytes)
// flags: netlink_msg_flags = 0xf0b (2 bytes)
// seq: int32 = 0x0 (4 bytes)
// pid: int32 = 0x0 (4 bytes)
// payload: tcmsg[AF_UNSPEC] {
// family: const = 0x0 (1 bytes)
// tcm__pad1: const = 0x0 (1 bytes)
// tcm__pad2: const = 0x12 (2 bytes)
// ifindex: ifindex (resource)
// tcm_handle: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x0 (2 bytes)
// }
// tcm_parent: tcm_handle {
// minor: tcm_handle_offsets = 0xffff (2 bytes)
// major: tcm_handle_offsets = 0xffff (2 bytes)
// }
// tcm_info: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x0 (2 bytes)
// }
// }
// attrs: array[rtm_tca_policy] {
// union rtm_tca_policy {
// qdisc_kind_options: union qdisc_kind_options {
// q_taprio: tca_kind_options_t["taprio", array[taprio_policy]] {
// TCA_KIND: nlattr_t[const[TCA_KIND, int16], string["taprio"]] {
// nla_len: offsetof = 0xb (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {74 61 70 72 69 6f 00} (length 0x7)
// size: buffer: {} (length 0x0)
// pad = 0x0 (1 bytes)
// }
// TCA_OPTIONS: nlattr_t[const[TCA_OPTIONS, int16], array[taprio_policy]] {
// nla_len: offsetof = 0x7c (2 bytes)
// nla_type: const = 0x2 (2 bytes)
// payload: array[taprio_policy] {
// union taprio_policy {
// TCA_TAPRIO_ATTR_PRIOMAP: nlattr_t[const[TCA_TAPRIO_ATTR_PRIOMAP, int16], tc_mqprio_qopt] {
// nla_len: offsetof = 0x56 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: tc_mqprio_qopt {
// num_tc: int8 = 0x2 (1 bytes)
// prio_tc_map: array[int8] {
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x1 (1 bytes)
// }
// hw: int8 = 0xfe (1 bytes)
// count: array[int16] {
// int16 = 0x8 (2 bytes)
// int16 = 0x4 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// }
// offset: array[int16] {
// int16 = 0x0 (2 bytes)
// int16 = 0x8 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x800 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// }
// }
// size: buffer: {} (length 0x0)
// pad = 0x0 (2 bytes)
// }
// }
// union taprio_policy {
// TCA_TAPRIO_ATTR_SCHED_CLOCKID: nlattr_t[const[TCA_TAPRIO_ATTR_SCHED_CLOCKID, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x5 (2 bytes)
// payload: int32 = 0x0 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// union taprio_policy {
// TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST: nlattr_tt[const[TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST, int16:14], 0, 1, array[nlnest[TCA_TAPRIO_SCHED_ENTRY, array[entry_policy$taprio]]]] {
// nla_len: offsetof = 0x18 (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nlattr_tt[const[TCA_TAPRIO_SCHED_ENTRY, int16:14], 0, 1, array[entry_policy$taprio]]] {
// nlattr_tt[const[TCA_TAPRIO_SCHED_ENTRY, int16:14], 0, 1, array[entry_policy$taprio]] {
// nla_len: offsetof = 0x14 (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[entry_policy$taprio] {
// union entry_policy$taprio {
// TCA_TAPRIO_SCHED_ENTRY_INTERVAL: nlattr_t[const[TCA_TAPRIO_SCHED_ENTRY_INTERVAL, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x4 (2 bytes)
// payload: int32 = 0x4000000 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// union entry_policy$taprio {
// TCA_TAPRIO_SCHED_ENTRY_GATE_MASK: nlattr_t[const[TCA_TAPRIO_SCHED_ENTRY_GATE_MASK, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x3 (2 bytes)
// payload: int32 = 0x2 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// }
// }
// len: len = 0xac (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x4002000 (8 bytes)
// ]
*(uint64_t*)0x2000000007c0 = 0;
*(uint32_t*)0x2000000007c8 = 0;
*(uint64_t*)0x2000000007d0 = 0x200000000780;
*(uint64_t*)0x200000000780 = 0x200000000380;
*(uint32_t*)0x200000000380 = 0xac;
*(uint16_t*)0x200000000384 = 0x24;
*(uint16_t*)0x200000000386 = 0xf0b;
*(uint32_t*)0x200000000388 = 0;
*(uint32_t*)0x20000000038c = 0;
*(uint8_t*)0x200000000390 = 0;
*(uint8_t*)0x200000000391 = 0;
*(uint16_t*)0x200000000392 = 0x12;
*(uint32_t*)0x200000000394 = r[1];
*(uint16_t*)0x200000000398 = 0;
*(uint16_t*)0x20000000039a = 0;
*(uint16_t*)0x20000000039c = -1;
*(uint16_t*)0x20000000039e = -1;
*(uint16_t*)0x2000000003a0 = 0;
*(uint16_t*)0x2000000003a2 = 0;
*(uint16_t*)0x2000000003a4 = 0xb;
*(uint16_t*)0x2000000003a6 = 1;
memcpy((void*)0x2000000003a8, "taprio\000", 7);
*(uint16_t*)0x2000000003b0 = 0x7c;
*(uint16_t*)0x2000000003b2 = 2;
*(uint16_t*)0x2000000003b4 = 0x56;
*(uint16_t*)0x2000000003b6 = 1;
*(uint8_t*)0x2000000003b8 = 2;
*(uint8_t*)0x2000000003b9 = 0;
*(uint8_t*)0x2000000003ba = 0;
*(uint8_t*)0x2000000003bb = 0;
*(uint8_t*)0x2000000003bc = 0;
*(uint8_t*)0x2000000003bd = 0;
*(uint8_t*)0x2000000003be = 0;
*(uint8_t*)0x2000000003bf = 0;
*(uint8_t*)0x2000000003c0 = 0;
*(uint8_t*)0x2000000003c1 = 0;
*(uint8_t*)0x2000000003c2 = 0;
*(uint8_t*)0x2000000003c3 = 0;
*(uint8_t*)0x2000000003c4 = 0;
*(uint8_t*)0x2000000003c5 = 0;
*(uint8_t*)0x2000000003c6 = 0;
*(uint8_t*)0x2000000003c7 = 0;
*(uint8_t*)0x2000000003c8 = 1;
*(uint8_t*)0x2000000003c9 = 0xfe;
*(uint16_t*)0x2000000003ca = 8;
*(uint16_t*)0x2000000003cc = 4;
*(uint16_t*)0x2000000003ce = 0;
*(uint16_t*)0x2000000003d0 = 0;
*(uint16_t*)0x2000000003d2 = 0;
*(uint16_t*)0x2000000003d4 = 0;
*(uint16_t*)0x2000000003d6 = 0;
*(uint16_t*)0x2000000003d8 = 0;
*(uint16_t*)0x2000000003da = 0;
*(uint16_t*)0x2000000003dc = 0;
*(uint16_t*)0x2000000003de = 0;
*(uint16_t*)0x2000000003e0 = 0;
*(uint16_t*)0x2000000003e2 = 0;
*(uint16_t*)0x2000000003e4 = 0;
*(uint16_t*)0x2000000003e6 = 0;
*(uint16_t*)0x2000000003e8 = 0;
*(uint16_t*)0x2000000003ea = 0;
*(uint16_t*)0x2000000003ec = 8;
*(uint16_t*)0x2000000003ee = 0;
*(uint16_t*)0x2000000003f0 = 0;
*(uint16_t*)0x2000000003f2 = 0;
*(uint16_t*)0x2000000003f4 = 0;
*(uint16_t*)0x2000000003f6 = 0;
*(uint16_t*)0x2000000003f8 = 0;
*(uint16_t*)0x2000000003fa = 0;
*(uint16_t*)0x2000000003fc = 0;
*(uint16_t*)0x2000000003fe = 0;
*(uint16_t*)0x200000000400 = 0x800;
*(uint16_t*)0x200000000402 = 0;
*(uint16_t*)0x200000000404 = 0;
*(uint16_t*)0x200000000406 = 0;
*(uint16_t*)0x200000000408 = 0;
*(uint16_t*)0x20000000040c = 8;
*(uint16_t*)0x20000000040e = 5;
*(uint32_t*)0x200000000410 = 0;
*(uint16_t*)0x200000000414 = 0x18;
STORE_BY_BITMASK(uint16_t, , 0x200000000416, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000417, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000417, 1, 7, 1);
*(uint16_t*)0x200000000418 = 0x14;
STORE_BY_BITMASK(uint16_t, , 0x20000000041a, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000041b, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000041b, 1, 7, 1);
*(uint16_t*)0x20000000041c = 8;
*(uint16_t*)0x20000000041e = 4;
*(uint32_t*)0x200000000420 = 0x4000000;
*(uint16_t*)0x200000000424 = 8;
*(uint16_t*)0x200000000426 = 3;
*(uint32_t*)0x200000000428 = 2;
*(uint64_t*)0x200000000788 = 0xac;
*(uint64_t*)0x2000000007d8 = 1;
*(uint64_t*)0x2000000007e0 = 0;
*(uint64_t*)0x2000000007e8 = 0;
*(uint32_t*)0x2000000007f0 = 0;
syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x2000000007c0ul, /*f=MSG_ZEROCOPY|0x2000*/0x4002000ul);
// prctl$PR_SCHED_CORE arguments: [
// option: const = 0x3e (8 bytes)
// cmd: intptr = 0x1 (8 bytes)
// pid: pid (resource)
// type: pid_type = 0x2 (8 bytes)
// uaddr: nil
// ]
syscall(__NR_prctl, /*option=*/0x3eul, /*cmd=*/1ul, /*pid=*/0, /*type=PIDTYPE_PGID*/2ul, /*uaddr=*/0ul);
// ioctl$sock_ax25_SIOCDELRT arguments: [
// fd: sock_ax25 (resource)
// cmd: const = 0x890c (4 bytes)
// arg: nil
// ]
syscall(__NR_ioctl, /*fd=*/(intptr_t)-1, /*cmd=*/0x890c, /*arg=*/0ul);
// socketpair$unix arguments: [
// domain: const = 0x1 (8 bytes)
// type: unix_socket_type = 0x2 (8 bytes)
// proto: const = 0x0 (4 bytes)
// fds: nil
// ]
syscall(__NR_socketpair, /*domain=*/1ul, /*type=SOCK_DGRAM*/2ul, /*proto=*/0, /*fds=*/0ul);
// mmap arguments: [
// addr: VMA[0xb36000]
// len: len = 0xb36000 (8 bytes)
// prot: mmap_prot = 0xb635773f06ebbeee (8 bytes)
// flags: mmap_flags = 0x8031 (8 bytes)
// fd: fd (resource)
// offset: intptr = 0x0 (8 bytes)
// ]
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul, /*prot=PROT_GROWSUP|PROT_SEM|PROT_WRITE|PROT_EXEC|0xb635773f04ebbee0*/0xb635773f06ebbeeeul, /*flags=MAP_POPULATE|MAP_FIXED|MAP_ANONYMOUS|MAP_SHARED*/0x8031ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
// connect$unix arguments: [
// fd: sock_unix (resource)
// addr: nil
// addrlen: len = 0x0 (8 bytes)
// ]
syscall(__NR_connect, /*fd=*/(intptr_t)-1, /*addr=*/0ul, /*addrlen=*/0ul);
// sendmsg$nl_route_sched arguments: [
// fd: sock_nl_route (resource)
// msg: nil
// f: send_flags = 0x400c804 (8 bytes)
// ]
syscall(__NR_sendmsg, /*fd=*/(intptr_t)-1, /*msg=*/0ul, /*f=MSG_ZEROCOPY|MSG_NOSIGNAL|MSG_MORE|MSG_DONTROUTE|MSG_CONFIRM*/0x400c804ul);
// clock_settime arguments: [
// id: clock_id = 0x0 (8 bytes)
// tp: ptr[in, timespec] {
// timespec {
// sec: time_sec (resource)
// nsec: time_nsec (resource)
// }
// }
// ]
*(uint64_t*)0x200000003c80 = 0x77359400;
*(uint64_t*)0x200000003c88 = 0;
syscall(__NR_clock_settime, /*id=*/0ul, /*tp=*/0x200000003c80ul);
// recvmmsg arguments: [
// fd: sock (resource)
// mmsg: nil
// vlen: len = 0x0 (8 bytes)
// f: recv_flags = 0x2 (8 bytes)
// timeout: nil
// ]
syscall(__NR_recvmmsg, /*fd=*/(intptr_t)-1, /*mmsg=*/0ul, /*vlen=*/0ul, /*f=MSG_PEEK*/2ul, /*timeout=*/0ul);
// mkdir arguments: [
// path: nil
// mode: open_mode = 0x0 (8 bytes)
// ]
syscall(__NR_mkdir, /*path=*/0ul, /*mode=*/0ul);
// mkdir arguments: [
// path: nil
// mode: open_mode = 0x0 (8 bytes)
// ]
syscall(__NR_mkdir, /*path=*/0ul, /*mode=*/0ul);
// bpf$PROG_LOAD arguments: [
// cmd: const = 0x5 (8 bytes)
// arg: nil
// size: len = 0x0 (8 bytes)
// ]
// returns fd_bpf_prog
syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0ul, /*size=*/0ul);
return 0;
}
]