map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
if (a0 == 0xc || a0 == 0xb) {
char buf[128];
sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2);
return open(buf, O_RDWR, 0);
} else {
unsigned long nb = a1;
char buf[1024];
char* hash;
strncpy(buf, (char*)a0, sizeof(buf) - 1);
buf[sizeof(buf) - 1] = 0;
while ((hash = strchr(buf, '#'))) {
*hash = '0' + (char)(nb % 10);
nb /= 10;
}
return open(buf, a2 & ~O_CREAT, 0);
}
}
static int inject_fault(int nth)
{
int fd;
fd = open("/proc/thread-self/fail-nth", O_RDWR);
if (fd == -1)
exit(1);
char buf[16];
sprintf(buf, "%d", nth);
if (write(fd, buf, strlen(buf)) != (ssize_t)strlen(buf))
exit(1);
return fd;
}
static const char* setup_fault()
{
int fd = open("/proc/self/make-it-fail", O_WRONLY);
if (fd == -1)
return "CONFIG_FAULT_INJECTION is not enabled";
close(fd);
fd = open("/proc/thread-self/fail-nth", O_WRONLY);
if (fd == -1)
return "kernel does not have systematic fault injection support";
close(fd);
static struct {
const char* file;
const char* val;
bool fatal;
} files[] = {
{"/sys/kernel/debug/failslab/ignore-gfp-wait", "N", true},
{"/sys/kernel/debug/fail_futex/ignore-private", "N", false},
{"/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", "N", false},
{"/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N", false},
{"/sys/kernel/debug/fail_page_alloc/min-order", "0", false},
};
unsigned i;
for (i = 0; i < sizeof(files) / sizeof(files[0]); i++) {
if (!write_file(files[i].file, files[i].val)) {
if (files[i].fatal)
return "failed to write fault injection file";
}
}
return NULL;
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
if ((reason = setup_fault())) {
fprintf(stderr, "reproducer setup failed: fault injection: %s\n", reason);
exit(1);
}
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// syz_open_dev$tty1 arguments: [
// dev: const = 0xc (8 bytes)
// major: const = 0x4 (8 bytes)
// minor: intptr = 0x1 (8 bytes)
// ]
// returns fd_tty
res = -1;
res = syz_open_dev(/*dev=*/0xc, /*major=*/4, /*minor=*/1);
if (res != -1)
r[0] = res;
// ioctl$KDFONTOP_SET arguments: [
// fd: fd_tty (resource)
// cmd: const = 0x4b72 (4 bytes)
// arg: ptr[in, console_font_op[KD_FONT_OP_SET, in]] {
// console_font_op[KD_FONT_OP_SET, in] {
// op: const = 0x2 (4 bytes)
// flags: int32 = 0x0 (4 bytes)
// width: int32 = 0x0 (4 bytes)
// height: int32 = 0x0 (4 bytes)
// charcount: int32 = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// data: nil
// }
// }
// ]
*(uint32_t*)0x200000000040 = 2;
*(uint32_t*)0x200000000044 = 0;
*(uint32_t*)0x200000000048 = 0;
*(uint32_t*)0x20000000004c = 0;
*(uint32_t*)0x200000000050 = 0;
*(uint64_t*)0x200000000058 = 0;
inject_fault(6);
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x4b72, /*arg=*/0x200000000040ul);
// syz_open_dev$tty1 arguments: [
// dev: const = 0xc (8 bytes)
// major: const = 0x4 (8 bytes)
// minor: intptr = 0x1 (8 bytes)
// ]
// returns fd_tty
res = -1;
res = syz_open_dev(/*dev=*/0xc, /*major=*/4, /*minor=*/1);
if (res != -1)
r[1] = res;
// ioctl$KDFONTOP_SET arguments: [
// fd: fd_tty (resource)
// cmd: const = 0x4b72 (4 bytes)
// arg: ptr[in, console_font_op[KD_FONT_OP_SET, in]] {
// console_font_op[KD_FONT_OP_SET, in] {
// op: const = 0x0 (4 bytes)
// flags: int32 = 0x3 (4 bytes)
// width: int32 = 0x1b (4 bytes)
// height: int32 = 0xd (4 bytes)
// charcount: int32 = 0x200 (4 bytes)
// pad = 0x0 (4 bytes)
// data: ptr[in, buffer] {
// buffer: {0d e4 73 70 56 3e d4 50 e7 4f ba 9e e1 5c c0 c3 e9 ad c8 5c af 8b 84 72 24 62 ad 15 24 c6 6b fb 8e 45 ba 6e 38 74 c6 5b 82 9b 1f 1a 23 5b 81 00 48 fb 05 15 ce e6 7c da f9 ae ae 59 5c 1e 8e a1 a6 1d 94 24 98 1d 3f 26 e4 69 9a 20 6b cd d0 f8 f5 37 45 66 88 f3 cd fc 70 45 da 32 84 2f 9b 8e 41 12 7e d9 9b 2c fa 30 c0 52 1f 50 ac 45 b1 37 69 68 c3 ce fe bb 90 e3 45 94 fd 8c 1c 76 7c 68 84 50 44 d3 3e cc 85 38 8e 44 fa dd 6f f0 4e 3f f6 46 ef 3e a4 81 56 ec 22 08 31 e2 04 18 1e 64 ba 8e d6 60 fb 38 49 b9 7c f8 d3 bc 64 c1 71 65 52 98 8b 6a be b6 81 89 0c 0e 7c a0 07 04 a1 c4 64 24 3e 28 30 55 b0 d9 48 78 fa a0 e1 57 be de ec 96 69 6e 32 d5 ea 55 c2 b8 d7 1d 9c 5e a9 7e d4 8e 5b 69 0f 2e b5 80 22 72 4c 6b 8d 78 2b 67 14 a1 35 9f bd 34 4b 7c de de df 7a d3 7d da f7 51 0a 0e 4b 91 b2 8f 9d 6f 07 28 92 71 39 2d 00 2d 3e 1a 3b b3 c8 33 a1 e8 ff d0 05 3f 68 14 b3 ff 52 e6 04 00 00 00 00 00 00 00 cb d5 a9 76 f1 7a 60 0b a5 41 c4 14 8e 9d 4e b2 7f 8e 5d a4 1b ee 54 0b 02 05 99 25 4f 3e 27 4d 88 34 fe cc 7f 0a c2 fa 8c 05 00 00 00 af 2c 76 52 57 44 4a 06 00 00 00 00 00 00 00 93 72 40 ae 45 d7 8b 49 ed ad f0 ba b1 5d 48 a0 c0 13 ff 92 44 c3 19 6f e8 f6 38 38 92 df e6 f9 1a 41 c7 74 60 22 47 aa e6 6c 10 29 cd 3e d3 7c d8 eb 12 a6 24 b0 4f f6 93 7c a7 dd 1f 2c d9 9a 8e c0 f0 3d 41 6f 40 13 97 ca 9c 82 e2 4f fa 9d 94 62 f0 05 00 bc c7 f0 68 a9 38 ba 40 2d 65 5e 96 2c c7 a9 96 95 dc c9 b2 a8 8d 46 dd b9 6c 2a b9 5c db 41 fb 79 e4 18 1f 08 79 6a d3 40 4b d1 ee 43 bc dd 48 ba eb 38 af 36 fb 70 20 1c 7b 72 19 e6 4f 2d 92 03 7c 9a 0f 42 0a 9f 72 53 f3 5e 8b 2d 2c 52 8b 76 69 35 ed 69 7e 00 27 bf 6e e6 0d 60 d1 57 ab 1a 41 53 f9 55 5b 22 f2 ab 3b 61 40 fa 15 bb 8f 05 9e fe 6e b9 37 1d 47 94 6a 99 db 68 19 23 e9 b1 51 13 87 e2 b8 77 cf 12 7d 98 c0 95 65 22 d9 1c 4d 86 1e eb 3b bb 4f 45 d2 ae 36 7b a7 f7 d4 a9 04 a6 43 94 26 fb 02 aa b5 84 a0 5a 1e e7 34 af a4 c1 5f 38 b5 b6 72 17 86 3c d7 f9 40 f2 1d 76 7f 77 98 df 55 26 03 7f 17 59 68 ac dd fa 42 b3 77 b7 65 06 d4 26 2f ae 4d 68 e1 ab 84 f2 79 f1 b0 90 60 c0 ec 58 48 02 05 eb a6 1e f9 59 25 45 36 7a 97 8d 1e 19 3c e8 e5 ff 8f e6 81 a3 20 bc 84 00 c1 ce d7 9a 87 fa 36 23 55 9c 3b ae 1e 96 b8 8e b6 f2 18 b5 83 96 a0 53 75 5b 9c 60 f4 60 5f 34 73 ef 80 03 b1 b2 8c bd 43 a4 ab a8 7e 4e ad 0c 84 c4 1a f5 05 00 00 00 8a ef 3e 16 53 03 56 67 a1 d9 37 72 60 4f 4c 9b 6b 59 2c 0e 83 10 6a 63 00 9e 5c 9c 54 eb 56 08 26 be 1f 00 00 00 00 00 00 00 62 65 89 d8 72 ce ad ae ac 87 8e 2a e5 66 bc 2a 6c 67 39 dc 0c f0 88 79 56 3b 96 fe e0 03 5c 22 d3 73 6a 07 b3 b0 ed a0 e8 27 d7 5b 06 fa 7a c4 39 27 ef 83 83 e7 cc ad 06 64 f6 63 2e 17 4b 99 47 40 55 e5 86 73 c6 53 04 24 97 15 9a 91 14 2f 47 28 78 95 10 bd 2e 94 4d 51 07 4b 58 34 2c e8 bc 3d 3f d4 dc 4b e0 4a 3f 1c cd c7 92 f1 42 70 3c fe 1c 2b 10 4c 7d 62 de c4 ba 9e 0c b9 cb 1c a9 ae 9a 58 b7 89 fa 93 07 76 15 51 74 7a c4 e6 89 01 07 f8 94 1c a6 48 6c b4 43 ab b0 c7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x400)
// }
// }
// }
// ]
*(uint32_t*)0x200000000040 = 0;
*(uint32_t*)0x200000000044 = 3;
*(uint32_t*)0x200000000048 = 0x1b;
*(uint32_t*)0x20000000004c = 0xd;
*(uint32_t*)0x200000000050 = 0x200;
*(uint64_t*)0x200000000058 = 0x200000000080;
memcpy((void*)0x200000000080, "... [truncated large byte array] ...", 1024);
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x4b72, /*arg=*/0x200000000040ul);
return 0;
}
]