map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_userfaultfd
#define __NR_userfaultfd 323
#endif
#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
struct csum_inet {
uint32_t acc;
};
static void csum_inet_init(struct csum_inet* csum)
{
csum->acc = 0;
}
static void csum_inet_update(struct csum_inet* csum, const uint8_t* data, size_t length)
{
if (length == 0)
return;
size_t i = 0;
for (; i < length - 1; i += 2)
csum->acc += *(uint16_t*)&data[i];
if (length & 1)
csum->acc += le16toh((uint16_t)data[length - 1]);
while (csum->acc > 0xffff)
csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16);
}
static uint16_t csum_inet_digest(struct csum_inet* csum)
{
return ~csum->acc;
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL arguments: [
// fd: sock_udp (resource)
// cmd: const = 0x89f3 (4 bytes)
// arg: ptr[inout, ifreq_dev_t[ipv4_tunnel_names, ptr[inout, ip_tunnel_parm]]] {
// ifreq_dev_t[ipv4_tunnel_names, ptr[inout, ip_tunnel_parm]] {
// ifr_ifrn: buffer: {67 72 65 30 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// elem: ptr[inout, ip_tunnel_parm] {
// ip_tunnel_parm {
// name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// link: ifindex (resource)
// i_flags: ip_tunnel_io_flags = 0x0 (2 bytes)
// o_flags: ip_tunnel_io_flags = 0x0 (2 bytes)
// i_key: int32be = 0x0 (4 bytes)
// o_key: int32be = 0x0 (4 bytes)
// iph: ipv4_packet_t[flags[ip_tunnel_protocols, int8], void] {
// header: ipv4_header[flags[ip_tunnel_protocols, int8]] {
// ihl: bytesize4 = 0x0 (0 bytes)
// version: const = 0x4 (1 bytes)
// ecn: int8 = 0x0 (0 bytes)
// dscp: int8 = 0x0 (1 bytes)
// total_len: len = 0x0 (2 bytes)
// id: int16be = 0x0 (2 bytes)
// frag_off: int16be = 0x0 (2 bytes)
// ttl: int8 = 0x0 (1 bytes)
// protocol: ip_tunnel_protocols = 0x0 (1 bytes)
// csum: csum = 0x0 (2 bytes)
// src_ip: union ipv4_addr {
// rand_addr: int32be = 0x0 (4 bytes)
// }
// dst_ip: union ipv4_addr {
// rand_addr: int32be = 0x0 (4 bytes)
// }
// options: ipv4_options {
// options: array[ipv4_option] {
// }
// }
// }
// payload: buffer: {} (length 0x0)
// }
// }
// }
// pad = 0x0 (16 bytes)
// }
// }
// ]
memcpy((void*)0x200000000180, "gre0\000\000\000\000\000\000\000\000\000\000\000\000", 16);
*(uint64_t*)0x200000000190 = 0x200000000100;
memset((void*)0x200000000100, 0, 16);
*(uint32_t*)0x200000000110 = 0;
*(uint16_t*)0x200000000114 = htobe16(0);
*(uint16_t*)0x200000000116 = htobe16(0);
*(uint32_t*)0x200000000118 = htobe32(0);
*(uint32_t*)0x20000000011c = htobe32(0);
STORE_BY_BITMASK(uint8_t, , 0x200000000120, 0, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000120, 4, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000121, 0, 0, 2);
STORE_BY_BITMASK(uint8_t, , 0x200000000121, 0, 2, 6);
*(uint16_t*)0x200000000122 = htobe16(0);
*(uint16_t*)0x200000000124 = htobe16(0);
*(uint16_t*)0x200000000126 = htobe16(0);
*(uint8_t*)0x200000000128 = 0;
*(uint8_t*)0x200000000129 = 0;
*(uint16_t*)0x20000000012a = htobe16(0);
*(uint32_t*)0x20000000012c = htobe32(0);
*(uint32_t*)0x200000000130 = htobe32(0);
struct csum_inet csum_1;
csum_inet_init(&csum_1);
csum_inet_update(&csum_1, (const uint8_t*)0x200000000120, 20);
*(uint16_t*)0x20000000012a = csum_inet_digest(&csum_1);
syscall(__NR_ioctl, /*fd=*/(intptr_t)-1, /*cmd=*/0x89f3, /*arg=*/0x200000000180ul);
// userfaultfd arguments: [
// flags: userfaultfd_flags = 0x801 (8 bytes)
// ]
// returns fd_uffd
res = syscall(__NR_userfaultfd, /*flags=UFFD_USER_MODE_ONLY|O_NONBLOCK*/0x801ul);
if (res != -1)
r[0] = res;
// ioctl$UFFDIO_API arguments: [
// fd: fd_uffd (resource)
// cmd: const = 0xc018aa3f (4 bytes)
// arg: ptr[in, uffdio_api] {
// uffdio_api {
// api: const = 0xaa (8 bytes)
// featur: uffdio_features = 0x0 (8 bytes)
// ioctls: const = 0x0 (8 bytes)
// }
// }
// ]
*(uint64_t*)0x200000000000 = 0xaa;
*(uint64_t*)0x200000000008 = 0;
*(uint64_t*)0x200000000010 = 0;
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc018aa3f, /*arg=*/0x200000000000ul);
// openat$cgroup_ro arguments: [
// fd: fd_cgroup (resource)
// file: ptr[in, buffer] {
// buffer: {6d 65 6d 6f 72 79 2e 65 76 65 6e 74 73 00} (length 0xe)
// }
// flags: const = 0x275a (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd
memcpy((void*)0x200000000080, "memory.events\000", 14);
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000080ul, /*flags=*/0x275a, /*mode=*/0);
if (res != -1)
r[1] = res;
// write$binfmt_script arguments: [
// fd: fd_binfmt (resource)
// data: ptr[in, binfmt_script] {
// binfmt_script {
// hdr: buffer: {23 21 20} (length 0x3)
// bin: buffer: {} (length 0x0)
// args: array[binfmt_script_arg] {
// }
// nl: const = 0xa (1 bytes)
// data: buffer: {} (length 0x0)
// }
// }
// len: bytesize = 0xfecc (8 bytes)
// ]
memcpy((void*)0x200000000100, "#! ", 3);
*(uint8_t*)0x200000000103 = 0xa;
syscall(__NR_write, /*fd=*/r[1], /*data=*/0x200000000100ul, /*len=*/0xfeccul);
// mmap arguments: [
// addr: VMA[0x3000]
// len: len = 0x3000 (8 bytes)
// prot: mmap_prot = 0x1 (8 bytes)
// flags: mmap_flags = 0x12 (8 bytes)
// fd: fd (resource)
// offset: intptr = 0x0 (8 bytes)
// ]
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x3000ul, /*prot=PROT_READ*/1ul, /*flags=MAP_FIXED|MAP_PRIVATE*/0x12ul, /*fd=*/r[1], /*offset=*/0ul);
// ioctl$UFFDIO_COPY arguments: [
// fd: fd_uffd (resource)
// cmd: const = 0xc028aa03 (4 bytes)
// arg: ptr[in, uffdio_copy] {
// uffdio_copy {
// dst: VMA[0x4000]
// src: VMA[0x3000]
// len: len = 0x4000 (8 bytes)
// mode: uffdio_copy_mode = 0x0 (8 bytes)
// copy: const = 0x0 (8 bytes)
// }
// }
// ]
*(uint64_t*)0x200000000040 = 0x200000ffb000;
*(uint64_t*)0x200000000048 = 0x200000ffd000;
*(uint64_t*)0x200000000050 = 0x4000;
*(uint64_t*)0x200000000058 = 0;
*(uint64_t*)0x200000000060 = 0;
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc028aa03, /*arg=*/0x200000000040ul);
return 0;
}
]