// https://syzkaller.appspot.com/bug?id=11832ca31d6c07737490e9cc29e384a6a34170d7 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // socket$inet_udp arguments: [ // domain: const = 0x2 (8 bytes) // type: const = 0x2 (8 bytes) // proto: const = 0x0 (4 bytes) // ] // returns sock_udp syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0); // bpf$BPF_BTF_LOAD arguments: [ // cmd: const = 0x12 (8 bytes) // arg: ptr[in, bpf_btf_load] { // bpf_btf_load { // btf: nil // btf_log_buf: ptr[out, buffer] { // buffer: (DirOut) // } // btf_size: bytesize = 0x0 (4 bytes) // btf_log_size: bytesize = 0x3 (4 bytes) // btf_log_level: int32 = 0x1 (4 bytes) // btf_log_true_size: int32 = 0x9 (4 bytes) // btf_flags: btf_load_flags = 0x0 (4 bytes) // btf_token_fd: union _bpf_btf_load_btf_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad: union _bpf_btf_load_pad_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // size: len = 0x28 (8 bytes) // ] // returns fd_btf *(uint64_t*)0x200000000000 = 0; *(uint64_t*)0x200000000008 = 0x2000000000c0; *(uint32_t*)0x200000000010 = 0; *(uint32_t*)0x200000000014 = 3; *(uint32_t*)0x200000000018 = 1; *(uint32_t*)0x20000000001c = 9; *(uint32_t*)0x200000000020 = 0; *(uint32_t*)0x200000000024 = 0; syscall(__NR_bpf, /*cmd=*/0x12ul, /*arg=*/0x200000000000ul, /*size=*/0x28ul); // openat$md_new_array arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, buffer] { // buffer: {2f 73 79 73 2f 6d 6f 64 75 6c 65 2f 6d 64 5f 6d 6f 64 2f 70 // 61 72 61 6d 65 74 65 72 73 2f 6e 65 77 5f 61 72 72 61 79 00} (length // 0x28) // } // flags: const = 0x1 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd_md_new_array memcpy((void*)0x200000000040, "/sys/module/md_mod/parameters/new_array\000", 40); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000040ul, /*flags=*/1, /*mode=*/0); if (res != -1) r[0] = res; // write$md_new_array arguments: [ // fd: fd_md_new_array (resource) // buf: ptr[in, md_array_name] { // md_array_name { // prefix: buffer: {6d 64} (length 0x2) // unit: union md_unit { // num: proc = 0x0 (1 bytes) // } // } // } // len: bytesize = 0x3 (8 bytes) // ] memcpy((void*)0x200000000080, "md", 2); *(uint8_t*)0x200000000082 = 0x30; syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000080ul, /*len=*/3ul); // write$md_sysfs arguments: [ // fd: fd_md_sysfs (resource) // buf: nil // len: bytesize = 0x0 (8 bytes) // ] syscall(__NR_write, /*fd=*/(intptr_t)-1, /*buf=*/0ul, /*len=*/0ul); // openat$md_sysfs arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, md_sysfs_path] { // md_sysfs_path { // prefix: buffer: {2f 73 79 73 2f 62 6c 6f 63 6b 2f 6d 64} (length // 0xd) unit: union md_unit { // num: proc = 0x0 (1 bytes) // } // md: buffer: {2f 6d 64 2f} (length 0x4) // file: union md_sysfs_file { // array: buffer: {72 61 69 64 5f 64 69 73 6b 73 00} (length 0xb) // } // } // } // flags: md_sysfs_open_flags = 0x1 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd_md_sysfs memcpy((void*)0x200000000780, "/sys/block/md", 13); *(uint8_t*)0x20000000078d = 0x30; memcpy((void*)0x20000000078e, "/md/", 4); memcpy((void*)0x200000000792, "raid_disks\000", 11); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000780ul, /*flags=O_WRONLY*/ 1, /*mode=*/0); if (res != -1) r[1] = res; // write$md_sysfs arguments: [ // fd: fd_md_sysfs (resource) // buf: ptr[in, md_sysfs_val] { // union md_sysfs_val { // str: buffer: {32} (length 0x1) // } // } // len: bytesize = 0x1 (8 bytes) // ] memset((void*)0x2000000007c0, 50, 1); syscall(__NR_write, /*fd=*/r[1], /*buf=*/0x2000000007c0ul, /*len=*/1ul); // openat$md_sysfs arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, md_sysfs_path] { // md_sysfs_path { // prefix: buffer: {2f 73 79 73 2f 62 6c 6f 63 6b 2f 6d 64} (length // 0xd) unit: union md_unit { // num: proc = 0x0 (1 bytes) // } // md: buffer: {2f 6d 64 2f} (length 0x4) // file: union md_sysfs_file { // array: buffer: {63 6f 6d 70 6f 6e 65 6e 74 5f 73 69 7a 65 00} // (length 0xf) // } // } // } // flags: md_sysfs_open_flags = 0x1 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd_md_sysfs memcpy((void*)0x200000000800, "/sys/block/md", 13); *(uint8_t*)0x20000000080d = 0x30; memcpy((void*)0x20000000080e, "/md/", 4); memcpy((void*)0x200000000812, "component_size\000", 15); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000800ul, /*flags=O_WRONLY*/ 1, /*mode=*/0); if (res != -1) r[2] = res; // write$md_sysfs arguments: [ // fd: fd_md_sysfs (resource) // buf: nil // len: bytesize = 0x0 (8 bytes) // ] syscall(__NR_write, /*fd=*/r[2], /*buf=*/0ul, /*len=*/0ul); // write$md_sysfs arguments: [ // fd: fd_md_sysfs (resource) // buf: ptr[in, md_sysfs_val] { // union md_sysfs_val { // str: buffer: {30} (length 0x1) // } // } // len: bytesize = 0x1 (8 bytes) // ] memset((void*)0x200000000980, 48, 1); syscall(__NR_write, /*fd=*/(intptr_t)-1, /*buf=*/0x200000000980ul, /*len=*/1ul); return 0; }