// https://syzkaller.appspot.com/bug?id=167a6a07d68b75f20b2f23354e93f418170a55c9 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } memcpy((void*)0x200000000000, "/dev/mdctl\000", 11); res = syscall(SYS_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000000ul, /*flags=*/0ul, /*mode=*/0ul); if (res != -1) r[0] = res; *(uint32_t*)0x200000000380 = 0; *(uint32_t*)0x200000000384 = 0; *(uint32_t*)0x200000000388 = 0; *(uint64_t*)0x200000000390 = 0; *(uint64_t*)0x200000000398 = 0x80008; *(uint32_t*)0x2000000003a0 = 0x7ffd; *(uint32_t*)0x2000000003a4 = 6; *(uint64_t*)0x2000000003a8 = 0xfffffffffffffffe; *(uint32_t*)0x2000000003b0 = 0; *(uint32_t*)0x2000000003b4 = 0x10; *(uint64_t*)0x2000000003b8 = 0; *(uint32_t*)0x2000000003c0 = 0; *(uint32_t*)0x2000000003c4 = 0; *(uint32_t*)0x2000000003c8 = 0x8001; *(uint32_t*)0x2000000003cc = 4; *(uint32_t*)0x2000000003d0 = 0; *(uint32_t*)0x2000000003d4 = 0; *(uint32_t*)0x2000000003d8 = 3; *(uint32_t*)0x2000000003dc = 0; *(uint32_t*)0x2000000003e0 = 0; *(uint32_t*)0x2000000003e4 = 0; *(uint32_t*)0x2000000003e8 = 0; *(uint32_t*)0x2000000003ec = 6; *(uint32_t*)0x2000000003f0 = 0x1000; *(uint32_t*)0x2000000003f4 = 0; *(uint32_t*)0x2000000003f8 = 0x40000000; *(uint32_t*)0x2000000003fc = 0; *(uint32_t*)0x200000000400 = 2; *(uint32_t*)0x200000000404 = 0; *(uint32_t*)0x200000000408 = 0xfffffffd; *(uint32_t*)0x20000000040c = 0x204; *(uint32_t*)0x200000000410 = 0; *(uint32_t*)0x200000000414 = 0; *(uint32_t*)0x200000000418 = 0xfffffffc; *(uint32_t*)0x20000000041c = 0; *(uint32_t*)0x200000000420 = 0; *(uint32_t*)0x200000000424 = 1; *(uint32_t*)0x200000000428 = 2; *(uint32_t*)0x20000000042c = 0x80002; *(uint32_t*)0x200000000430 = 0; *(uint32_t*)0x200000000434 = 0x40000; *(uint32_t*)0x200000000438 = 0; *(uint32_t*)0x20000000043c = 3; *(uint32_t*)0x200000000440 = 0xfffffffe; *(uint32_t*)0x200000000444 = 0x1fffffe; *(uint32_t*)0x200000000448 = 0xe2; *(uint32_t*)0x20000000044c = 0; *(uint32_t*)0x200000000450 = -1; *(uint32_t*)0x200000000454 = 0; *(uint32_t*)0x200000000458 = 0x10001; *(uint32_t*)0x20000000045c = 1; *(uint32_t*)0x200000000460 = 8; *(uint32_t*)0x200000000464 = 0x80000007; *(uint32_t*)0x200000000468 = 0; *(uint32_t*)0x20000000046c = 0; *(uint32_t*)0x200000000470 = 0x1000000; *(uint32_t*)0x200000000474 = 0x800000; *(uint32_t*)0x200000000478 = 9; *(uint32_t*)0x20000000047c = 0; *(uint32_t*)0x200000000480 = 0; *(uint32_t*)0x200000000484 = 0x60d6; *(uint32_t*)0x200000000488 = 0; *(uint32_t*)0x20000000048c = 0; *(uint32_t*)0x200000000490 = 6; *(uint32_t*)0x200000000494 = 0; *(uint32_t*)0x200000000498 = 0; *(uint32_t*)0x20000000049c = 0; *(uint32_t*)0x2000000004a0 = 0; *(uint32_t*)0x2000000004a4 = 2; *(uint32_t*)0x2000000004a8 = 0xfffffffc; *(uint32_t*)0x2000000004ac = 0; *(uint32_t*)0x2000000004b0 = 0; *(uint32_t*)0x2000000004b4 = 0xc7d8; *(uint32_t*)0x2000000004b8 = 0; *(uint32_t*)0x2000000004bc = 0; *(uint32_t*)0x2000000004c0 = 0; *(uint32_t*)0x2000000004c4 = 0xfffffffc; *(uint32_t*)0x2000000004c8 = 0; *(uint32_t*)0x2000000004cc = 0x10; *(uint32_t*)0x2000000004d0 = 4; *(uint32_t*)0x2000000004d4 = 0; *(uint32_t*)0x2000000004d8 = 0xfffffffc; *(uint32_t*)0x2000000004dc = 3; *(uint32_t*)0x2000000004e0 = 0; *(uint32_t*)0x2000000004e4 = 2; *(uint32_t*)0x2000000004e8 = 0; *(uint32_t*)0x2000000004ec = 0xc; *(uint32_t*)0x2000000004f0 = 0x7a; *(uint32_t*)0x2000000004f4 = 3; *(uint32_t*)0x2000000004f8 = 6; *(uint32_t*)0x2000000004fc = 9; *(uint32_t*)0x200000000500 = 0x80000; *(uint32_t*)0x200000000504 = 3; *(uint32_t*)0x200000000508 = 0; *(uint32_t*)0x20000000050c = 0x800; *(uint32_t*)0x200000000510 = 7; *(uint32_t*)0x200000000514 = 0; *(uint32_t*)0x200000000518 = 9; *(uint32_t*)0x20000000051c = 1; *(uint32_t*)0x200000000520 = 0; *(uint32_t*)0x200000000524 = 0; *(uint32_t*)0x200000000528 = 4; *(uint32_t*)0x20000000052c = 2; *(uint32_t*)0x200000000530 = 0x20000003; *(uint32_t*)0x200000000534 = 7; *(uint32_t*)0x200000000538 = 0; *(uint32_t*)0x20000000053c = 0; syscall(SYS_ioctl, /*fd=*/r[0], /*cmd=*/0xc1c06d00ul, /*arg=*/0x200000000380ul); return 0; }