// https://syzkaller.appspot.com/bug?id=5b90694222396ecc0ddc12986c14ca709eb9b187 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } memcpy((void*)0x20000b00, "/proc/self/smaps\000", 17); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000b00ul, /*flags=O_NOATIME|FASYNC*/ 0x42000, /*mode=*/0); if (res != -1) r[0] = res; syscall(__NR_read, /*fd=*/r[0], /*buf=*/0x200000c0ul, /*len=*/0xffffff24ul); memcpy((void*)0x20000640, "/sys/kernel/debug/orangefs/kernel-debug\000", 40); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000640ul, /*flags=O_TRUNC|O_WRONLY*/ 0x201, /*mode=*/0); if (res != -1) r[1] = res; memcpy( (void*)0x20000680, "\x2f\x13\x27\x26\xe3\xc9\x96\x13\xd1\x8f\x56\xf9\x51\x60\x59\x86\x13\x9c" "\xe9\xde\x73\x9a\x3c\x90\xd4\xb6\x6a\xb1\x58\xdc\xc4\x23\x86\xa4\x24\xd8" "\xa9\x20\x80\x30\xf2\xa4\xbe\x03\xae\x47\xcd\xdf\xff\x38\x62\x2a\x57\x65" "\xd8\x9e\x1d\x34\x8c\x4e\xc8\xd5\x1e\x91\x47\xe8\x1a\xd8\xee\x71\xd0\xf3" "\xe2\xf9\xbd\x3f\xfd\xff\x62\x33\xe9\x4e\x85\x11\xe6\x8f\x01\x86\x9e\xbb" "\xd5\x06\xaa\xf6\xa5\x03\x7c\x22\x78\xc0\xe2\x05\x91\x69\x34\x55\x48\x85" "\x21\x2e\xd1\x07\x34\x0a\xa1\xb4\x0f\x48\xd0\x1d\xd6\xd1\x9f\x68\x2b\x40" "\xed\x4c\x69\x23\x0d\xbe\xd2\xe2\xb3\xd1\x68\xa6\x0e\x03\xb0\x8f\x1d\x05" "\x78\x0f\xa7\x39\x3b\xdc\x56\x34\xe0\xea\x4f\xcd\x8f\x91\x42\xd4\x5f\x09" "\x39\xc3\xde\x42\xdf\xc0\x18\x37\xe4\x9d\x7a\x6b\xd5\xf0\x35\x95\x67\x7b" "\xd9\x6a\x4c\x30\xb1\x1a\x8b\x6a\x7b\xc1\xc3\x0e\xa1\xd3\x35\xb8\xfa\xe0" "\xa3\x10\xa1\xff\x4e\xc5\x21\x76\x38\x8a\x5b\xed\x40\x66\xe4\x8e\xc9\x83" "\x44\x7e\x15\xab\xb1\x66\x28\x2c\x76\xd9\x4c", 227); syscall(__NR_write, /*fd=*/r[1], /*buf=*/0x20000680ul, /*len=*/0x802ul); return 0; }